Processing of personal data must always be fair as well as lawful. If any aspect of our processing is unfair, we will be in breach of this principle – even if we can show that we have a lawful basis for the processing.
In general, fairness means that we should only handle personal data in ways that people would reasonably expect and not use it in ways that have unjustified adverse effects on them. We consistently consider not just about how we may use personal data, but also about whether we should.
Assessing whether we are processing information fairly depends partly on how we obtain it. In particular, if anyone is deceived or misled when the personal data is obtained, then this is unlikely to be fair.
In order to assess whether or not we are processing personal data fairly, we must consider more generally how it affects the interests of the people concerned – as a group and individually. If we have obtained and used the information fairly in relation to most of the people it relates to but unfairly in relation to one individual, there will still be a breach of this principle.
Personal data may sometimes be used in a way that negatively affects an individual without this necessarily being unfair. What matters is whether or not such detriment is justified.
We ensure that we treat individuals fairly when they seek to exercise their rights over their data. This ties in with our obligation to facilitate the exercise of individuals’ rights.
These matters are discussed, reviewed, updated and amended through our regular Information Governance Board Meetings.
