Answered by Lee Weavers, MD, Ramesses Group

An employer may request and hold this information on file if they have a legitimate reason, such as a concern that members of their workforce may not have obtained the right to work in this country, however, they should be registered with the Information Commissioner’s Office as a data controller. If a company intends to store personal information they must contact the Information Commissioner’s Office to register.

The Information Commissioner’s Office regulates and enforces the Data Protection Act 1998 that governs the use and storage of personal data. It is an independent body that was set up to promote access to information and also to protect personal information from misuse. The Act aims to promote high standards in the handling of personal information and to protect the individual’s right to privacy.

Data Controllers must comply with the eight principles of good practice set out by the Data Protection Act 1998 which are: Personal information must be fairly and lawfully processed, processed for specific purposes, the information kept should be relevant and not excessive, it should be accurate and up to date, secure, processed in line with the rights of the individual, should not be transferred out the European Economic Area and should be kept no longer than is necessary.

You can complain to the Information Commissioner’s Office if you believe someone is breaching these principles and you can also visit the website for more information on your rights as an individual at ico.org.uk/

Lee Weavers has extensive experience at executive and management level. Since the creation of the Ramesses Group Ltd (RGL) in 2000, he has been responsible for delivery of key programmes to clients in the UK and Internationally and RGL’s overall business development, strategic planning and developing core systems and processes.