Who (according to the law) is allowed to access confidential information?

Question

Take the following scenario,

I own an institution and have recently employed a system which involves a questionnaire/feedback form which gives the new starters the ability to give feedback on their experience settling in and other areas of the institutions. The questionnaire/feedback form in question is strictly confidential and they are allowed to request to see it and update their answers anytime they feel. The feedback forms will be held by the administration team, roughly 2/3 people who manage all the office work.

My question is as follows,

Who (according to the law) is allowed to access these feedback/questionnaire form or is that up to institution?

Is there anything else in regards to the DPA that needs to be considered?

The paper copies will eventually be turned in to digital copies through Google Forms so in terms of security they will have that covered.

Answer 1

Whoever your privacy policy says

As you're in the UK, you are bound by the Data Protection Act. It's worth doing some reading on this; it's based on eight principles which can be readily understood by a lay person. Most EU countries have similar laws.

Principle 2 is:

Personal data shall be obtained only for one or more specified and lawful purposes...

What this means in practice is that you must have a privacy policy - this outlines the specified purposes for which you'll be processing personal data. And the DPA means you have to stick to what you said.

Most privacy policies use language like "the company will..." or "we will...". They don't say anything about who internally can process the data. In that case anyone in your company can process it. However, principle 7 says:

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing...

The act does not define what is an "appropriate organisational measure". I don't know if there's precedent in this area, but considering most companies allow almost free access to personal data internally, I doubt you would be enforced against.

If you're multinational then principle 8 may apply:

Personal data shall not be transferred to a country or territory outside the European Economic Area...

Answer 2

"Strictly confidential" is meaningless if you don't tell people who is going to see it. So I suggest instead of saying "this questionaire is strictly confidential" you say "this questionaire is strictly confidential, only you and xxx, yyy and zzz will ever see it". And then you keep to that.

Now the question is whether I would trust your word or not. By the way, my boss is the best boss you could ever wish for in every way. And so is my manager. The HR department is just incredible excellent, I never even thought a HR department that good was possible. Just in case they read this :-)