What counts as personal information for the purposes of monitoring at work?

Your personal data is any information from which you can be identified, either on its own or taken together with other information your employer holds about you, and which affects your privacy, either in your personal or family life or in your working life. Occasional references to you in a set of minutes from a team meeting, for example, are unlikely to count as personal information under the Data Protection Act. Anonymised information about the workforce, so that it is impossible to identify any individual workers, will not count as personal information.

All computerised personal data is covered by the Data Protection Act. It also covers personal information on paper or microfiche, so long as this is held in a 'relevant filing system'. A ‘relevant filing system’ essentially means a fairly sophisticated, structured filing system, so that the information about you is easily located.

Examples of personal information include:

• details of a worker’s salary and bank account held on an organisation’s computer system or in a relevant manual filing system
• an e-mail about an incident involving a named worker
• a supervisor’s notebook containing sections on several named workers
• a set of completed application forms

There are additional rules in the Data Protection Act governing 'sensitive data', which is information concerning an individual’s:

• racial or ethnic origin
• political opinions
• religious beliefs or other beliefs of a similar nature
• trade union membership
• physical or mental health or condition
• sexuality or sexual life
• commission or alleged commission of any offence, or proceedings for any offence committed or alleged to have been committed

Your employer can hold and use this type of information about you only in limited circumstances, for example:

Your employer is required to do so by legislation (e.g. for health and safety reasons, to make sure they are not discriminating on grounds of race, religion, sex or sexuality, to keep records of statutory sick pay); or

You have given your employer your clear-cut permission to do so - preferably in writing - knowing fully what is involved, and no pressure has been put on you to give that permission. You must also be able to withdraw your permission at any time.