The first rule of data protection is fair obtaining and processing: "the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly" - section 2(1)(a) of the Data Protection Act.

According to the Data Protection Commissioner, Mr Joe Meade, this is the fundamental principle of data protection. If an organisation wishes to keep personal information about people on computer, then it must collect the information fairly and process or use the information fairly.

This provision of the Act requires that at the time of providing personal information, individuals are made fully aware of:

the identity of the persons who are collecting it (though this may often be implied);

to what use the information will be put;

and the persons or category of persons to whom the information will be disclosed.

Secondary or future uses, which might not be obvious to individuals, should be brought to their attention at the time of obtaining personal data. Individuals should be given the option of saying whether they wish their information to be used in these other ways.

If a data controller has information about people on computer and wishes to use it for a new purpose (which was not disclosed and perhaps not even contemplated at the time the information was collected), it must give an option to individuals to indicate whether they wish their information to be used for the new purpose.

For more information see www.dataprivacy.ie or contact the Office of the Data Protection Commissioner, Block 4, Irish Life Centre, Talbot Street, Dublin 1, telephone: 018748544.