Some case studies (1 of 2)

If a member of the public enquires who donated a specific object to the Museum two years ago, can you give that information to the enquirer?
If the donor is still alive, the information falls under the DPA. It should not be disclosed if the donor has expressly asked you not to do so. If you are certain the donor is dead, you can disclose the information unless there is a confidentiality agreement with the heirs.
How long should the museum keep job applications from unsuccessful applicants?
Recruitment files for unsuccessful applicants should only be kept until the relevant appeal process is over (usually about 6 months) or until any external audit has been completed. Your HR or Personnel officer can confirm how long the appeal process lasts and when audit takes place.
Under the Freedom of Information Act, a member of the public asks for all of the personal data held on people who attended a particular event at the museum. Should you disclose that information?
Even if you still hold the data, you must not disclose it because the person is asking for information about individuals other than themselves. Additionally, the Data Protection Act provides an exemption from disclosure under the Freedom of Information Act.
If a colleague asks you for the contact details of someone who attended an event or with whom you are in regular contact, should you share that information?
You can share the information if the use that your colleague will make of it is compatible with your use of it. You should take into consideration what expectations the person would have had as to how the information about them would be used, based on their original consent (whether explicit or implied).