9 July 2025
In All Fairness… Understanding the Fairness Principle in Data Protection
By Sue White, Information Governance Manager
Fairness is one of the fundamental principles of data protection law. When it comes to data protection, organisations must ensure that fairness is embedded into how they collect, use, and share personal data.
Even if an organisation is acting lawfully, if it is not handling personal data fairly, it risks breaching data protection laws. Just because you can, does not mean you should! But what does fairness really mean in this context?
What is ‘Fairness’?
Fairness can be tricky to define. It is often subjective. What feels fair to one person may not seem fair to another.
Being fair is not always about being pleasant. It is sometimes necessary to use personal data in ways people may not like and in ways which produce negative effects. For example; a resident may be angry that their local council uses their details to collect Council Tax, or an employee might resent their earnings being reported to the tax office. Still, these are valid, lawful, and fair uses of data.
What matters is whether the use of personal data is appropriate and justified. So, let’s have a look at what the data protection laws would likely deem to be unfair…
Misleading collection of personal data
Organisations must consider how they obtain personal data and whether individuals are fully aware of how their information will be used. Misleading individuals or collecting data under false pretences is a clear violation of the fairness principle.
An example:
Henry visits his favourite coffee shop, ‘Coffee-Cup.’ The barista asks for his name “to write it on the cup” and his email address “to provide a receipt.” A few days later, Henry finds himself receiving marketing emails for gym equipment and power tools.
Unbeknownst to him, ‘Coffee-Cup’ has profiled him as a male under 40 and added his details to a database used for targeted advertising. Here, ‘Coffee-Cup’ has breached multiple data protection laws, including obtaining Henry’s email under deceptive means – an outright breach of the fairness principle.
Reasonable Expectations
Whenever I am asked questions about whether an organisation can use personal data in a specific way, I ask two key questions:
- What was the individual told when their data was collected?
- Would the individual reasonably expect their data to be used in this way?
Organisations must be transparent about why they collect personal data, how they plan to use it, who it may be shared with, and how long it will be kept. This information is usually provided in a Privacy Notice.
If personal data is used in an undisclosed manner, especially one that has a negative impact on the individual, the organisation is likely breaching the fairness principle.
An example:
Company-A holds employee data. A marketing firm, Market-Me, approaches Company-A, offering discounts on various products for its employees. Company-A hands over a list of staff contact details to Market-Me, which then sells the data to other companies.
Soon, Company-A employees are overwhelmed with unsolicited sales emails, causing frustration and distress.
Company-A has violated several data protection laws, including not informing employees about how their data would be used and using personal data in a way which the individuals would not reasonably expect.
Fairness Is Not Optional
Fairness is more than just best practice; it is a legal obligation. By prioritising fairness and respecting individuals’ expectations, organisations not only minimise the likelihood of breaching data protection laws but also build trust by demonstrating a genuine commitment to responsible and lawful data handling practices.
Further help
If you found this useful and want to deepen your expertise in data protection, explore our Intermediate and Advanced Certificates in Data Protection, or contact our Training Manager at info@naomikorn.com.