The Data Protection Act 1998 is a Act of Parliament of the United Kingdom of Great Britain and
Northern Ireland which defines UK law on the processing of data on identifiable living
people.
It is the main piece of legislation that governs the protection of personal data in the UK.
Although the Act itself does not mention privacy, it was enacted to bring British law into line
with the EU data protection directive of 1995 which required Member States to protect people's
fundamental rights and freedoms and in particular their right to privacy with respect to the
processing of personal data.
In practice it provides a way for individuals to control information about themselves.
Most of the Act does not apply to domestic use, for example keeping a personal address
book.
Anyone holding personal data for other purposes is legally obliged to comply with this Act,
subject to some exemptions.
The Act defines eight data protection principles.
It also requires companies and individuals to keep personal information to themselves.
History The 22 August 1998 Act replaced and consolidated
earlier legislation such as the Data Protection Act 1984 and the Access to Personal Files
Act 1987.
At the same time it aimed to implement the European Data Protection Directive.
In some aspects, notably electronic communication and marketing, it has been refined by subsequent
legislation for legal reasons.
The Privacy and Electronic Communications Regulations 2003 altered the consent requirement
for most electronic marketing to "positive consent" such as an opt in box.
Exemptions remain for the marketing of "similar products and services" to existing customers
and enquirers, which can still be permissioned on an opt out basis.
The Jersey data protection law was modelled on the UK law.
Personal data The Act's definition of "personal data" covers
any data that can be used to identify a living individual.
Anonymised or aggregated data is not regulated by the Act, providing the anonymisation or
aggregation has not been done in a reversible way.
Individuals can be identified by various means including their name and address, telephone
number or Email address.
The Act applies only to data which is held, or intended to be held, on computers, or held
in a 'relevant filing system'.
In some cases even a paper address book can be classified as a 'relevant filing system',
for example diaries used to support commercial activities such as a salesperson's diary.
The Freedom of Information Act 2000 modified the act for public bodies and authorities,
and the Durant case modified the interpretation of the act by providing case law and precedent.
The Data Protection Act creates rights for those who have their data stored, and responsibilities
for those who store, process or transmit such data.
The person who has their data processed has the right to:
View the data an organisation holds on them.
A 'subject access request' can be obtained for a nominal fee.
As of January 2014, the maximum fee is £2 for requests to credit reference agencies,
£50 for health and educational request, and £10 per individual otherwise,
Request that incorrect information be corrected.
If the company ignores the request, a court can order the data to be corrected or destroyed,
and in some cases compensation can be awarded.
Require that data is not used in any way that may potentially cause damage or distress.
Require that their data is not used for direct marketing.
Data protection principles Personal data shall be processed fairly and
lawfully and, in particular, shall not be processed unless-
at least one of the conditions in Schedule 2 is met, and
in the case of sensitive personal data, at least one of the conditions in Schedule 3
is also met.
Personal data shall be obtained only for one or more specified and lawful purposes, and
shall not be further processed in any manner incompatible with that purpose or those purposes.
Personal data shall be adequate, relevant and not excessive in relation to the purpose
or purposes for which they are processed.
Personal data shall be accurate and, where necessary, kept up to date.
Personal data processed for any purpose or purposes shall not be kept for longer than
is necessary for that purpose or those purposes.
About the rights of individuals e.g. personal data shall be processed in accordance with
the rights of data subjects.
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful
processing of personal data and against accidental loss or destruction of, or damage to, personal
data.
Personal data shall not be transferred to a country or territory outside the European
Economic Area unless that country or territory ensures an adequate level of protection for
the rights and freedoms of data subjects in relation to the processing of personal data.
Conditions relevant to the first principle Personal data should only be processed fairly
and lawfully.
In order for data to be classed as 'fairly processed', at least one of these six conditions
must be applicable to that data.
The data subject has consented to the processing; Processing is necessary for the performance
of, or commencing, a contract; Processing is required under a legal obligation;
Processing is necessary to protect the vital interests of the data subject;
Processing is necessary to carry out any public functions;
Processing is necessary in order to pursue the legitimate interests of the "data controller"
or "third parties".
Consent Except under the below mentioned exceptions,
the individual needs to consent to the collection of their personal information and its use
in the purpose(s) in question.
The European Data Protection Directive defines consent as “…any freely given specific
and informed indication of his wishes by which the data subject signifies his agreement to
personal data relating to him being processed”, meaning the individual may signify agreement
other than in writing.
However, non-communication should not be interpreted as consent.
Additionally, consent should be appropriate to the age and capacity of the individual
and other circumstances of the case.
E.g., if an organisation "intends to continue to hold or use personal data after the relationship
with the individual ends, then the consent should cover this."
And even when consent is given, it shouldn't be assumed to last forever.
Although in most cases consent lasts for as long as the personal data needs to be processed,
individuals may be able to withdraw their consent, depending on the nature of the consent
and the circumstances in which the personal information is being collected and used.
The Data Protection Act also specifies that sensitive personal data must be processed
according to a stricter set of conditions, in particular any consent must be explicit.
Exceptions The Act is structured such that all processing
of personal data is covered by the act, while providing a number of exceptions in Part IV.
Notable exceptions are: Section 28 – National security.
Any processing for the purpose of safeguarding national security is exempt from all the data
protection principles, as well as Part II, Part III, Part V, and Section 55.
Section 29 – Crime and taxation.
Data processed for the prevention or detection of crime, the apprehension or prosecution
of offenders, or the assessment or collection of taxes are exempt from the first data protection
principle.
Section 36 – Domestic purposes.
Processing by an individual only for the purposes of that individual's personal, family or household
affairs is exempt from all the data protection principles, as well as Part II and Part III.
Offences The Act details a number of civil and criminal
offences for which data controllers may be liable if a data controller has failed to
gain appropriate consent from a data subject.
However 'consent' is not specifically defined in the Act; consent is therefore a common
law matter.
Sub-section 21(1) – This sub-section makes it an offence to process personal information
without registration.
Sub-section 21(2) – This sub-section makes it an offence to fail to comply with the notification
regulations made by the Secretary of State.
Section 55 – Unlawful obtaining of personal data.
This section makes it an offence for people, such as hackers and impersonators, outside
the organisation to obtain unauthorised access to the personal data.
Section 56 – This section makes it a criminal offence to require an individual to make a
Subject Access Request relating to cautions or convictions for the purposes of recruitment,
continued employment, or the provision of services.
This was brought into effect by the Data Protection Act 1998 Order 2008.
Complexity The UK Data Protection Act is a large Act
that has a reputation for complexity.
While the basic principles are honoured for protecting privacy, interpreting the act is
not always simple.
Many companies, organisations and individuals seem very unsure of the aims, content and
principles of the DPA.
Some hide behind the Act and refuse to provide even very basic, publicly available material
quoting the Act as a restriction.
The act also impacts on the way in which organisations conduct business in terms of who can be contacted
for marketing purposes, not only by telephone and direct mail, but also electronically and
has led to the development of permission based marketing strategies.
Problems of interpretation Definition of personal data
The definition of personal data is data which relates to a living individual who can be
identified from that data, or
from that data and other information which is in the possession of, or is likely to come
into the possession of, the data controller Sensitive personal data concerns the subject's
race, ethnicity, politics, religion, trade union status, health, sex life or criminal
record.
Subject access Personal data which is normally held for under
40 days may be legitimately denied in subject access requests under the Act.
This is a consequence of the time limit data controllers must meet in making their response.
If the data has been deleted by the normal procedures of the business by the time the
data controller responds to a request, that data cannot be supplied.
For data such as closed-circuit television images which are routinely overwritten, it
may be impossible for a subject to exercise their data access rights.
Regulation Compliance with the Act is regulated and enforced
by an independent authority, the Information Commissioner's Office, which maintains guidance
relating to the Act.
Full details can be found at http:www.ico.gov.uk See also
Computer Misuse Act 1990 Data privacy
Data Protection Directive Freedom of Information Act 2000
Gaskin v. the United Kingdom List of UK government data losses
Privacy and Electronic Communications Regulations 2003
References
External links Information Commissioner's Office
The Department for Constitutional Affairs The Data Protection Act Explained
The Employment Practice Code Overview of Data Protection Act
Council of Europe - ETS no.
108 - Convention for the Protection of Individuals with regard to Automatic Processing of Personal
Data – basis for Data Protection Act 1984 Directive 95EC of the European Parliament
and of the Council of 24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data – basis for Data Protection
Act 1998 UK Legislation
Official text of the Data Protection Act 1998 as in force today within the United Kingdom,
from the UK Statute Law Database