iPedia Free Information Center

Information about Data Protection Act

Acts of Parliament of predecessor
states to the United Kingdom
Acts of English Parliament to 1601
Acts of English Parliament to 1641
Acts and Ordinances (Interregnum) to 1660
Acts of English Parliament to 1699
Acts of English Parliament to 1706
Acts of Parliament of Scotland
Acts of Irish Parliament to 1700
Acts of Irish Parliament to 1800
Acts of Parliament of the United Kingdom
1707–1719 | 1720–1739 | 1740–1759
1760–1779 | 1780–1800 | 1801–1819
1820–1839 | 1840–1859 | 1860–1879
1880–1899 | 1900–1919 | 1920–1939
1940–1959 | 1960–1979 | 1980–1999
2000–Present
Acts of the Scottish Parliament
Acts of the Northern Ireland Parliament
Acts of the Northern Ireland Assembly
Measures of the National Assembly for Wales
Orders in Council for Northern Ireland
United Kingdom Statutory Instruments


The Data Protection Act (DPA) is a United Kingdom Act of Parliament. It defines a legal basis for the handling in the UK of information relating to living people. It is the main piece of legislation that governs protection of personal data in the UK. Although the Act does not mention privacy, in practice it provides a way in which individuals can enforce the control of information about them. Most of the Act does not apply to domestic use[1], for example keeping a personal address book.

Compliance with the Act is overseen by an independent government authority, the Office of the Information Commissioner (OIC). The OIC maintains Guidance relating to the Act [2].

The act defines eight principles of information-handling practice.

The UK Data Protection Act is a large Act, and has a reputation for complexity. Whilst the basic principles are honoured for protecting privacy, interpreting the act is not always simple. Many companies, organisations and individuals seem very unsure of the aims, content and principles of the DPA. Some hide behind the Act and refuse to provide even very basic, publicly available material quoting the Act as a restriction.

Plain Language Summary of Key Principles

This section provides a quick overview of what the Key Principles of information-handling practice mean. The Key Principles themselves are discussed below in the context of their definition in law.
  • Data may only be used for the specific purposes for which it was collected.
  • Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.
  • Individuals have a right of access to the information held about them, subject to certain exceptions (for example, information held for the prevention or detection of crime).
  • Personal information may be kept for no longer than is necessary.
  • Personal information may not be transmitted outside the EEA unless the individual whom it is about has consented or adequate protection is in place, for example by the use of a prescribed form of contract to govern the transmission of the data.
  • Subject to some exceptions for organisations that only do very simple processing, and for domestic use, all entities that process personal information must register with the Information Commissioner.
  • Entities holding personal information are required to have adequate security measures in place. Those include technical measures (such as firewalls) and organisational measures (such as staff training).

History

The Data Protection Act 1984 was an implementation of the 1981 European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. It provided for a regulatory authority, the Data Protection Registrar, to oversee the implementation of and adherence to the Act. The 1984 Act was repealed by the Data Protection Act 1998. [3]

The Data Protection Act 1998 expanded on the 1984 Act, and was an implementation of European Union Directive 95/46/EC which, amongst other measures, expanded the remit of the Data Protection Registrar and renamed the position to the Data Protection Commissioner.

Paper-based health, education and social work records which were created before 24 October 1998 are subject to slightly different provisions in the Act which will apply until 23 October 2007.

Most recently, the Freedom of Information Act 2000 further expanded the role to include freedom of information; the job title of the DPR/DPC was changed once again, this time to Office of the Information Commissioner.

Following the practice of taking fingerprints of children without parental consent in school, it has been established that the latter was not necessary under the DPA. 3,500 schools in the UK have such fingerprint locks or databases in 2007 [4].

Personal data

The Act covers any data which can be used to identify a living person. This including names, birthday and anniversary dates, addresses, telephone numbers, Fax numbers, e-mail addresses etc. It only applies to that data which is held, or intended to be held, on computers ('equipment operating automatically in response to instructions given for that purpose'), or held in a 'relevant filing system'.

Subject rights

The data protection act creates rights for those who have their data stored, and responsibilities for those who store or collect personal data.

The person who has their data processed has the right to[5]
  • View the data an organisation holds on them, for a small fee, known as 'subject access'[6]
  • Request that incorrect information is corrected. If the company ignores the request, a court can order the data to be corrected or destroyed, and in some cases compensation can be awarded.[7]
  • Require that data is not used in a way which causes damage or distress.[8]
  • Require that their data is not used for direct marketing.[9]

Data protection principles

  1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
  2. at least one of the conditions in Schedule 2 is met, and
  3. in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
  4. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
  5. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
  6. Personal data shall be accurate and, where necessary, kept up to date.
  7. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
  8. Personal data shall be processed in accordance with the rights of data subjects under this Act.
  9. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
  10. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Conditions relevant to the first principle

  • Personal data should only be processed fairly and lawfully. In order for data to be classed as 'fairly processed', at least one of these six conditions must be applicable to that data.
  • The data subject (the person whose data is stored) has consented ("given their permission") to the processing;
  • Processing is necessary for 'the performance of a contract (any processing not directly required to complete a contract would not be "fair");
  • Processing is required under a legal obligation (other than one stated in the contract);
  • Processing is necessary to protect the vital interests of the data subject's rights;
  • Processing is necessary to carry out any public functions;
  • Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties" (unless it could unjustifiably prejudice the interests of the data subject).

Exemptions

The Act is structured such that all processing of personal data is covered by the act, while providing a number of exemptions in Part IV.[1] Notable exemptions are:
  • Section 28 - National security. Any processing for the purpose of safeguarding national security are exempt from all the data protection principles, as well as Part II (subject access rights), Part III (notification), Part V (enforcement), and Section 55 (Unlawful obtaining of personal data).
  • Section 29 - Crime and taxation. Data processed for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of taxes are exempt from the first data protection principle.
  • Section 36 - Domestic purposes. Processing by an individual only for the purposes of that individual's personal, family or household affairs is exempt from all the data protection principles, as well as Part II (subject access rights) and Part III (notification).

Offences

  • Section 55 - Unlawful obtaining of personal data. This Section makes it an offence for people (Other Parties), such as hackers and impersonators, outside the organisation to obtain unauthorised access to the personal data.[10]
  • Section 56 - This section makes it a criminal offence to require an individual to make a Subject Access Request relating to cautions or convictions for the purposes or recruitment, continued employment, or the provision of services.[11] As of 2007 this section has not yet been enabled.[12] According to the government, this section will not be enabled until the Criminal Records Bureau is providing a Basic Disclosure service.[13] The provision of a Basic Disclosure service is dependent on s.112 of the Police Act 1997 being enacted, which provides for "Criminal Conviction Certificate".<ref name="emplaws56" />

References

1. ^ Data Protection Act 1998, Part IV (Exemptions), Section 36, Office of Public Sector Information, accessed September 6 2007
2. ^ Guidance - The Data Protection Act, Page of Assorted Guidance, Office of the Information Commissioner, accessed October 20 2007
3. ^ Data Protection Act 1998, Schedule 16, Part I (Repeals), Office of Public Sector Information, accessed September 8 2007
4. ^ Child fingerprint plan considered, BBC, March 4, 2007
5. ^ Your rights,, ICO, accessed September 6 2007
6. ^ As of 2006, the maximum fee is £10 per item, FAQs, ICO
7. ^ Correcting information, ICO
8. ^ Data Protection Act 1998, Part III (Notification by Data Controllers), Section 10, Office of Public Sector Information, accessed September 6 2007
9. ^ Data Protection Act 1998, Part III (Notification by Data Controllers), Section 11, Office of Public Sector Information, accessed September 6 2007
10. ^ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 55, Office of Public Sector Information, accessed September 14 2007
11. ^ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 56, Office of Public Sector Information, accessed September 14 2007
12. ^ British Employment Law website (emplaw.co.uk), Criminal law aspects / vetting of job applicants / position under Police Act 1997
13. ^ Hansard, 28 Jun 2005 : Column 1451W

See also

External links

This is a list of Acts of Parliament of the English Parliament during that body's existence prior to the Act of Union of 1707. For legislation passed after that date see List of Acts of Parliament of the United Kingdom Parliament.
..... Click the link for more information.
This is a list of Acts of Parliament of the English Parliament during that body's existence prior to the Act of Union of 1707. For legislation passed after that date see List of Acts of Parliament of the United Kingdom Parliament.
..... Click the link for more information.
This is a list of Acts of Parliament of the English Parliament during that body's existence prior to the Act of Union of 1707. For legislation passed after that date see List of Acts of Parliament of the United Kingdom Parliament.
..... Click the link for more information.
This is a list of Acts of Parliament of the English Parliament during that body's existence prior to the Act of Union of 1707. For legislation passed after that date see List of Acts of Parliament of the United Kingdom Parliament.
..... Click the link for more information.
List of Acts of the Scottish Parliament to 1707 is a list of Acts of Parliament of the Parliament of Scotland. It lists the Acts of Parliament of the old Parliament of Scotland, that was merged with the old Parliament of England to form the Parliament of Great Britain, by the
..... Click the link for more information.
This is an incomplete list of Acts of the Parliament of Ireland for the years up to 1700.

Click here for the List of Acts of the Parliament of Ireland, 1701 to 1800.

The numbers after the titles of the acts are the chapter numbers.
..... Click the link for more information.
This is an incomplete list of Acts of the Parliament of Ireland for the years 1701 to 1800.

Click here for the List of Acts of the Parliament of Ireland to 1700.

The numbers after the titles of the acts are the chapter numbers.
..... Click the link for more information.
list of Acts of the Scottish Parliament. It lists Acts of the modern, devolved Scottish Parliament, established in 1999 by the Scotland Act 1998.

1999

  • Mental Health (Public Safety and Appeals) (Scotland) Act 1999 asp 1

2000


..... Click the link for more information.
list of Acts of the Parliament of Northern Ireland, from its first session in 1921 to suspension in 1972.

The short titles for these Acts were distinguished from those passed by the Westminster parliament by the insertion of the bracketed words "Northern Ireland" between the
..... Click the link for more information.
This is a list of Acts of the Northern Ireland Assembly passed by that body from its establishment in 2000 until its suspension in 2002 and from its re-establishment in 2007.

2000

  • Allowances to Members of the Assembly Act (Northern Ireland) 2000 c.

..... Click the link for more information.
Wales

This article is part of the series:
Politics of Wales

  • Contemporary Welsh Law
  • English Law
  • Courts of England and Wales
  • National Assembly for Wales

..... Click the link for more information.
The is a list of Orders in Council for Northern Ireland which are primary legislation for the province when it is being directly ruled from London and also for those powers not devolved to the Northern Ireland Assembly.
..... Click the link for more information.
A Statutory Instrument (SI) is a form of delegated or secondary legislation in Great Britain which is governed by the Statutory Instruments Act 1946.[1] Most secondary legislation in Great Britain is made in the form of a statutory instrument.
..... Click the link for more information.
Motto
"Dieu et mon droit" [2]   (French)
"God and my right"
Anthem
"God Save the Queen" [3]
..... Click the link for more information.
worldwide view of the subject.
Please [ improve this article] or discuss the issue on the talk page.
An Act of Parliament or Act is law by the parliament (see legislation).
..... Click the link for more information.
Data privacy refers to the evolving relationship between technology and the legal right to, or public expectation of privacy in the collection and sharing of data.

Privacy concerns exist wherever uniquely identifiable data relating to a person or persons are collected and
..... Click the link for more information.
Privacy has no definite boundaries and it has different meanings for different people. It is the ability of an individual or group to keep their lives and personal affairs out of public view, or to control the flow of information about themselves.
..... Click the link for more information.
The Information Commissioner's Office (ICO) in the United Kingdom, is a non-departmental public body which reports directly to Parliament and is sponsored by the Ministry of Justice.
..... Click the link for more information.
Tort law I
Part of the common law series
Intentional torts
Assault  · Battery
False arrest  · False imprisonment
Intentional infliction of emotional distress
Property torts
Trespass to chattels
Trespass to land  · Conversion
..... Click the link for more information.
European Economic Area (EEA) came into being on January 1, 1994 following an agreement[1] between three member states of European Free Trade Association (EFTA), the European Community (EC), and all member states of the European Union (EU).
..... Click the link for more information.
The Information Commissioner's Office (ICO) in the United Kingdom, is a non-departmental public body which reports directly to Parliament and is sponsored by the Ministry of Justice.
..... Click the link for more information.
The Information Commissioner's Office (ICO) in the United Kingdom, is a non-departmental public body which reports directly to Parliament and is sponsored by the Ministry of Justice.
..... Click the link for more information.
“EU” redirects here. For other uses, see EU (disambiguation).


..... Click the link for more information.
The full title of this European Union directive is Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This article provides a general overview of the directive only.
..... Click the link for more information.
Office of the Information Commissioner (Oifig an Choimisinéara Cosanta Sonraí) was set up under the terms of the Freedom of Information Act, 1997, which came into effect in April 1998.
..... Click the link for more information.
Freedom of Information Act 2000 (2000 c. 36) is the implementation of freedom of information legislation in the United Kingdom on a national level. It is an Act of Parliament that introduces a public "right to know" in relation to public bodies.
..... Click the link for more information.
The Information Commissioner's Office (ICO) in the United Kingdom, is a non-departmental public body which reports directly to Parliament and is sponsored by the Ministry of Justice.
..... Click the link for more information.
fingerprint is an impression of the friction ridges of all or any part of the finger.[1] A friction ridge is a raised portion of the epidermis on the palmar (palm and fingers) or plantar (sole and toes) skin, consisting of one or more connected ridge units of friction
..... Click the link for more information.
Compensation may refer to:
  • Damages - legal term referring to the financial compensation recoverable by reason of another's breach of duty; the money paid or awarded to a plaintiff
  • workers' compensation

..... Click the link for more information.
The external links in this article or section may require cleanup to comply with Wikipedia's content policies.
Please [ improve this article] by removing excessive or inappropriate external links. Please remove this tag when this is done.
..... Click the link for more information.


This article is copied from an article on Wikipedia.org - the free encyclopedia created and edited by online user community. The text was not checked or edited by anyone on our staff. Although the vast majority of the wikipedia encyclopedia articles provide accurate and timely information please do not assume the accuracy of any particular article. This article is distributed under the terms of GNU Free Documentation License.
Herod_Archelaus


page counter