From Wikipedia, the free encyclopedia

Acts of Parliament of predecessor states to the United Kingdom

Acts of English Parliament to 1601 Acts of English Parliament to 1641 Acts and Ordinances (Interregnum) to 1660 Acts of English Parliament to 1699 Acts of English Parliament to 1706 Acts of Parliament of Scotland Acts of Irish Parliament to 1700 Acts of Irish Parliament to 1800

Acts of Parliament of the United Kingdom

1707–1719 | 1720–1739 | 1740–1759 1760–1779 | 1780–1800 | 1801–1819 1820–1839 | 1840–1859 | 1860–1879 1880–1899 | 1900–1919 | 1920–1939 1940–1959 | 1960–1979 | 1980–1999 2000–Present

Acts of the Scottish Parliament

Acts of the Northern Ireland Parliament

Acts of the Northern Ireland Assembly

Measures of the National Assembly for Wales

Orders in Council for Northern Ireland

United Kingdom Statutory Instruments

The Data Protection Act (DPA) is a United Kingdom Act of Parliament. It defines a legal basis for the handling in the UK of information relating to living people. It is the main piece of legislation that governs protection of personal data in the UK. Although the Act does not mention privacy, in practice it provides a way in which individuals can enforce the control of information about them. Most of the Act does not apply to domestic use^[1], for example keeping a personal address book.

Compliance with the Act is overseen by an independent government authority, the Office of the Information Commissioner (OIC). The OIC maintains Guidance relating to the Act ^[2].

The act defines eight principles of information-handling practice.

The UK Data Protection Act is a large Act, and has a reputation for complexity.^{[citation needed]} Whilst the basic principles are honoured for protecting privacy, interpreting the act is not always simple. Many companies, organisations and individuals seem very unsure of the aims, content and principles of the DPA. Some hide behind the Act and refuse to provide even very basic, publicly available material quoting the Act as a restriction.^{[citation needed]}

Contents 1 Plain Language Summary of Key Principles 2 History 3 Personal data 4 Subject rights 5 Data protection principles 5.1 Conditions relevant to the first principle 6 Exemptions 7 Offences 8 References 9 See also 10 External links

This section provides a quick overview of what the Key Principles of information-handling practice mean. The Key Principles themselves are discussed below in the context of their definition in law.

• Data may only be used for the specific purposes for which it was collected.
• Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.
• Individuals have a right of access to the information held about them, subject to certain exceptions (for example, information held for the prevention or detection of crime).
• Personal information may be kept for no longer than is necessary.
• Personal information may not be transmitted outside the EEA unless the individual whom it is about has consented or adequate protection is in place, for example by the use of a prescribed form of contract to govern the transmission of the data.
• Subject to some exceptions for organisations that only do very simple processing, and for domestic use, all entities that process personal information must register with the Information Commissioner.
• Entities holding personal information are required to have adequate security measures in place. Those include technical measures (such as firewalls) and organisational measures (such as staff training).

The Data Protection Act 1984 was an implementation of the 1981 European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. It provided for a regulatory authority, the Data Protection Registrar, to oversee the implementation of and adherence to the Act. The 1984 Act was repealed by the Data Protection Act 1998. ^[3]

The Data Protection Act 1998 expanded on the 1984 Act, and was an implementation of European Union Directive 95/46/EC which, amongst other measures, expanded the remit of the Data Protection Registrar and renamed the position to the Data Protection Commissioner.

Paper-based health, education and social work records which were created before 24 October 1998 are subject to slightly different provisions in the Act which will apply until 23 October 2007.

Most recently, the Freedom of Information Act 2000 further expanded the role to include freedom of information; the job title of the DPR/DPC was changed once again, this time to Office of the Information Commissioner.

Following the practice of taking fingerprints of children without parental consent in school, it has been established that the latter was not necessary under the DPA. 3,500 schools in the UK have such fingerprint locks or databases in 2007 ^[4].

The Act covers any data which can be used to identify a living person. This includes names, birthday and anniversary dates, addresses, telephone numbers, Fax numbers, e-mail addresses etc. It only applies to that data which is held, or intended to be held, on computers ('equipment operating automatically in response to instructions given for that purpose'), or held in a 'relevant filing system'.

The data protection act creates rights for those who have their data stored, and responsibilities for those who store or collect personal data.

The person who has their data processed has the right to^[5]

• View the data an organisation holds on them, for a small fee, known as 'subject access'^[6]
• Request that incorrect information is corrected. If the company ignores the request, a court can order the data to be corrected or destroyed, and in some cases compensation can be awarded.^[7]
• Require that data is not used in a way which causes damage or distress.^[8]
• Require that their data is not used for direct marketing.^[9]

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
   1. at least one of the conditions in Schedule 2 is met, and
   2. in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

• Personal data should only be processed fairly and lawfully. In order for data to be classed as 'fairly processed', at least one of these six conditions must be applicable to that data.
  1. The data subject (the person whose data is stored) has consented ("given their permission") to the processing;
  2. Processing is necessary for 'the performance of a contract (any processing not directly required to complete a contract would not be "fair");
  3. Processing is required under a legal obligation (other than one stated in the contract);
  4. Processing is necessary to protect the vital interests of the data subject's rights;
  5. Processing is necessary to carry out any public functions;
  6. Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties" (unless it could unjustifiably prejudice the interests of the data subject).

The Act is structured such that all processing of personal data is covered by the act, while providing a number of exemptions in Part IV.^[1] Notable exemptions are:

• Section 28 - National security. Any processing for the purpose of safeguarding national security are exempt from all the data protection principles, as well as Part II (subject access rights), Part III (notification), Part V (enforcement), and Section 55 (Unlawful obtaining of personal data).
• Section 29 - Crime and taxation. Data processed for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of taxes are exempt from the first data protection principle.
• Section 36 - Domestic purposes. Processing by an individual only for the purposes of that individual's personal, family or household affairs is exempt from all the data protection principles, as well as Part II (subject access rights) and Part III (notification).

• Section 55 - Unlawful obtaining of personal data. This Section makes it an offence for people (Other Parties), such as hackers and impersonators, outside the organisation to obtain unauthorised access to the personal data.^[10]

• Section 56 - This section makes it a criminal offence to require an individual to make a Subject Access Request relating to cautions or convictions for the purposes or recruitment, continued employment, or the provision of services.^[11] As of 2007 this section has not yet been enabled.^[12] According to the government, this section will not be enabled until the Criminal Records Bureau is providing a Basic Disclosure service.^[13] The provision of a Basic Disclosure service is dependent on s.112 of the Police Act 1997 being enacted, which provides for "Criminal Conviction Certificate".^[12]

1. ^ ^{a b} Data Protection Act 1998, Part IV (Exemptions), Section 36, Office of Public Sector Information, accessed September 6, 2007
2. ^ Guidance - The Data Protection Act, Page of Assorted Guidance, Office of the Information Commissioner, accessed October 20, 2007
3. ^ Data Protection Act 1998, Schedule 16, Part I (Repeals), Office of Public Sector Information, accessed September 8, 2007
4. ^ Child fingerprint plan considered, BBC, March 4, 2007
5. ^ Your rights,, ICO, accessed September 6, 2007
6. ^ As of 2006, the maximum fee is £10 per item, FAQs, ICO
7. ^ Correcting information, ICO
8. ^ Data Protection Act 1998, Part III (Notification by Data Controllers), Section 10, Office of Public Sector Information, accessed September 6, 2007
9. ^ Data Protection Act 1998, Part III (Notification by Data Controllers), Section 11, Office of Public Sector Information, accessed September 6, 2007
10. ^ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 55, Office of Public Sector Information, accessed September 14, 2007
11. ^ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 56, Office of Public Sector Information, accessed September 14, 2007
12. ^ ^{a b} British Employment Law website (emplaw.co.uk), Criminal law aspects / vetting of job applicants / position under Police Act 1997
13. ^ Hansard, 28 Jun 2005 : Column 1451W

• Data privacy
• Freedom of Information Act 2000
• Computer Misuse Act 1990
• Privacy and Electronic Communications (EC Directive) Regulations 2003

• The Information Commissioner
• Data Protection Act 1998 (full text from OPSI)
• Council of Europe - ETS no. 108 - Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (1981) - basis for Data Protection Act 1984
• Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data - basis for Data Protection Act 1998
• The Department for Constitutional Affairs
• The Data Protection Act Explained
• Data Protection Act 1984 (full text), broken link on September 6, 2007
• The Employment Practice Code (an explanation of employees rights from the Data Protection Act) (full text)