|
---------------
---------------
|
|
|
|
|
|
The Data Protection Act 1998
21 Jul 2006
The information contained within this briefing is accurate at the time of writing.
Background
The Data Protection Act 1998 replaced the Data Protection Act 1984. It came into force on 1 March 2000, but is not fully effective until 23 October 2007.
The following is a basic outline of the Act. Further advice should be sought from the 24 Hour Telephone Advisory Service or the Data Protection Registrar.
Scope of the 1998 Act
In addition to electronic files, the 1998 Act also covers information held manually, i.e. paper form. The legislation regulates the processing of information ("personal data") by the person holding that information ("data controller"). It is important to note that manual personnel filing systems are covered by the legislation.
Personal data is information relating to living individuals who can be identified from that data. Sensitive personal data is information relating to racial/ethnic origin, political opinions, religious beliefs, union membership, physical/mental health, sex life or criminal offences.
The Data Protection Principles
Data Controllers have two main duties under the 1998 Act:
- they must comply with the eight data protection principles set out in the Act.
- they must ensure that before processing automated records containing personal data, they have notified the Data Protection Commissioner and are included in the register of notifications. It is a criminal offence to process data without registering as a Data Controller.
The Principles:
- Personal data must be processed fairly and lawfully and must not be processed unless one of the conditions in Schedule 2 is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. The conditions in Schedule 2 are:
- The data subject has positively consented to the processing, for example through a term in the contract of employment. Employers should be aware that this also applies to monitoring employees' e-mail and internet use at work.
- The processing is necessary to fulfil a contract or to take steps at the request of the data subject prior to entering into a contract e.g. processing CVs, mortgage references.
- The processing is necessary to comply with a legal obligation, such as compliance with the Working Time Regulations.
- The processing is necessary to protect the vital interests of the data subject, for example, in releasing medical information where the data subject's life is at stake.
- The processing is necessary for the administration of justice or for public functions.
- The processing is necessary for the purposes of legitimate interests pursued by the data controller or the person to whom the data is disclosed. The Secretary of State has the power to stipulate circumstances where this provision will apply.
- Personal data may only be processed for specified and lawful purposes.
- Personal data shall be adequate, relevant and not excessive in relation to the purpose for which it is processed.
- Personal data shall be accurate and, where necessary, kept up to date.
- Personal data processed for any purpose shall not be kept for longer than necessary.
- Personal data shall be processed in accordance with the rights of data subjects under the 1998 Act.
- Appropriate technical and organisational steps shall be taken to prevent unauthorised or unlawful disclosure of, accidental loss or destruction of, or damage to, personal data.
- Personal data shall not be transferred outside the European Economic Area unless that country or territory also provides an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
21 Jul 2006
The information contained within this briefing is accurate at the time of writing.
|
|
|
|
