text:
Data Protection Act 1998
From Wikipedia, the free encyclopedia
Jump to: navigation, search
Data Protection Act 1998
Act of Parliament
Parliament of the United Kingdom
Long title
An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.
Territorial extent
United Kingdom of Great Britain and Northern Ireland
Dates
Royal assent
16 July 1998
Commencement
March 2000
Other legislation
Replaces
Data Protection Act 1984
Status: Current legislation
Text of the Data Protection Act 1998 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk
The Data Protection Act 1998 (c 29) is a United Kingdom Act of Parliament designed to protect personal data stored on computers or in an organised paper filing system. It follows the EU Data Protection Directive 1995 protection, processing and movement of data. Individuals have legal rights to control information about themselves. Most of the Act does not apply to domestic use,[1] for example keeping a personal address book. Anyone holding personal data for other purposes is legally obliged to comply with this Act, subject to some exemptions. The Act defines eight data protection principles to ensure that information is processed lawfully.
Contents
[hide]
1 Background
2 Contents
2.1 Scope of protection
2.2 Data protection principles
2.3 Exceptions
2.4 Police and court powers
2.5 Offences
2.6 Complexity
2.7 Definition of personal data
2.8 Subject Access Requests
2.9 Information Commissioner
2.10 EU’s Article 29 Working Party
3 See also
4 References
5 External links
5.1 UK legislation
Background[edit]
The 1998 Act replaced the Data Protection Act 1984 and the Access to Personal Files Act 1987 and implemented the EU Data Protection Directive 1995.
The Privacy and Electronic Communications (EC Directive) Regulations 2003 altered the consent requirement for most electronic marketing to "positive consent" such as an opt in box. Exemptions remain for the marketing of "similar products and services" to existing customers and enquirers, which can still be given permission on an opt out basis.
The Jersey data protection law was modelled on the UK law.[2]
Contents[edit]
Scope of protection[edit]
Section 1 defines "personal data" as any data that can be used to identify a living individual. Anonymised or aggregated data is less regulated by the Act, providing the anonymisation or aggregation has not been done in a reversible way. Individuals can be identified by various means including their name and address, telephone number or email address. The Act applies only to data which is held, or intended to be held, on computers ('equipment operating automatically in response to instructions given for that purpose'), or held in a 'relevant filing system'.[3]
In some cases a paper address book can be classified as a 'relevant filing system' for example diaries used to support commercial activities, such as a salesperson's diary.[clarification needed]
The Freedom of Information Act 2000 modified the act for public bodies and authorities, and the Durant case modified the interpretation of the act by providing case law and precedent.[4]
A person who has their data processed has the following rights:[5][6]
under section 7, to view the data an organisation holds on them for a reasonable fee: the maximum fee is £2 for requests to credit reference agencies, £50 for health and educational request, and £10 per individual otherwise,[7]
under section 14, request that incorrect information be corrected. If the company ignores the request, a court can order the data to be corrected or destroyed, and in some cases compensation can be awarded.[8]
under section 10, require that data is not used in any way that may potentially cause damage or distress.[9]
under section 11, require that their data is not used for direct marketing.[10]
Data protection principles[edit]
Schedule 1 lists eight "data protection principles".
Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:
at least one of the conditions in Schedule 2 is met, and
in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
Personal data shall be accurate and, where necessary, kept up to date.
Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
About the rights of individuals e.g.[11] personal data shall be processed in accordance with the rights of data subjects (individuals).
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
Conditions relevant to the first principle
Personal data should only be processed fairly and lawfully. In order for data to be classed as 'fairly processed', at least one of these six conditions must be applicable to that data (Schedule 2).
The data subject (the person whose data is stored) has consented ("given their permission") to the processing;
Processing is necessary for the performance of, or commencing, a contract;
Processing is required under a legal obligation (other than one stated in the contract);
Processing is necessary to protect the vital interests of the data subject;
Processing is necessary to carry out any public functions;
Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties" (unless it could unjustifiably prejudice the interests of the data subject).[12]
Consent
Except under the below mentioned exceptions, the individual needs to consent to the collection of their personal information and its use in the purpose(s) in question. The European Data Protection Directive defines consent as “…any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”, meaning the individual may signify agreement other than in writing. However, non-communication should not be interpreted as consent.
Additionally, consent should be appropriate to the age and capacity of the individual and other circumstances of the case. E.g., if an organisation "intends to continue to hold or use personal data after the relationship with the individual ends, then the consent should cover this." And even when consent is given, it shouldn't be assumed to last forever. Although in most cases consent lasts for as long as the personal data needs to be processed, individuals may be able to withdraw their consent, depending on the nature of the consent and the circumstances in which the personal information is being collected and used.[13]
The Data Protection Act also specifies that sensitive personal data must be processed according to a stricter set of conditions, in particular any consent must be explicit.[13]
Exceptions[edit]
The Act is structured such that all processing of personal data is covered by the act, while providing a number of exceptions in Part IV.[1] Notable exceptions are:
Section 28 – National security. Any processing for the purpose of safeguarding national security is exempt from all the data protection principles, as well as Part II (subject access rights), Part III (notification), Part V (enforcement), and Section 55 (Unlawful obtaining of personal data).
Section 29 – Crime and taxation. Data processed for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of taxes are exempt from the first data protection principle.
Section 36 – Domestic purposes. Processing by an individual only for the purposes of that individual's personal, family or household affairs is exempt from all the data protection principles, as well as Part II (subject access rights) and Part III (notification).
Police and court powers[edit]
The Act grants or acknowledges various police and court powers.
Section 29 – Consent of the Data Subject is not required when processing Personal Data to prevent or detect crime, apprehend or prosecute offenders, the assessment and collection of taxes and duties and to discharge a statutory function.[14]
Section 35 – Disclosures required by law or made in connection with legal proceedings. This includes obeying court orders, other laws and are part of legal proceedings.[15]
Offences[edit]
The Act details a number of civil and criminal offences for which data controllers may be liable if a data controller has failed to gain appropriate consent from a data subject. However, 'consent' is not specifically defined in the Act and so is a common law matter.
Section 21(1) makes it an offence to process personal information without registration.[16]
Section 21(2) makes it an offence to fail to comply with the notification regulations made by the Secretary of State[16] (proposed by the Information Commissioner under section 25 of the Act).[17]
Section 55 makes unlawful obtaining of personal data. This section makes it an offence for people (Other Parties), such as hackers and impersonators, outside the organisation to obtain unauthorised access to the personal data.[18]
Section 56 makes it a criminal offence to require an individual to make a Subject Access Request relating to cautions or convictions for the purposes of recruitment, continued employment, or the provision of services.[19] This section came into force on 10 March 2015.[20]
Complexity[edit]
The UK Data Protection Act is a large Act that has a reputation for complexity.[21] While the basic principles are honoured for protecting privacy, interpreting the act is not always simple. Many companies, organisations and individuals seem very unsure of the aims, content and principles of the Act. Some hide behind the Act and refuse to provide even very basic, publicly available material quoting the Act as a restriction.[22] The Act also impacts on the way in which organisations conduct business in terms of who can be contacted for marketing purposes, not only by telephone and direct mail but also electronically and has led to the development of permission based marketing strategies.
Definition of personal data[edit]
The definition of personal data is data relating to a living individual who can be identified
from that data or
from that data and other information in the possession of, or is likely to come into the possession of, the data controller
Sensitive personal data concerns the subject's race, ethnicity, politics, religion, trade union status, health, sex life or criminal record.[23]
Subject Access Requests[edit]
The Information Commissioner's Office website states[24]:
You have the right to get a copy of the information that is held about you. This is known as a subject access request.
This right of subject access means that you can make a request under the Data Protection Act to any organisation processing your personal data. The Act calls these organisations ‘data controllers’.
You can ask the organisation you think is holding, using or sharing the personal information you want, to supply you with copies of both paper and computer records and related information.
Organisations may charge a fee for responding to a subject access request of up to[24]:
£2 if it is a request to a credit reference agency for information about your financial standing
£50 for health records that are not available in electronic form or only partially available in electronic form
£10 in all other circumstances
Information Commissioner[edit]
Main article: Information Commissioner's Office
Compliance with the Act is regulated and enforced by an independent authority, the Information Commissioner's Office, which maintains guidance relating to the Act.[25][26]
EU’s Article 29 Working Party[edit]
In January 2017 the Information Commissioner's Office invited public comments on the EU’s Article 29 Working Party's proposed changes to data protection law and the anticipated introduction of extensions to the interpretation of the Act, the Guide to the General Data Protection Regulation.[27]
See also[edit]
Data Protection Act, 2012 (Ghana)
Computer Misuse Act 1990
Data privacy
Data Protection Directive (EU)
Freedom of Information Act 2000
Gaskin v United Kingdom
List of UK government data losses
Privacy and Electronic Communications (EC Directive) Regulations 2003
General Data Protection Regulation – a 2016 EU regulation on data protection
Smith v Lloyds TSB Bank plc
Durant v Financial Services Authority [2003] EWCA Civ 1746
References[edit]
^ Jump up to: a b Data Protection Act 1998, Part IV (Exemptions), Section 36, Office of Public Sector Information, accessed 6 September 2007
Jump up ^ Jersey: Data Protection In Jersey And Other Offshore Jurisdictions 23 July 2008 Article by Wendy Benjamin, mondaq.com,
Jump up ^ "Data Protection Act 1998, Basic interpretative provisions". Office of Public Sector Information. Retrieved 14 March 2014.
Jump up ^ "What is personal data? Information Commissioner updates guidance". Pinsent Masons. 30 August 2007. Retrieved 20 August 2012. In the case involving Michael Durant he sought information held on him by the Financial Services Authority. The Court of Appeal ruled that just because a document contained his name it was not necessarily defined as personal data. This changed the perception of how wide a definition of personal data could be.
Jump up ^ Your rights, ICO, accessed 6 September 2007
Jump up ^ "The rights of individuals (Principle 6)", ICO, accessed 7 December 2016
Jump up ^ "FAQs". Information Commissioner's Office. Retrieved 19 January 2014.
Jump up ^ "Claiming compensation". Information Commissioner's Office. Retrieved 24 November 2017.
Jump up ^ Data Protection Act 1998, Part II (Rights of data subjects and others), Section 10, Office of Public Sector Information, accessed 6 September 2007
Jump up ^ Data Protection Act 1998, Part II (Rights of data subjects and others), Section 11, Office of Public Sector Information, accessed 6 September 2007
Jump up ^ The rights of individuals (Principle 6), ICO.org.uk, accessed 14 April 2011
Jump up ^ OPSI.gov.uk Data Protection Act 1998 Schedule 2
^ Jump up to: a b "Conditions for Processing – Guide to Data Protection – ICO". Information Commissioner's Office. Retrieved 8 February 2013.
Jump up ^ Data Protection Act 1998, Part IV (Exceptions – Crime and taxation), Section 29
Jump up ^ Data Protection Act 1998, Part IV (Exemptions – Disclosures required by law or made in connection with legal proceedings etc.), Section 35
^ Jump up to: a b Data Protection Act 1998, Part III (Notification by Data Controllers), Section 21, Office of Public Sector Information)
Jump up ^ Data Protection Act 1998, Part III (Notification by Data Controllers), Section 25
Jump up ^ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 55, Office of Public Sector Information, accessed 14 September 2007
Jump up ^ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 56, Office of Public Sector Information, accessed 14 September 2007
Jump up ^ http://www.lewissilkin.com/Journal/2015/March/Forced-data-subject-access-requests-are-now-a-criminal-offence.aspx
Jump up ^ Bainbridge, D: "Introduction to Computer Law – Fifth Edition", page 430. Pearson Education Limited, 2005
Jump up ^ Data Protection myths and realities, Information Commissioner's Office, accessed 30 August 2008
Jump up ^ "Data Protection Act 1998". UK Statute Law Database. Retrieved 20 August 2012.
^ Jump up to: a b "Find out how to request your personal information". Retrieved 6 August 2017.
Jump up ^ "The Guide to Data Protection". Information Commissioner's Office. Retrieved 6 January 2015.
Jump up ^ Guidance – The Data Protection Act, Page of Assorted Guidance, Information Commissioner's Office, accessed 20 October 2007
Jump up ^ "Guide to the General Data Protection Regulation (GDPR)". ico.org.uk. 22 December 2017. Retrieved 6 January 2018.
External links[edit]
Wikiversity has learning resources about Data Protection Act 1998
Information Commissioner's Office
The Department for Constitutional Affairs
Council of Europe – ETS no. 108 – Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (1981) – basis for Data Protection Act 1984
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data – basis for Data Protection Act 1998
UK legislation[edit]
Text of the Data Protection Act 1998 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk
[show]
v
t
e
United Kingdom legislation
Pre-Parliamentary legislation
List of English statutes
Charter of Liberties
Magna Carta
Acts of Parliament by states preceding
the Kingdom of Great Britain
Parliament of England
to 1483
1485–1601
1603–1641
Interregnum (1642–1660)
1660–1699
1700–1706
Parliament of Scotland
to 1706
Acts of Parliament of the
Kingdom of Great Britain
1707–1719
1720–1739
1740–1759
1760–1779
1780–1800
Acts of the Parliament of Ireland
to 1700
1701–1800
Acts of Parliament of the United Kingdom of
Great Britain and Ireland and the United
Kingdom of Great Britain and Northern Ireland
1801–1819
1820–1839
1840–1859
1860–1879
1880–1899
1900–1919
1920–1939
1940–1959
1960–1979
1980–1999
2000 to date
Halsbury's Statutes
Legislation.gov.uk
Short titles
relating to the European Union
1972 to date
Church of England measures
List
Church of England Assembly (Powers) Act 1919
Legislation of devolved institutions
Acts of the Scottish Parliament
List
Acts and Measures of the National Assembly for Wales
List
Acts of the Northern Ireland Assembly
Acts of the Parliament of Northern Ireland
Orders-in-Council / Orders in Council
Orders-in-Council
for Northern Ireland (1972-2009)
Orders in Council for Northern Ireland
Secondary legislation
United Kingdom Statutory Instruments
various
Scottish Statutory Instruments
Acts of Sederunt
Acts of Adjournal
all others
Retrieved from "https://en.wikipedia.org/w/index.php?title=Data_Protection_Act_1998&oldid=821916514"
Categories:
United Kingdom Acts of Parliament 1998
Information privacy
Cybercrime
Computing legislation
United Kingdom privacy law
Data laws
Data protection
Hidden categories:
Wikipedia articles needing clarification from March 2017
Use dmy dates from January 2011
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
Deutsch
Simple English
中文
Edit links
This page was last edited on 23 January 2018, at 10:35.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

value: mw-page-base noprint

value: mw-head-base noprint

value: firstHeading firstHeading en

value: siteSub noprint

value: jump-to-nav mw-jump

tag: caption

attr: alt src width height srcset data-file-width data-file-height

value:
/wiki/Long_title
mw-redirect
Long title

value: text-align:center;border-top: 1px solid #aaa;

value:
/wiki/Data_Protection_Act_1984
mw-redirect
Data Protection Act 1984

value:
/wiki/Data_Protection_Directive_1995
mw-redirect
Data Protection Directive 1995

value:
/wiki/Access_to_Personal_Files_Act_1987
mw-redirect
Access to Personal Files Act 1987

value:
/wiki/Data_Protection_(Jersey)_Law_2005
mw-redirect
Data Protection (Jersey) Law 2005

value: The text near this tag may need clarification or removal of jargon. (March 2017)

value:
noprint Inline-Template
margin-left:0.1em; white-space:nowrap;

value: Edit section: Data protection principles

value: Edit section: Definition of personal data

value: float: right; clear: right; margin: 0.5em 0 0.8em 1.4em; padding: 10px; border: 1px solid #aaa; font-size: 88%; background-color: #F9F9F9; position: relative; text-align: left;

value: Edit section: EU’s Article 29 Working Party

value:
/wiki/Data_privacy
mw-redirect
Data privacy

value:
nofollow
external text
http://www.out-law.com/page-8427

value:
/wiki/UK_Statute_Law_Database
mw-redirect
UK Statute Law Database

value: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

value: v:Special:Search/Data Protection Act 1998

value:
nofollow
external text
http://www.ico.org.uk

value:
nofollow
external text
http://www.dca.gov.uk/foi/datprot.htm

value: List of Acts of the Parliament of England to 1483

value: List of Acts of the Parliament of England, 1485–1601

value: List of Acts of the Parliament of England, 1603–41

value: List of Ordinances and Acts of the Parliament of England, 1642–60

value: List of Acts of the Parliament of England, 1660–99

value: List of Acts of the Parliament of England, 1700–06

value: List of Acts of the Parliament of Scotland to 1707

value: List of Acts of the Parliament of Great Britain, 1707–19

value: List of Acts of the Parliament of Great Britain, 1720–39

value: List of Acts of the Parliament of Great Britain, 1740–59

value: List of Acts of the Parliament of Great Britain, 1760–79

value: List of Acts of the Parliament of Great Britain, 1780–1800

value: List of Acts of the Parliament of Ireland to 1700

value: List of Acts of the Parliament of Ireland, 1701–1800

value: United Kingdom of Great Britain and Ireland

value: List of Acts of the Parliament of the United Kingdom, 1801–19

value: List of Acts of the Parliament of the United Kingdom, 1820–39

value: List of Acts of the Parliament of the United Kingdom, 1840–59

value: List of Acts of the Parliament of the United Kingdom, 1860–79

value: List of Acts of the Parliament of the United Kingdom, 1880–99

value: List of Acts of the Parliament of the United Kingdom, 1900–19

value: List of Acts of the Parliament of the United Kingdom, 1920–39

value: List of Acts of the Parliament of the United Kingdom, 1940–59

value: List of Acts of the Parliament of the United Kingdom, 1960–79

value: List of Acts of the Parliament of the United Kingdom, 1980–99

value: List of Acts of the Parliament of the United Kingdom, 2000–present

value: List of Acts of the Parliament of the United Kingdom relating to the European Communities / European Union

value: Church of England Assembly (Powers) Act 1919

value: List of Acts of the Scottish Parliament from 1999

value: Measure of the National Assembly for Wales

value: List of Acts and Measures of the National Assembly for Wales

value: List of Acts of the Northern Ireland Assembly

value: List of Acts of the Parliament of Northern Ireland

value: List of Orders in Council for Northern Ireland

value: Delegated legislation in the United Kingdom

value:
/wiki/Statutory_Instrument_(UK)
mw-redirect
Statutory Instrument (UK)

value: nowraplinks collapsible collapsed navbox-inner

value: Category:United Kingdom Acts of Parliament 1998

value: Category:Wikipedia articles needing clarification from March 2017

value: Category:Use dmy dates from January 2011

value: Discussion about edits from this IP address [ctrl-alt-n]

value: A list of edits made from this IP address [ctrl-alt-y]

value: You are encouraged to create an account and log in; however, it is not mandatory

value: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

value:
/wiki/Data_Protection_Act_1998
View the content page [ctrl-alt-c]
c

value: Discussion about the content page [ctrl-alt-t]

value: p-namespaces navigation vectorTabs p-namespaces-label

value:
p-variants
navigation
vectorMenu emptyPortlet
p-variants-label

value: Past revisions of this page [ctrl-alt-h]

value: p-views navigation vectorTabs p-views-label

value:
p-cactions
navigation
vectorMenu emptyPortlet
p-cactions-label

value:
mw-wiki-logo
/wiki/Main_Page
Visit the main page

value:
/wiki/Main_Page
Visit the main page [ctrl-alt-z]
z

value: Featured content – the best of Wikipedia

value: Find background information on current events

value:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

value:
uls-settings-trigger
Language settings
0
button
true

value: 数据保护法案 – Chinese

value:
suggestions
display: none; font-size: 13px;

value: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Data_Protection_Act_1998 rootpage-Data_Protection_Act_1998 skin-vector action-view