Data Protection Act 1998

The Data Protection Act (DPA) is a United Kingdom Act of Parliament that provides a legal basis and allowing for the privacy and protection of data of individuals in the UK. The act places restrictions on organisations which collect or hold data which can identify a living person. The Act does not apply to domestic use, for example keeping a personal address book.

Data collected by any person or organisation may only be used for the specific purposes for which they were collected. Personal data may only be kept for an appropriate length of time and must not be disclosed to other parties without the consent of the data owner, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention and detection of crime). Schools, for example, may decide to keep information on former pupils for no longer than ten years.

The act is overseen by an independent government authority, the Office of the Information Commissioner. Persons and organisations which store personal data must register with the Information Commissioner.

The UK Data Protection Act is a large Act, and has a reputation for complexity. Whilst the basic principles are honoured for protecting privacy, interpreting the act is not always simple. Many companies, organisations and individuals seem very unsure of the aims, content and principles of the DPA. Some it seems hide behind the Act and refuse to provide even very basic, publicly available material quoting the Act as a restriction i.e. you can use a telephone 'Directory Enquiry' type service to request an individuals home telephone number, which they will readily give but they will refuse to confirm the individuals address or postcode.

what the fuck do you want to know about this! fuck sue and fuck the college! fuck em all hehehe

The Data Protection Act 1998 expanded on the 1984 Act, and was an implementation of European Union Directive 95/46/EC which, amongst other measures, expanded the remit of the Data Protection Registrar and renamed the position to the Data Protection Commissioner.

Paper-based health, education and social work records which were created before 24 October 1998 are subject to slightly different provisions in the Act which will apply until 23 October 2007.

Most recently, the Freedom of Information Act 2000 further expanded the role to include freedom of information; the job title of the DPR/DPC was changed once again, this time to Office of the Information Commissioner.

fuck u

I deleted this and now u fuckin wankers tryna put it back*# Processing is required under a legal obligation (other than one stated in the contract);

• 1. Processing is necessary to protect the vital interests of the data subject's rights;
  2. Processing is necessary to carry out any public functions;
  3. Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties" (unless it could unjustifiably prejudice the interests of the data subject).
• Personal data must be obtained only for specified and lawful purposes.
• The data collected must be adequate, relevant and not excessive.
• Personal data must be accurate and up to date.
• The data should not be kept any longer than necessary. Data collected for research or historical reasons may be kept indefinitely
• Personal data should only be processed in accordance with the "data subject's" (the individual's) rights.
• Personal data should be securely kept, and not transferred to any other country without adequate protection.

The person who has their data held has the right to

• View the data an organisation holds on them, for a small fee
• Request that incorrect information is corrected. If the company ignores the request, a court can order the data to be corrected or destroyed, and in some cases compensation can be awarded.
• Request not to receive direct marketing.

Eight principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
   1. at least one of the conditions in Schedule 2 is met, and
   2. in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

See also

• Freedom of Information Act 2000
• Data privacy
• Computer Misuse Act 1990

External links

• The Information Commissioner
• Data Protection Act 1998 (full text from OPSI)
• Council of Europe - ETS no. 108 - Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (1981) - basis for Data Protection Act 1984
• Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data - basis for Data Protection Act 1998
• The Department for Constitutional Affairs
• The Data Protection Act Explained
• Data Protection Act 1984 (full text)
• The Employment Practice Code (an explanation of employees rights from the Data Protection Act) (full text)