Data protection

1. The Data Protection Act 1998 ("DPA")¹ regulates the processing and use of personal data². The DPA is wide ranging and covers data kept in both manual and electronic form³. It lists eight "data protection principles", and any "processing" of personal data must be done in accordance with them. "Processing" includes obtaining, recording, holding, adapting, or disclosing the data⁴. These principles are designed to ensure that:

• personal data is only used in a way which is fair, lawful and proportionate;
• data held is accurate, kept safely and not kept for longer than absolutely necessary for the purpose for which it was obtained; and
• personal data is not transferred to countries which do not provide adequate protection for that data.

2. The DPA specifies conditions which must be met before processing of personal data ⁵ and "sensitive" personal data ⁶ can be undertaken.

3. The DPA provides certain rights of access by data subjects to the data held on them ⁷ but is also subject to a number of exceptions for a range of governmental (including law enforcement and regulatory) activities ⁸.

4. It also prevents access by third parties to the personal data of others ⁹ but this prohibition is again subject to various exceptions ¹⁰.

---

Footnotes

1. c.29 The Data Protection Act 1998 gives effect to European Directive 95/46/EC (OJ No L281/31) (23.11.95). Back to reference of footnote 1
2. For detailed guidance on Data Protection Act 1998 see GAP 37. Back to reference of footnote 2
3. DPA 1998 Section 1. Back to reference of footnote 3
4. DPA 1998 Sections 1, 4 and Schedule 1. Back to reference of footnote 4
5. DPA 1998 Section 1 and Schedule 2. Back to reference of footnote 5
6. DPA 1998 Section 2 and Schedule 3. Back to reference of footnote 6
7. DPA 1998 Section 7-8. Back to reference of footnote 7
8. Part IV of Act, sections 27-39. For example, there are exemptions to the right of subject access for the purpose of safeguarding national security (section 28); where disclosure would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders (section 29(1)); and where disclosure would be likely to prejudice the proper discharge of certain functions including those designed to secure the health, safety and welfare of persons at work, or to protect persons other than persons at work against risks to health or safety or safety arising out of or in connection with the actions of persons at work (section 31(1)(2)(e) and (f)). Back to reference of footnote 8
9. Sections 7(4) and 27(3). Back to reference of footnote 9
10. For example, personal data is exempt from what are called "the non-disclosure provisions" in any case in which the disclosure is necessary for the purpose of the prevention or detection of crime or the apprehension or prosecution of offenders and non-disclosure would be likely to prejudice those purposes (section 29(3)). Personal data is also exempt from the non-disclosure provisions where the disclosure is required by or under any enactment, by any rule of law or by order of the Court (section 35(1)) or where the disclosure is "necessary" for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or for the purpose of obtaining legal advice, or is otherwise necessary for the purpose of establishing, exercising or defending legal rights (section 35(2)(a) and (b)). Back to reference of footnote 10