| Data Protection Act 1998 |
Article Index for Data |
Website Links For Data |
Information AboutData Protection Act 1998 |
| CATEGORIES ABOUT DATA PROTECTION ACT | |
| united kingdom acts of parliament 1984 | |
| united kingdom acts of parliament 1998 | |
| data privacy | |
| computer crimes | |
| computer law | |
|
The Data Protection Act ('''DPA''') is a , accessed September 6 2007 , for example keeping a personal address book. Compliance with the Act is overseen by an independent government authority, the Office Of The Information Commissioner . The act defines eight principles of information-handling practice. These are listed below. The key requirements are: - Data may only be used for the specific purposes for which it was collected. - Data must not be disclosed to other parties without the Consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation. - Individuals have a right of access to the information held about them, subject to certain exceptions (for example, information held for the prevention or detection of crime). - Personal information may be kept for no longer than is necessary. - Personal information may not be transmitted outside the EEA unless the individual whom it is about has consented or adequate protection is in place, for example by the use of a prescribed form of contract to govern the transmission of the data. - Subject to some exceptions for organisations that only do very simple processing, and for domestic use, all entities that process personal information must register with the Information Commissioner . - Entities holding personal information are required to have adequate security measures in place. Those include technical measures (such as firewalls) and organisational measures (such as staff training). The UK Data Protection Act is a large Act, and has a reputation for complexity. Data Protection Act FAQ , Staffordshire University , accessed September 6 2007 Whilst the basic principles are honoured for protecting privacy, interpreting the act is not always simple. Many companies, organisations and individuals seem very unsure of the aims, content and principles of the DPA. Some hide behind the Act and refuse to provide even very basic, publicly available material quoting the Act as a restriction. HISTORY The Data Protection Act 1984 was an implementation of the 1981 European ''Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data''. It provided for a regulatory authority, the , accessed September 8 2007 The Data Protection Act 1998 expanded on the 1984 Act, and was an implementation of European Union Directive 95/46/EC which, amongst other measures, expanded the remit of the Data Protection Registrar and renamed the position to the Data Protection Commissioner . Paper-based health, education and social work records which were created before 24 October 1998 are subject to slightly different provisions in the Act which will apply until 23 October 2007. Most recently, the Freedom Of Information Act 2000 further expanded the role to include freedom of information; the job title of the DPR/DPC was changed once again, this time to Office Of The Information Commissioner . Following the practice of taking '', March 4, 2007 . PERSONAL DATA The Act covers any data which can be used to identify a living person. This including names, birthday and anniversary dates, addresses, telephone numbers, Fax numbers, e-mail addresses etc. It only applies to that data which is held, or intended to be held, on computers ('equipment operating automatically in response to instructions given for that purpose'), or held in a 'relevant filing system'. SUBJECT RIGHTS The data protection act creates rights for those who have their data stored, and responsibilities for those who store or collect personal data. The person who has their data processed has the right to'' Your rights, '', ICO, accessed September 6 2007
DATA PROTECTION PRINCIPLES # Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless- ## at least one of the conditions in Schedule 2 is met, and ## in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. # Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. # Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. # Personal data shall be accurate and, where necessary, kept up to date. # Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. # Personal data shall be processed in accordance with the rights of data subjects under this Act. # Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. # Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. Conditions relevant to the first principle
EXEMPTIONS The Act is structured such that all processing of personal data is covered by the act, while providing a number of exemptions in Part IV. Notable exemptions are:
REFERENCES SEE ALSO
EXTERNAL LINKS
|
|
|