data protection

Safeguards relating to personal data, i.e. personal information about individuals that is stored on a computer. The principles of data protection, the responsibilities of data users, and the rights of data subjects are governed by the Data Protection Act 1984, all sections of which are now in force.

The principles of data protection include the following:

(1) The information to be contained in personal data shall be obtained, and personal data shall be processed, fairly and lawfully.

(2) Personal data shall be held only for specified and lawful purposes and shall not be used or disclosed in any manner incompatible with those purposes.

(3) Personal data held for any purpose shall be relevant to that purpose.

(4) Personal data shall be accurate and, where necessary, kept up to date.

(5) Personal data held for any purpose shall not be kept longer than necessary for that purpose.

(6) Appropriate security measures shall be taken against unauthorized access to, or alteration, disclosure, or destruction of personal data and against accidental loss or destruction of personal data.

Data users must register their activities with the Data Protection Registrar by means of a registration form obtained from a post office. This requires the data user to give: a description of the personal data it holds and the purposes for which the data is held; a description of the sources from which it intends or may wish to obtain the data or the information to be contained in the data; a description of any persons to whom it intends or may wish to disclose the data; the names or a description of any countries or territories outside the UK to which it intends or may wish directly or indirectly to transfer the data; and one or more addresses for the receipt of requests from data subjects for access to the data.

A data user who fails to register is guilty of the offence of failing to register. A data user is not entitled to process personal data after registration except in accordance with the terms of its registration. The Registrar is entitled to strike a data user off the register. In practice, however, he must indicate specific requirements to a data user: failure to comply with these will lead to an enforcement notice requiring the data user to take particular steps within a time limit to comply with the data protection principles (see above). Only as a last resort will the Registrar issue a deregistration notice.

An individual is entitled to compensation from a data user for any damage or distress suffered because of the loss, damage, destruction, disclosure, or access to his personal data, provided the damage has been suffered after 12 September 1984. It is a defence to an action of this kind if the data user can prove that he had taken all reasonable care to prevent the damage or distress. This is in effect a right of action for damages caused by inadequate computer security.

An individual is entitled to be informed by any data user whether he holds personal data of which that individual is the subject. He is also entitled to obtain a printout from a registered data user of any personal data held by him and to demand that any inaccurate or misleading information is corrected or erased. If a court is satisfied on the application of a data subject that personal data held by a data user concerning him is inaccurate it may order the rectification or erasure of the data. Additionally it may order the rectification or erasure of any data held by the data user that contains an expression of opinion that appears to the court to be based on the inaccurate data. In certain circumstances, however, it may allow the data user to supplement the data by a statement of true facts as approved by the court.

It is now possible for a person to apply for and, on payment of a fee, obtain copies of any criminal convictions recorded against him on the UK Police National Computer. Standard forms are available to do this from Scotland Yard.