THE UNITED KINGDOM DATA PROTECTION LEGAL FRAMEWORK – PART 2

1.0              The DPA 1998 sets out a clear framework on how those dealing with data may treat personal data.

2.0               The Act allows the data subject, to assert greater control over how his personal information is gathered, used, housed and shared by providing for a number of rights and remedies which are easily applicable. In addition to actively promoting security and privacy of information in general, the Information Commissioner is the supervisory authority of the DPA 1998 and the Freedom of Information Act, 2000.[1]

3.0              The drafters in producing the Eight Principles in Schedule 2 to the DPA 1998, reproduced the obligations in Article 6, Article 8 (sensitive personal data), Article 10 and 11 (information to data subjects), Article 12 to Article 15 (rights of data subjects), Article 17 (process personal data securely) and Article 25 (overseas transfers) of the EU Directive.[2]

4.0              The Principles[3] are, firstly, personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 5 is also met.

5.0              Secondly, personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

6.0               Thirdly, personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

7.0              Fourthly, personal data shall be accurate and, where necessary, kept up to date.

8.0              Fifthly, personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

9.0              Sixthly, personal data shall be processed in accordance with the rights of data subjects under this Act.

10.0          Seventhly, appropriate technical and organizational measures shall be taken against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

11.0          Finally, personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

12.0          Section 4(4) provides that it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.


[1]               The Joint Information Committee, "The General Issues of Data Protection " (2006),online,accessed on  April 3rd 2006,available at http://www.jisc.ac.uk/uploaded-document.
[2]               Peter Carey,Data Protection: A Practical Guide to UK and EU Law, 2nd ed., (Oxford University Press Oxford 2004),p.3.
[3]              Part 1 of Schedule 1of the Data protection Act, 1998.

Comments

Popular posts from this blog

ETHICAL DUTIES & RESPONSIBILITIES OF LAWYERS

REMOTE SENSING

UiTM bids for World Universities Debating Championship (WUDC) 2015