Data Protection Act

Every time consumers respond to an offer in a magazine, use a loyalty card, surf the internet, or obtain government services electronically, they are laying down a trail of information that can be sold to others, or used for marketing.

Why does data protection matter?

Personal information is one of the most valuable commodities in society today. Government and public service providers gather a wealth of information from taxpayers, car owners, benefit recipients, patients, clients, customers and voters. Businesses, too, are intent on developing ever more sophisticated ways of capturing and using data about individuals.

Consumers have much to gain from these developments. But whenever personal data is collected and stored, it may also be abused. Wrong information may be passed on to third parties, privacy invaded, or individuals besieged by marketers. Trust is hard-won and necessarily fragile. If the information age is to develop on secure foundations, it is vital that those who collect and use personal data maintain the confidence of those who are asked to provide it.

What legislation exists to protect consumers?

In July 1998, a new Data Protection Act replaced the 1984 Act. It covers most information held in written files, as well as on computer.

Eight principles

There are eight data protection principles in the Act that define the duties of people who collect and provide personal data. Data controllers make decisions about what data is held, how and why it is held and who has access to it. Those who act on behalf of data controllers are called data processors. Data controllers and data processors can be an individual, a group of individuals or organisation depending on its size. The principles also define the rights of people who own the information about themselves — data subjects.

The principles dictate that:

•  personal data must be processed fairly and lawfully, and usually only with the subject's consent.
•  Consent should be given freely if pertinent information is insufficient and not while under duress
•  data should only be processed for specified and lawful purposes
•  data must not be excessive to the purpose(s) for which it is processed
•  data must be accurate and kept up to date
•  data must not be kept longer than the purpose requires;
•  the data subject's rights must be protected (these rights are detailed within sections 7 to
   14 of the Act)
•  data must be safeguarded against misuse or accidental loss
•  data must not be transferred outside the European Economic Area without the assurance
   of adequate protection (this issue has led to the 'safe harbour' agreement).