Data Protection Act 1998 - Legislation.gov.uk

1 data ProtectionAct 1998 CHAPTER 29 First Published 1998 Published by TSO (The Stationery Office) and available , Telephone, Fax & E-mailTSOPO Box 29, Norwich NR3 1 GNTelephone orders/General enquiries 0870 600 5522 Fax orders 0870 600 5533 Order through the Parliamentary HotlineLo-call0845 7 023474 Email 0870 240 3701 TSO Shops123 Kingsway, London WC2B 6PQ020 7242 6393 Fax 020 7242 639468 69 Bull Street, Birmingham B4 6AD0121 236 9696 Fax 0121 236 96999 21 Princess Street, Manchester M60 8AS0161 834 7201 Fax 0161 833 063416 Arthur Street, Belfast BT1 4GD028 9023 8451 Fax 028 9023 540118 19 High Street, Cardiff CF10 1PT029 2039 5548 Fax 029 2038 434771 Lothian Road.

2 Edinburgh EH3 9AZ0870 606 5566 Fax 0870 606 5588 The Parliamentary Bookshop12 Bridge Street, Parliament Square,London SW1A 2 JXTelephone orders/General enquiries 020 7219 3890 Fax orders 020 7219 3866 Accredited Agents(see Yellow Pages)andthroughgoodbooksellersISBN 0-10-542998-89 780105 429982 Reprinted Incorporating Corrections 200501-05-99 04:05:08ch2998A00 AACTA Unit: pagaCh 29, 1998 , Vellum, Protection Act 1998 CHAPTER 29 ARRANGEMENT OF SECTIONSPartIPreliminarySection1. Basic interpretative Sensitive personal The special The data Protection Application of The Commissioner and the Right of access to personal Provisions supplementary to section Application of section 7 where data controller is credit Right to prevent processing likely to cause damage or Right to prevent processing for purposes of direct Rights in relation to automated Compensation for failure to comply with certain Rectification, blocking.

3 Erasure and Jurisdiction and Prohibition on processing without Notification by data Register of Duty to notify Preliminary assessment by Power to make provision for appointment of data 04:05:08ch2998a01aACTA Unit: pagaCh 29, 1998 , Vellum, Protection Act 1998 Section24. Duty of certain data controllers to make certain Functions of Commissioner in relation to making of Fees National Crime and Health, education and social Regulatory Journalism, literature and Research, history and information available to the public by or under Disclosures required by law or made in connection with legalproceedings Domestic Miscellaneous Powers to make further exemptions by Transitional Enforcement Cancellation of enforcement Request for information Special information Determination by Commissioner as to the special Restriction on enforcement in case of processing for the Failure to comply with Rights of Determination of Powers of entry and of Commissioner51.

4 General duties of Reports and codes of practice to be laid before Assistance by Commissioner in cases involving processing for thespecial International 04:05:08ch2998a01aACTA Unit: pagaCh 29, 1998 , Vellum, Protection Act 1998 Unlawful obtaining etc. of personal dataSection55. Unlawful obtaining etc. of personal obtained under data subject s right of access56. Prohibition of requirement as to production of certain Avoidance of certain contractual terms relating to health provided to Commissioner or Tribunal58. Disclosure of Confidentiality of provisions relating to offences60. Prosecutions and Liability of directors of Consumer Credit Act 197462.

5 Amendments of Consumer Credit Act Application to Transmission of notices etc. by electronic or other Service of notices by Exercise of rights in Scotland by Orders, regulations and Meaning of accessible record .69. Meaning of health professional .70. Supplementary Index of defined Modifications of Transitional provisions and Minor and consequential amendments and repeals Short title, commencement and :Schedule 1 The data Protection I The II Interpretation of the principles in Part 2 Conditions relevant for purposes of the firstprinciple: processing of any personal 3 Conditions relevant for purposes of the firstprinciple: processing of sensitive personal 4 Cases where the eighth principle does not 5 The data Protection Commissioner and the DataProtection I The II The III Transitional 6 Appeal 7 Miscellaneous 8 Transitional 04:05.

6 09ch2998a01aACTA Unit: pagaCh 29, 1998 , Vellum, Protection Act 1998 Part I Interpretation of II Exemptions available before 24th October III Exemptions available after 23rd October 2001 butbefore 24th October IV Exemptions after 23rd October 2001 for V Exemption from section 9 Powers of entry and 10 Further provisions relating to assistance undersection 11 Educational 12 Accessible public 13 Modifications of Act having effect before 24thOctober 14 Transitional provisions and 15 Minor and consequential 16 Repeals and I II 01:35:45ch0029c06aACT Unit: pag1Ch 29, 1998 , Vellum, Protection Act 19981998 CHAPTER 29An Act to make new provision for the regulation of the processingof information relating to individuals, including the obtaining,holding, use or disclosure of such information .

7 [16th July 1998 ]Beitenactedby the Queen s most Excellent Majesty, by and withthe advice and consent of the Lords Spiritual and Temporal, andCommons, in this present Parliament assembled, and by theauthority of the same, as follows: PartIPreliminary1. (1) In this Act, unless the context otherwise requires Basicinterpretative data means information which provisions.(a) is being processed by means of equipment operatingautomatically in response to instructions given for thatpurpose,(b) is recorded with the intention that it should beprocessed by means of such equipment,(c) is recorded as part of a relevant filing system or with theintention that it should form part of a relevant filingsystem, or(d) does not fall within paragraph (a), (b) or (c) but formspart of an accessible record as defined by section 68.

8 data controller means, subject to subsection (4), a person who(either alone or jointly or in common with other persons)determines the purposes for which and the manner in which anypersonal data are, or are to be, processed; data processor , in relation to personal data , means any person(other than an employee of the data controller) who processesthe data on behalf of the data controller; data subject means an individual who is the subject of personaldata;22-10-98 01:35:45ch0029c06aACT Unit: pag1Ch 29, 1998 , Vellum, Protection Act 1998 PartI personal data means data which relate to a living individual whocan be identified (a) from those data , or(b) from those data and other information which is in thepossession of, or is likely to come into the possession of, thedata controller,and includes any expression of opinion about the individual andany indication of the intentions of the data controller or anyother person in respect of the individual.

9 Processing , in relation to information or data , means obtaining,recording or holding the information or data or carrying outany operation or set of operations on the information or data ,including (a) organisation, adaptation or alteration of theinformation or data ,(b) retrieval, consultation or use of the information ordata,(c) disclosure of the information or data by transmission,dissemination or otherwise making available, or(d) alignment, combination, blocking, erasure ordestruction of the information or data ; relevant filing system means any set of information relating toindividuals to the extent that, although the information is notprocessed by means of equipment operating automatically inresponse to instructions given for that purpose, the set isstructured, either by reference to individuals or by reference tocriteria relating to individuals, in such a way that specificinformation relating to a particular individual is readilyaccessible.

10 (2) In this Act, unless the context otherwise requires (a) obtaining or recording , in relation to personal data ,includes obtaining or recording the information to be containedin the data , and(b) using or disclosing , in relation to personal data , includesusing or disclosing the information contained in the data .(3) In determining for the purposes of this Act whether anyinformation is recorded with the intention (a) that it should be processed by means of equipment operatingautomatically in response to instructions given for thatpurpose, or(b) that it should form part of a relevant filing system,it is immaterial that it is intended to be so processed or to form part ofsuch a system only after being transferred to a country or territory outsidethe European Economic Area.