Law Books
Adverts from Google:
|
Home |
lawindexpro |
law-bytes |
law-index |
statutes |
Law Books |
Discuss Law |
lip-cases |
Contact Us
|
|
|||
Data Protection Act 1984 (Ch 34)
Search lawindexpro for case law on this statute.
This document is for private study purposes only. It is likely not to reflect the law as it stands today. It may be incomplete, and some provisions are likely to have been repealed or amended, and new ones inserted.
PART II
PART III
RIGHTS OF DATA SUBJECTS 21.---
Right of access to personal data
21.--(1) Subject to the provisions of this section, an individual shall be entitled
(a) to be informed by any data user whether the data held by him include personal data of which that individual is the data subject and
(b) to be supplied by any data user with a copy of the information constituting any such personal data held by him;
and where any of the information referred to in paragraph (b) above is expressed in terms which are not intelligible without explanation the information shall be accompanied by an explanation of those terms.
(2) A data user shall not be obliged to supply any information under subsections (1) above except in response to a request in writing and on payment of such fee (not exceeding the prescribed maximum) as he may require but a request for information under both paragraphs of that subsection shall be treated as a single request and a request for information under paragraph (a) shall, in the absence of any indication to the contrary, be treated as extending also to information under paragraph (b).
(3) In the case of a data user having separate entries in the register in respect of data held for different purposes a separate request must be made and a separate fee paid under this section in respect of the data to which each entry relates.
(4) A data user shall not be obliged to comply with a request under this section--
(a) unless he is supplied with such information as he may reasonably require in order to satisfy himself as to the identity of the person making the request and to locate the information which he seeks and
(b) if he cannot comply with the request without disclosing information relating to another individual who can be identified from that information, unless he is satisfied that the other individual has consented to the disclosure of the information to the person making the request.
(5) In paragraph (b) of subsection (4) above the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that paragraph shall not be construed as excusing a data user from supplying so much of the information sought by the request as can be supplied without disclosing the identity of the other individual concerned whether by the omission of names or other identifying particulars or otherwise.
(6) A data user shall comply with a request under this section within forty days of receiving the request or, if later, receiving the information referred to in paragraph (a) of subsection (4) above and, in a case where it is required, the consent referred to in paragraph (b) of that subsection.
(7) The information to be supplied pursuant to a request under this section shall be supplied by reference to the data in question at the time when the request is received except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.
(8) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data user in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request but a court shall not make an order under this subsection if it considers that it would in all the circumstances be unreasonable to do so, whether because of the frequency With which the applicant has made requests to the data user under those provisions or for any other reason.
(9) The Secretary of State may by order provide for enabling a request under this section to be made on behalf of any individual who is incapable by reason of mental disorder of managing his own affairs.
Compensation for inaccuracy
22.--(1) An individual who is the subject of personal data held by a data user and who suffers damage by reason of the inaccuracy of the data shall be entitled to compensation from the data user for that damage and for any distress which the individual has suffered by reason of the inaccuracy.
(2) In the case of data which accurately record information received or obtained by the data user from the data subject or a third party, subsection (1) above does not apply if the following requirements have been complied with---
(a) the data indicate that the information was received or obtained as aforesaid or the information has not been extracted from the data except in a form which includes an indication to that effect and
(b) if the data subject has notified the data user that he regards the information as incorrect or misleading, an indication to that effect has been included in the data or the information has not been extracted from the data except in a form which includes an indication to that effect.
(3) In proceedings brought against any person by virtue of this section it shall is a defence to prove that he had taken such care as in all the circumstances was reasonably required to ensure the accuracy of the data at the material time.
(4) Data are inaccurate for the purposes of this section if incorrect or misleading as to any matter of fact.
Compensation for loss or unauthorised disclosure
23.--(1) An individual who is the subject of personal data held by a data user or in respect of which services are provided by a person carrying on a computer bureau and who suffers damage by reason of--
(a) the loss of the data
(b) the destruction of the data without the authority of the data user or, as the case may be, of the person carrying on the bureau or
(c) subject to subsection (2) below, the disclosure of the data, or access having been obtained to the data, without such authority as aforesaid,
shall be entitled to compensation from the data user or, as the case may be, the person carrying on the bureau for that damage and for any distress which the individual has suffered by reason of the loss, destruction, disclosure or access.
(2) In the case of a registered data user, subsection (l)(c) above does not apply to disclosure to, or access by, any person falling within a description specified pursuant to section 4(3)(d) above in an entry in the register relating to that data user.
(3) In proceedings brought against any person by virtue of this section it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to prevent the loss, destruction, disclosure or access in question.
Rectification and erasure
24.---(1) If a court is satisfied on the application of a data subject that personal data held by a data user of which the applicant is the subject are inaccurate within the meaning of section 22 above, the court may order the rectification or erasure of the data and of any data held by the data user and containing an expression of opinion which appears to the court to be based on the inaccurate data.
(2) Subsection (1) above applies whether or not the data accurately record information received or obtained by the data user from the data subject or a third party but where the data accurately record such information, then--
(a) if the requirements mentioned in section 22(2) above have been complied with, the court may, instead of making an order under subsection (1) above, make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve and
(b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a) above.
(3) If a court is satisfied on the application of a data subject--
(a) that he has suffered damage by reason of the disclosure of personal data, or of access having been obtained to personal data, in circumstances entitling him to compensation under section 23 above and
(b) that there is a substantial risk of further disclosure of or access to the data without such authority as is mentioned in that section,
the court may order the erasure of the data; but, in the case of data in respect of which services were being provided by a person carrying on a computer bureau, the court shall not make such an order unless such steps as are reasonably practicable have been taken for notifying the person for whom those services were provided and giving him an opportunity to be heard .
Jurisdiction and procedure
25.--(1) The jurisdiction conferred by sections 21 and 24 above shall be exercisable by the high Court or a county court or, in Scotland, by the Court of Session or the sheriff.
(2) For the purpose of determining any question whether an applicant under subsection (8) of section 21 above is entitled to the information which he seeks (including any questions whether any relevant data are exempt from that section by virtue of Part IV of this Act) a court may require the information constituting any data held by the data user to be made available for its own inspection but shall not, pending the determination of that question in the applicants favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise.
PART IV
EXEMPTIONS
Preliminary
26.---(1) References in any provision of Part II or III of this Act to personal data do not include references to data which by virtue of this Part of this Act are exempt from that provision.
(2) In this Part of this Act the subject access provisions means
(a) section 21 above and
(b) any provision of Part II of this Act conferring a power on the Registrar to the extent to which it is exercisable by reference to paragraph (a) of the seventh data protection principle.
(3) In this Part of this Act "the non-disclosure provisions" means--
(a) sections 5(2)(d) and 15 above and
(b) any provision of Part II of this Act conferring a power on the Registrar to the extent to which it is exercisable by reference to any data protection principle inconsistent with the disclosure in question.
(4) Except as provided by this Part of this Act the subject access provisions shall apply notwithstanding any enactment or rule of law prohibiting or restricting the disclosure, or authorising the withholding, of information.
National security
27.---(1) Personal data are exempt from the provisions of Part II of this Act and of sections 21 to 24 above if the exemption is required for the purpose of safeguarding national security.
(2) Any question whether the exemption mentioned in subsection (1) above is or at any time was required for the purpose there mentioned in respect of any personal data shall be determined by a Minister of the Crown and a certificate signed by a Minister of the Crown certifying that the exemption is or at any time was so required shall be conclusive evidence of that fact.
(3) Personal data which are not exempt under subsection (1) above are exempt from the non-disclosure provisions in any case in which the disclosure of the data is for the purpose of safeguarding national security.
(4) For the purposes of subsection (3) above a certificate signed by a Minister of the Crown certifying that personal data are or have been disclosed for the purpose mentioned in that subsection shall be conclusive evidence of that fact.
(5) A document purporting to be such a certificate as is mentioned in this section shall be received in evidence and deemed to be such a certificate unless the contrary is proved.
(6) The powers conferred by this section on a Minister of the Crown shall not be exercisable except by a Minister who is a member of the Cabinet or by the Attorney General or the Lord Advocate.
Crime and taxation
28.--(1) Personal data held for any of the following purposes--
(a) the prevention or detection of crime
(b) the apprehension or prosecution or offenders; or
(c) the assessment or collection of any tax or duty,
are exempt from the subject access provisions in any case in which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection.
(2) Personal data which--
(a) are held for the purpose of discharging statutory functions; and
(b) consist of information obtained for such a purpose from a person who had it in his possession for any of the purposes mentioned in subsection (1) above,
are exempt from the subject access provisions to the same extent as personal data held for any of the purposes mentioned in that subsection.
(3) Personal data are exempt from the non-disclosure provisions in any case in which--
(a) the disclosure is for any of the purposes mentioned in subsection (1) above and
(b) the application of those provisions in relation to the disclosure would be likely to prejudice any of the matters mentioned in that subsection
and in proceedings against any person for contravening a provision mentioned in section 26(3)(a) above or for an offence under section 5(6) above +94] it shall be defence to prove that he had reasonable grounds for believing that failure to make or (in the case of section 5(6)) to procure +94] the disclosure in question would have been likely to prejudice any of those matters.
(4) Personal data are exempt from the provisions of Part II of this Act conferring powers on the Registrar, to the extent to which they are exercisable by reference to the first data protection principle, in any case in which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in subsection (1) above.
Health and social work
29.--(1) The Secretary of State may by order exempt from the subject access provisions, or modify those provisions in relation to, personal data consisting of information as to the physical or mental health of the data subject.
(2) The Secretary of State may by order exempt from the subject access provisions, of modify those provisions in relation to, personal data of such other descriptions as may be specified in the order, being information--
(a) held by government departments or local authorities or by voluntary organisation or other bodies designated by or under the order; and
(b) appearing to him to be held for, or acquired in the course of, carrying out social work in relation to the data subject or other individuals;
but the Secretary of State shall not under this subsection confer any exemption or make any modification except so far as he considers that the applications to the data of those provisions (or of those provisions without modification) would be likely to prejudice the carrying out of social work.
(3) All order under this section may make different provision in relation to data consisting of information of different descriptions.
Regulation of financial services
30.- (1) Personal held for the purpose of discharging statutory functions to which this section applies are exempt from the subject access provisions in any case in which the application of those provisions to the data would be likely to prejudice the proper discharge of those functions
(2) This section applies to any functions designated for the purposes of this section by an order made the Secretary of State, being functions conferred by or under any enactment appearing to him to be designed for protecting members of the public against financial loss due to dishonesty, incompetence or malpractice by persons concerned in the provision of banking, insurance investment or other financial services or in the management of companies or to the conduct of discharged or undischarged bankrupts.
Judicial appointments and legal professional privilege
31.--(1) Personal data held by a government department are exempt from the subject access provisions if the data consist of information which has been received from a third party and is held as information relevant to the making of judicial appointments.
(2) Personal data are exempt from the subject access provisions if the data consist of information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality as between client and professional legal adviser) could be maintained in legal proceedings.
Payrolls and accounts
32.--(1) Subject to subsection (2) below, personal data held by a data user only for one or more of the following purposes
(a) calculating amounts payable by way of remuneration or pensions in respect of service in any employment or office or making payments of, or of sums deducted from, such remuneration or pensions or
(b) keeping accounts relating to any business or other activity carried on by the data user or keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments are made by or to him in respect of those transactions or for the purpose of making financial or management forecasts to assist him in the conduct of any such business or activity,
are exempt from the provisions of Part II of this Act and of sections 21 to 24 above.
(2) it shall be a condition of the exemption of any data under this section that the data are not used for any purpose other than the purpose or purposes for which they are held and are not disclosed except as permitted by subsections (3) and (4) below: but the exemption shall not be lost by any use or disclosure in breach of that condition if the data user shows that he had taken such care to prevent it as in all the circumstances was reasonably required.
(3) Data held only for one or more of the purposes mentioned in subsection (1)(a) above may be disclosed
(a) to any person, other than the data user, by whom the remuneration or pensions in question are payable
(b) for the purpose of obtaining actuarial advice
(c) for the purpose of giving information as to the persons in any employment or office for use in medical research into the health of, or injuries suffered by, persons engaged in particular occupations or working in particular places or areas
(d) if the data subject (or a person acting on his behalf) has requested or consented to the disclosure of the data either generally or in the circumstances in which the disclosure in question is made or
(e) if the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (d) above.
(4) Data held for any of the purposes mentioned in subsection (1) above may be disclosed--
(a) for the purpose of audit or where the disclosure is for the purpose only of giving information about the data user's financial affairs or
(b) in any case m which disclosure would be permitted by any other provision of this Part of this Act if subsection (2) above were included among the non-disclosure provisions.
(5) In this section "remuneration" includes remuneration in kind and pensions includes gratuities or similar benefits.
Domestic or other limited purposes
33.--(1) Personal data held by an individual and concerned only with the management of his personal, family or household affairs or held by him only for recreational purposes are exempt from the provisions of Part II of this Act and of sections 21 to 24 above.
(2) Subject to subsection (3) and (4) below
(a) personal data held by an unincorporated members club and relating only to the members of the club and
(b) personal data held by a data user only for the purpose of distributing, or recording the distribution of, articles or information to the data subjects and consisting only of their names, addresses or other particulars necessary for effecting the distribution,
are exempt from the provisions of Part II of this Act and of sections 21 to 24 above.
(3) Neither paragraph (a) nor paragraph (b) of subsection (2) above applies to personal data relating to any data subject unless he has been asked by the club or data user whether he objects to the data relating to him being held as mentioned in that paragraph and has not objected.
(4) It shall be a condition of the exemption of any data under paragraph (b) of subsection (2) above that the data are not used for any purpose other than that for which they are held and of the exemption of any data under either paragraph of that subsection that the data are not disclosed except as permitted by subsection (5) below but the first exemption shall not be lost by any use, and neither exemption shall be lost by any disclosure, in breach of that condition if the data user shows that he had taken such care to prevent it as in all the circumstances was reasonably required.
(5) Data to which subsection (4) above applies may be disclosed
(a) if the data subject (or a person acting on his behalf) has requested or consented to the disclosure of the data either generally or in the circumstances in which the disclosure in question is made
(b) if the person makings the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (a) above: or
(c) in any case in which disclosure would be permitted by any other provision of this Part of this Act if subsection (4) above were included among the non-disclosure provisions.
(6) Personal data held only for--
(a) preparing statistics; or
(b) carrying out research,
are exempt from the subject access provisions but it shall be a condition of that exemption that the data are not used or disclosed for any other purpose and theft the resulting statistics or the results of the research are not made available in a form which identifies the data subjects or any of them .
Other exemptions
34.--(1 ) Personal data held by any person are exempt from the provisions of Part Il of this Act and of sections 21 to 24 above if the data consist of information which that person is required by or under any enactment to make available to the public, whether by publishing it, makings it available for inspection or otherwise and whether gratuitously or on payment of a fee.
(2) The Secretary of State may by order exempt from the subject access provisions personal data consisting of information the disclosure of which is prohibited or restricted by or under any enactment if he considers that the prohibition or restriction ought to prevail over those provisions in the interests of the data subject or of any other individual.
(3) Where all the personal data relating to a data subject held by a data user (or all such data in respect of which a data user has a separate entry in the register) consist of information in respect of which the data subject is entitled to make a request to the data user under section 158 of the Consumer Credit Act 1974 (files of credit reference agencies)--
(a) the data are exempt from the subject access provisions and
(b) any request in respect of the data under section 21 above shall be treated for all purposes as if it were a request under the said section 158.
(4) Personal data are exempt from the subject access provisions if the data are kept only for the purpose of replacing other data in the event of the latter being lost, destroyed or impaired.
(5) Personal data are exempt from the non-disclosure provisions in any case in which the disclosure is
(a) required by or under any enactment, by any rule of law or by the order of a court or
(b) made for the purpose of obtaining legal advice or for the purposes of, or in the course of, legal proceedings in which the person making the disclosure is a party or a witness.
(6) Personal data are exempt from the non-disclosure provisions in any case in which
(a) the disclosure is to the data subject or a person acting on his behalf or
(b) the data subject or any such person has requested or consented to the particular disclosure in question or
(c) the disclosure is by a data user or a person carrying on a computer bureau to his servant or agent for the purpose of enabling the servant or agent to perform his function as such or
(d) the person making the disclosure has reasonable grounds for believing that the disclosure falls within any of the foregoing paragraphs of this subsection.
(7) Section 4(3)(d) above does not apply to any disclosure falling within paragraph (a), (b) or (c) of subsection (6) above and that subsection shall apply to the restriction on disclosure in section 33(6) above as it applies to the non-disclosure provisions.
(8) Personal data are exempt from the non-disclosure provisions in any case in which the disclosure is urgently required for preventing injury or other damage to the health of any person or persons and in proceedings against any person for contravening a provision mentioned in section 26(3)(a) above it shall be a defence to prove that he had reasonable grounds for believing that the disclosure in question was urgently required for that purpose.
(9) A person need not comply with a notice, request or order under the subject access provisions if compliance would expose him to proceedings for any offence other than an offence under this Act and information disclosed by any person in compliance with such a notice, request or order shall not be admissible against him in proceedings for an offence under this Act.
Examination marks.
35.--(1) Section 21 above shall have effect subject to the provisions of this section in the case of personal data consisting of marks or other information held by a data user--
(a) for the purpose of determining the results of an academic, professional or other examination or of enabling the results of any such examination to be determined; or
(b) in consequence of the determination of any such results.
(2) Where the period mentioned in subsection (6) of section 21 begins before the results of the examination are announced that period shall be extended until--
(a) the end of five months from the beginning of that period; or
(b) the end of forty days after the date of the announcement,
whichever is the earlier.
(3) Where by virtue of subsection (2) above a request is complied with more than forty days after the beginning of the period mentioned in subsection (6) of section 21, the information to be supplied pursuant to the request shall be supplied both by reference to the data in question at the time when the request is received and (if different) by reference to the data as from time to time held in the period beginning when the request is received and ending when it is complied with.
(4) For the purposes of this section the results of an examination shall be treated as announced when they are first published or (if not published) when they are first made available or communicated to the candidate in question.
(5) In this section "examination" includes any process for determining the knowledge, intelligence, skill or ability of a candidate by reference to his performance in any test, work or other activity.
Part V
General
General duties of Registrar.
36.--(1) It shall be the duty of the Registrar so to perform his functions under this Act as to promote the observance of the data protection principles by data users and persons carrying on computer bureaux.
(2) The Registrar may consider any complaint that any of the data protection principles or any provision of this Act has been or is being contravened and shall do so if the complaint appears to him to raise a matter of substance and to have been made without undue delay by a person directly affected; and where the Registrar considers any such complaint he shall notify the complainant of the result of his consideration and of any action which he proposes to take.
(3) The Registrar shall arrange for the dissemination in such form and manner as he considers appropriate of such information as it may appear to him expedient to give to the public about the operation of this Act and other matters within the scope of his functions under this Act and may give advice to any person as to any of those matters.
(4) It shall be the duty of the Registrar, where he considers it appropriate to do so, to encourage trade associations or other bodies representing data users to prepare, and to disseminate to their members, codes of practice for guidance in complying with the data protection principles.
(5) The Registrar shall annually lay before each House of Parliament a general report on the performance of his functions under this Act and may from time to time lay before each House of Parliament such other reports with respect to those functions as he thinks fit.
Co-operation between parties to Convention.
37.-- The Registrar shall be the designated authority in the United Kingdom for the purposes of Article 13 of the European Convention; and the Secretary of State may by order make provision as to the functions to be discharged by the Registrar in that capacity.
Application to government departments and police.
38.--(1) Except as provided in subsection (2) below, a government department shall be subject to the same obligations and liabilities under this Act as a private person; and for the purposes of this Act each government department shall be treated as a person separate from any other government department and a person in the public service of the Crown shall be treated as a servant of the government department to which his responsibilities or duties relate.
(2) A government department shall not be liable to prosecution under this Act but--
(a) sections 5(3) and 15(2) above (and, so far as relating to those provisions, sections 5(5) and 15(3) above) shall apply to any person who by virtue of this section falls to be treated as a servant of the government department in question; and
(b) section 6 (6) above and paragraph 12 of Schedule 4 to this Act shall apply to a person in the public service of the Crown as they apply to any other person.
(3) For the purposes of this Act--
(a) the constables under the direction and control of a chief officer of police shall be treated as his servants; and
(b) the members of any body of constables maintained otherwise than by a police authority shall be treated as the servants--
(i) of the authority or person by whom that body is maintained, and
(ii) in the case of any members of such a body who are under the direction and control of a chief officer, of that officer.
(4) In the application of subsection (3) above to Scotland, for the reference to a chief officer of police there shall be substituted a reference to a chief constable.
(5) In the application of subsection (3) above to Northern Ireland, for the reference to a chief officer of police there shall be substituted a reference to the Chief Constable of the Royal Ulster Constabulary and for the reference to a police authority there shall be substituted a reference to the Police Authority for Northern Ireland.
Data held, and services provided, outside the United Kingdom.
39.--(1) Subject to the following provisions of this section, this Act does not apply to a data user in respect of data held, or to a person carrying on a computer bureau in respect of services provided, outside the United Kingdom.
(2) For the purposes of subsection (1) above--
(a) data shall be treated as held where the data user exercies the control referred to in subsection (5)(b) of section 1 above in relation to the data; and
(b) services shall be treated as provided where the person carrying on the computer bureau does any of the things referred to in subsection (6) (a) or (b) of that section.
(3) Where a person who is not resident in the United Kingdom--
(a) exercises the control mentioned in paragraph (a) of subsection (2) above; or
(b) does any of the things mentioned in paragraph (b) of that subsection,
through a servant or agent in the United Kingdom, this Act shall apply as if that control were exercised or, as the case may be, those things were done in the United Kingdom by the servant or agent acting on his own account and not on behalf of the person whose servant or agent he is.
(4) Where by virtue of subsection (3) above a servant or agent is treated as a data user or as a person carrying on a computer bureau he may be described for the purposes of registration by the position or office which he holds; and any such description in an entry in the register shall be treated as applying to the person for the time being holding the position or office in question.
(5) This Act does not apply to data processed wholly outside the United Kingdom unless the data are used or intended to be used in the United Kingdom.
(6) Sections 4(3)(e) and 5(2)(e) and subsection (1) of section 12 above do not apply to the transfer of data which are already outside the United Kingdom; but references in the said section 12 to a contravention of the data protection principles include references to anything that would constitute such contravention if it occurred in relation to the data when held in the United Kingdom.
Regulations, rules and orders.
40.--(1) Any power conferred by this Act to make regulations, rules or orders shall be exercisable by statutory instrument.
(2) Without prejudice to sections 2(6) and 29(3) above, regulations, rules or orders under this Act may make different provision for different cases or circumstances.
(3) Before making an order under any of the foregoing provisions of this Act the Secretary of State shall consult the Registrar.
(4) No order shall be made under section 2(3), 4(8), 29, 30 or 34(2) above unless a draft of the order has been laid before and approved by a resolution of each House of Parliament.
(5) A statutory instrument containing an order under section 21 (9) or 37 above or rules under paragraph 4 of Schedule 3 to this Act shall be subject to annulment in pursuance of a resolution of either House of Parliament.
(6) Regulations prescribing fees for the purposes of any provision of this Act or the period mentioned in section 8(2) above shall be laid before Parliament after being made.
(7) Regulations prescribing fees payable to the Registrar under this Act or the period mentioned in section 8 (2) above shall be made after consultation with the Registrar and with the approval of the Treasury; and in making any such regulations the Secretary of State shall have regard to the desirability of securing that those fees are sufficient to offset the expenses incurred by the Registrar and the Tribunal in discharging their functions under this Act and any expenses of the Secretary of State in respect of the Tribunal.
General interpretation.
41. In addition to the provisions of sections 1 and 2 above, the following provisions shall have effect for the interpretation of this Act--
"business" includes any trade or profession;
"data equipment" means equipment for the automatic processing of data or for recording information so that it can be automatically processed;
"data material" means any document or other material used in connection with data equipment;
"a de-registration notice" means a notice under section 11 above;
"enactment" includes an enactment passed after this Act;
"an enforcement notice" means a notice under section 10 above;
"the European Convention" means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28th January 1981;
"government department" includes a Northern Ireland department and any body or authority exercising statutory functions on behalf of the Crown;
"prescribed" means prescribed by regulations made by the Secretary of State;
"the Registrar" means the Data Protection Registrar;
"the register", except where the reference is to the register of companies, means the register maintained under section 4 above and (except where the reference is to a registered company, to the registered office of a company or to registered post) references to registration shall be construed accordingly;
"registered company" means a company registered under the enactments relating to companies for the time being in force in any part of the United Kingdom;
"a transfer prohibition notice" means a notice under section 12 above;
"the Tribunal" means the Data Protection Tribunal.
Commencement and transitional provisions.
42.--(1) No application for registration shall be made until such day as the Secretary of State may by order appoint, and sections 5 and 15 above shall not apply until the end of the period of six months beginning with that day.
(2) Until the end of the period of two years beginning with the day appointed under subsection (1) above the Registrar shall not have power--
(a) to refuse an application made in accordance with section 6 above except on the ground mentioned in section 7(2)(a) above; or
(b) to serve an enforcement notice imposing requirements to be complied with, a de-registration notice expiring, or a transfer prohibition notice imposing a prohibition taking effect, before the end of that period.
(3) Where the Registrar proposes to serve any person with an enforcement notice before the end of the period mentioned in subsection (2) above he shall, in determining the time by which the requirements of the notice are to be compiled with, have regard to the probable cost to that person of complying with those requirements.
(4) Section 21 above and paragraph 1 (b) of Schedule 4 to this Act shall not apply until the end of the period mentioned in subsection (2) above.
(5) Section 22 above shall not apply to damage suffered before the end of the period mentioned in subsection (1) above and in deciding whether to refuse an application or serve a notice under Part II of this Act the Registrar shall treat the provision about accuracy in the fifth data protection principle as inapplicable until the end of that period and as inapplicable thereafter to data shown to have been held by the data user in question since before the end of that period.
(6) Sections 23 and 24(3) above shall not apply to damage suffered before the end of the period of two months beginning with the date on which this Act is passed.
(7) Section 24 (1) and (2) above shall not apply before the end of the period mentioned in subsection (1) above.
Short title and extent.
43.--(1) This Act may be cited as the Data Protection Act 1984.
(2) This Act extends to Northern Ireland.
(3) Her Majesty may by Order in Council direct that this Act shall extend to any of the Channel Islands with such exceptions and modifications as may be specified in the Order.
SCHEDULES
Section 2(1) Schedule 1
THE DATA PROTECTION PRINCIPLES
THE PRINCIPLES
Personal data held by data users
1. The information to be contained in personal data shall be obtained, and personal data shall be processed, fairly and lawfully.
2. Personal data shall be held only for one or more specified and lawful purposes.
3. Personal data held for any purpose or purposes shall not be used or disclosed in any manner incompatible with that purpose or those purposes.
4. Personal data held for any purpose or purposes shall be adequate, relevant and not excessive in relation to that purpose or those purposes.
5. Personal data shall be accurate and, where necessary, kept up to date.
6. Personal data held for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
7. An individual shall be entitled--
(a) at reasonable intervals and without undue delay or expense--
(i) to be informed by any data user whether he holds personal data of which that individual is the subject and
(ii) to access to any such data held by a data user and
(b) where appropriate, to have such data corrected or erased.
Personal data held by data users or in respect of which services are provided by persons carrying on computer bureaux
8. Appropriate security measures shall be taken against unauthorised access to, or alteration, disclosure or destruction of, personal data and against accidental loss or destruction of personal data.
PART II
INTERPRETATION
The first principle
1.--(1) Subject to sub-paragraph (2) below, in determining whether information was obtained fairly regard shall be had to the method by which it was obtained, including in particular whether any person from whom it was obtained was deceived or misled as to the purpose or purposes for which it is to be held used or disclosed.
(2) Information shall in any event be treated as obtained fairly if it is obtained from a person who--
(a) is authorised by or under any enactment to supply it or
(b) is required to supply it by or under any enactment or by any convention or other instrument imposing an international obligation on the United Kingdom
and in determining whether information was obtained fairly there shall be disregarded any disclosure of the information which is authorised or required by or under any enactment or required by any such convention or other instrument as aforesaid.
The second principle
2. Personal data shall not be treated as held for a specified purpose unless that purpose is described in particulars registered under this Act in relation to the data.
The third principle
3. Personal data shall not be treated as used or disclosed in contravention of this principle unless
(a) used otherwise than for a purpose of a description registered under this Act in relation to the data or
(b) disclosed otherwise than to a person of a description so registered.
The fifth principle
4. Any question whether or not personal data are accurate shall be determined as for the purposes of section 22 of this Act but in the case of such data as are mentioned in subsection (2) of that section, this principle shall not be regarded as having been contravened by reason of any inaccuracy in the information there mentioned if the requirements specified in that subsection have been complied with.
The seventh principle
5.--(1) Paragraph (a) of this principle shall not be construed as conferring any rights inconsistent with section 21 of this Act.
(2) In determining whether access to personal data is sought at reasonable intervals regard shall be had to the nature of the data the purpose for which the data are held and the frequency with which the data are altered.
(3) The correction or erasure of personal data is appropriate only where necessary for ensuring compliance with the other data protection principles.
The eighth principle
6. Regard shall be had
(a) to the nature of the personal data and the harm that would result from such access alteration disclosure loss or destruction as are mentioned in this principle and
(b) to the place where the personal data are stored to security measures programmed into the relevant equipment and to measures taken for ensuring the reliability of staff having access to the data.
Use for historical statistical or research purposes
7.--Where personal data are held for historical statistical or research purposes and not used in such a way that damage or distress is or is likely to be caused to any data subject--
(a) the information contained in the data shall not be regarded for the purposes of the first principle as obtained unfairly by reason only that its use for any such purpose was not disclosed when it was obtained and
(b) the data may notwithstanding the sixth principle be kept indefinitely.
SCHEDULE 2
Section 3(6).
The Data Protection Registrar and the Data Protection Tribunal
Part I The Registrar
Status
1.--(1) The Registrar shall be a corporation sole by the name of "The Data Protection Registrar".
(2) Except as provided in section 17(2) of this Act, the Registrar and his officers and servants shall not be regarded as servants or agents of the Crown.
Tenure of office
2.--(1) Subject to the provisions of this paragraph, the Registrar shall hold office for five years.
(2) The Registrar may be relieved of his office by Her Majesty at his own request.
(3) The Registrar may be removed from office by Her Majesty in pursuance of an Address from both Houses of Parliament.
(4) The Registrar shall in any case vacate his office on completing the year of service in which he attains the age of sixty-five years.
(5) Subject to sub-paragraph (4) above, a person who ceases to be Registrar on the expiration of his term of office shall be eligible for re-appointment.
Salary etc.
3.--(1) There shall be paid--
(a) to the Registrar such salary, and
(b) to or in respect of the Registrar such pension,
as may be specified by a resolution of the House of Commons.
(2) A resolution for the purposes of this paragraph may either specify the salary or pension or provide that it shall be the same as that payable to, or to or in respect of, a person employed in a specified office under, or in a specified capacity in the service of, the Crown.
(3) A resolution for the purposes of this paragraph may take effect from the date on which it is passed or from any earlier or later date specified in the resolution.
(4) Any salary or pension payable under this paragraph shall be charged on and issued out of the Consolidated Fund.
(5) In this paragraph "pension" includes an allowance or gratuity and any reference to the payment of a pension includes a reference to the making of payments towards the provision of a pension.
Officers and servants
4.--(1) The Registrar--
(a) shall appoint a deputy registrar; and
(b) may appoint such number of other officers and servants as he may determine.
(2) The remuneration and other conditions of service of the persons appointed under this paragraph shall be determined by the Registrar.
(3) The Registrar may pay such pensions, allowances or gratuities to or in respect of the persons appointed under this paragraph, or make such payments towards the provision of such pensions, allowances or gratuities, as he may determine.
(4) The references in sub-paragraph (3) above to pensions, allowances or gratuities to or in respect of the persons appointed under this paragraph include references to pensions, allowances or gratuities by way of compensation to or in respect of any of those persons who suffer loss of office or employment.
(5) Any determination under sub-paragraph (1)(b), (2) or (3) above shall require the approval of the Secretary of State given with the consent of the Treasury.
5.--(1) The deputy registrar shall perform the functions conferred by this Act on the Registrar during any vacancy in that office or at any time when the Registrar is for any reason unable to act.
(2) Without prejudice to sub-paragraph (1) above, any functions of the Registrar under this Act may, to the extent authorised by him, be performed by any of his officers.
Receipts and expenses
6.--(1) All fees and other sums received by the Registrar in the exercise of his functions under this Act shall be paid by him into the Consolidated Fund.
(2) The Secretary of State shall out of moneys provided by Parliament pay to the Registrar such sums towards his expenses as the Secretary of State may with the approval of the Treasury determine.
Accounts
7.--(1) It shall be the duty of the Registrar--
(a) to keep proper accounts and other records in relation to the accounts;
(b) to prepare in respect of each financial year a statement of account in such form as the Secretary of State may direct with the approval of the Treasury; and
(c) to send copies of that statement to the Comptroller and Auditor General on or before 31st August next following the end of the year to which the statement relates or on or before such earlier date after the end of that year as the Treasury may direct.
(2) The Comptroller and Auditor General shall examine and certify any statement sent to him under this paragraph and lay copies of it together with his report thereon before each House of Parliament.
(3) In this paragraph "financial year" means a period of twelve months beginning with 1st April.
Part II
The Tribunal
Tenure of office
8.--(1) A member of the Tribunal shall hold and vacate his office in accordance with the terms of his appointment and shall, on ceasing to hold office, be eligible for re-appointment.
(2) Any member of the Tribunal may at any time resign his office by notice in writing to the Lord Chancellor (in the case of the chairman or a deputy chairman) or to the Secretary of State (in the case of any other member).
Salary etc.
9. The Secretary of State shall pay to the members of the Tribunal out of moneys provided by Parliament such remuneration and allowances as he may with the approval of the Treasury determine.
Officers and servants
10. The Secretary of State may provide the Tribunal with such officers and servants as he thinks necessary for the proper discharge of its functions.
Expenses
11. Such expenses of the Tribunal as the Secretary of State may with the approval of the Treasury determine shall be defrayed by the Secretary of State out of moneys provided by Parliament.
Part III
General
Parliamentary disqualification
12.--(1) In Part II of Schedule 1 to the House of Commons Disqualification Act 1975 (1975 c. 24) (bodies whose members are disqualified) there shall be inserted at the appropriate place "The Data Protection Tribunal".
(2) In Part III of that Schedule (disqualifying offices) there shall be inserted at the appropriate place "The Data Protection Registrar".
(3) Corresponding amendments shall be made in Parts II and III of Schedule 1 to the Northern Ireland Assembly Disqualification Act 1975 (1975 c. 25.).
Supervision by Council on Tribunals
13. The Tribunals and Inquiries Act 1971 (1971 c. 62.) shall be amended as follows--
(a) in section 8(2) after "paragraph" there shall be inserted "5A";
(b) in section 19(4) after "46" there shall be inserted the words "or the Data Protection Registrar referred to in paragraph 5A";
(c) in Schedule 1, after paragraph 5 there shall be inserted--
Data protection
5A. (a) The Data Protection Registrar;
The Data Protection Tribunal.
Public records
14. In Part II of the Table in paragraph 3 of Schedule 1 to the Public Records Act 1958 (1958 c. 51.) there shall be inserted at the appropriate place "the Data Protection Registrar"; and after paragraph 4 (1)(n) of that Schedule there shall be inserted--
(nn) records of the Data Protection Tribunal;".
SCHEDULE 3
Section 13(4).
Appeal Proceedings
Hearing of appeals
1. For the purpose of hearing and determining appeals or any matter preliminary or incidental to an appeal the Tribunal shall sit at such times and in such places as the chairman or a deputy chairman may direct and may sit in two or more divisions.
2.--(1) Subject to any rules made under paragraph 4 below, the Tribunal shall be duly constituted for an appeal under section 13 (1) of this Act if it consists of--
(a) the chairman or a deputy chairman (who shall preside); and
(b) an equal number of the members appointed respectively in accordance with paragraphs (a) and (b) of section 3(5) of this Act.
(2) The members who are to constitute the Tribunal in accordance with sub-paragraph (1) above shall be nominated by the chairman or, if he is for any reason unable to act, by a deputy chairman.
(3) The determination of any question before the Tribunal when constituted in accordance with this paragraph shall be according to the opinion of the majority of the members hearing the appeal.
3. Subject to any rules made under paragraph 4 below, the jurisdiction of the Tribunal in respect of an appeal under section 13(2) or (3) of this Act shall be exercised ex parte by the chairman or a deputy chairman sitting alone.
Rules of procedure
4.--(1) The Secretary of State may make rules for regulating the exercise of the rights of appeal conferred by section 13 of this Act and the practice and procedure of the Tribunal.
(2) Without prejudice to the generality of sub-paragraph (1) above, rules under this paragraph may in particular make provision--
(a) with respect to the period within which an appeal can be brought and the burden of proof on an appeal;
(b) for the summoning of witnesses and the administration of oaths;
(c) for securing the production of documents and data material;
(d) for the inspection, examination, operation and testing of data equipment and the testing of data material;
(e) for the hearing of an appeal wholly or partly in camera;
(f) for hearing an appeal in the absence of the appellant or for determining an appeal without a hearing;
(g) for enabling any matter preliminary or incidental to an appeal to be dealt with by the chairman or a deputy chairman;
(h) for the awarding of costs;
(i) for the publication of reports of the Tribunal's decision; and
(j) for conferring on the Tribunal such ancillary powers as the Secretary of State thinks necessary for the proper discharge of its functions.
Obstruction etc.
5.--(1) If any person is guilty of any act or omission in relation to proceedings before the Tribunal which, if those proceedings were proceedings before a court having power to commit for contempt, would constitute contempt of court, the Tribunal may certify the offence to the High Court or, in Scotland, the Court of Session.
(2) Where an offence is so certified, the court may inquire into the matter and, after hearing any witness who may be produced against or on behalf of the person charged with the offence, and after hearing any statement that may be offered in defence, deal with him in any manner in which it could deal with him if he had committed the like offence in relation to the court.
SCHEDULE 4
Section 16.
Powers of Entry and Inspection
Issue of warrants
1. If a circuit judge is satisfied by information on oath supplied by the Registrar that there are reasonable grounds for suspecting--
(a) that an offence under this Act has been or is being committed; or
(b) that any of the data protection principles have been or are being contravened by a registered person,
and that evidence of the commission of the offence or of the contravention is to be found on any premises specified in the information, he may, subject to paragraph 2 below, grant a warrant authorising the Registrar or any of his officers or servants at any time within seven days of the date of the warrant to enter those premises, to search them, to inspect, examine, operate and test any data equipment found there and to inspect and seize any documents or other material found there which may be such evidence as aforesaid.
2. A judge shall not issue a warrant under this Schedule unless he is satisfied--
(a) that the Registrar has given seven days' notice in writing to the occupier of the premises in question demanding access to the premises;
(b) that access was demanded at a reasonable hour and was unreasonably refused; and
(c) that the occupier has, after the refusal, been notified by the Registrar of the application for the warrant and has had an opportunity of being heard by the judge on the question whether or not it should be issued;
but the foregoing provisions of this paragraph shall not apply if the judge is satisfied that the case is one of urgency or that compliance with those provisions would defeat the object of the entry.
3. A judge who issues a warrant under this Schedule shall also issue two copies of it and certify them clearly as copies.
Execution of warrants
4. A person executing a warrant issued under this Schedule may use such reasonable force as may be necessary.
5. A warrant issued under this Schedule shall be executed at a reasonable hour unless it appears to the person executing it that there are grounds for suspecting that the evidence in question would not be found if it were so executed.
6. If the person who occupies the premises in respect of which a warrant is issued under this Schedule is present when the warrant is executed, he shall be shown the warrant and supplied with a copy of it; and if that person is not present a copy of the warrant shall be left in a prominent place on the premises.
7.--(1) A person seizing anything in pursuance of a warrant under this Schedule shall give a receipt for it if asked to do so.
(2) Anything so seized may be retained for so long as is necessary in all the circumstances but the person in occupation of the premises in question shall be given a copy of anything that is seized if he so requests and the person executing the warrant considers that it can be done without undue delay.
Matters exempt from inspection and seizure
8. The powers of inspection and seizure conferred by a warrant issued under this Schedule shall not be exercisable in respect of personal data which are exempt from Part II of this Act.
9.--(1) Subject to the provisions of this paragraph, the powers of inspection and seizure conferred by a warrant issued under this Schedule shall not be exercisable in respect of--
(a) any communication between a professional legal adviser and his client in connection with the giving of legal advice to the client with respect to his obligations, liabilities or rights under this Act; or
(b) any communication between a professional legal adviser and his client, or between such an adviser or his client and any other person, made in connection with or in contemplation of proceedings under or arising out of this Act (including proceedings before the Tribunal) and for the purposes of such proceedings.
(2) Sub-paragraph (1) above applies also to--
(a) any copy or other record of any such communication as is there mentioned; and
(b) any document or article enclosed with or referred to in any such communication if made in connection with the giving of any advice or, as the case may be, in connection with or in contemplation of and for the purposes of such proceedings as are there mentioned.
(3) This paragraph does not apply to anything in the possession of any person other than the professional legal adviser or his client or to anything held with the intention of furthering a criminal purpose.
(4) In this paragraph references to the client of a professional legal adviser include references to any person representing such a client.
10. If the person in occupation of any premises in respect of which a warrant is issued under this Schedule objects to the inspection or seizure under the warrant of any material on the grounds that it consists partly of matters in respect of which those powers are not exercisable, he shall, if the person executing the warrant so requests, furnish that person with a copy of so much of the material as is not exempt from those powers.
Return of Warrants
11. A warrant issued under this Schedule shall be returned to the court from which it was issued--
(a) after being executed; or
(b) if not executed within the time authorised for its execution;
and the person by whom any such warrant is executed shall make an endorsement on it stating what powers have been exercised by him under the warrant.
Offences
12. Any person who--
(a) intentionally obstructs a person in the execution of a warrant issued under this Schedule; or
(b) fails without reasonable excuse to give any person executing such a warrant such assistance as he may reasonably require for the execution of the warrant,
shall be guilty of an offence.
Vessels, vehicles etc.
13. In this Schedule "premises" includes any vessel, vehicle, aircraft or hovercraft, and references to the occupier of any premises include references to the person in charge of any vessel, vehicle, aircraft or hovercraft.
Scotland and Northern Ireland
14. In the application of this Schedule to Scotland, for any reference to a circuit judge there shall be substituted a reference to the sheriff, for any reference to information on oath there shall be substituted a reference to evidence on oath and for the reference to the court from which the warrant was issued there shall be substituted a reference to the sheriff clerk.
15. In the application of this Schedule to Northern Ireland, for any reference to a circuit judge there shall be substituted a reference to a county court judge and for any reference to information on oath there shall be substituted a reference to a complaint on oath.
