he personal data.
The Eight Data Protection Principle
The eighth DPA says that “Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data”. The data controller requires informing individuals about the disclosure of their personal data to other overseas parties. Before making the data transfer to a third party, the data controller should consider whether he can achieve his aims without processing the original data and there should be some substantive processing conducted on the personal data in the third country. The condition will not apply in the case where it is not possible to identify individuals from the information. In this type of cases the data controller are free to transfer the information outside the EEA.
A transfer is said to have occurred when the personal data is send to other country. If the data controller puts the personal data on a website will often results in data transfer to other countries outside the EEA. The transfer occurs when someone outside the EEA access the website. The data controller should also consider the fact that a transfer occurs while putting personal data on websites and sees whether it is fair for the concerned data subject. Currently, there are no restrictions on personal data transfer to EEA countries. They are: Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, and Slovenia.
The European Commission will also undergo a case to case assessment of the level of protection affordable by the third country. All the circumstances surrounding the data transfer are assessed. In addition to this consideration must be also given to:
- The nature of personal data.
- How long will the proposed process last.
- The country of origin of personal data and the destination to which it will be transferred.
- The security measures and professional rules in the destination country.
Certain countries have been considered for having adequate protection by the European Commission. They are Argentina, Canada, Guernsey, Isle of Man, Switzerland, and Jersey.
I hope this report would have given a brief idea about the Data Protection Act 1998. This report also mentions the different principles concerned with DPA, the way that a data controller should follow for lawful and fairness processing. Proper care should be taken while handling personal data, still cyber threats are done by accruing the mobile numbers of individuals and pinpointing them by identifying the co-ordinates of the SIM location. So the firms or organisation should ensure that they pay more attention to DPA for the safety and privacy of people.
- DPA – Data Protection Act 1998
- ICO – Information Commissioner’s Office
- EEA – European Economic Area
- SIM – Subscriber Identification Module Card
- Stewart Room, 2007, “Data Protection & Compliance in Context”, Published by CAPDM.
- City Of London, Data Protection Act, Available at: http://www.cityoflondon.gov.uk/Corporation/LGNL_Services/Council_and_democracy/Data_protection_and_freedom_of_information/Data_protection_act.htm Accessed on [Jan 10,2010]
- Wikipedia, Data Protection Act 1998, Available at: http://en.wikipedia.org/wiki/Data_Protection_Act_1998 Accessed on [Jan15,2010]
Piers Leigh-Pollitt & James Mullock, 1999, “The Data Protection Act Explained”, Second Edition 2000,Publlished by Osborne Clarke.
- Lancaster University Data Protection Project, 2001, the Data Protection Principle. Available at: http://www.dpa.lancs.ac.uk/principles.htm Accessed on [Jan16, 2010].
- ICO, Processing personal data for specified purposes (Principle 2), Available at : http://www.ico.gov.uk/for_organisations/data_protection_guide/principle_2_processing_personal_data_for_specified_purposes.aspx Accessed on [Jan 24,2010]
- ICO, Keeping personal data a