ta. Certain protections where given in scenario where the personal information relating to them was handled, such as large business organisations and in emerging information technology. Data given from one party to another party may only be used for the specific purpose it was disclosed for. The data should be only kept for a limited period of time and must not be disclosed to other party without the authorisation of data owner. The term ‘Processing’ and ‘Personal data’ had a great impact in transformation during the DPA 1984. The ‘Personal data’ covers both the data in electronic and manual form. And the term ‘Processing’ became wide in such a way that nothing could be carried out in relation to personal data under this definition.
The Data Protection Registrar was the regulatory authority who oversees the implementation and functionality of the act. Later it was followed up by the Data Protection Act 1998, which is an implementation of European Union Directive 95/46/EC. In DPA 1998 it renamed the Data Protection Registrar to Data Protection Commissioner. The functionality of Data Protection Commissioner is to ensure the compliance by publics by taking the necessity steps. The current Information Commissioner is Richard Thomas, he has the authority to inform parliament directly. The other function of commissioner is to provide guidance, promote good practice which falls under the Act. It also provides helpline services by phone or written request. The commissioner also acts like a legal adviser to the data controller’s and has developed & issued many documents for the data controller for implementing and interpretation of their duties.
Some of the documents include:
- Code of Practice for CCTV users;
- Code of Practice on Employment Practices, which include codes on Recruitment and Selection; Records Management; Monitoring at Work and Medical Information about the employees.
- Code of Practice on Telecommunications Directory Information and Fair Processing.
The Principles of DPA 1998
The DPA 1998 contains eight data protection principles in relation to the processing of personal data. They are
- Personal data should be processed fairly and lawfully.
- Personal data should only be obtained for one or more specified and lawful purposes, and it should not be further processed in any manner incompatible with these purposes.
- Personal data should be adequate, relevant and not excessive in relation to the purposes for which they were collected or processed.
- Personal data should be accurate and where necessary kept up to date.
- Personal data should not be kept longer than is needed for its intended purpose.
- Personal data should be processed in accordance with the rights of the individual which the information concerns.
- Appropriate technical measures should be taken against unauthorised or unlawful processing or destruction of personal data and against accidental loss or destructionor damage to personal data.
- Personal data should not be transferred outside the European Economic Area unless that country ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
The First Data Protection Principle
The first data protection principle says that
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
- At least one of the conditions in Schedule 2 is met, and
- In the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
In the first principle, by fairly and lawfully it means that any processing of personal data must be allowed by common law. Fair processing states that any all the processing must be fair without any misleading. The processing should be carried out without any deception. The important point of view of the first principle is obtaining and disclosing personal data, which covers the whole life cycle of personal data used by the data controller. The data controller should have legitimate reasons for collecting and processing the personal data and shoul