This paper seeks views on the UK's new data protection regime in the light of early experience of its operation. It is too soon to carry out a comprehensive evaluation of the new legislation, especially since the Act's transitional provisions are still in force. However, the Government wishes to make an early appraisal of the new regime. This will help inform the UK's position on the European Commission's report on implementation of the 1995 EC Data Protection Directive which is due by October 2001.
The paper identifies those issues on which the Home Office would particularly welcome comments. The focus is on the practical effect of those provisions of the 1998 Act, or the subordinate legislation made under it, which are either new to UK data protection legislation or substantially different from the provisions of the Data Protection Act 1984. Please feel free to comment on any other issue.
The Act brings certain manual records within the scope of data protection legislation for the first time. It also changes some definitions familiar from the 1984 Act and introduces some new concepts.
A new principle on data exports has been added. Otherwise the data protection principles themselves are similar to those in the 1984 Act. But some express new requirements have been added. These relate to the conditions for processing (Schedules 2 and 3) (see also Question 3); and the provision of information to data subjects (Part II of Schedule 1).
The Act regards information about race, political opinions, religion, trade union membership, health, sex life and offences as "sensitive data" and subjects it to special rules.
The 1998 Act enhances individuals' rights. It creates some new ones and strengthens existing ones. It also incorporates access rights previously provided under other non-data protection legislation. It also introduces some new exemptions from the right of subject access (or, in some cases, subject information).
The 1998 Act requires data controllers to notify the Data Protection Commissioner of the processing which they do. Notification is different from registration under the 1984 Act. The Act also provides for exemptions from notification. The exemptions do not provide exemptions from the data protection principles. Again, this differs from the position under the 1984 Act.
Subject to some exemptions, the Act prohibits the transfer of personal data to countries outside the European Economic Area which do not provide an adequate level of data protection. In the first instance it is up to data controllers to decide whether they can make transfers.
The Data Protection Commissioner has stronger powers to promote compliance with and enforce the 1998 Act.
The data protection regime applies to Internet transactions.
If you have any other comments to offer on the new data protection regime we should be pleased to have them. We should also welcome any available information about the financial implications of the new regime.
| Please send your comments by post, fax or e-mail to: Paul Henery Fax: 020 7273 3205 E.mail: Paul.Henery@homeoffice.gsi.gov.uk The closing date for responses is 27 October 2000 The 1998 Act and its subordinate legislation are also available If you have any queries about this review, please ring Paul Henery on 020 7273 3723. We may wish to make your response publicly available. Please make clear in your response if you do not wish us to do so.
|
Data Protection Act Post Implementation Appraisal letter