| Data Protection Act 1984 (c. 35) |
| 1984 Chapter c.35 - continued |
|
 |
|
| |
An Act to regulate the use of automatically processed information
relating to individuals and the provision of services in respect of such
information.
12th July 1984
BE IT ENACTED by the
Queen's most Excellent Majesty, by and with the advice and consent of the
Lords Spiritual and Temporal, and Commons, in this present Parliament assembled,
and by the authority of the same, as follows:-
|
| |
PART I |
| |
PRELIMINARY |
| Definition of "data" and related expressions. |
1. - (1) The following provisions
shall have effect for the interpretation of this Act.
|
| |
(2) "Data" means information recorded
in a form in which it can be processed by equipment operating automatically
in response to instructions given for that purpose.
|
| |
(3) "Personal data" means data consisting
of information which relates to a living individual who can be identified
from that information (or from that and other information in the possession
of the data user), including any expression of opinion about the individual
but not any indication of the intentions of the data user in respect of
that individual.
|
| |
(4) "Data subject" means an individual
who is the subject of personal data.
|
| |
(5) "data user" means a person who holds
data, and a person "holds" data if-
|
| |
(a) the data form part of a collection of data processed or intended
to be processed by or on behalf of that person as mentioned in subsection
(2) above; and
|
| |
(b) that person (either alone or jointly or in common with other persons)
controls the contents and use of the data comprised in the collection;
and
|
| |
(c) the data are in the form in which they have been or are intended
to be processed as mentioned in paragraph (a) above or (though not for
the time being in that form) in a form into which they have been converted
after being so processed and with a view to being further so processed
on a subsequent occasion.
|
| |
(6) A person carries on a "computer bureau"
if he provides other persons with services in respect of data, and a person
provides such services if-
|
| |
(a) as agent for other persons he causes data held by them to be processed
as mentioned in subsection (2) above; or
|
| |
(b) he allows other persons the use of equipment in his possession
for the processing as mentioned in that subsection of data held by them.
|
| |
(7) "Processing", in relation to data,
means amending, augmenting, deleting or re-arranging the data or extracting
the information constituting the data and, in the case of personal data,
means performing any of those operations by reference to the data subject.
|
| |
(8) Subsection (7) above shall not be
construed as applying to any operation performed only for the purpose of
preparing the text of documents.
|
| |
(9) "Disclosing", in relation to data,
includes disclosing information extracted from the data; and where the
identification of the individual who is the subject of personal data depends
partly on the information constituting the data and partly on other information
in the possession of the data user, the data shall not be regarded as disclosed
or transferred unless the other information is also disclosed or transferred.
|
| The data protection principles. |
2. - (1) Subject to subsection
(3) below, references in this Act to the data protection principles are
to the principles set out in Part I of Schedule 1 to this Act; and those
principles shall be interpreted in accordance with Part II of that Schedule.
|
| |
(2) The first seven principles apply
to personal data held by data users and the eighth applies both to such
data and to personal data in respect of which services are provided by
persons carrying on computer bureaux.
|
| |
(3) The Secretary of State may by order
modify or supplement those principles for the purpose of providing additional
safeguards in relation to personal data consisting of information as to-
|
| |
(a) the racial origin of the data subject;
|
| |
(b) his political opinions or religious or other beliefs;
|
| |
(c) his physical or mental health or his sexual life; or
|
| |
(d) his criminal convictions;
|
| |
and references in this Act to the data protection principles
include, except where the context otherwise requires, references to any
modified or additional principle having effect by virtue of an order under
this subsection.
|
| |
(4) An order under subsection (3) above
may modify a principle either by modifying the principle itself or by modifying
its interpretation; and where an order under that subsection modifies a
principle or provides for an additional principle it may contain provisions
for the interpretation of the modified or additional principle.
|
| |
(5) An order under subsection (3) above
modifying the third data protection principle may, to such extent as the
Secretary of State thinks appropriate, exclude or modify in relation to
that principle any exemption from the non-disclosure provisions which is
contained in Part IV of this Act; and the exemptions from those provisions
contained in that Part shall accordingly have effect subject to any order
made by virtue of this subsection.
|
| |
(6) An order under subsection (3) above
may make different provision in relation to data consisting of information
of different descriptions.
|
| The Registrar and the Tribunal. |
3. - (1) For the purposes of
this Act there shall be-
|
| |
(a) an officer known as the Data Protection Registrar (in this Act
referred to as "the Registrar"); and
|
| |
(b) a tribunal known as the Data Protection Tribunal (in this Act referred
to as "the Tribunal").
|
| |
(2) The Registrar shall be appointed
by Her Majesty by Letters Patent.
|
| |
(3) The Tribunal shall consist of-
|
| |
(a) a chairman appointed by the Lord Chancellor after consultation
with the Lord Advocate;
|
| |
(b) such number of deputy chairmen appointed as aforesaid as the Lord
Chancellor may determine; and
|
| |
(c) such number of other members appointed by the Secretary of State
as he may determine.
|
| |
(4) The members of the Tribunal appointed
under subsection (3) (a) and (b) above shall be barristers, advocates or
solicitors, in each case of not less than seven years' standing.
|
| |
(5) The members of the Tribunal appointed
under subsection (3) (c) above shall be-
|
| |
(a) persons to represent the interests of data users; and
|
| |
(b) persons to represent the interests of data subjects.
|
| |
(6) Schedule 2 to this Act shall have
effect in relation to the Registrar and the Tribunal.
|
