| Data Protection Act 1984 (c. 35) |
| 1984 Chapter c.35 - continued |
|
 |
|
| |
PART II |
| |
REGISTRATION AND SUPERVISION
OF DATA USERS AND COMPUTER
BUREAUX |
| |
Registration |
| Registration of data users and computer bureaux. |
4. - (1) The Registrar shall
maintain a register of data users who hold, and of persons carrying on
computer bureaux who provide services in respect of, personal data and
shall make an entry in the register in pursuance of each application for
registration accepted by him under this Part of this Act.
|
| |
(2) Each entry shall state whether it
is in respect of a data user, of a person carrying on a computer bureau
or of a data user who also carries on such a bureau.
|
| |
(3) Subject to the provisions of this
section, any entry in respect of a data user shall consist of the following
particulars-
|
| |
(a) the name and address of the data user;
|
| |
(b) a description of the personal data to be held by him and of the
purpose or purposes for which the data are to be held or used;
|
| |
(c) a description of the source or sources from which he intends or
may wish to obtain the data or the information to be contained in the data;
|
| |
(d) a description of any person or persons to whom he intends or may
wish to disclose the data;
|
| |
(e) the names or a description of any countries or territories outside
the United Kingdom to which he intends or may wish directly or indirectly
to transfer the data; and
|
| |
(f) one or more addresses for the receipt of requests from data subjects
for access to the data.
|
| |
(4) Subject to the provisions of this
section, an entry in respect of a person carrying on a computer bureau
shall consist of that person's name and address.
|
| |
(5) Subject to the provisions of this
section, an entry in respect of a data user who also carries on a computer
bureau shall consist of his name and address and, as respects the personal
data to be held by him, the particulars specified in subsection (3) (b)
to (f) above.
|
| |
(6) In the case of a registered company
the address referred to in subsections (3)(a), (4) and (5) above is that
of its registered office, and the particulars to be included in the entry
shall include the company's number in the register of companies.
|
| |
(7) In the case of a person (other than
a registered company) carrying on a business the address referred to in
subsections (3)(a), (4) and (5) above is that of his principal place of
business.
|
| |
(8) The Secretary of State may by order
vary the particulars to be included in entries made in the register.
|
| Prohibition of unregistered holding etc. of
personal data. |
5. - (1) A person shall not
hold personal data unless an entry in respect of that person as a data
user, or as a data user who also carries on a computer bureau, is for the
time being contained in the register.
|
| |
(2) A person in respect of whom such
an entry is contained in the register shall not-
|
| |
(a) hold personal data of any description other than that specified
in the entry;
|
| |
(b) hold any such data, or use any such data held by him, for any purpose
other than the purpose or purposes described in the entry;
|
| |
(c) obtain such data, or information to be contained in such data,
to be held by him from any source which is not described in the entry;
|
| |
(d) disclose such data held by him to any person who is not described
in the entry; or
|
| |
(e) directly or indirectly transfer such data held by him to any country
or territory outside the United Kingdom other than one named or described
in the entry.
|
| |
(3) A servant or agent of a person to
whom subsection (2) above applies shall, as respects personal data held
by that person, be subject to the same restrictions on the use, disclosure
or transfer of the data as those to which that person is subject under
paragraphs (b), (d) and (e) of that subsection and, as respects personal
data to be held by that person, to the same restrictions as those to which
he is subject under paragraph (c) of that subsection.
|
| |
(4) A person shall not, in carrying on
a computer bureau, provide services in respect of personal data unless
an entry in respect of that person as a person carrying on such a bureau,
or as a data user who also carries on such a bureau, is for the time being
contained in the register.
|
| |
(5) Any person who contravenes subsection
(1) above or knowingly or recklessly contravenes any of the other provisions
of this section shall be guilty of an offence.
|
| Applications for registration and for amendment
of registered particulars. |
6. - (1) A person applying
for registration shall state whether he wishes to be registered as a data
user, as a person carrying on a computer bureau or as a data user who also
carries on such a bureau, and shall furnish the Registrar, in such form
as he may require, with the particulars required to be included in the
entry to be made in pursuance of the application.
|
| |
(2) Where a person intends to hold personal
data for two or more purposes he may make separate applications for registration
in respect of any of those purposes.
|
| |
(3) A registered person may at any time
apply to the Registrar for the alteration of any particulars included in
the entry or entries relating to that person.
|
| |
(4) Where the alteration would consist
of the addition of a purpose for which personal data are to be held, the
person may, instead of making an application under subsection (3) above,
make a fresh application for registration in respect of the additional
purpose.
|
| |
(5) A registered person shall make an
application under subsection (3) above whenever necessary for ensuring
that the entry or entries relating to that person contain his current address;
and any person who fails to comply with this subsection shall be guilty
of an offence.
|
| |
(6) Any person who, in connection with
an application for registration or for the alteration of registered particulars,
knowingly or recklessly furnishes the Registrar with information which
is false or misleading in a material respect shall be guilty of an offence.
|
| |
(7) Every application for registration
shall be accompanied by the prescribed fee, and every application for the
alteration of registered particulars shall be accompanied by such fee,
if any, as may be prescribed.
|
| |
(8) Any application for registration
or for the alteration of registered particulars may be withdrawn by notice
in writing to the Registrar at any time before the applicant receives a
notification in respect of the application under section 7 (1) below.
|
| Acceptance and refusal of applications. |
7. - (1) Subject to the provisions
of this section, the Registrar shall as soon as practicable and in any
case within the period of six months after receiving an application for
registration or for the alteration of registered particulars notify the
applicant in writing whether his application has been accepted or refused;
and where the Registrar notifies an applicant that his application has
been accepted the notification shall contain a statement of-
|
| |
(a) the particulars entered in the register, or the alteration made,
in pursuance of the application; and
|
| |
(b) the date on which the particulars were entered or the alteration
was made.
|
| |
(2) The Registrar shall not refuse an
application made in accordance with section 6 above unless-
|
| |
(a) he considers that the particulars proposed for registration or,
as the case may be, the particulars that would result from the proposed
alteration, will not give sufficient information as to the matters to which
they relate; or
|
| |
(b) he is satisfied that the applicant is likely to contravene any
of the data protection principles; or
|
| |
(c) he considers that the information available to him is insufficient
to satisfy him that the applicant is unlikely to contravene any of those
principles.
|
| |
(3) Subsection (2)(a) above shall not
be construed as precluding the acceptance by the Registrar of particulars
expressed in general terms in cases where that is appropriate, and the
Registrar shall accept particulars expressed in such terms in any case
in which he is satisfied that more specific particulars would be likely
to prejudice the purpose or purposes for which the data are to be held.
|
| |
(4) Where the Registrar refuses an application
under this section he shall give his reasons and inform the applicant of
the rights of appeal conferred by section 13 below.
|
| |
(5) If in any case it appears to the
Registrar that an application needs more consideration than can be given
to it in the period mentioned in subsection (1) above he shall as soon
as practicable and in any case before the end of that period notify the
applicant in writing to that effect; and in that event no notification
need be given under that subsection until after the end of that period.
|
| |
(6) Subject to subsection (8) below,
a person who has made an application in accordance with section 6 above
shall-
|
| |
(a) until he receives a notification in respect of it under subsection
(1) above or the application is withdrawn; and
|
| |
(b) if he receives a notification under that subsection of the refusal
of his application, until the end of the period within which an appeal
can be brought against the refusal and, if an appeal is brought, until
the determination or withdrawal of the appeal,
|
| |
be treated for the purposes of section 5 above as if his
application had been accepted and the particulars contained in it had been
entered in the register or, as the case may be, the alteration requested
in the application had been made on the date on which the application was
made.
|
| |
(7) If by reason of special circumstances
the Registrar considers that a refusal notified by him to an applicant
under subsection (1) above should take effect as a matter of urgency he
may include a statement to that effect in the notification of the refusal;
and in that event subsection (6) (b) above shall have effect as if for
the words from "the period" onwards there were substituted the words "the
period of seven days beginning with the date on which that notification
is received".
|
| |
(8) Subsection (6) above shall not apply
to an application made by any person if in the previous two years-
|
| |
(a) an application by that person has been refused under this section;
or
|
| |
(b) all or any of the particulars constituting an entry contained in
the register in respect of that person have been removed in pursuance of
a de-registration notice;
|
| |
but in the case of any such application subsection (1) above
shall apply as if for the reference to six months there were substituted
a reference to two months and, where the Registrar gives a notification
under subsection (5) above in respect of any such application, subsection
(6) above shall apply to it as if for the reference to the date on which
the application was made there were substituted a reference to the date
on which that notification is received.
|
| |
(9) For the purposes of subsection (6)
above an application shall be treated as made or withdrawn-
|
| |
(a) if the application or notice of withdrawal is sent by registered
post or the recorded delivery service, on the date on which it is received
for dispatch by the Post Office;
|
| |
(b) in any other case, on the date on which it is received by the Registrar;
|
| |
and for the purposes of subsection (8) (a) above an application
shall not be treated as having been refused so long as an appeal against
the refusal can be brought, while such an appeal is pending or if such
an appeal has been allowed.
|
