| Data Protection Act 1984 (c. 35) |
| 1984 Chapter c.35 - continued |
|
 |
|
| Duration and renewal of registration. |
8. - (1) No entry shall be
retained in the register after the expiration of the initial period of
registration except in pursuance of a renewal application made to the Registrar
in accordance with this section.
|
| |
(2) Subject to subsection (3) below,
the initial period of registration and the period for which an entry is
to be retained in pursuance of a renewal application ("the renewal period")
shall be such period (not being less than three years) as may be prescribed
beginning with the date on which the entry in question was made or, as
the case may be, the date on which that entry would fall to be removed
if the renewal application had not been made.
|
| |
(3) The person making an application
for registration or a renewal application may in his application specify
as the initial period of registration or, as the case may be, as the renewal
period, a period shorter than that prescribed, being a period consisting
of one or more complete years.
|
| |
(4) Where the Registrar notifies an applicant
for registration that his application has been accepted the notification
shall include a statement of the date when the initial period of registration
will expire.
|
| |
(5) Every renewal application shall be
accompanied by the prescribed fee, and no such application shall be made
except in the period of six months ending with the expiration of-
|
| |
(a) the initial period of registration; or
|
| |
(b) if there have been one or more previous renewal applications, the
current renewal period.
|
| |
(6) Any renewal application may be sent
by post, and the Registrar shall acknowledge its receipt and notify the
applicant in writing of the date until which the entry in question will
be retained in the register in pursuance of the application.
|
| |
(7) Without prejudice to the foregoing
provisions of this section, the Registrar may at any time remove an entry
from the register at the request of the person to whom the entry relates.
|
| Inspection etc. of registered particulars. |
9. - (1) The Registrar shall
provide facilities for making the information contained in the entries
in the register available for inspection (in visible and legible form)
by members of the public at all reasonable hours and free of charge.
|
| |
(2) The Registrar shall, on payment of
such fee, if any, as may be prescribed, supply any member of the public
with a duly certified copy in writing of the particulars contained in the
entry made in the register in pursuance of any application for registration.
|
| |
Supervision |
| Enforcement notices. |
10. - (1) If the Registrar
is satisfied that a registered person has contravened or is contravening
any of the data protection principles he may serve him with a notice ("an
enforcement notice") requiring him to take, within such time as is specified
in the notice, such steps as are so specified for complying with the principle
or principles in question.
|
| |
(2) In deciding whether to serve an enforcement
notice the Registrar shall consider whether the contravention has caused
or is likely to cause any person damage or distress.
|
| |
(3) An enforcement notice in respect
of a contravention of the fifth data protection principle may require the
data user-
|
| |
(a) to rectify or erase the data and any other data held by him and
containing an expression of opinion which appears to the Registrar to be
based on the inaccurate data; or
|
| |
(b) in the case of such data as are mentioned in subsection (2) of
section 22 below, either to take the steps mentioned in paragraph (a) above
or to take such steps as are specified in the notice for securing compliance
with the requirements specified in that subsection and, if the Registrar
thinks fit, for supplementing the data with such statement of the true
facts relating to the matters dealt with by the data as the Registrar may
approve.
|
| |
(4) The Registrar shall not serve an
enforcement notice requiring the person served with the notice to take
steps for complying with paragraph (a) of the seventh data protection principle
in respect of any data subject unless satisfied that the person has contravened
section 21 below by failing to supply information to which the data subject
is entitled and which has been duly requested in accordance with that section.
|
| |
(5) An enforcement notice shall contain-
|
| |
(a) a statement of the principle or principles which the Registrar
is satisfied have been or are being contravened and his reasons for reaching
that conclusion; and
|
| |
(b) particulars of the rights of appeal conferred by section 13 below.
|
| |
(6) Subject to subsection (7) below,
the time specified in an enforcement notice for taking the steps which
it requires shall not expire before the end of the period within which
an appeal can be brought against the notice and, if such an appeal is brought,
those steps need not be taken pending the determination or withdrawal of
the appeal.
|
| |
(7) If by reason of special circumstances
the Registrar considers that the steps required by an enforcement notice
should be taken as a matter of urgency he may include a statement to that
effect in the notice; and in that event subsection (6) above shall not
apply but the notice shall not require the steps to be taken before the
end of the period of seven days beginning with the date on which the notice
is served.
|
| |
(8) The Registrar may cancel an enforcement
notice by written notification to the person on whom it was served.
|
| |
(9) Any person who fails to comply with
an enforcement notice shall be guilty of an offence; but it shall be a
defence for a person charged with an offence under this subsection to prove
that he exercised all due diligence to comply with the notice in question.
|
| De-registration notices. |
11. - (1) If the Registrar
is satisfied that a registered person has contravened or is contravening
any of the data protection principles he may-
|
| |
(a) serve him with a notice ("a de-registration notice") stating that
he proposes, at the expiration of such period as is specified in the notice,
to remove from the register all or any of the particulars constituting
the entry or any of the entries contained in the register in respect of
that person; and
|
| |
(b) subject to the provisions of this section, remove those particulars
from the register at the expiration of that period.
|
| |
(2) In deciding whether to serve a de-registration
notice the Registrar shall consider whether the contravention has caused
or is likely to cause any person damage or distress, and the Registrar
shall not serve such a notice unless he is satisfied that compliance with
the principle or principles in question cannot be adequately secured by
the service of an enforcement notice.
|
| |
(3) A de-registration notice shall contain-
|
| |
(a) a statement of the principle or principles which the Registrar
is satisfied have been or are being contravened and his reasons for reaching
that conclusion and deciding that compliance cannot be adequately secured
by the service of an enforcement notice; and
|
| |
(b) particulars of the rights of appeal conferred by section 13 below.
|
| |
(4) Subject to subsection (5) below,
the period specified in a de-registration notice pursuant to subsection
(1) (a) above shall not expire before the end of the period within which
an appeal can be brought against the notice and, if such an appeal is brought,
the particulars shall not be removed pending the determination or withdrawal
of the appeal.
|
| |
(5) If by reason of special circumstances
the Registrar considers that any particulars should be removed from the
register as a matter of urgency he may include a statement to that effect
in the de-registration notice; and in that event subsection (4) above shall
not apply but the particulars shall not be removed before the end of the
period of seven days beginning with the date on which the notice is served.
|
| |
(6) The Registrar may cancel a de-registration
notice by written notification to the person on whom it was served.
|
| |
(7) References in this section to removing
any particulars include references to restricting any description which
forms part of any particulars.
|
| Transfer prohibition notices. |
12. - (1) If it appears to
the Registrar that-
|
| |
(a) a person registered as a data user or as a data user who also carries
on a computer bureau; or
|
| |
(b) a person treated as so registered by virtue of section 7 (6) above,
|
| |
proposes to transfer personal data held by him to a place
outside the United Kingdom, the Registrar may, if satisfied as to the matters
mentioned in subsection (2) or (3) below, serve that person with a notice
("a transfer prohibition notice") prohibiting him from transferring the
data either absolutely or until he has taken such steps as are specified
in the notice for protecting the interests of the data subjects in question.
|
| |
(2) Where the place to which the data
are to be transferred is not in a State bound by the European Convention
the Registrar must be satisfied that the transfer is likely to contravene,
or lead to a contravention of, any of the data protection principles.
|
| |
(3) Where the place to which the data
are to be transferred is in a State bound by the European Convention the
Registrar must be satisfied either-
|
| |
|
| |
(i) the person in question intends to give instructions for the further
transfer of the data to a place which is not in such a State; and
|
| |
(ii) that the further transfer is likely to contravene, or lead to
a contravention of, any of the data protection principles; or
|
| |
(b) in the case of data to which an order under section 2 (3) above
applies, that the transfer is likely to contravene or lead to a contravention
of, any of the data protection principles as they have effect in relation
to such data.
|
| |
(4) In deciding whether to serve a transfer
prohibition notice the Registrar shall consider whether the notice is required
for preventing damage or distress to any person and shall have regard to
the general desirability of facilitating the free transfer of data between
the United Kingdom and other states and territories.
|
| |
(5) A transfer prohibition notice shall
specify the time when it is to take effect and contain-
|
| |
(a) a statement of the principle or principles which the Registrar
is satisfied are likely to be contravened and his reasons for reaching
that conclusion; and
|
| |
(b) particulars of the rights of appeal conferred by section 13 below.
|
| |
(6) Subject to subsection (7) below,
the time specified in a transfer prohibition notice pursuant to subsection
(5) above shall not be before the end of the period within which an appeal
can be brought against the notice and, if such an appeal is brought, the
notice shall not take effect pending the determination or withdrawal of
the appeal.
|
| |
(7) If by reason of special circumstances
the Registrar considers that the prohibition should take effect as a matter
of urgency he may include a statement to that effect in the transfer prohibition
notice; and in that event subsection (6) above shall not apply but the
notice shall not take effect before the end of the period of seven days
beginning with the date on which the notice is served.
|
| |
(8) The Registrar may cancel a transfer
prohibition notice by written notification to the person on whom it was
served.
|
| |
(9) No transfer prohibition notice shall
prohibit the transfer of any data where the transfer of the information
constituting the data is required or authorised by or under any enactment
or required by any convention or other instrument imposing an international
obligation on the United Kingdom.
|
| |
(10) Any person who contravenes a transfer
prohibition notice shall be guilty of an offence; but it shall be a defence
for a person charged with an offence under this subsection to prove that
he exercised all due diligence to avoid a contravention of the notice in
question.
|
| |
(11) For the purposes of this section
a place shall be treated as in a State bound by the European Convention
if it is in any territory in respect of which the State is bound.
|
