The Data Protection Act 1998 came into force on 1st March 2000 replacing the Data Protection Act 1984. The Act implements the European Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Directive) which came into force on 24 October 1998. The Act also gives effect to the judgement of the European Court of Human Rights in the 1989 case Gaskin v the United Kingdom concerning the right of access to social work records.

In summary the DPA 1998:

• enhances the rights of individuals to gain access to information held about them
• sets rules for processing personal information and applies to some paper records as well as those held on computers

Principles of Data Protection

The rules

Anyone processing personal data must comply with the eight enforceable principles of good practice. They say that data must be:

• fairly and lawfully processed
• processed for limited purposes
• adequate, relevant and not excessive
• accurate
• not kept longer than necessary
• processed in accordance with the data subject's rights
• secure
• not transferred to other countries without adequate protection

Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the data controller towards the individual, although in some limited circumstances exemptions will apply. With processing, the definition is far wider than before. For example, it incorporates the concepts of 'obtaining', holding' and 'disclosing'

Implications of the Data Protection Act 1998

The Data Protection Act 1998 covers personal data held electronically (and also includes some manual information).

Organisations which hold personal information about individuals on computer, need to be open about how the information is used.

Churches and organisations which ask applicants to provide police records about themselves through 'enforced subject access' need to be aware that when the Criminal Records Bureau begins to issue criminal record certificates from summer 2000, it will not be possible to obtain subject access records for the purpose of recruiting a person, as it was possible to under the Data Protection Act 1984.

Foster Carers need to be aware that the Act covers a person's access to social services records about themselves (there are a few exemptions to this).

This right of access extends to children and young people under 18 who understand what it means to exercise that right.

Where a child or young person under 18 makes a request for access to their records, an authority will need to decide whether or not s/he has sufficient understanding to do so.

Published guidance on how the Act may be interpreted, entitled ‘The Data Protection Act 1998 An Introduction' can be ordered from the Data Protection Commissioner's office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AX or through the information line on 01625 545 745.

It is also available on the internet at: http://www.dataprotection.gov.uk

‘Data Protection Act 1998 Guidance to Social Services March 2000' is also available from the Department of Health

Click here to return to the Articles menu.