§10.0 Introduction - UK Overview

When we talk about data protection, what we mean is the protection of data which is personal to one individual; we are not concerned with data which details other matters ... animal breeding programmes, companies, nor even partnerships or (with certain restrictions) persons acting as sole traders. Individuals only - people! And only living people at that, not the dead.

The Computer Misuse Act became law because of the determination of one individual Westminster MP who had previously been a computing professional ...

... but the UK history of data protection legislation is very much otherwise, with the UK government very reluctantly moving (for trade protection reasons) to adopt European ideas.

Curiously, there were two very different forces driving the European ideas of data protection:

• At one extreme, was [West] Germany, desperate to avoid computers being used for a Nazi-like domination by the state
  • The first data protection act was in West Germany, circa 1970

• At the other extreme was Sweden, which legislated to preserve into the computer age the free availability of personal data, a freedom which had been recognised in their society at least since the eighteenth century.

Eventually the United Kingdom passed its Data Protection Act in 1984. That act is now repealed and superseded by the similarly titled 1998 Act ... though the final details of that act will be along time coming: the first sections were immediately applicable, but the last ones were not scheduled to be mandatory until 2007!

Many of the changes made under the 1998 Act (by comparison with its predecessor) are as yet poorly understood, even though it has been essentially in force since 1998 (as just remarked, some of the provisions were deferred for quite a long time before they came into effect).

• There is still a relative dearth of case law on new aspects of the act

• But do be very clear about one difference; the 1998 act is mucha wider reaching in the protection it gives to the recording and using of personal data:
  • Certainly it covers virtually all computer-held data;

  • But it also covers data held in structured manual systems
    (where the storage stucture permits identification of individual records)

• The second of these points - paper storage - was explicitly excluded from the original, 1984 Act ... not any longer!

§10.1 Evolution of the U.K Act

The widespread concerns of the 1960's about privacy led eventually to the Younger Report of 1972

• only a very small part of which was concerned with computer-held material

• but all of which was concerned with the protection for the individual, for example advising that personal data should be
  • held only for a specific purpose
  • held only if of relevance to that purpose
  • accurate.

• "We cannot on the evidence before us conclude that the computer as used in the private sector is [yet] a threat to privacy"

But things changed, relatively quickly, so far as the availability and deployment of computers was concerned ... suddenly, long gone were the 1940's days of " six computers being sufficient for the world's needs" and the startling 1950 deployment of LEO (Lyons' Electronic Office). Ask yourself, just why those changes were so sudden and so marked!

Within a very few years, and in response to a 1975 White Paper [UK government proposal for legislation], the Lindup Report of 1978 supported the idea of computer legislation and identified relevant aspects of privacy for which provision ought to be made.

Many countries acted on these and related ideas, including in particular the European Union, but the UK government was reluctant and slow to act ... which brings us to the international pressure described at the beginning of the chapter, the pressures which eventually compelled the UK government to bring forward what became the Data Protection Act 1984.

What did the 1984 Act provide for?

• Personal information (that is, a human individual's) capable of being processed electronically
  • though with the caveat that the Act only applied to the living

• To which were applied the Younger ideas of
  • Purpose
  • Relevance
  • Accuracy

• And an extension of those Younger ideas
  • to registration
    • by way of the office of a Data Protection Registrar

    • of the purpose for which the data was kept, and its source, nature, location and exportability

  • with a right of subject access (for a fee, not exceeding some legal limit)

  • and a right of correction of the data, possibly of its removal

• together with areas of (partial) exemption, for example, for police and medical records.

The 1984 Act has now been repealed and superseded by the 1998 Act; from now on we will concentrate on the latter. We have already commented on one major difference between the two acts, the fact that the later one covers manual as well as computer-based filing systems. A second point - in one sense immaterial, but from another viewpoint essential knowledge! - is that the Data Protection Registrar was restyled Data Protection Commissioner, and subsequently Information Commissioner. And a third is that the system of registration with the Data Protection Registrar has been superseded by a system of notification of data held, the principal difference being that a much reduced amount of detail is held on the central register.

From a practical point of view, note also and in particular that

• Excluding the name of the data subject (by using, say, a numeric key) does not take the data outside the scope of the Act

• That we can be required permanently and untraceably to remove the data, has implications for the data structures used for storage (e.g. for binary search trees and for hash tables, both of which must extend to seamless data removal - both in current source and in any back-up copies - although of course what we are really concerned about is long-term rather than short-term storage)

• Virtually all computer-held personal data is covered, as well as a high proportion of that held in paper form
  • There continue to be certain exemptions of a general nature, specified in the Act (although there may be other reasons, such as some of the recent anti-discrimination legislation, for believing such exemption is only sound if you keep the data very secure); in particular,
    • the keeping of domestic records is exempt from regulation;
    • and so are certain records of not-for-profit charities, an exemption intended to facilitate the needs of small clubs, voluntary organisations and church administrations.

• Despite the Act (and subsequent criminal prosecutions, with significant fines and associated, compensatory payments), despite all that, significant abuse of personal data continues - with justification often being given (quite falsely in the eyes of the law) on the grounds of ignorance.

There is much guidance available on 1998 Act (and also, if you need it, on that of 1984).

• The 1984 Act is summarised, and commented on in the context of the 1998 Act, in Bott, Coleman, Eaton, & Rowland, whilst extended commentary on both acts can be found in the works of Ian Lloyd

• But, above all, be aware of and see the notes and booklets issued by the Information Commissioner; many of these are available on the web via www.informationcommissioner.gov.uk.

In particular, you must be familiar with the Data Protection Principles, which were originally defined in schedule 1 to the 1984 Act but were subsequently extended and refined in the 1998 Act.

§10.2 The Data Protection Principles

The heart of the UK Data Protection Act 1998 is the set of data protection principles defined in it, principles which closely derive from the relevant EU directive. They closely resemble those of the 1984 Act, although there are some interesting if small differences.

There are eight principles defined - and the Information Commissioner now summarises them (on the web site and elsewhere) as follows:

Beware: as has already been said, these are eight points for professionals to have mastered! Start by understanding them, then gradually move to the point where you know the principles and can automatically apply them.

We need to examine these principles more closely, but it is also interesting, and - more to the point - instructive, to examine them in the context of what has been changed since the original, 1984 Act. It is also important to remember that we are talking about personal data; no matter how senstitive or confidential other materials may be - referring, for example, to religious organizations or to commercial or security arrangements - they are not protected by the Act - although of course other legislation may be applicable, such as that on prejudice or on official secrets.

1. fairly and lawfully processed:
   • The 1984 Act talked explicitly about "obtained and processed"
   • The idea of "obtaining" personal data has now been considerably sharpened; the 1998 Act incorporates two schedules setting out conditions for obtaining data, and no data may be handled unless at least one of the conditions of the relevant schedule has been met;
     • Schedule 1 applies to the handling of any personal data;
     • Schedule 2 covers the tighter conditions required for handling "sensitive [personal] data"
   • A much more explicit, and so tighter, set of conditions! We may usefully think of them respectively as implicit consent and explicit consent, although neither term is actually defined.
2. processed for limited purposes:
   • the old Act explicitly extended this (in the old clause 3)
     • "and shall not be further processed in any manner incompatible with that purpose":
   • territory which is now effectively policed by the new clause 3
3. adequate, relevant and not excessive:
4. accurate:
5. not kept for longer than is necessary:
6. processed in line with the subject's rights:
   • The previous version - 1984 clause 7 - was far more specific:
     An individual shall be entitled -
     1. at reasonable intervals and without undue delay or expense -
        1. to be informed by any data user whether he holds personal data of which that individual is the subject; and
        2. to access any such data held by a data user; and
        3. where appropriate to have such data corrected or erased.
   • Why was the change made? Why is the new red version, although less specific, really of greater value to the data subject?
7. secure:
   • How delightfully simple! Particularly when compared with what went before (though the first bit is more on subject's rights),
     Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data
     which was followed by (the old clause 8)
     security measures [against] unauthorised access to or alteration, disclosure or destruction of personal data
   • As much as anything, the changes show the development of recognition of the professionalism inherent in any sophisticated use of computer science
8. not transferred to other countries without adequate protection:
   • The old, 1984 final clause was also far more specific than is now felt to be necessary:
     Personal data shall not be transferred to a country or territory outside the European Economic Area UNLESS that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data
   • The new, red version comes directly from an EU Directive - previously (1984 Act) it was sufficient to register any intention to transfer data to outwith the European Union

§10.3 Data Protection Developments

Not likely to be discussed within the present lecture series!

§10.4 Freedom of Information

In the context of rights of access to personal data, one of the key features of data protection legislation, it is right to refer to the various developments there have been within the European Union as a consequence of the human rights legislation. This has impinged on many aspects of law: for example, one particular point in the context of the Scottish system was the independence of the judiciary - until very recently it was possible to argue that the judiciary in Scotland was not wholly free of political control, as is required by EU human rights legislation, because many cases were heard before temporary sheriffs ... and temporary sheriffs were appointed from the ranks of the senior lawyers, at the discretion of the government's politically appointed senior law officers.

On the data protection side, there is now legislation which gives a citizen a right of access to almost all material held on him or her, and to much related government (or local government) material besides - and there are associated codes of practice. This is moving away from strictly computer-related legislation, although there is the obvious link of the retitling of the former Data Protection Registrar / Commissioner as the Information Commissioner.

Be careful, however, for the details of the information legislation change as you move across the United Kingdom. For England and Wales the relevant act is the one promoted by the Information Commissioner, the Freedom of Information Act 2000.

The act applicable in Scotland (and there is also an act for Northern Ireland, as indeed for the Republic of Ireland) is the Freedom of Information (Scotland) Act 2002. Amongst other things, the Scottish act requires the appoinment of a Scottish Information Commissioner; details are available from the Scottish Commissioner's website, www.itspublicknowledge.info. You may care to smile wryly over the fact that, although Scottish universities are not government bodies - they are independent, charitable bodies, existing by royal or other charter, or as a consequence of a series of acts of parliament - they have the dubious privilege of being specifically incorporated amongst those bodies to which the act is applicable. It is tempting to ask the old, lawyer's question, cui bono? "To whose good?"