SEARCH, INDEX, UPDATES, CONTENTS, REGULATIONS, DATA PROTECTION ACT
The original Data Protection Act 1984 introduced a requirement to register businesses recording personal data by computer.
The 1984 Act has been repealed and replaced by the Data Protection Act 1998. This Act extends the scope of the Act and has been effective from 1 March 2000 with a transitional period until 23 October 2001. It also introduces the concept of a data controller as a person who determines the purposes for which and the manner in which personal data are, or are to be processed.
The Data Protection Act 1998 covers some records held in paper form. Such records need not be notified to the Commissioner, but should be handled in accordance with the data protection principles. Manual records are covered by the Act if they form part of a relevant filing system. The Act defines a relevant filing system as "any set of information relating to individuals and structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible".
There is no requirement to notify manual records which come within the scope of the Data Protection Act 1998.
Data controllers who only process personal data for the purposes of staff administration, advertising, marketing and public relations, or accounts and records, for their own business do not need to notify.
Information to identify who needs to notify and how to do so are available at http://www.informationcommissioner.gov.uk or by telephone to the Notification Helpline on 01625-545740. For those in doubt, there is a self assessment check list available at http://forms.informationcommissioner.gov.uk.
You can complete the notification form online at http://www.informationcommissioner.gov.uk or by answering questions on the Helpline number. In either case you need to sign the form which you print or receive and return it by post.
The annual statutory registration fee is £35 on which no VAT is payable, and there are no other costs of registration.
The Information Commissioner is concerned at the activities of companies with names such as Data Protection Agency Services Ltd who offer to arrange registration for £95 plus VAT, and has issued advice to consult local Trading Standards Offices in respect of these companies at http://www.tradingstandards.gov.uk.
The Data Protection Principles
It is good business practice to comply with the eight principles established
by the Act. These state that personal data must be -
Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the data controller towards the individual, although some limited exemptions will apply. With processing, the definition is far wider than before, for example it now incorporates the concepts of 'obtaining', 'holding' and 'disclosing' information.
There are a number of exemptions for national security, journalism, research, education etc. which are not detailed here.
Reminder - disclaimer applies. Please feedback your comments.