Computing related legislation: Data Protection Act 1998

Overview

Recall questions on the Data Protection Act 1998, its eight principles, data subjects, controllers and processors, subject access requests, sensitive personal data, exemptions, breach scenarios, enforcement by the Information Commissioner, automated decisions and its repeal.

What you need to know

Answer each one before you reveal it.

Questions from this subtopic

Each one with the model answer underneath.

1. 1

   The Data Protection Act 1998 gets quoted in exam answers as though it protects computers. What does it actually protect, and who does it place the duty on?

   Model answer

   It protects people, not machines, and not data in general. Its subject matter is personal data: data relating to a living individual who can be identified either from that data alone, or from that data together with other information that the data controller holds or is likely to hold. The person the data is about is the data subject. The duty falls on the data controller, the person or organisation that decides why and how the data is processed, and on any data processor acting on the controller's instructions. Data about a dead person, or about a company rather than an individual, falls outside it, as does data that has been genuinely anonymised so no individual can be identified. Important point of fact: the 1998 Act is the legislation you should write about in the exam, but it is no longer the law. It was repealed on 25 May 2018 and replaced by the Data Protection Act 2018 working alongside the UK General Data Protection Regulation.

2. 2

   State the eight data protection principles set out in the Data Protection Act 1998.

   Model answer

   Personal data must be: (1) processed fairly and lawfully, and only where a stated condition for processing is met; (2) obtained for one or more specified and lawful purposes, and not further processed in a way incompatible with those purposes; (3) adequate, relevant and not excessive for those purposes; (4) accurate and, where necessary, kept up to date; (5) not kept for longer than is necessary for the purpose; (6) processed in accordance with the rights of data subjects under the Act; (7) protected by appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage; (8) not transferred outside the European Economic Area unless the destination country ensures an adequate level of protection for the rights of data subjects. The 2018 replacement regime keeps very similar principles but merges them into six and adds an explicit accountability principle requiring the controller to be able to demonstrate compliance.

3. 3

   Distinguish between a data subject, a data controller and a data processor, and give an example of each in a single scenario.

   Model answer

   The data subject is the living individual the personal data is about. The data controller is the person or organisation that determines the purposes for which and the manner in which the data is processed, and it is the controller who carries the legal responsibility. The data processor processes the data on the controller's behalf and on its instructions, without deciding the purpose. In one scenario: a secondary school stores pupil records. Each pupil is a data subject. The school is the data controller, because it decides what to record and why. The cloud provider hosting the management information system is a data processor, because it stores and backs up the data but has no say in what is collected or what it is used for. If the school decides to sell the records to a revision company, that decision is the controller's and the liability is the school's.

4. 4

   What is a subject access request, and what could a person get from one under the 1998 Act?

   Model answer

   A subject access request is a request made by a data subject to a data controller for the personal data the controller holds about them. Under the 1998 Act the controller had to be told in writing, could charge a small fee (generally up to ten pounds, capped lower at two pounds for a credit reference file and higher at up to fifty pounds for health and education records), and had to respond within forty days. The subject was entitled to be told whether their data was being processed, to be given a description of the data, the purposes of processing and who it might be disclosed to, to receive a copy of the information in intelligible form, and to be told any information available about the source of the data. Certain material could be withheld, for example where disclosing it would also reveal information about another identifiable person who had not consented. Under the current 2018 regime the request need not be in writing, the fee has gone in ordinary cases, and the deadline is one month.

5. 5

   The 1998 Act treated some categories of information as needing extra protection. Which categories, and why does that classification matter for a system designer?

   Model answer

   The Act called these sensitive personal data: racial or ethnic origin; political opinions; religious beliefs or other beliefs of a similar nature; trade union membership; physical or mental health or condition; sexual life; the commission or alleged commission of any offence; and any proceedings for an offence, their disposal or the sentence. Processing these lawfully required an additional condition to be satisfied on top of the ordinary conditions, typically explicit consent or a specific statutory ground such as medical purposes or equal-opportunity monitoring. It matters to a designer because it changes the engineering: these fields normally warrant stricter access control, separate storage or encryption, tighter audit logging, shorter retention, and an explicit consent-capture step in the interface rather than a pre-ticked box. The current regime keeps the idea under the label special category data and adds biometric and genetic data used for identification.

6. 6

   Why could a police force keep a database of suspects without letting each suspect see their entry, if the Act gave a right of access?

   Model answer

   Because the Act contained exemptions that switched off some of its provisions in defined circumstances. The most relevant here is the crime and taxation exemption, which disapplied the subject access right and the first principle where compliance would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax. Other exemptions covered national security, journalism, literature and art, regulatory activity, and processing purely for domestic or recreational purposes by an individual. An exemption is narrow and conditional: it applies only so far as compliance would actually cause the prejudice in question, so a force cannot refuse every request as a matter of blanket policy. The same structure of exemptions survives in the 2018 Act.

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.