Data Protection Act 1984 (repealed 1.3.2000)

PART I — Preliminary

Definition of " data " and related expressions

1

• (1) The following provisions shall have effect for the interpretation of this Act.

• (2) " Data " means information recorded in a form in which it can be processed by equipment operating automatically in response to instructions given for that purpose.

• (3) " Personal data " means data consisting of information which relates to a living individual who can be identified from that information (or from that and other information in the possession of the data user), including any expression of opinion about the individual but not any indication of the intentions of the data user in respect of that individual.

• (4) " Data subject" means an individual who is the subject of personal data.

• (5) " Data user " means a person who holds data, and a person " holds " data if—

• (a) the data form part of a collection of data processed or intended to be processed by or on behalf of that person as mentioned in subsection (2) above ; and

• (b) that person (either alone or jointly or in common with other persons) controls the contents and use of the data comprised in the collection ; and

• (c) the data are in the form in which they have been or are intended to be processed as mentioned in paragraph (a) above or (though not for the time being in that form) in a form into which they have been converted after being so processed and with a view to being further so processed on a subsequent occasion.

• (6) A person carries on a " computer bureau " if he provides other persons with services in respect of data, and a person provides such services if—

• (a) as agent for other persons he causes data held by them to be processed as mentioned in subsection (2) above; or

• (b) he allows other persons the use of equipment in his possession for the processing as mentioned in that subsection of data held by them.

• (7) " Processing ", in relation to data, means amending, augmenting, deleting or re-arranging the data or extracting the information constituting the data and, in the case of personal data, means performing any of those operations by reference to the data subject.

• (8) Subsection (7) above shall not be construed as applying to any operation performed only for the purpose of preparing the text of documents.

• (9) "Disclosing", in relation to data, includes disclosing information extracted from the data ; and where the identification of the individual who is the subject of personal data depends partly on the information constituting the data and partly on other information in the possession of the data user, the data shall not be regarded as disclosed or transferred unless the other information is also disclosed or transferred.

The data protection principles

2

• (1) Subject to subsection (3) below, references in this Act to the data protection principles are to the principles set out in Part I of Schedule 1 to this Act; and those principles shall be interpreted in accordance with Part II of that Schedule.

• (2) The first seven principles apply to personal data held by data users and the eighth applies both to such data and to personal data in respect of which services are provided by persons carrying on computer bureaux.

• (3) The Secretary of State may by order modify or supplement those principles for the purpose of providing additional safeguards in relation to personal data consisting of information as to—

• (a) the racial origin of the data subject;

• (b) his political opinions or religious or other beliefs;

• (c) his physical or mental health or his sexual life; or

• (d) his criminal convictions;

and references in this Act to the data protection principles include, except where the context otherwise requires, references to any modified or additional principle having effect by virtue of an order under this subsection.

• (4) An order under subsection (3) above may modify a principle either by modifying the principle itself or by modifying its interpretation; and where an order under that subsection modifies a principle or provides for an additional principle it may contain provisions for the interpretation of the modified or additional principle.

• (5) An order under subsection (3) above modifying the third data protection principle may, to such extent as the Secretary of State thinks appropriate, exclude or modify in relation to that principle any exemption from the non-disclosure provisions which is contained in Part IV of this Act; and the exemptions from those provisions contained in that Part shall accordingly have effect subject to any order made by virtue of this subsection.

• (6) An order under subsection (3) above may make different provision in relation to data consisting of information of different descriptions.

The Registrar and the Tribunal

3

• (1) For the purposes of this Act there shall be—

• (a) an officer known as the Data Protection Registrar (in this Act referred to as " the Registrar "); and

• (b) a tribunal known as the Data Protection Tribunal (in this Act referred to as " the Tribunal").

• (2) The Registrar shall be appointed by Her Majesty by Letters Patent.

• (3) The Tribunal shall consist of—

• (a) a chairman appointed by the Lord Chancellor after consultation with the Lord Advocate;

• (b) such number of deputy chairmen appointed as aforesaid as the Lord Chancellor may determine; and

• (c) such number of other members appointed by the Secretary of State as he may determine.

• (4) The members of the Tribunal appointed under subsection (3)(a) and (b) above shall be barristers, advocates or solicitors, in each case of not less than seven years' standing.

• (5) The members of the Tribunal appointed under subsection (3)(c) above shall be—

• (a) persons to represent the interests of data users ; and

• (b) persons to represent the interests of data subjects.

• (6) Schedule 2 to this Act shall have effect in relation to the Registrar and the Tribunal.

PART II — Registration and Supervision of Data Users and Computer Bureaux

Registration

Registration of data users and computer bureaux

4

• (1) The Registrar shall maintain a register of data users who hold, and of persons carrying on computer bureaux who provide services in respect of, personal data and shall make an entry in the register in pursuance of each application for registration accepted by him under this Part of this Act.

• (2) Each entry shall state whether it is in respect of a data user, of a person carrying on a computer bureau or of a data user who also carries on such a bureau.

• (3) Subject to the provisions of this section, an entry in respect of a data user shall consist of the following particulars—

• (a) the name and address of the data user ;

• (b) a description of the personal data to be held by him and of the purpose or purposes for which the data are to be held or used ;

• (c) a description of the source or sources from which he intends or may wish to obtain the data or the information to be contained in the data ;

• (d) a description of any person or persons to whom he intends or may wish to disclose the data ;

• (e) the names or a description of any countries or territories outside the United Kingdom to which he intends or may wish directly or indirectly to transfer the data ; and

• (f) one or more addresses for the receipt of requests from data subjects for access to the data.

• (4) Subject to the provisions of this section, an entry in respect of a person carrying on a computer bureau shall consist of that person's name and address.

• (5) Subject to the provisions of this section, an entry in respect of a data user who also carries on a computer bureau shall consist of his name and address and, as respects the personal data to be held by him, the particulars specified in subsection (3)(b) to (f) above.

• (6) In the case of a registered company the address referred to in subsections (3)(a), (4) and (5) above is that of its registered office, and the particulars to be included in the entry shall include the company's number in the register of companies.

• (7) In the case of a person (other than a registered company) carrying on a business the address referred to in subsections (3)(a), (4) and (5) above is that of his principal place of business.

• (8) The Secretary of State may by order vary the particulars to be included in entries made in the register.

Prohibition of unregistered holding etc. of personal data

5

• (1) A person shall not hold personal data unless an entry in respect of that person as a data user, or as a data user who also carries on a computer bureau, is for the time being contained in the register.

• (2) A person in respect of whom such an entry is contained in the register shall not—

• (a) hold personal data of any description other than that specified in the entry :

• (b) hold any such data, or use any such data held by him, for any purpose other than the purpose or purposes described in the entry ;

• (c) obtain such data, or information to be contained in such data, to be held by him from any source which is not described in the entry ;

• (d) disclose such data held by him to any person who is not described in the entry ; or

• (e) directly or indirectly transfer such data held by him to any country or territory outside the United Kingdom other than one named or described in the entry.

• (3) A servant or agent of a person to whom subsection (2) above applies shall, as respects personal data held by that person, be subject to the same restrictions on the use, disclosure or transfer of the data as those to which that person is subject under paragraphs (b), (d) and (e) of that subsection and, as respects personal data to be held by that person, to the same restrictions as those to which he is subject under paragraph (c) of that subsection.

• (4) A person shall not, in carrying on a computer bureau, provide services in respect of personal data unless an entry in respect of that person as a person carrying on such a bureau, or as a data user who also carries on such a bureau, is for the time being contained in the register.

• (5) Any person who contravenes subsection (1) above or knowingly or recklessly contravenes any of the other provisions of this section shall be guilty of an offence.

Applications for registration and for amendment of registered particulars

6

• (1) A person applying for registration shall state whether he wishes to be registered as a data user, as a person carrying on a computer bureau or as a data user who also carries on such a bureau, and shall furnish the Registrar, in such form as he may require, with the particulars required to be included in the entry to be made in pursuance of the application.

• (2) Where a person intends to hold personal data for two or more purposes he may make separate applications for registration in respect of any of those purposes.

• (3) A registered person may at any time apply to the Registrar for the alteration of any particulars included in the entry or entries relating to that person.

• (4) Where the alteration would consist of the addition of a purpose for which personal data are to be held, the person may, instead of making an application under subsection (3) above, make a fresh application for registration in respect of the additional purpose.

• (5) A registered person shall make an application under subsection (3) above whenever necessary for ensuring that the entry or entries relating to that person contain his current address; and any person who fails to comply with this subsection shall be guilty of an offence.

• (6) Any person who, in connection with an application for registration or for the alteration of registered particulars, knowingly or recklessly furnishes the Registrar with information which is false or misleading in a material respect shall be guilty of an offence.

• (7) Every application for registration shall be accompanied by the prescribed fee, and every application for the alteration of registered particulars shall be accompanied by such fee, if any, as may be prescribed.

• (8) Any application for registration or for the alteration of registered particulars may be withdrawn by notice in writing to the Registrar at any time before the applicant receives a notification in respect of the application under section 7(1) below.

Acceptance and refusal of applications

7

• (1) Subject to the provisions of this section, the Registrar shall as soon as practicable and in any case within the period of six months after receiving an application for registration or for the alteration of registered particulars notify the applicant in writing whether his application has been accepted or refused; and where the Registrar notifies an applicant that his application has been accepted the notification shall contain a statement of—

• (a) the particulars entered in the register, or the alteration made, in pursuance of the application ; and

• (b) the date on which the particulars were entered or the alteration was made.

• (2) The Registrar shall not refuse an application made in accordance with section 6 above unless—

• (a) he considers that the particulars proposed for registration or, as the case may be, the particulars that would result from the proposed alteration, will not give sufficient information as to the matters to which they relate ; or

• (b) he is satisfied that the applicant is likely to contravene any of the data protection principles ; or

• (c) he considers that the information available to him is insufficient to satisfy him that the applicant is unlikely to contravene any of those principles.

• (3) Subsection (2)(a) above shall not be construed as precluding the acceptance by the Registrar of particulars expressed in general terms in cases where that is appropriate, and the Registrar shall accept particulars expressed in such terms in any case in which he is satisfied that more specific particulars would be likely to prejudice the purpose or purposes for which the data are to be held.

• (4) Where the Registrar refuses an application under this section he shall give his reasons and inform the applicant of the rights of appeal conferred by section 13 below.

• (5) If in any case it appears to the Registrar that an application needs more consideration than can be given to it in the period mentioned in subsection (1) above he shall as soon as practicable and in any case before the end of that period notify the applicant in writing to that effect; and in that event no notification need be given under that subsection until after the end of that period.

• (6) Subject to subsection (8) below, a person who has made an application in accordance with section 6 above shall—

• (a) until he receives a notification in respect of it under subsection (1) above or the application is withdrawn; and

• (b) if he receives a notification under that subsection of the refusal of his application, until the end of the period within which an appeal can be brought against the refusal and, if an appeal is brought, until the determination or withdrawal of the appeal,

be treated for the purposes of section 5 above as if his application had been accepted and the particulars contained in it had been entered in the register or, as the case may be, the alteration requested in the application had been made on the date on which the application was made.

• (7) If by reason of special circumstances the Registrar considers that a refusal notified by him to an applicant under subsection (1) above should take effect as a matter of urgency he may include a statement to that effect in the notification of the refusal; and in that event subsection (6)(b) above shall have effect as if for the words from " the period " onwards there were substituted the words " the period of seven days beginning with the date on which that notification is received ".

• (8) Subsection (6) above shall not apply to an application made by any person if in the previous two years—

• (a) an application by that person has been refused under this section; or

• (b) all or any of the particulars constituting an entry contained in the register in respect of that person have been removed in pursuance of a de-registration notice;

but in the case of any such application subsection (1) above shall apply as if for the reference to six months there were substituted a reference to two months and, where the Registrar gives a notification under subsection (5) above in respect of any such application, subsection (6) above shall apply to it as if for the reference to the date on which the application was made there were substituted a reference to the date on which that notification is received.

• (9) For the purposes of subsection (6) above an application shall be treated as made or withdrawn—

• (a) if the application or notice of withdrawal is sent by registered post or the recorded delivery service, on the date on which it is received for dispatch by the Post Office;

• (b) in any other case, on the date on which it is received by the Registrar;

and for the purposes of subsection (8)(a) above an application shall not be treated as having been refused so long as an appeal against the refusal can be brought, while such an appeal is pending or if such an appeal has been allowed.

Duration and renewal of registration

8

• (1) No entry shall be retained in the register after the expiration of the initial period of registration except in pursuance of a renewal application made to the Registrar in accordance with this section.

• (2) Subject to subsection (3) below, the initial period of registration and the period for which an entry is to be retained in pursuance of a renewal application (" the renewal period ") shall be such period (not being less than three years) as may be prescribed beginning with the date on which the entry in question was made or, as the case may be, the date on which that entry would fall to be removed if the renewal application had not been made.

• (3) The person making an application for registration or a renewal application may in his application specify as the initial period of registration or, as the case may be, as the renewal period, a period shorter than that prescribed, being a period consisting of one or more complete years.