Uh LL ‘[enpyagpur soy 3yauag jueyLUODuOD pagfuAy]B YALA ‘S20[[O1}LO9 BIep 109 aUI0s usping 2xou aurea Krostaradns swopSury pauuig aq aru 01 paasas aaey| aoueuy ulm parero0sse 428.1] sansst “roxamoy ‘Mojaq JoUpLIN} passndsep 2q I[Lm sy -Aoeaud Jeuoreutiojur yim yser> Ajrequayod ywowrooroyu9 sw] Jo sisozarU ayp azo BULTEYS ep pure spur Asnuapr se yn spjay ur me] 249 jo juaLudoyasop aanany axp 0} sv a1eqap Buio8u0 ayy ut ystueSeoxd v se ‘sreaK yuosau UF wwopHury para 9x2 UT 2IQEIOL W99q Set stu Sunde oF saoxojuE me] YSnomp ‘temspnquuo satUNstOD kioxy SurBuTes Sapo go.afurs apim e—Ajqeyi0j.wooun soutroutos—ayppenis 04 aAvy satouade axp ‘FaAaNOH Sotanse uyssaooid Jo sta1Aron0 ue aye 01 sfenpraypuy uexp pare|d ssiiag axe sor safe {aostaiadns 1eq) 1qnop ou st 2194], Aagprfea jo SquatHoq> aAey ston Isod Bog >ezoneoung uy yuou99z0;u 598 03 BunsooKP W>eoudde sHstTEU soyed v aye suvadoung ayy, wy ogy payeuasstp pure psn :pada]0> a4 |]! or PULOFUL YEYA% 0 Se tOISI9p UI 3OIGA aE] w axeY AK 19{ 0 HOTIDE a4) Jo aU 11 yenpiatput ain and 0; pauisp s1 uor2aiosd Aoeajad spremon yseoxdde: 24} yp parsafins traaq sey y saamoy Smodpueys UesTIaUrY we WON ‘sajouaBe ayeayad pue ajqnd snotrea a Jo santanse aap arenyess puv az{qeue oy waxy Sumnguniad uopeuaoyut A1essos0u aip jo paandap iaplsina we stuns 2 se jo soos yan poysnsyua st>9/qns epep 3tp jt Uaag -UORS ixrodns ayenbape saxanoy ‘saaquesen# fosjuo> yo savour feuonpenn ayp yo Ku sou palqns eyep ou) Jo uonedionsed ayy zoqpaN ‘suownipuo> Buyss200ad ay: Jo Suouou a7 a1noes ose ysnuu oye[sto| ay, Furssa00ad exep 109 yronauueay Asovepureus eave fo ySnous you 3] so¥eqap sa}se9 amp ul payers Apeaaye sen jeys stay 09 aoUaKI9d {uornne jonueo ywapuadapu uw yo yuouysy{qeisa a1 sasoddnsard wor!so.01d vxep eqn persons sey ‘2ss9py Jo Jepue] 10 ayes wruss9D ax 209 s3UOISSTUTIOD Benonioug wing] sou ‘yung sods sossojoaq “apoyne Sumpeoy aug “sores Paya, Bp ur padope ypeodde ayy wosy aauaiaayp jo 1uyod aofeur syreur pure suansks Besdosng je fqpenz214 07 uouruz09 st yoryen aero st uoxy22I00d eyep Jo pray 94) UI ONZE Bs Aaysqysuodsas ypu paysriqease 9q prnoys Aoua8e pasrqejaads v yyp uonoU aq uon2nponuy sainuabe Asosiasadns vSUPERVISORY AGENCIES | 61 Be exrablishment ofa specific supervisory agency was not originally a requirement Be Gourcil of Europe Convention, which requires signatories merely 0. desig Be or more authorities’ who will at the request of another designated authority information on national laws and administrative practices, provide factva) Getion related to specified automated files, and undertake any investigations fo the request in conformity with national legal provisions.® When the Data Brion Act 1984 was being prepared, it was indeed suggested thatthe supervisory Bon might be carried out bythe Home Office. Ultimately, however, the decison Hes to establish an independent Data Protection Registrar, an approach which Fommon to all European states enacting data protection laws, with the exceP~ surg, The Data Protection Directive is more prescriptive, requiring the san independent supervisory authority (or authorities) Itspecifies in hat the establishment of independent supervisory authorities isan essential he protection of individuals with regard to the processing of personal Se and provides under Article 28 that Ss Mersber State shall provide that one or more public authorities are responsible Be es onitoring the application within its territory of the provisions adopted by the eer States pursuant to this Directive. These authorities shall at with complete Eedependence ine the functions entrusted to them. Birsendments tothe Council of Europe Convention now make similar provision, 1 Baas be noted that the Treaty of Amsterdam—which made significant changes Boi treaties establishing the EU—provides that independent supervisory 28 Bc to be established in respect ofthe Community institutions, Article 286 0 nied Treaty provides that Drom 1 January 1999, Community acts on the protection of individuals with fepardio the processingofpersonal data and thefree movement of such data shal poly tothe institations and bodies set up by, oF on the basis ofthis Westy Before the date refered to in paragraph, the Cound actingin accordance with the Droccdurereferedtoin Article 25, shallestablishan independent supe" Non? body Fesponsibe for monitoring the aplication of sch Community acts to Comnnely trentutions and bodies and shall adopt anyother relevant provisions as appropriate Ietion was not taken until the end of 2000, when Regulation 45/2001 on the protee Beef dividuals with regard tothe processing of personal data by the Comma Bations and boxliesand on the Free movement of such data® was adopted, entering Bes force atthe end of January 200. The Regulation provides for the appointment © Be gropean Data Protection Supervisor” and contains provisions, equivalent apy Ethane contained in the Data Protection and Electronic Communications Privacy Bescctvs which will aply to processing carried out by the European institations.je 2804, "S919 uae osoup ut paysoa 2q 01 szomod 218eq atp saquosoud osye aayy2ariq{ won>eiezd EC ann ‘sersuate 10 Aous8e juepuadapury we Jo waLaystiqeyse aU Bursinbox 03 woREPPE UT sajsuaGe K1osjaadns so swor,>uny £9y) asund age ap tious A20uEpUt 30 Apoastp pepuny aq 0 puay sontoMrne Auostazadns ap qeip taal feradse Suyssan0.d-eyep 3010982 gnd yo yadsox waste suajqond sen, Sp fad UE aaorype 0} zapHey yng avendas o1 ASe9 s} YH soWEUE est su, Sestazodns Jrsoniatioe asou asoup pure Souade axp ua5uiaq woRezedas v 24 03 st 2x24 12K JOKED mnq 3380} Wop2ay}22|cko> sey Kousde Azosttons ayy eyp WeaUs ourE> 2tk9puad=pUL < ydzauon poorsiepunstas Ajaprx pue x2jdwwo, © #e—uone|MBOY SuoHEaxUALITUO? |} J Pesiuoo ax9 uI—uom suoneaqunarmo..] feuoneUaTU aq) Aq paquosep ts9q SEH Damonais AzovenSax 24) Jo ywouodwoo 4ay e syaouapuedapur yBnouTY “wepLiadapuy aq oy sopuofe Auostasodns 20} paou ay Uo ssans sie 2A1299N1C] 4p “SAOGE PaIEDIPUT SV soas suonearuntwor9|9y pue eIpaut arp, tu szoqena1 jenpraipur aay yo suon>uiy 24 J240 ay 03 Xpog Azowemndes pasoquisut Spynur ese (WOOO) sUoHES!UMUMYOD Jo I9IHO ay} JO WoUTUSHRES>. 105 PapIHOLE 007 HY suonestMUWOD ayy oxaNoy puapas a20Py SolnSMpUT ABNFeX pur at srsiooya S08 posreatad ou 30} svowemnBox amp pue Buypeny, se Jo [B12UE0 JOW2zICL Sip sotoyssrurtio5 uORERLO;UT ay} apn sj durex Teo aus ejo waunUodde Sip parnoaty sey wopSury payun axa ‘jeouoxsTH"suonrpest feuoneu Aq paouange Gr vorssiurtu0> © 20 soyeynSos ajfuts v qULodde o1 Joyay Jo aovo"p ays Wed UL Wiflam saqead8 Aazeo Au ‘payeos wou ‘suorst>ap yep a2ucanb Sox aqp pen poruasoidax ag Seu asryiadxe pure sysasayur jo Stes sop eveKp APL sre s144 nq “uasstp feusayUT 205 fenKrarod azow st axoqn Apog areiBF[09"XPEM “PIO Beoc ay so santge pu Aayfeuosiad ayp tiodn puadap 4jsno.ago tts. yon yBnoUpe Msoneqnas oy ypeoudde yuo|sisuo> pure pesnoas a10ut e Burag 02 age 2 [M4 Kou Z01 Rejndor afBurs y “seare soyio Aweur uy pare g avy sro1]ndas adja Bi2uis jo sysour aanepeu ayy, xapoypMe Jo uo}ssyNtHoD pazaqurournmate HL AOKNE Bernsen 20 syois jonuteysqns & aq Aeur wym Aq parsoddns woq(e owner ayfuys © 30 roonuodde ayy uaamiog sdecpod sa 210y> Aay axp ang ajqzyeae axe suondo Lue Keno8e Axoyejn3ar 249 joammionns axp suzzou0o apeUs ag 0} sp32U oq suOIsTIOp LO yo uc 101208 ayeatsd ow pu axignd ay) 20 soyouade yerodas yiaeso}ous8v a7e18 Boe yesopey ywosoynp Ayam usansog poptapps1 Aayrqysuodsa rananoy news99 tT Bousriqerse 909 s0q Kouade Azostasadns aus sare zoquuoyy 30 Asofews a UT ‘sa1s9) 1eaK-aay 205 parutodde 20m yiog, Be eysisse sry se epeBjoqt winbeo{ spy yum ‘rostasadng very aq se xUnSNHL 11ad JO Ht nodde ayy pasunouur ,¢s/¥002 WoIST>9q 230309 a8depp 01 a1aM SOK Om JOUR xomoazowd Viva aNY xovarta | 79ly given that public purse Be agencies, the Bin these agen SUPERVISORY AGENCIES | 63 spvestigative powers, such as powers of access to data forming the subject-matter Gf processing operations and powers to collect all the information necessary for fhe performance ofits supervisory duties fective powers of intervention, such as, for example, that of delivering opin fons before processing operations are cartied out, in accordance with Article 20 ghd ensuring appropriate publication of such opinions, of ordering the block fg, erasure, or destruction of data, of imposing a temporary or definitive bar to processing, of warning or admonishing the controller, or that of eferring th uatter to national parliaments or other political institutions and the power to engage in legal proceedings where the national provisions adopted pursuant to this directive have been violated or to bring these violations to the attention of the judicial authorities" Beis further provided that: ory authority shall hear claims lodged by any person, or by an Bon representing that person, concerning the protection of is rights and freedoms processing of personal data, The person concerned shall be informed lbfthe outcome ofthe claim.” Fhe Information Commissioner and Tribunal ser the United Kingdom's Data Protection Act 1984, the office of Data Protection Bitrar as created. n addition tothe Registrar, the Act provided forthe establish Bo of Data Protection Tribunal. The sole function ofthe Data Protection Tribunal © tohear appeals brought by data users or computer bureaux against decisions taken Be tne Registrar which directly afect them. The Tribunal could uphold the Registrar's ginal ruling, reverse it, or wherethe Registrarsact involved the exerise of disre Bos, substitute its own ruling bthe first Data Protection Registrar, Mr Eric Howe, was appointed in 1984, and after Being tivo terms of office was replaced in 1994 by Mrs Elizabeth France, who served eel 2003, when she became Telecommunications Ombudsman. The current holder is Bechara Thomas, whose term ofoffice runs to Jane 2009. Inher Twelfth Annual Geblishedin 1996, he hen Registrar indicated concera thatthetitle of Registat placed FB edve emphasis on one (rather bureaucratic) aspect ofherroleand suggested that with pe introduction of a new Data Protection Act there should be a change in nomencls Hare so that her office should be described as Privacy Protection Commissioner. This Request was accepted in part, although the Data Protection Act 1988 in common with Bre 1984 Act eschewed any mention of the word ‘privacy’ From the date ofthe 1998 Baers entry into force, it provided that the ‘Data Protection Registrar...shall continue Grexistence by the name of the Data Protection Commissioner.” With the enactmentsesqgyaueusnaop/pe0idnpe's ea wonexsoye, mp Ws) WOE PTV a vrs 0 aopanit342j 18 PPDRPOM secu a toda 1949 SEU © anna Haro OD PEP 8 SSH 8 1 yo siaquinw go erste ea] WoHTEe! O13 aus asta eA ysampaaoid oid 49¥ ag sass worDaUoo we ssfost40> wep 4a ved $995 348 WHO} St erpou yo anznos yweoyTuss Joup0 Aquo ax *WomTU ss ode JO # yuauaz9408 sg papny ave wore uonezoyu Jo wopoods Jo w0dsas Wl Ae ya>uiny $920 sen uBeoxnlysuaen ep vodn pasoduny suoneligo = Puy EV OF jo adoos axp Sut 28 WoT cut sonup uorsoap sky, Burpuouy 3s Aes] 29 Prnens a Gera woquaqu ogy tf seus JOUOISTESEIOD 2229810} PE aq on spuny aniqnd joy uoystaord soxeu g6gT HY WONZHO‘ PEC 2 iuSnoupy “woRe|st#a] axp Jo eu ee gan moge saregep ay Jo Area 302900 a) 78 weds PPT 2 prnoys 320% Fe rostasadns axa nou o ast, "wom 1930 way oH Y ar98s9s00 80 es2do rp spounonoraggeapisuo2 sobs wotest wero usisans © Fe vonezado up Sgenaut pofogds ae ges €97 aos ‘THO. A] PTS 1HaIRION, Fre soqea PTE .05 20) pays gese used ay 2200HsTENTOD HN sissy we Aq paper, Mee wongo oezedag 900 TeEISATS © 8 90 SAIUOBHTENIID Uo yeunsoyt UL ‘9309 94 24 100 Fu sup yom wonduansse xo t9 oN) HOM 3048 20} ysod aqp uy suruoo aU ee gagc amp wtp wondenese ay) HOH pagans wood AARON uneap pea aveusogun posopisuo> aq ygSNur “myn 00 #49 UE STI 13s Jo 99.03, Gym iow stasnew ayy moxpyy “soan2end Bus.2701e ep yenuaurets9408 SUI20U09 Haan aesrp pasionand-ox © uy paafonay w20q ped pow29u0> [NPIS ap eye Hows panayiuo> you se ToatHyodde ssOUossLstO}) woos od OG Baa ran paurodat u29q sey auapiau! 2U0 ‘Suwssood wep 701098 1 sup ae i ees Aaonasodns ay Jap xr wourimodds we anewue o) IEA Surproop uy 2702 5309 jaw sed a wt passaxdx> u90q et HIISUOD APS prno>renptayps we xptyes sua} Jo zaguares ays Uo TL out Sem src asosant god amy wf aygeasop, wuaunuTodde Jo Worn 5 v ypu 290815 Haan iris araym ane “SLs31 ost Joj 24108 Ayo Aru UOSIN-ACD © A wo!s aa rar got aay wonzavord eC, a) wy apews asUETD 20 SST 09 SHH Hosea on yoqeagnba snes ¥wuauseyed Jo sesToH oa FAP sd wormnjosay PSUIO] oy quo 2940 tuo) PaADUes 29 eH UOHSTETTOD > sng ungyyy “024 Sr ipazoxa iu Wiz0} party © x05 24 oF 8 UML. povefodds 24 O12 raorssrt ui ae arr pun suorypuoo pur suse agp seuTods g66T 19V dosed © ec ou voy woreensoyuy jo wopeakg at pun HO pare|E Smt paysuodsns puoqppe Sun2oq! Teunguy, voneuucyel ap v9 PE su31 $e [PUNUL ray aes ax FV «cTowossesusoD woneaaeye] OY A cou ayy uy aBtreUD panvsny 2 uoag seu own Toe step RsuBoo2q “won swe YX 9 AE ado ay 203, Beuodsas aus¥209 ose soUe}sTUo) 2 ‘0002 PY HREM jo wopaaig 241 J0 omgauowa vava axy xovAntd | F9SUPERVISORY AGENCIES | 6 E guimissioner, whilst any significant reduction in the numbers of those liable to Moti have significant implications either for the financial s imposed Bs nating subject to a registration requirement or forthe ¢ mmission ene stream Betially this chapter will focus on b and maintenance of the Data Son Fesistcrandtheobligationsimposedondataconmranae Attention willthen Sipe the investigative and enforcement powers confer cet the Commissioner, Bee concluding wit BeeCommissioner 1 account ofthe remaining powers and duties imposed a esulation of data controllers Fang oda, tthe carly data protection statutes was the impasition ofa System ugh terminology inthe field is somewhat ineonsee Be ars nigh be analogiced othe obtaining ofa licence hare Possession of B88 0" 2 motor vehicle, with the onus being placed eee epplicant ers ane reci the avrard. With the mast Increase ia ea xercising effective control in Bi manner has be recognised. An initial step, which was implemented Berri 1984 sw the inzoduction of eystem oops ae Bion and ceaane® 1 requie those wishing to process pertonal der tec cacy soi ualitative criteria, but switches the foes ent B22. '0 indicate the cause ofan application being rejecrad alure to apply for fit Would constitute an offence punishable bys en plications might be Bg tee grounds. Fist, that inthe Registrars opinion Particulars pro ete sr ill bot eve sucientinformationestotheretencte Poy Bn in apelcation may also be refused ifthe Regen sen tisfied thatthe eg ca) Contavene any ofthe data protection princes angen tthe pplinaerad thatthe information avilable to him ic insuicent ts he cat unlikely to contravene any of those princision# peesuurteen years thatthe registration system operate, vet pplications icomputers since s, the impossibility so tus. Thirty-two applications were refused in the yon 1994-95, 31 $596, and none in subsequent years ® Even at th his translated $e Fes rate of one in every 2,650 applica OM registration to notification sisctiveness of the registration process adopted in the Data Protection Act er cased ftom the outset. More recent statutes, such ar the coe n Data Bie 0" Act 1950, moved away from the requirements afunte registration by Ping large numbers of data controllers from any procedum] quirements. EvenSo stoypes xp osu yseapre‘ejep euoedaaRMoCyanE=T TE (4) pire yout st z aqnpoypg ur suoHEPUOD ayp Jo 2U0INeaLIP (2) ssayuin passa2oid 3g Bee regs 2epponred ur ‘pur Aqpryne] pue prey passoroad 9q 1]eys eIeP [PUOSIAg “| eup Suzmbos papayas ym aantvo04C a es v2w2jdun wr y>vordde sup panunuosxy g66t aul Eaop pre] sem safdioutzd wor joud exep 14819 j0 125 & pggl PY UOH=Od FEC SwOPBUTy PoxUA 3p Z9PUN, ppossaooud soyyany ae Bie yoru 203 10 parsozjo> azos ewep ayy yori 404 sesodand ayy 105 Kxess220u Be siey) 22810] ov 203 s120fqns Pep jo uoHeayHUApy syod yortas wsLO} UL ado pure spayriaas 10 pase: Bad sary axe Kaupy yours 205 10 pay2aijo> a1aa Kany Yorn 404 $280 Bp profes Suravy ‘oy9]desosut 20 ayeano2~Ur axe yoIyse yep seq) aanstE 03 vase Bae asm days ajqeuoseas Azoaa ‘arep on dn aday sessanaus zays pure ayesn22e spossonoad x04} 1n3 10/pue payro|}o> 910 [tu 40} sasod.nd aq 07 uorre[ax ur aarssanx9 ou pue yweAdfos ‘axenbape sosodan asoyynyn aqgnedito>ay fem vu passe Besa s0xj3nj ou puv sosodind aqoumn 8ay pure yordx9 “paytvads 20} po129[10> (4) Aqrnyoey pre dqz1ej passacosd (e) steep [euosiad yey aunsua oy ayeys soqu Besmbar Cenb erep oy Suneyar sajdiourad, ay soquaosoud aanysazicy worrsmoId BEC Be jo 9 appnay “ssoueysumou> pur santanise oytoads Jo axaquo ap ur papurdxa puv Bo udioqu 24 0) aummbox yng anpuos poo yo suoneinusso} jesus’ ystyqeIsa YIOq Resouspuouuios way, ay jo 3y2 01 pastBoyeur aq Ajstey Aout Sojdzoutad yons Jo 2I04 Bei “shop ysonsea ayy wosy uorre[si#ay uonrsioud vzep Jo aamyeay v uaaq sey aon203d Bpetss020.d ajquideooe jo squawioves [es9us8 jo worze|nussos ayy, 2]qeas 220ur poueUsaL Beng 22p201d Buyssaa0ud ajqeydoone jo sjuauiozynbas aanueysqne ay ‘sreak 2y1 1240 Bese rytuSis pouey> axcy sxasn evep Jo uorstAsodns yo woy ax JO SUONOU ISAM uonsnpo.uy sajdiouiid uondaj}o1d eyep ayy Sanna” xapnyarodas neo uso ose arc Jo UONEHOUD aqgegeae ar009q he worerandsaya jo sanss to aurepind sayy 9h sy aul Jo woR|2a1ap Jo woRuanozd ayy of sy z34}0 04 A Suorrezrdde sioqy 0} suonaqaisar 10 wos} suondaoxa Suypraoad Jo Wo} 24 sostaoad peuoryppe year ayzes at Jo Apoq axp wr stow!4osd IIH aan Ag parinbar [242] aif} puoseq suosstaoad 2xp jo adons ayy Sura1s1692 Trasshuruioz au Woy wIUED Jo woWssaxdxa we porduroad sey KPI fdiourad ayy jo woneiadsoy ayy wodn puedxo gest V WonDeOzE saqnparpg amos tetp 19825 ON "sa03n0s JO ABeLAEA w WON} U>YED aye veanedde ap BuruzaDu03 ounprnd payela Aapanre Jo stH303 Fo|NONTPS Sep uojsmedo anynborsodouted axa joe oe HE=KHSTES [2 leq syep yp Jo ancreaayar pu Soueano>e 24 Ay, soxg ys pu suornpuo> anes td 34 1414p 349PHUOD [PA PINOT sd yep Jog pure way Hoge Ey sassa2qId ow axEAE 2Fe s}7A/qNS PEP su yoos sopdroutad ap ‘jane asoyy 721098 Pst 2ouarsrx2 Kran sous fq pinousaiaxa wey 32949 94705] woseso| wonDoroxd mp AyHsA oF Pes enuasos y -peoxisap Aigesstnansy pue Xpuouetzad sf Ways su ao cod dunen seeqzod ‘pastabe S14 st erep ways aBers amp toss Buyssaooud senuo3 our ach eds sajdfoutad wor>oyo1d wep 2, 2AK2a¥4C gy UE qqeap are saog viop Joproqsien 290 soru99 pte anoss ayenbope 30 un ssivo(qns evep 10 siyBlz au ApewseU “pazano> s>idor [PuOREPPE 2X Tapun padope acouy Uetp Zapeoug st saydioutrd wopAury Pawel ep J euosiad jo Hu aq 02 vores ur si2a{qns ® 1y pure sujfls aun 405 wORBIO4. uenbape ub saznsta 4309332) 10 Kzjum09 ey ssaqtm waxy awOTODA t sp aprsino Azovpzay 20 Anno © 0} palsajsues aq YOU TTPYS ET -eyep [euosiad ‘or aBeurep 10 JO Wor zo io esaprne ute pow wep reuosod jo Sugsooord yarn OP Hneun sutede uoyea 9q [jeus samnseaue [euorrestue8zo pur [ear 92} 21 ays sqoofqns eiep jo syySts ax wats souepsoore uy passaoord 24 THUS WEP ‘asodind asoy3 10 asodind 19000 so8uoy 105 1day 99 201 {ey sos0dd 10 asodd Ku 30jpossa2o1d PEP TH syep on din dan ‘Kresso20u a1aqo “pure ayean22e 29 TEES Ee spassoaoad axe Aavp yore 10} sosodn: and 943 01 uneasy aaiss2oxo 30U pure easyer ‘azenbepe oq Les PIED) ssasodand 2604 0 jexp yutn aqueduroour soutreus ere wy possanoud saypany 2q 10u [Tes Pu ind fate pur pay|20ds az0u 10 240 20) Ayo patFEgO 241045 © fg | satatonnid NOLLDALOWS VVC AH Binpays ey suoryp% Bee reqs enon red w Sexson tv See B UPI 10) 20 p23} eu) 228110] 01 20} 5339 Bac souny ove dong preou Suracy ‘ovoid Bsncu days 2jqouos Be yo! 20) sasodany Bed soyjan 100 pur s9 aber ‘Aaypenb wyep oF Be 9 apniy sasuesa Bedsow 9q 01 aninba ppurwnuos ual 2 Stop asorv9 oy) wo Beo01d ajquidacoe jos sou20id Burss2001d Buruits pat sajdiouSuyssaooud jo suo) seynoqised jc Seedsor ur paydde oq few edaouo ayy soy ayexysnjy jeungi4y, uonreeaaopUT 349 30 sUOIS v soUoWsIUNLHO) ayy Aq 1ySNOsq stONZR Jo JAqUENU & ‘puodss ‘pur spauTerqo cu20JUT KPIS Uy Tae 34 O} pres PEM syuatiasMbas 9y!>ods wos 0} LOL >] au) UF apeUL st SouRAaJaN SHY UEAA}—I axe Suyssao0rd sey Jo sr>adse ONT ryenejun Surssav0ud sapuar [jm woystAoxd axp jo ypeaug Aue xay aaa ing pauteiqo SeIep Y>IYM ur soUUEUE 249 Jo IXoIUOD ayp MT SsOUsTRY O} aaUEIaJOI aA|SUDIKD 210% Beqres soyeur joy yy, “siuowormnbas jeBoq jo wij ay wy a1e pasoduuy syuauiosynbos Bei jo re soppnay pur sjeusoy si us yog ssouezTes Jo yda>U09 ax OF sHayas aanamtcr Sep uSroqyry uormuyap parriap 03 pasins-yp sdeysad s id 3094 Jo wonoU 34) Guyssazoud sey xyejuin 9g 0} pouopisto> yng nyse] aq Kea Buiss0>0:4 Bioj2q poqus2sap 2q IM se uyeSy “2¥ woN>aI0Ng EEC aM Jo PEANUT aq ILM SLONIP Zalnpayps ayp Jo 2uo Ulypyst 2wWO> ou sop 1141 mq MFA pu sey 99 AUST Baiss0205,1 “woneyst8aq au9 Jo ysea1g wt sayjonjuo> axp 904d Ae yoadsax Aue UY aunyEY suompuo> ¢ 10 z ajnpoyps ayroads stp Jo au0 389] 3 YILA 29UepOIE UT + pup siqmngane] + ‘yep sson0ad 01 pasmnbas axe aq, su9[jomuoa wep uo suoste84Iq0 anf Bejnuin9 aan sasodury jdioutad yay ayy, jaaye aus 243 04 ae sapdroutad saan2anrcy Ba. -A11my210] pue Apney, passa2oud aq wxep ze4p saxmnbax uone}0x4 wep IY S9V AU Buyssaooud jnyme} pur ayey Seanseou Ayanoas aeadosdde dope siasn yeip Suqabar ‘ad}aujzd uon>o}oud wy Bis2sc8 ayy jo uoneodo oy s9pisuo> jun sondeyo six Mqqeur zed paren v 01 evep Be emsopsip epnpour jm pue surs0y yo hyarrea & aye) deur as7) “wep [euossad ss2>01d Pppoysy] Aeus sojjonues wep v suonspues yy soptn pur yHAIX YeHEA 0} OpIsCOD TIE BBadeus stop ‘soydroutzd Surureurar ay; uo Sursnooq -Ayprexedas paxopisuosq ta “Kjoan, Eeodso1 ‘soy evep sapuogsuieny 4940 sjosiwo> pur 22a(qns wrep a4p Jo sIUE a MEM Beijeop saldiourad yaysie agp pue ypxis ay Som zuasasd aep Jo sasodind exp 30 1099105 F861 Bein 111s pareduios snaeys pea] paouequa we aagooau 0} asaup 105 Buypiaosd y S66 Ban (i118 <22n 201d Jo s2pon ay:zads-soy298 40) paSestaua sf 2por jueayIUBIs e “Apeuty Boues.jor Sumunuo> sroyp yur] Kour—Burssao0xd Jo wonsuyap yp ut Aypersedso—so Bees ySooyyye eouensjas owos jo uyewos [Tim PS6t DV oRDeIOIg BEG aM JapUN Beet suojsioap jo soquinu y ‘wopeurLs.9p jeuNglET, © 30 2Beys ax poraees aAKy s95e9 Be quo ‘uoneaydde say ayn Jo sxead auBie ysourpe ur ae Buystidans sdeqiad stay Bese> jemize Zursjosos jounquy woryewtsojuy 243 pue syin0> ayp Jo stotst20p ySnom) NOLLALOWa Viva aNV xovArNd | 98Be which data sing unlawfu bin the legisla plied in respec THE DATA PROTECTION PRINCIPLES Be Part 11 of Schedule 1 ofthe Data Protection Act, guidance is given concerni tation of number of the Data Protection Principles. Here, itis provided that where personal data are processed fairly fegard shall be had to the method by which twas obtained, ncladingin pa Hepes any person from whom i was obtained was deceived or misled as to the pur Boe or purposes for which itis tobe held, used or disclosed. epttious and deceptive collection of personal data perhaps in the form of Pho- Beph, would contravene this requirement but would also be likely to constitute 2 Gh of the data subject’s rights under Article 8 of the European Convention on ain Rigi Bis not enough that the data not misled as to the purpose for which the Baisto be used. In order for processing to be lawful itis necessary that information Bren to the data subject about the purposes for which processing willbe carried Eiwo situations are specified inthe Actand the Directive, the fist applying where Gots collected directly from the data subject, perhaps through the completion of Bem, and the second where data i obtained from some other source Beocmation obtained from the data subject BI. ata is obtained from the data subject itis provided that information must b Be wo ormace readily available’ tothe data subject. This formulation ¢ ffers from Bese in the Directive, which requires that information be provided tothe subjest Be where ne alrcadyhasit.Teisnot clear whether the United Ki \gdom's approach Be splements the Directive. Ifa website for example, provides a prominent link Be data protection policy giving the necessary detail, it could be argued that he ee crration is eadily available, but unless and until the data subject follows the link Dp ezanot be argued that ‘he already has i Geterms of the information required to be submitted, the Act requires details a8 Be sicntty ofthe controller or that ofa nominated representative for cases where the eller not established in the EEA. the purposes for which the data are intended Be osed, and any intended recipients ofthe data. The subject must be supplied with: Iiny further information which is necessary having regard to the specific circu er hch the data are or ae tobe processed, to enable processingin respect of is not specified further in the Act. The Data Protection Directive Beever states that subjects must also be informed, whether providing answers 0 0 Be tions is voluntary or compulsory and as tothe possble consequences. failure Be reply” Notice must also be given ofthe right of subject accessoxeye end 23a" IAPS ce Hed 14°1 ANDES 4 zee camps gpd sourpynf- Pe won row eep/opeN erode” PaMPPIUONDIION putes sisunoopspeorsnyani eapaany'di> 28 ge 28 Frosisopmusensoqrimac$sungumonresoyuransyrdi> wey 3 rep 217 Jo 2>aypa jeL>Epnfard ajqyssod axp pur sojjoxzu0> o4p 303 suOTTeDy| AL PeOPLON ue siso> ayy uaoaraq powutiopiad aq 0} axinbar yea 32" Buucqeq V "2569 [Enplatpur eee uy paurwseiap 2q 04 138} jo uoTsanb v aq [ILM SHIA eH Mata 24 passaidxa sey Seuowssrunwor uonew20juy auy, :120y evn odordstp, aamarasuod 1ySTu FY OF $2 fox18 s| uontyep ON. 20H areUoRodosdsyp, 2ajonur pnom i azaK uaags aq Ou peou vorye24 rou yey sapracid yoy ayy, xoqjozit0> exep v Aq paseypind aq deur y>tyes BaisiBoy pesor29] 2p $0 WOrszan poripo 2xp tT paysl| SIoI0A jenpraypur axp aq aBLUE Bydurexs uy eyepjouorjsayjoreuraouezeadde wreoyrusisurenprarpurpueyesayduod BS équo soxfeu siza(qns remand Surusa2u0> ewep eH 2q AYBHUE IF 'S9SED 9WOS UT ‘poxnbai oq deur RonEouli0U ySTYM ye waKFOW axp ayMIASUOD Pom pauTeIgo st eEp auf y>rTas Ie eH Fee) ioqno aun Aue nou aBesyaus on ao\Ep stat eIep ay -, SUIpyoy 10 Ruyprores Bi Eareigo, o 8120 oxy sopn [pur Buyssav0ud yo uonryap Axomgeys ays WHY IORI ay USAID rporzed ajqewosvas 8 urge uoaif 2g sur oreoyniou “woRrENAS soqRo Aare UT yeqpae apeus aq astute one=yrou “posopsrp 94 o> Apaygqun st eyep reqN pauyunsarep APUanbasqns st tJ au yeu 18 uaa 2q isnt uoRe>yNOU “Ated pamys © 01 PasopsEp sf eH awn rey 38 Bpeur aq isn uore>ytou ‘iaqjosi40> exep ar9id}303 ayp Aq Ps sr yep 2031 soureu99s ajqissod yo ates v yyia xojdwo> yeysauros si sity Usinoyape peur Se 0} st uoreayniou trie ye aur amp 10j apeut st worstaord ayrpads oy Xtsed pany Sa Ag. asa{qns exep ap 0} Uast 9q o1—anoge paqur>sap wp oy wars PUL eusis—uoreoyriou x05 saprvoad soy ayp wonems v Yans uy z9Coydus> enuarod e se ons Cred para v03 wo 3143 sossed pur uonrpuon [eoypaut szuatted wyo ywoUssasse ue Bejidtuo> souionroead jearpaws e axoqe Worms 243 U1 oq 4S adurexe try 92/qns rep acy wow 10430 29mos ews} pauTerqo 2q10u Avs wORIELUAOyUT soouT|SUE AULT ypalgns eyep ayy woy pauteygo 10u LoReWLOJUL “giv s66t 2tn Zapun pastoytoj aq pinom ypeosdde aures ax soya mata amp passozdx ex souseran a4, 120lqns ep ax Woy pars]. sea Eep amp aT AMD YeIMUEG sn swuauiosmnbaz ag yeya payns [eunqyay, wonDar0sg EEC 4 Boy wor22104 inc 4 (12p10 proyx) suoHLonowy ‘uoRE|S!#9] PROT aXN PUN WyBNOAg >s89 e UT I9A/qNS sep ou 01 wast aq 0 parinbay st wonrewzsoyen 243 Uayee Astoads JOU s20p 1 AL NOLLOaLOWd VL¥G ANY 29VALN | 06THE DATA PROTECTION PRINCIPLES | 91 Be saterests of the subject. One specific factor identified as being of relevance Bibs th extent to which the subject may already know about the processing of Bonal data, In the example given above, although the issue of disproportional Bree arie, the data subject would be ikely tobe well aware thatthe results of Texamination would be forwarded to the potential employer as part of the ermining whether an offer of employment would be made. fal notions of unfairness perhaps notions of fairness continue to play a valid role is here conduct is Jaw but is considered to be unfair. An Bes not against the specific provisions of th von sehich may arise can be seen in the enforcement notice serv Be Commissioner in August 2006 against the operators of a website company oa The website promoted itself as providing facilities for tracking the location GSeiduals using the Electoral Roll. As the enforcement notice" states: sebsite offers ‘people searching’ facilities and claims to contain ‘over 45 million Be os from the United Kingdom Electoral Rol The website further claims tf Bee records are‘ from the 2001 oll’ These search facilities are offered free of Be ecquire no subscription or registration. Users need only enter the sure Hog nction ofthe person they wish to rac forthe system to return ist ofl resi register entries that match the search criteria. of the Electoral Rol for commercial and other non-voting purposes hed lon Be ause of controversy. Under the terms of the Representation of the People rations 1990,!* Electoral Registration Officers were obliged to sup. = ister for their area upon request. Prior to the introduction ofthese Beeitions the officers were required to supply copies ofthe Regier ‘only where these Be readily available. The consequence was # massive in usage of data Be the Electoral Rolls for direct marketing and similar purposes. Following Bort of «working group, the Home Secretary reported to rliament concerns that the stands, anyone may buy a copy ofthe electoral register for any purpose. The Horne Office andclectoral administrators receiverore complaints about hat tan any ere clject, People are unhappy about the large amount of unsolicited mai junk eee companies that have obtained their detals from the elector! sister Pathaps more worryingly, the advent of powerful CD-Roms complet from the ronal register, which allow for searching by name means for example het S90 Hcvocscarstrac their former partners with considerable case usinga single CD-Rom People who fel threatened in that way ray imply not dare o reset srr or ubat, together with the requirements of the European Union data pr thon directive,” which was signed and agreed by the r Administration and, Directive 9546/ECBoos syeprsspu ogo vonsodod weayius sey uaa apjun 9013009 Repo s9UOISSHUNION aU ausjam sjonuoo erep at Uo 2igelteae eyep IUEASP Ban 2yeur on Sumenuod Sq suoneinfoy zooz aq) pue aysts wey) pastozexo ancy Bein asoup jo soysio ssazdxa ayp autuuzapun op areyun st yr raystB01 pope aq Boxy popajose ase dayy gous ysonbar 01 481 Bane OU seMpLAIpUT EER UAE asm sit wo suoryainsoa ssaudxo Aue noypien Suwon, uux820 jeasoumw0> 0} pasoppstp Auranbasqns ag o1 Wor eUTOGUL UP 10} SUO Rono!su0> jeuruns> eyo Aayeuad wo woremtzoyut jeuosiad ap soad 0} patjadit10> Be ox syenprarpur 20j s1ejun stjuazayur st 324 s4apIsto> JoUOSSTLUHIOD 24 J areyun pamminsut Soc ur evep axp oasn acpi exp pauwuay9p sOUOrSsTUNLOD) WORBULIO;UT a FAA2MOH, seq) popnjsuos aariou wousaaz0yue aq, Buysse004 Bp caverp soa joy fexo129yg aq seq umn aq 2e poo3s ¥ $8 4] ax JApuM jgsey sea Bed sea eyep axp yore on asn ayy, suonelnBay 2007 amp axoyeq pewer> ase] 9H) ‘TOR Bon3o(3 1007 stp wHoss aye) sem yysqan wor FET aMp to PHY PIP 94], PsnOses aM onjes ays ysrurump pinos aay © Yong soisidoy exoI>2Ig ajqeeae AqpeseutUI09 Ben jo ano xdo 0p 9B sToxp pastozoxa pey slaz0a Jo 1wo9 Jad g¢ punoze ‘soz Aq \_sasodind jiozourtzo9 0 pasn pue ,.parddns ag feu yor “P2aNP Bq ose 1 100 pordo ancy ox asorp Jo seiop 22 Burpnjaxs doo parpat souayo {88 yo Ayn 9g reqs s22001 wan 2. puey yo suEaU Aq s240.1 UY Papapus Thomsed due spuoaes 10 30 Acoo ® soysu pure systBar [jg axa si2adsu OM woszad Y eqn 9 woneynsoy wr papraosd By: coeynsuo> onqnd 205 ayqeyreae 21 sup yBnowpy “suomeaydde peuyap Aqes0P> BS saquinu puv sosodind yexo}2aj9 0) poroynser aq {[IM YOM ‘230A 0} 21418419 Reossad ype jo sypeiap wyeruos yu aarsto4 [ny OUI, “s12Is18 1a sisoyo uoNens!Bay “Pasop>sip vrep 212q; Suraey jo ano 1dc Besi0y 94 u24) BS Grumaoddo ayy uaa'8 pue pasn ag yyw soysiBas ogy ay paueyuo> wrep Gor Bs sesodand ayy Sutprefos uonyeuszoyus uaatd 2q “2002 suoneyn fax Besuspuoury) Galen pue purjsug) aqdoag 218 J Mat sy -soisiBay [esor>ofa aun Jo suoysian oma ystgeise o} 2peut aq 01 SHORE] 10} wojstaoxdl ape 07 12¥ 2fdoad a4} Jo wonewaseaday 9 30 6 HORDS ronrequasaaday 93 Wr payout sosodind porejazun x2410 30} pasn j pros woneutojer rx EAeyH ogo Aes ou 2Key Lo puE ssodand UonEAstFor fero19of> 10 tfe2p a19q1 apraoid on woRES|go AzomEssv z9pun 2q prmoys adoad 7H uous sea 3 17 9pnysuos o1 Kized Bunyrow aun pay ovarad of 48h ap Jo ApezoU} Nomoa1oud viva any xovarta | 26THE DATA PROTECTION PRINCIPLES | 93 details are contained in the relevant data will have subsequently exercised their Fight not to have those details included in the edited electoral register Ring; the website owner was ordered to cease making the data available on its $i c28¢ can perhaps be seen as a borderline one and itis perhaps unfortunate that Eetormation Tribunal was not called upon to deliver a determination, If data was 8 ten years old, could processing still be classed as unfair? Or twenty Hf Data controllers should be able to assess whether their processing will com Beith the requirements ofthe legislation and at least in this area, itis submitted, the fof the law is insufficiently precise. =< registers may represent the most extensive record oftheir kind, have arisen with other forms of records which are required to be made Ble to the public. Concern has been expressed on a number of occasions at BS made of lsts of company shareholders, particulary inthe case of privatised Bekings which might have several hundred-thousand shareholders. It may be that the purpose of making details of shareholders publicly availableis to allow BBcation ofthe owners ofa limited liability company. Use ofthis information for poses of compiling mailing lists for direct marketing purposes raises differen although itis difficu how prohibitions might be enforced against the use lable information for such purposes. aspect of the fair processing inanumber of cases before the Data Protection Tribunal under the provisions of the 1984 Act. At Bras the conduct ofthe then four lead: ncies: CCN, Credit Piste Marketing Services, Equifax, and Infolink, each of which was the recipient Benforcement notice served by the Rey BeeBough the details of their operations vary, each of the credit reference a fedto above holds core of data culled from public sources, Infolink, for example pried as holdin, *toral registration information in the form of the collected electoral rolls for € United Kingdom; BH Scottish Valuation Roll Sp oanty Court Judgments from courts in England and Wales, Northern Treland, Sad the Channel Islands; Sp bankruptcy information obtained from court records and other public sources, Sich as the London and Edinburgh Gazette providing alnk to sister ite’ selling eleceeal gootje2s tp 0 Yolgne ot Moge UoHEULO;UL oF woRYppE UY porDesIx st asa4) AqpIoyA Yyorwes ox Jo 29fqns ays J0 sasaxppeso ssaxppe snojaaid 20 uous oy) on ony Pessaooud 9q 01 sosea> sjenplasput jo seis jeureuy aya 0 Surfs Bp feuosiod et) amnsu 0} squatdioar ayn Hupsynbas ‘yeonwapr AjjenastA BPP s2>nou sayy jo stuu9) aqL ‘O66 NBHY UF so!>UaBe sofeU Ine} ayp to p Biss soonou qowri0jue ‘xonnjos axqeidaoce we apraosd 03 payey Ansnpur pais a1 Br suosssnosip zayy ~2jdiouad uonsa.0ud exep r8ay aqp pocaaes}u0d ‘yan se “pu Bp tewoszod jo Sunssa003d srejum eimmnsuo> oy sensiR2y up Aq pasapisuo9 seen joes aidde renpraspur we inoge suoysioap Suryeur wt erep saxed-pary jo woRseNxD ou, treonedde oun tara ssaxppe arp paseys oye siaypo Jo trang 0 siaquiatt o Be pu woar8 ssosppe aye soprsas snoyaaid moge von eutiyuy anatsi4 pjnow fonpta Bper avo Aq upas2 10j uonwoydde we woxy Sungnsas ys v yey 99 AqqeaAaMT ptnow PPE 0} 2ouaIa23 Aq Surssapord jo ouanboston ayp aAanoH ‘pall st uoReONENp Bo Aarassod a4 “s9po0qs0d jo asn xp yun dqjersadsa ‘pu yeuns05 pe Aiqeuoseat ey Bope>soudar oqo) pun sossauppe isenuo>.g “sodojsata uo seadde eu yeip senna pus Bettrru jo suore;nutiad snopes puv Auour ayp Jo arene 2q [La [feur yunl, Jo satdisas gow pur onbrun aq o1 seyqun are soureu: yng uang 2ou0 wey azo avadte source Sms js0ur ey Moy [1m AUoIsap ouoydays Aue ye aoutE|B y -uoREyUApr jo suvoLN BePwseur soqres v aimsuos soupy 201204 jo zoquunu v wodn paseq sem yi [eBoy Bes Star aoqioead agp sys yxy ge yBnowpY “owreu v ueeA raKAe1 ssauppe UE On 9>U $3791 49 patompuo> arom. sayprvas ‘sase> je ul yous} existBaqiaxp Aa Uae sean on on nedse amp pur suoneiado go1rua80 yp Suruz2.40> ju1od [e991 a {UDT> 943 0 pans: POM por29{0x 99 uorsodde ayy yey uoMepuouruodas 8 905 StI pazboaas soxrvos Bf ss9um0 auto Jou a100 oY syuEaydde pe sofas 0) “aydusex9 205 Sv 0s jana aqcunys Bites © ve steiodo ayShur asouy‘pandde aq aysiu roma aoueydaoze uno su" a Beep eves way auonp e Burdiddins Jo peorsuy Sarton aaisuaixe a10u porayo ospe sa1> peste oun asco jo Zoquamu e uy seq syn wo porezado suone jeungiay ay ut paspoauy Beeuee sous} pao oyp jo try wardiay ayy o4 djasniua sormyoeysipau> puores BseH94s uoneutmap ay) Buyaea] soxpas> jenuajod ou3 swoH> Sy O1 paresatse Be pewrzosur op dydns 0 Aous8e a43 209 09 pnom wonezado yo powaus paystiqens> BAL 840s jo Arortes v ut poon aq ayBiur np 20} woneay\dde repnonumed © yan uon SPPEHOO UF patsenxe pur sajousse aowas9}95 pan ap Aq prey YorreMUOyU! 24) sotja1e2s Ul] FU pg autos pe}anpuoD Besrorey sspym sak sod $899x9 ut paranpuoo Aouae siqp 124) Beemer yr qeadde 5: 1 Pu sp94-) axp ut [eungEay, 243 yo 1z0dar 34 9 os 242 Jo Won PoRpUT uy ape saxppreas i s; HTelUreUT pu siqop peq Jo sa2tie sur Burszodas suequosqns si Aq poriddn Pesewaorer spyoy dousBe yoca ‘uojearzoyur ayqeyyeav Ajxygnd sty 01 uon}ppe UL e21g 1804 at} Aq a/ge|te48 apes pure paonpord Beporisod pue sassarppe ije jo Suns wos uayeI—uonrewzoyur ssasppe [eisod + ‘eg J0 sing + NOMLOALOWd vEvG ANY xOVAIE | +6etice mig father ineffcie: that most ftobe represent possibilty gence to addr individual app ‘of personal da iscussions w Brent notices we Frese notices we fo be processed THE DATA PROTECTION PRINCIPLES | 95 Snformation about any other individual who has been recorded as residing at any Beat the same or similar current or previous address a the subject ofthe search als were lodged by all the agencies with the Data Protection Tribunal which Gered evidence submitted on behalf of theappellant, arguing that depriving them fd-party information would render their operations less effective, The conse Bice would be either an increase in bad debts or the denial of credit to persons who otherwise have been accepted. It mig ain creditors would fo operate in the consumer field. ‘Tribunal accepted that the oper Tr noted that the Data Protection Act 1984 essayed no definition of the word slation was fo protect the rights of ncies provided ber # but held that the prime purpose of the Redividval, Whilst the interests of the credit industry should not be ignored, pri- must be given to the interests of the individual applicant. On this bas Bidered tenfair fora creditreference agency, requested by itscustomersto supply inform: Be ceferonce to a named individval, oto program the extraction of information as to evrch for information about all persons associated with a given address or addresses oewithstanding that they may have no links with the individual [who is] the subject the inquiry or may have no financial relationship with that individual.” mation held, for example, judgments from Bras also argued that much of the info that such data ‘ourts, was public information. It was in the public inte: ibe readily available. Whilst not disputing this argument, the Tribunal pointed Bat they were concerned with a much narrower issue: whether the extraction of Gaformation in connection with a search relating to an unconnected individual B be considered fair. The answer to this must be in the negative. Bail of the credit reference agency decisions, the Tribunal accepted that a breach Be frst data protection principle had occurred, sufficient to justify the Registrar Eeving an enforcement notice. In all the cases, however, the Tribunal conside tbe terms of the notice were excessively broad. Although the unrestricted use of party information was considered objectionable, the Tribunal did a tation relating to members of the applicant's immediate fami Be whom the applicant shared property might be relevant to a decision concern- ‘feredit, To this extent, the terms of the Registrar's enforcement notice J to permit the extraction of third-party information ina restricted set Ercumstances. Bise most recent case concerned with the issue of fair proces ee Union.» The facts of this case have been described above in the context ofthe ‘of whether the Medical Defence Union's activities constituted processing. By gis Johnson vMedical Atpara. 16 S cnhsiweeinformationtrfounsl-govak/Documenisdecisionsfinflinkpdf at pas. 53——_ Oe ———— snd a1 M4 19000] ge sista 0} asnsodxo jo jana sy SuySewe yo [eo8 Aressapau pure ayeusy eo] SEN 2Igt Sjedio> osye azem pure ‘uorun, 22u9j9¢T [Porpawy a1p Jo diysioquiows xp dn apew oy fqns wep amp Jo Arx[eI0} 24) 01 21e {21s siqasau aonposd 03 2yn0s pue CUD Sup jeuorte: oda paseg sea ss9901d aq 384 3 PaysHes 13n09 24 0} paytasard aau=p S921), “1Da/qns eyep auo Aq syegtn se panyeorad aoq aney Sour yMsax ay ySnowpye Pue Ej wor225 70 adoos ays apisino [pa s9ss9201d wow, 2 paqy ay uomuaas930 Geum jo 2918p ott0s 20g Suuplaoad Aq -oyae [FeIap 220ur UL Passnostp st Sty], "VO Bez] voN22¢ yo suojssaoud ayp Jopun 329/40 07 1481s 2) pey aaey pynow rueUTE|duI0D Sq) Aijesnewoine Ajare|duzo> ino parsae> uaag sossaooad yuDUDss9880 3st 3Hp PY Te) Boron 2 dou 3 yeaddy jo 13n0g ayp 4q ppeydin Ajsnourstreun sem toFsTIDUOD SIYL, .c¥dpond uonzoroad seep say amp yo sasodund aup 20) Suissapoud areyun ou~pasyoat, uonviade Si yeqy pure -“aUN sem Aoyfod suowistasse str S.C 248 YUL pfoy oF tunoD stp. oY ado you S| yy rase> yuasaid 24) up yuaUIsas Sips wo ynej9p pjnom yueaydde we yeqp pooura ap pur Arzed pap eInoge ewep Rsonaq uorne[91309 jeonstrers snonusy you auf {Uo Sem a10u3 2xayy ‘Sase> Sou Goura12j21 ypar> axp ut Burdydete req wsosy paustnBunstp aq Pyno> worrenyts © yoMs gc Npuny si} Uo uyesp w asne> jj u} op ep s99uaZIN90 Jo FoquiNUE TEES fqponsinas v jo Susaddeg qn Stxnreave Aq Adu pasnseaur aq youUe> aamrew re yo ysis req st aouarz9dx9 ACUI UI, "2eminf 249 us s¥s0> Jo BussMou aK pur SUITED puny awa atp SayAsososd ye—quouneueu su 4e pai22u1p st Konod 1p Suyidle uy uorpewssoyur passo20ad 1 yy wt Aes. uy noge20.6or 0d quowssosse ¥S1I SW AY! moge seu ApUcaays2 SuNpOU ajdfourad uy st 2104 ep papnjsuo> sewn aansn| ry ‘aaoge passnosip,euieRoy womz2I04] YIP Bstuasség x9 $0 509 ayn tr feunguay, uou2d}014 eveC a Jo UOIS>9p axp JO wuNO>: Bye) Boxary eras ay ssauayy Jo ansst yp uo Aaqurucun sem azoyp ‘92014 woe) prey Barsses01d soyysya wo sa%pnf ay) usoajoq wouragesp sem axa ynoyY ‘aman at! 20320 ayy Suyyuasaadas ur aan Spuadxo Sumunuo> nous op posmnbas aq plnom toRup aauayacy [eONpaN atp wD 9g Bynes uons:pard ayy, popunojun aq 01 paaoud poy siurejdazos snoraasd ayy sayays Bo ssoqpreBos‘snuqu0> pinos puan ayy exp zowe>rpey a1qeHPaXB aq PHO SHI sed YR SS wy ysureBe 1yBno3q ssuTe|duIO Jo Kaoysty IUWSYLUTIS w pey sOI>0p e JT YEE TayET Bes sata oy ‘sase> qpans Jo auronino ay Jo wasjer sea prefan pansy yey WoW Reiforur we sea 11 pur raquo xeynoned e Burajoau porrodar syuapfous Jo aumy Bap jo yun092e Yoo) auroyas au, -agEJUN PasopIsuoD aq pines WorLiA 20U1F9C [P1PIN Bap fq Aorjod yuoussosse ypu © Jo 2sn ap raypays uodn parwaao ase> ayy, syEsuM SOM Buissao0id Aue ‘Sora aq mata sep plnoys ‘oyu Jo soeUI 24) 03 L2alB osye SEM Ronesapist09 atiog “ou pip Aoyp yeKp PIPY [Paddy Jo umnog aqy ‘worsTDap AapIOfeu w NoLOaLOWd VIVE aX¥ KOVARIE | 96THE DATA PROTECTION PRINCIPLES processing Beth the requirement of fairness, neither the Act nor the Directive provide any fon when conduct will be lawful. In the decision of the House of Lords in R v Sess concerned with marital rape, the concept of unlawful conduct was defined Bed Keith as relating to ‘something which is contrary to some law or enactment iBone without lawful justification or excuse’.” In Legal Guidar ation Commissioner indicated that Bibis means that a data controller must comply with al relevant rales of law whether Besved from statute or common law, relating to the purpose and ways in which the Bes controller processes personal data, Peamber of particular areas were identified as being of particlar relevance: |) Confidentiality arising from the relationship of the data controller with the data subject. BS) The ultra viresruleand the rule relating to the excess of delegated powers, under which the data controller may only act within the limits ofits legal powers. BE) Legitimate expectation, that is, the expectation of the individual as to how ata controller will use the information relating to him, BS) Articles ofthe European Convention on Human Rights (the right to respect for private and family life, home, and correspondence) of these topics are dealt with in the Data Protection Act itself, although, again, fs evidence of collision between concepts of fairness and lawfulness. ic factors legitimising processing Geddition to imposing a general requirement that data be processed fairly and law- the Act places the onus on the data controller to evidence specific justification Processing. In the case of general data, processing will be permitted only where the eller can demonstrate compliance with one of alist of conditions laid down in dule 2, For sensitive data, Schedule 3 provides a more restrictive set of qualifying tions, In both Schedules, the list of legitimising factors begins with the notion o/ Bject consent fe fundamental tenet of contract law that silence cannot constitute acceptance 0 bier. Silence, however, can take a variety of forms. Many supermarket transactions be carried out without the exchange ofa single word, et alone one possessing legal Beilaie from jo quouraumbos yp yun zenoned wy pue IA/SHIS6 Fuostio3 jo uORUyap aUA HAL aqqnedtzo> jou s s.eUr Ys aA}9>ax OL WesUOD par|duI] eu papnjouo> 31 '8120/qns Prep 07 3H98 are seu [PISEUIIOD 270}9q ourr go 2q yuastio> zorid yeqp antioautc suoneoremurei0 tuo 2—Tg pure ADeALLg I tr wwourozinbax ayy posspIstio> 1 ,s2sodind Bunayreur Joy suorre>tunNUWOD par jjosun uo vorutdo, ue uy ‘papaau aq bur ypeoadde Ut ydo we zeya s98Bns oy stead fare Sunaoy 67 aHTY 2p YxAWOD juAIRpEP e UE EGTY “Says!s STY JO wORPOTpAT Te S18 04 Aypeas ayge st 129{qns wywp axp aeqp Suroq ywousouinbos 2pSeq ay; HEM “q>POxdde Grado 10 yno-do ue saxpia wp ajqneduo> Buroq se wees Ayjesoue8 st 1 ‘wopSuTy, Peuun own ut poroudiowus sy “pauyap you st w1i0) stuy, dysnon8iqureun uaa aq 32s {go> zey souseas axnoasicy atp “erep Jo Bujssao0xd ax 0} yuosuo> Jo xOqUOD 2H UY passevoud Suaq uy 01 Sune[a1 wep yeuosiad 07 riowss8e sty sayyudis y20{qns warp ayn y>tuen Aq soyst St 30 BOR “ypu powszoju pur ay.oads uaa [pou Aue ueaue |[eys ast0> 5 09/qns BED a1 oq Surpraoud nydjay 2x0un apy FS} aanz2s1C] wOH2=O%d rec 24 PV aq) HF pauyep s1 asezyd soMON “auasuod ‘o1ydxa, saay8420{qNs amp Te Keambar ¢ apnpayps “Sarssa20xd ayp 0} yuasuo> s1y UaayS sey a2a(qns eyep auf, LaYAL Jogae] 2q [12m Butssonoud yep sapiaoad gg6r 19¥ HoRDaOLA EC ap 01 Z >IRPEYS a1 ydo 01 payyseaze sqafgns a1aqes ase at) 24 [im asionou axp‘siseq 1n0-do tre UO Ssajjonuos djay deur Aopede 190(qns ewep sty. jAouOW sn sed oy suodurE Or STEEP nod (95199, sou] xp Buope aq mySter uOeySIEN YsINOr y -noK op sax=qUTJo9q feu Sapisuo> am san1as98 20 spoo8 asous sorreduto> pox22f2sAI[njose9 Jay tM erep ano seus 01 9 pInom a, ‘SUT a Buoqe aq wyGrer woRe|MLAIOS TeDtdAs Y “Pasodoxd Bureq Br yeqe Jo suomeardut yy axa yo areaceum 2q dew 20 22nou ayn pear rou Aer sy2e/qns rep ‘sose> Aurew up passaro.d aq dew wae as0ys suosied Jo sOquUMU 243 asIuHFCeRT jus siopaeqp poideaoe rom se ‘onbyuypor Lut ax Jo as agp asTUNELE 1 TO baer siojostuon eqep NqpeordX, aaeyd ayer ost 305 yuodu0> axe Loup IeUp >1e>4pUr OF olgas eiep arp se 0} osfe nq Busso>01d Jo suis0y patsap agp Jo aonou aAi8 0} wreBe g)-u1 Bundo, se 03 perrayax yovoxdde aanvuzoye ay], x09 ,no ido, ue uy yeu © sa>eIe spafqns af yous anmbor qetasou pom si, “pasta2ay st uora{qojo a2noU ssaqun 22ed dy 29 Bursso>0ud yo stuzoy paynads oyu etn prot 2q [Es 399/qns erep atp "ammpa2dad ‘no ido, tre se 0} paziajar S124 Apu WALUNDOp se]fUNTS 10 WHJ0} 3oprO Le UO UaAIs aq jis suotruon Sinssoooud gzajonuo> Bep ay 40 2104 & opPQ possnostp SAse> [PUMAESL BuoydonSury puo suonenotiy ax Jo xayto> at ur paquosap sea se Xqjea1dXT, ‘pasn aze pty senbyuqpanotseq ap yptn Fea 9q_ JEM VOH.DesueN au 10 9pr0 POU FO UTIOG Aue ysourye ow parayua sex, os auokuY “eiep [eUOsIad yo futssanoad a4} 04 1UastIOD dni8 Ayprrea Ae 129fqns wiep e sou wo ayeqpp anrsuarxe u29q sey azacy ‘sse=K 97 JAD 43811009 prea? gariqeise ues pesqu0d 01 ysis e Bune>_pur 1onpUOD Yat pofdne> souRpS 2>ueDyIUaTS NOIEOaLOWd VIVE GNY AOVATLG | 86THE DATA PROTECTION PRINCIPLES | 99 Bo of someone's wishes, including where this would be done “unless oppes Fe anade (opt-out) Similarly, pre-ticked boxes,¢-on websites are not compatible ition of the Directive either, Hess pending any court decison either inthe United Kingdom or before he Beare arjustice, appears that an ‘opt out’ approach wil be accepted i Bed Kingrom. A key criteria in determining the acceptability of the technique & the clarity of the notification. In Linguaph y Data Prote case broight before the Tribunal under the 19 advertisements a notice to the effect Ee tick here if you do not wish Linguaphone to make your details availabe 10 Bing that there was a breach ofthe data protection principles, the Tibunal sed concern t & gpt out box appears in mite print at the bottom ofthe order form, In fhe ory vie the position, sie of pint and wording ofthe opt-out box does not Hrs asuticen indication thatthe company atedsormay wish to Bold se Tee har personal data provide at the time of enquiry fr the purpose of trading Bond giving information to the data subject, the controller must afford a rea Pron bortanity forthe subject to expres consent (or the lack of i) This was a Gee yer case brought before the Data Protection Tribunal under the 1984 Ac, “pata Protection Registrar. In tis case, the appellant was inthe bust ‘Custom was solicited in a variety of ways, including the dis otlogues and the placing of advertisements in various media, including apers.adi, an television The appellant catalogues gave customers nous °° Be ity and is order forms offered customers the opportunity to excale we Boers for broking purposes. Some adverts, especially those appearing on Fadio erator, did not make mention of the possibility, and in the event that calogve ior ced by telephone, no mention would be made ofthis secondary pur Fr cinowledgement ofan order would, however, besent and this would convey Hy itcrest you. Ifyou do aot wish to receive such mailings please send an ect Bepy of your address label estos ook the view that notification of the intended se came to te Heraal process and served an enforcement notice alleging a breach of the Bs Be protection principle, which, as f ‘under the 1984 Act, required that data pbtained fairly and lawfully sd Data Protection Registrar Case DN/92 31491404 Suyssao0rd Sursruan89{ Jo 2]qede> ‘spunor® jo s9quinu v jo ouo Ajuo saynynsuos 4 ounar nau axp jo rsadse ajyoud-ysity e u22q sey 1u2su09 Jo ydaoue> ary ySnouLY Bulssaroid Buyswi6a] s101224 4940 yaoypne jo pooy stp uodn quopuodap st yprya Surssaoord aanany Aue [ryateyun sapuay oy 24328 PynOM 1 I22yh fantpadsoniaz ancy woutre> wastio> Jo [eMExpIPiM aya IS] 14D IgNOP OU St 2124) un ep ae ueas Jaypo eyep LOTIea0| Jo SuIssa90ud Sy} 20} uast09 atau) mespyytan co AyQISSOd ayp LAA aq Tey SEqLDSgNS JO SIO8N) muuiuso9 2ru0.}29/9 943 UE BIep [ous 103 Aqpeagisads s1ayar yr Ssuoneonmurto:) 2uon29/q puv dread Uo aan2asiq ap Jo 6 aPHAY “2an|2aI1C Bip 20 12 vonsoioxg exec axp sox wr Ajroausp payyads you s] quod sry, puuN kuE Ie Guasuos mesa 07 90(qns tiep ¥ 0} uado sf “uorpuoD qUsUPUEZDd v JOU st UastIOS quasuo2 Jo uoneing rosn eiep au tod sf eiep 2104p Jo 98n snOLAqO-LOU 34} 10} astIOD| Snysod 5 3294ns erep 24) Ure rgo o} woReSEEGo 2qp, eqD payns eunqUA, aqp eIqeoH2eI Bq 10% 1jrur woneoynou soxd aroy my yest! Aq purys you pyno> 1 FususeA JaypaNy v Bexpraoud jo Avs ayqepuatutiod e aq, wyBus uoneayHow Jair] vAS[IYAK ‘PAUTEAGO SVMs rep 21) a10j0q asodand snotago-wou ayp Jo pjor aq 320/qns 243 yeuy pasinbax BureTeIgo Bre.1-poagoau siva{qns evep axp 01 snorago aq pnom yoru asodind vou sem ‘Pays Sesosod:nd Sujouq.asy 20) ep a4 JO 2s “Mey ayp z2sd32qUI 0} sem feUNglA] aX 305 Spe} 21) ‘2>uepmn8 prjasn armstios 1yBU suoRIPUaLIWODY PUL B91}>B1¢ J0 SPO Renouyy Sempns szoasiBoq axp pjaydn eunqe ayy “10158 asoMp BurPUEIST_TMON, _ Butioxsews wastp jo sasodind aqp Joy pasn vyep jeuossad Gouons2,0:d 2p wo uorepusuuorsy sadoang Jo [ounloD ayp pur aonsesd Jo apoo4n Isnpur wre yrs Aa}twx0jt09 ur axaM sootyoeud sueyradde xp wip yno poyurod 20 3do 0) oto sn9 ayp 405 ata 2jduue panos ‘parsons seas.4 SIYT, 1U2 RescoSpoynouyae arp aiep ayy tH033 skep Aastqy pun sosodind Buryo1q-151] 105 past Bq 10x pron sreiap ayp rey no parurod oste sear] auorsn9 ayn pure JonPddns ay 9q 10} s1809 Busvasouy Aqasou “]e> 24p Jo ypBuay ayy a5e212u1 pjnos aaniou y}Dads Ba1i8 “suoydayey dq apeur a1am srapzo azoy.mroedusy poyrurty aavy pInom axoge 01 Besisj0r sour ay) 3 104 ¥ yeep pue spool axp BurEreIgo yy AqpeUnIad pows99 Bano 2q po! e Surapjd Jo auan ayy 18 “yup paysoBSns sean yf "SOO Berd sro17 Bu1dynsnf se yeoydde ayy dq paemso) ynd asom syuouunSre jo soquinu y NOMDILOWd VIVE GNV AOVARHG | OTsneral and sensitive data, a range of grounds are specified which may allow sing to take place without the subject's consent being obtained.” Beal data for concluding or performing a contract with the d sing may lawfully take place when this is necessary, either for entering into or ming a contract with the subject, Some stress should be placed on the adje Bessery. This frequently appears in instruments such as the Furopean Convention Beeman Rights, and the jurisprudence of the European Court of Human Righ Ee has been approved by the European Court of Justice—has adopted an inter- Bon requiring that the practice in question be close to essential for the specified 4 Clearly, information about a data subject’s income may be necessary for a Beto determine whether to grant loan and information as to address will be vital Bail order sale, but controllers should take care not to require more information strictly necessary for the pu for the controller to comply with a legal obligation Ber comments apply to this requirement. A controller may, for example, require ation to ensure that credit facilities are not extended to those under the age of in It would be reasonable for such a controller to require applicants to give an fon that they are aver eighteen years of ag y to protect the vital interests ofthe dota su Besyto envisage situations where the interests of the data subject may require that Be processed in situations where it is not practicable to obtain consent. The limi the subject's ‘vital interests’ might mean, in practice, that the data is likely I6fa Kind considered sensitive. ‘The Information Commissioner has indicated for this view. The only significant exception might be in respect of informa- Relating to a data subject’ financial affairs. As was noted earlier, public opinion & conducted for the Commissioner indicate that protection of financial dat peaked higher by most responden protection of many of the categories Gesignated as sensitive. Processing designed to g ainst the dangers of theft, for example, might be seen as coming within the scope of this provi- h, as will be discussed below, the first data protection principle does not Sehere processing is conducted in connection with the prevention or detection compliance with the principle would prejudice the attainment ofGeouesmbozayp"2svo stan uy quasuos wan sey r29(qns aya EKA Tae} sTerep [Pus Bansuas jo Buysso2oad Suystusrc#o| se paytoads punoxB aay auf waep [Brau IN SY quasuod jpaf yep aanisuas cuornsoddo oy se 2ou9z9y pur oy YR snp Suraq ares asuodsax wo axp yptm ‘isasu0> aanioadsoxjas 30} sonbare ov puod pa szolqes yo afenunaiad rus vAquo wei st poouroyn auL,sHon>e wonbosqs 4 Beseuo9 0s 09 anne [uy wre toaran0 0 sey JofJorUOD ¥ uay pore>yds09 2x0u Besooza sioneyy -pasnyos to9q ancy syferep Ye IOD yeyp 10a a oF a0u we BursasU B clarore 20 iq soe ueur aus Aoaneax¥ wr paypuey aq ueD soTeUT ou) BuHwOSTHeS Hoare yuostos Jy wane -(BurUasu0> 24 plnous ous UPy Jo 1xOU sep 24 [PH YB Bacup) Hupeou yu2suoo ay) Jepun seauouraoo ywourkoydaa tas aya 2940ydul> Se 03) syreiap axa wreqo 0} roHveu prem royn 2 9q pinom 3 ey) ernsse 29 Btw x ‘pono arexo ooh uy punodS sp wodn aoweyas Yona oot 29818 Be jou pesiape fax 29 agStu ss2jor4u09 rep "e018 UT "pasinba 2q pow esto? Beoigns pur uuxdoydio o sasodina reuuzow 24) 40 edass9 29 ‘aK9H4O4 10 PINON Bey p20 ve sso 20 3u9pr>0 jo waKD 2Mp UP JO HOU 90K} Jo sTIH9P PIO ecopd9 uv so) rjosn 2g [dure Joy pynow pura ut au09 aq THUEISUOD As S resseoau, aario0{po au uptM pare|zosse ston1153524.4p OH YUrso}U pfowf or a|fOrIU0> ep 20 yoyasn 2g [34 Yor UE pounuapy aq wash suoyeNNs Aue BNO peu uaag axvy suorepnBas ou ep Og, pad aq 20u Kou 30 deur wostaoid Bs upon uy sooueasunaan ag Atoods or ape ag deer suomeyn as 4p popianzd sy salgns evep jo sisazaquy yeu 89} 10 serop9ay] dpe sigs a9 on apn(ord jo vosear fa are sejnonzed Aue uy poeazeaum 5H Person oxy azo aea>e>yqnd aq wy posovox amu ayfgnd wjo suonouny aHNe Bee so sworn yewutano8 yo astoxoxo ay wt ssaoniuoo vrep jo srasilay Buy Boo vy 2ydurexa 40 suorzouny Aroyne3s Jo astsox9 ayy 20} Axsso20u ayes IMO Pots eso seus Surssa>0xd‘sonsnd jo uonessturtnpe ayp 01 uonEppe wt ‘ssodind z01295 Bed payroads 3 o8ues oy Aressoou a sry uous Anya passarord 99 Arar ECL sya ‘aonsni yo uoposistjupo au 40) Ays5920N Nowoasoua viva GXY AOVANIE | ZOTTHE DATA PROTECTION PRINCIPLES | 103 xplicit. Although the term is not defined in either Act or Directive se Oxford Dictionary definition refers to it being: Sted merely but distinctly: plain in language outspoken: clear: unreserved gh the definition is pethaps not incompatible with an opt-out approach to ‘more may be required of the data controller to ensure that the subject isaware Isproposed to be done with the data. The Information Commissioner has sug: that: Bonsent of the data subject should be absolutely clear. In appropriate cases it specific detail of the processing, the particular type of data to be Biced (or even the specific information), the purposes of the processing and any aspects ofthe pro may affect the individual, for example disclo- Beehich may be made ofthe data." Bed the grant of explicit consent to the processing, the Act provides for a ran {grounds legtimising processing. Thislist has been supplemented by anumber g of secondary legislation. ent-related processing essary for the purposes of exercising or performing any right or téon which is conferred or imposed by law on the data controller in connection femployment. Ether provided thatthe Secretary of State may either exclude the application of . additional conditions. It may be noted that, Data Protection Directive sumed that existing dom Bectof the processing yment-related data, t the provision of adequate safeguards." Unlessitcanbe: ent Jaw provides adequate safeguards for the data subject, United Ki not comply with the Directive unless and until the regulations are mat Ipterests s necessazy to protect the vital interests of the data subject or of anothe is incapable of giving consent or where the controller Bisot reasonably be expected to obtain consent. Jes of such situations might be where medical data relating to the subject the subject who is unconscious in hospital. ‘sa carrier of an infectious dis- ty It is further Bes to be processed in order to tre & processing may be justified where the subject Bad where the data is needed to provide treatment to a third pa fed that processing may take place when this is ital interests of third party and the subject unreasonably pata Proecton Act 1998, Schedule, par Data Protection At 1998, Schedule 3, para. 3).og wed pHs“ Pra send ¢mpops StS] Z"E19 19 928 99) ONY VO ISTE es feud Inpo425 8551 GOH OA Ey poysnes 29 SLon:puo> jeuonyppe weep azynbos 20 suosrengsuye}s99 us wosstaosd sti so wone>tidde Bai 2pnpxe Aes aig jo Aavia096 9 ee 240 ‘suon>uNG exEAUuULaAG® 20 A204 Ser3 Jo ast>u0x9 ax 40} s2qnf Jo WoRENsFURUUPE 9) 205 LeessanoU sy HussaD0ad ay, ‘onbedo reysautios sreadde sfurpao2oid annisadsoud, oy Sunnpjes uorstaosd Syurey20-) “peog sppaissaaxo Buroq se jouMey|ze¢ Ur paston9 SEA WoIs!Aoud ST, sls ye8aq puayep 20 Boosoxo ysyqeas9 01 20 2214p 8] SoTUMEAgo 20} (BuIp229030 aan radsoud Buypn|au}) Su paaocid joo, yarn wonaouuo> 1 20 o asodind ay 30} Lavssanou st Buyssa200d ayy, aansn{yo uojonsiuuipo ay puo sBuypeecoid ‘pow atp Jo santanize ay 01 Bueja1 ojaq passnostp suorstanid Binreis aq) pure uorstacad sty) waaanaq diysuorye[au v Ajay st ax2yp, 129(qns ax jo Bese oyes0qH}9P 24) YBnorys passNa2I0 aAey sn stp SuTeAFOP ax|gnd axp OU BIO Sooner zoju ag wey a0yyns JOU [4 YM IXoIwOD step UT aYOL oD YeDY URLS StL sfgns evep 243.64 uy diavesoqgpp sds Be sor ese oyqnd apes uaag sey wrep [euossod ayy ur poureiuo> woreMtZoyUE uy ujouop 2yqnd aya uy wonowosuy apeut aq 148! suomelnou [esos yeIp pareorpur sep [eonfod 204 ‘sista 100p-o1-s00p Yinoxtp syzasuo> UyEIgo 01 1yBNos sUON Beviio snoifijax axoym Aydde pjnows uorenas sepruns y "warsis zajnduro> ¥ oo 41 aajsten 0} 3198 UoRUayUT ayy JT par9A09 aq pInaN SutsseauED fea OX eyed wr papaouos sea "ssotranbosto> payedriueun auros aaey Ae WOR Be 1ep jo wor}291]0>.=41 apnysuy orBuyss220xd Jo oR UYap ayp Jo WoIstIDXD-ATp WAI og 2alqas sep amp jo wuasuo9 ax no sored Bee 01 ep asp jo amnsopsxp aayoaut ou saop pur 3 yitmn 336,009 2e|nBas UL asOKp 10 Rorisosse ap jo szoquow oy dp ayepa ent Pep a4 “S!9(qHseIEp yo swHope245 PuE ayn 40) paptaosd 2q isnt sprenBayes ayeudoxdde sose9 yons uy sasod:nd worn Ben 20 snoySipor“jearqdosoqyad ‘yeanyfod 20) Hunsixo uonerosse 10 st Suissoo0ud a seypog payioads Aq Buyssa2014 -uoluypa1y aa79294 0} pO}>EIUO> 29 01 1 jun oye pure y2a/qns 249 YALA IDeVUOD OUT auIOD aazy WyBILA OYA suOstOd JO jo aansopsrp axp 01 3uasu09 oy sasnjax yng aseasip snonD2jUL ue wos} SIaYNS 19al fun arya 9g 14st ajdutexa wy saqfonuos 941 Aq pauruapr uaoq sey rDalqns ay SsonouT sip ath eM. ang “sAoge possnosip eur 1 re|UUIS:9q [om KELL LONEMIS STI, NOLLOSLOWd Viva GXV AOVATIa | FOrTHE DATA PROTECTION PRINCIPLES | 10 fous example of such a situation would be the maintenance of criminal Bit may be noted that the Data Protection Directive provides that ‘a com: criminal convictions may be kept only under the control of official 3g for medical purposes Bescessingis necessary for medical purposes and is undertaken by a health pros ivalent duty of confidentiality Bos “medical purposes’ is defined broadly to include ‘preventative medicine, Be diagnosis, medical research, the provision of care and treatment and the ent of he: vices. It should be stressed that in this case, as wit fexceptions described in the present section, the effect is essentially to free the Broiler from the requirement to seek explicit consent to processing. The process Fst be carried out in accordance with the data protection principles and other grements of the Act. Semonitoring Be processing relates to data indicating racial or ethnic origin but is carried out in Heder to monitor compliance with equal opportunities legislation. Appropriate safe Bs must also be taken for the rights and freedoms of data subjects Be again, it is provided that the Secretary of State may define more precisely the Ses coming within the scope of this provision. Care will certainly require to be f ensure that information supplied for this purpose, for example by an appli Gremployment, is used only for monitoring purposes and retained, atleast in a Svhich can identify the subject, for no longer than is necessary Be of the Secretary of State processing occurs in circumstances specified by the Secretary of State. rovision confers a wideranging power on the Secretary of State to extend the lof exemptions. ‘The Data Protection Directive requires that additional exemp: Seinstbe justified by ‘reasons of substantial public interest.” and must be notified {Commission segulatory power has been exercised with the making of the Data Protection sing of Sensitive Personal Data) Order 2000." ‘This provides no fewer than ten Sonal grounds justifying the processing of sensitive personal data, Pe ices 95/4618, arte 8 Bata Provecton Ac 1998, Schedule 3 Bprrcctive 9546/50, Artic bid, Schedule 3, para.Bo soyn pur oafqns xenon e iunvaye suossoap Loddns ox pasn row stern 2:44 ee ayes Kou Burso20 nd yap papranud st yqenbe qons Suowtoad i mars a NS S eycinyzodco jenba oy Sunwejea satqod yo uoresado ayp so1wout 0} woHeUusojUy 889 pon 3oas ‘atnsoxy0 40 kq azine Zourayis ous sxc Aue saydiutad Re pocrosd ejep arp auaneziuos astauzoqn0 148run YEE ing aqgeatsap paxapssuo> fer Bes are gory sontanze jo ouenunaos ayy wuusad oj 2442s suonduroxe 12K17§ ONL {quasuos moypias pajonpuod ag éqsessaoqu snr Bupssanord Bs 2says 20) yuasuoo y>y cea ya0s 0 qos u09 a 1948901 a|qeuoseas TOUS} FHP Be dane ayy soy Assanou 41} aq ana deus sp “Butssosd oy wau0> 10 Hop zatqns ropa veep pajousyjemie s 2x04 A124 anes ENP p9PEAOHE SEH PEP Beas sso] sea 9su0> 20) paau ax ‘aunfBox snoLAaad a JOpUL, “B66 PY OHIO Bec ony 30 yuowaouauni0> ayy 0} 21rd Aextsapum a12M tpt sapan7e Buyz9N02 wor Broxs jevonsutessoxyary © wy siganog ose sasodand aouesnsuy 20) Suss9201d jpouaouoa staalqns Heo 24s 0 yor suoyss9p 205 ss0q ap se post ou st Buyssarocd ana eG Pe Baguio ug sey sas rep 28payuour ym7e ane 30 Sop 2yjortuo> og Be sus> yordxa ureigo 0} ajqeuoseat 10u st yup Suornpu0d 2anyy oF seafans Sut Bessoo 1d yo uszog yy asyeurt3a] suorrey L'g661 12¥ woRsmIONg eIeC ATP JO SIU Borax an auaxer3u0o 1aBrua eye stip so Buss2>0ud ayp ‘eayre wrows suoszad 2824 Bee svans ays uy sBurqys x0 ‘swasedpes8 ‘squared Jo yay a) 7 Step sie}P oy postabot aq YB 29x09 zouesnst 20} Burkle uosiod y ~souuedto> 208 « penuatod jo st pury simp jo wrep ‘Kouwssodxs ayy Buyouanty W SIO1285 Bo28 so ou 217 yo ssouazeme paseazout pur yareasas VNC UE sIwOUEGOTPAaP TEM, surast0o 392fqns Bago 03 3oos 0 2yqeasopum 0 ojqeuoseas aygeonzesda st eeu SHETEHONTAP OF bas Suroqsqyosiuo> aqp it ‘avo papue-tado we you's} aq ope UL St Bos soqno 10 xoddins‘SuryTesunoa jo worsisoad ay yi. wondeUuED UE sar=HH HN Bw a ston uous au2sc0 tofqns aye noua ano parst> oq es HuyssI00Hd ysazayuy aygnd 2uy ut Be pos woneonand ays xn 5042799 Ayqeuosear arnsopsip ap Suryeus Atzed oH) 94 Be vorjeuuojut aya Jo vorennqnd ayy 0 mots v qi ot sip wou waurofeueusr Be ptzo> sadoidu Ajsnorses 10 ysouogsip “sur9 01 Buea erep Jo 2unsOPSIP 2 Be rryBoyxy sovzeyp s20N0]q 2) JO wI0jw $0 UODE 2q Ayu pundwd PIES V joa{qns erep axp jo ywasuo> yoqidxe aq MOYEN Be pots aq sqressavou yuu Busse00uc amp 3oq) uausasnbas vst SoHE? TE sonerposse 30 Apoq Aue Be peptsoud sotasos uy sauna 40 Yo uopensrorurpe agp ut wowadewewssr () 40 suosiad Kure 4o aouaradiro2u 10 ssaut Bn ax 20 fq rps Jodosdun Afpnouas oyio x0 soppesdqeu ssuogsTP asuyede 9nd 24) Bop2os 03 papuarur suonouny Aue yo aBenpstp at PuE PT ute yo won>9KP Be cononasd acp yo, sasodand ayy 405 3uyssa>oud oy aepa1 spunors Om) IY UL woaasowa Viva aXy AvanKa | 90ton withheld Bas less strc is subject d purpose am fe(or where t bvhich are ge Bata protect seek to pro B opportunities ke and where t THE DATA PROTECTION PRINCIPLES | 107 cessing isnot likely to cause substantial damage or stress to the data subject or Seny other person Be mnatar which attracted considerable discussion when the Data Protection Act Bes before Parliament was the realisation that the restrictions on the processing Be etive data would serve to restrict the ability of political parties to conduct acts® Beachy as the canvassing of voters where this would involve maintaining a record of seg intentions, The regulations seek to avoid this prospect by providing that Se rerion relating to politcal opinions may be processed by persons or organisa, Jatered under the Registration of Political Parties Act 1998 to the extent that aera likely to cause substantial damage or distress. Its further provided 1a} Be ects may give writen notice that their personal data is not tobe processed for Be porpoce. The Data Protection (Processing of Sensitive Personal Dots) lected dertatives) Order 2002 makes further provisions regarding the use of such data Bected representative Besrther exemption applies where data is processed for research purposes. This fpply where the processingisin the substantial public interest for cm eas part rere ral research project; wil not result in action being taken with regard tothe pes data subject without explicit consent; and isnot likely to cause substantial ise or distress. Bie final exemption is the shortest of all, but carries significant implications SStive data may be processed where this i Fecessary for the exereise of any functions conferred on a constable by any rule of 1 extensive powers conferred on constables under the common law this pro might serve to justify many forms of processing Peceptions to the first data protection principle By enforcement and revenue-gathering purposes Be icant exception to the operation of the fist principle applies whee data is Bred forte purposes ofthe prevention or detection of crime, the apprehension or ection of offenders, o the assessment or collection of any 12s OF duty and where Be otiance with the principle would be prejudicial tothe atsinment of the purpose Becton. In such cases, the Commissioner may not take an) action 2&8 nstthe data Be evolved alleging a breach of the principle where its aplication would be likely Bpecjucdice the activity in question 629(0). Thera jonale behind the exception lies in Be cccognition that law enforcement agencies might reasonably acaire information Bg hich might normally be regarded as unfair for example as the result of over apg or even eavesdropping on—aconverstion.Itmight,howeves Pe considered- E = 3 A A potre>dponbauy sou ays yep ssoquiw auoydopa ah pure equine Boo. (620130019 x0) 204 ‘pastuoned dynes 9s sdous ayp wunox2e qHEq 141 PE Bes douou yon: mov “pans ays azayn sanoosep 03 age U22q poy 0M JoqeB SDN! Beenid « poiojdiwa pey soup éopuns ayy, ‘SI 0 u2unuIodde 294 wodn yep But Berre> se payonbuo9q sey ‘a\dunexa a0} sy) Jo Peay s9un ap “UorBuTUINY eo%s s95N Beep © dq prey woneutaoyus feuossad 0) 2098 amz08 01 age arom hr2quiq 0 28ngs92 Bons jo suzioy snorses ySnoxp ‘ous ‘sistyeumof anreShsoaur pure sioweS1saaut yeatad Besemranioe a 01 poypenie uooq sey Aan qnd aqqezaprsto> ‘sea aua22s Huuna pafqns wep a4} 0} 20 Z9UOSSHUNLLOD 24 01 Besnpe doris asoxn wap 2jqndion are—posopsip are eiep aif troy 01 Kred Bey 20 sqjono> ax da ano patase> saqyeya.—Busss220ud jo susz0y anya Are youn Bururtazoiop Uy uoye aq EM MaLA >I e eK porEoypUT soy ZOUOHESTTOD) jjonuo> ayy 01 aansene Aayaae Jo suizoy Oyo afeur KeU swOUIdORPAAp [> Beraoy 20 aouesstunoat> uy sire yng i9a(qnserep ayy 01 want WoRE>GOU IND YALA Rescind auo 10j poureigo aq deur vrecr “somtanze Sussanoid BuyoBuo se papseior Be yar eyo suza.u0> apdurad puosss aya Jo wourape muvaysudis ax0w 3 axdioutad uorsaioad wiep say atp yo syuanuanmnbas aya Aystes Br 1991 Aq uoreoysiou wtp zanamoy porou.aq 0 sr rouossruntIoD 24101 uaa Renesyriow e ur xo 200/qns eqep aq 03 2104 Jo Rusa amp Aq sq feu Bsso01d 2g o1 218 yep yp so) sas0dind ay exp sopracad oy 2¢p ‘ydrouLd pores Be Scrardsoqut uy Suissooosd yo syaadse ay}90d oy saau ypryo soqdroutsd Bururewas Bo sso SoupreBor apeut aq pynoa yuaustuo> aures aya worn ‘paapu 3jd72u1xd wo Bora vxep puooes ou) 205 paats yeas © Agnnuapy oy Magn st k—ewep yo Bururego Be oy die>yiods staan yoripa—Bupssaooud Jo uorsuyap ayp Jo wpeaI9 aK HOA sosodand asoup fo sxodind ywyp pin ajqedeto2e souear Ae wr o4ny possop0xl 29 201 [EHS PLE sovdant nye pure payreds a10ut 30 2uo 303 Jo pSuTergo 29 [4s Ep TeUOsz2g sep soujnbox 2fd}outid uonsa10sd wxep pu029s 24 eqep jeuosiad yo Buyuyergo inymeyun 4ynp 10 xe) Kujo Bey 2aij0> 20 muatussosse aup 20 ‘s19puayo Jo wor n2asoud 10 LOIS p ayy ‘au B wo1i2032p 10 uonuaaard ayy 2orpnfaad pynos sey ayy Jo ooueasosqo yeu ee Be uyeisns on youre 2q ous ara ys no4pye “Ky MyeMejuM pasmbre uaeq sey rep OM Bs ano sie soe 01 Ayige saauoyssyurtu0;> ayy todn woR>{s}991 943 eK P2}OU 2 Be Seu 3 Aqnrey 00 0} uouras4Mbar ayy woxy wordaara a1a{duso0>-rvau v Bumpraord Aq jy xoyres pasjoaut rasn auf Jo worms repnoryzed au Jo Wy a4p UH ssausTE] 50.402 p 0} s9Nod ot aai8 aq jou plmoys JauorssrustOD axa oY ayoUNILO;UN NOILaLOWd VL¥G ANY XOvATNa | gorTHE DATA PROTECTION PRINCIPLES | 109 He the situation where the investigator obtained direct access to data held on a com- ter it would be likely that an offence would be committed under the Computer Bsscce Act 1990. In many instances, however, the information would be obtained, Beer through bribing an employee of the data user or by misleading the user as to Bty ond entitlement to access the data. In these situations, the investigator would ally commit to offence. To remedy thissituatior on Data Protection 398 provides that an offence will be committed by a person who ‘knowin Be iescly, without the consent of the data controller’ seeks to obtain or disclose per Hidata or procure its disclosure toa third party. An exception is provided where Maia is obtained in connection with the prevention or detection of crime or in pur feofa court order. A further offence is committed by a person who sells or offers Bai data obtained in contravention of this provision. Both convictions are punish: ya fine of up to £5,000 in the Magistrates Court and to a potentially unlimited Bant in the Crown Court te of the prohibition, there is extensive evidence that the trade in unlawfully ied personal information is continuing, Taking action against those involved in Beactice was identified asapriorityin the Information Commissioner's Regulatory published in 2005 and between 2002 and 2007 28 prosecutions have been ht with a maximum fine of £4,200 being imposed in a case in 2006. This fig Seas made up of fourteen fines of £300 each, imposed in respect of a number ts, and the Commissioner expressed disappointment at the generally low level 'd by the courts.* A report published by the Information fay 2006 entitled What Price Privacy? provides extensive evidence nd tactics used. Based on information obtained in the course of Savestigation into the activities of one private investigator, the report presents the sums charged for obtaining items of personal data; these included £17.50 fo Bring adciresses on the Electoral Roll, £65-£75 for obtaining an ex-directory tel Bee number, £500 for a criminal records check, and £750 for obtaining data relat- mobile telephone account. As stated in a follow-up repor 1 Privacy published in December 2006: Bee oliers use two main methods to obtain the information they want: through cor Bion, or more usually by some form of deception, generally known as “blagging! Becers pretend to be someone they are notin order to wheedle out te information Bi gre cecking. They ae prepared to make several telephone calls to get it. Each cal ma little further towards thei aining information lle Beis which they then sell fora specified price Faformation Commissioner argued for an extension of the penalties provided Bee offence to include a maximum term of imprisonment on conviction in the ili rs ocumentfibrarycorporstefrescarch_and_seports/rcos/va ‘SI6NE DAVEE sou yg eppUONR PER oUNO yBosoN MONTE Toe Ne verde ON nt potwnaatarp DoF 3anD954C oy Beu212 jo 28e ayn yoea pjnom oy asoyt Jo play 2q 01 pau pjnom puosar eyeM) Sur poe yBnoyye resysrB9y wonrajoug ee aNp SuIss2D0Id Jo wry ty 0184142919 eiep [Puosiad jo surant 2} 2281119 30 soe“ 10 usoyyBio 1an0 atom Ao4t sOKpaYo Jo ssofprelas “por mov] 219 Jo oqusaw Asano J ypata Jo ep aqp parsanbas jounor) ySnosog eppuotyy Bepn|pur ‘sonoyine ye>9]‘saxe> autos wy “uaanys Jo 980 ayy 2940 aUDAIDNa hq 2g sea a8iey QqumuoD au}, -o8ey AyyunuWOD aun ded oF a1qey| Woszod A949 SS2uppe pure aureu ax Jo s[exep apnyour pynoys says xp you paptaosd AqpEOY!> 10 Aunmog ureyUrERH pue apidiuod oy pasmbor 359%. we BuyBuvy> “gg67 I2Y aouUT MoUTUZeAOD [90'] 31} Jo suzz01 yA r9puN [euNqy, UoNds}0Ug VEC aK aU0JaQ 24NOI9 210% SuOISID9P Bap ssureBe sjeoddy -ajdiourad won2o.oad exep ypamoy ay) aianesqu0> 0} Ape] 270m Beoriddo ous rexp paysries sem sexisi82y 949 JOM sIseq a4 WO pasnyau sem UOIIEL}s Be Xpreurnin ,,1?4no9 sousiq aarysuordureyp10N yinog pur ,|s1m0> yBnai0g IAT z,THuNOD YBinorog apauduuny ,,ypUNOD YBNoog MOLIEH soMoYINE p1y0 zaquimu Aq payeorpur sjesodord Surssan0ud axp Yat. ansst YOO} OYA ‘TENISIEOY jo PECL at JO YoKUaNE ayy paivesne xe xp ded o4a}qe1] asoxp so poUsTqENsA ey) quoursumbay oy Jo wonEIuauedun ayp ‘sioadse yeaUeUY sy PaUs9> © povesaue8 Ayforignd axp jo yonus ynoypyy "saurty yu92~z ut psonpo.nuy uoREKE a0) e1s1aAor}Uo> sou 4p Jo aU0 pasord xe pod, 0 a8 ey.) AnyuMUULIOD aU a S120 onensiBy aBrey AyyununtHOD Jo soqunU w sures IySno19 Buypo99 ona ct nn tn Boe }o4, wae UH wi seMp oy Popom AqpeonUapy axamoy ‘st apdioutad aq) syuoUanIMbox B30 woneoydée oy Sususa.uoo wowunasur Zoyys UE 2[qopfeae st a>tepm sox) us3) utes 24 Sosn g2AN}D9NICT WORD@IOIA eNECT aU, -passanoud are K9tA Yor 30] @dind 10 osodind ay: o1 uoreax ut anwssaox9 jou pub yueAsfer‘oienbape, 24 eK ein saumbar g661 IV YoNDoIoxg wie am Jo ajdiound uorisaaud wep pA 24 souensjea pur Arenbape Jo sanss| ponijunzod aur Arewuawrerjzed usy press BySN03 24 pinom pus siqp 01 uore[srBaq yey) pure sjesodoud szouoNssTUNLKO? at Be 01 PopIrap pey wauL9A08 axp eI Log Azenaqoy Wy pasunowUtE sem 11-9007 Bey puo20s 041 ur sxrepry yeuonMAsuOD Jo aaunsedag 24) kq payonpUoD asI319x9 NSO & Humojjog “Ne; waLoUT a4) a1OJOq s1¥aK aon puE LIMO} sareENstAEYY NOMOHLOWd VL¥G GNY XOVARYE | ortfog a consultat the second hal decided to ac requires that d pose or purpos fae same term. plication of the se Data Protec anumber oflocs hat the applica Bpeals against th fame and addres Charge was pa horities, incl ember of the ho lof birth are cle although acce the age of eightee amptonshite Dis ‘THE DATA PROTECTION PRINCIPLES | 111 Ibbecome liable to pay the charge during the course of tax year, took the view tha! Hate of birth was irrelevant in the case of thase who were already of an age to pay fax. The appellant argued that many inhabitants of the Rhondda shared surnam forenames, The addition of a note of date of birth would limit the possibility tha Godividual might escape inclusion on the register because his or her identity was Bfased with some other person of the same name. It was also argued that the inchi- E of the information would assist the Registration Officer in the efficient perform jof his or her duties. Sthese arguments were rejected by the Tribunal, It heard evidence that, nation- S fewer than 1 per cent of households contained persons who shared the same sme and forename. Although it accepted that the figure might be higher in the Bndda, it did not consider that this justified the appellant’s actions. The Tribunal Bie find thatthe information the appellant wishes to hold on database concerning ind Miuals exceeds substantially the minimum amount of information which is required SD oorer for him to full the purpose for which he has soughtregistration..tofulfilhis Baty 0 compile and maintain the Community Charges Register + issues were involved in the case of the other councils. Each of the appellants B or proposed to hold, details of the type of property occupied by each subject. information of this type would be classed as personal data and the Registrar Nobjection on the ground that its inclusion was, or would be likely to constitute, a fourth data protection principle. Inthe case of Harrow and Runnymede Buzh Councils, action took the form of a refusal to accept an application for fon. In the case of South Northamptonshire District Council, whose application egistration had previously been accepted, an enforcement notice was served Bp terms of the status of the information relating to type of property, the Tribunal hot whilst there might be justification for holding some information additional Bat required under the Local Government Finance Act 1988, the wish to record s of type of property in every case was excessive. The Tribunal endorsed the Ee given to data users by the Registrar to the effect that they should seek to Sify the minimum amount of personal data which is required in order to enable Eto fulfil their purpose. Where additional data might be required in certain cases, Bee should again be identified and the further information sought or held only in Bheapplicationofthethird (and also the ifth) data protection principles has recently before the Information Tribunal in the case of The Chief Constables Grest Yorkshire, South Yourshire and North Wales Police and the Information nissioner.” At issue in this case were the data retention practices of a number Be aiormation Commissione:'s Office, Guideline Booklet No. 4, The Data Protection Principles Besiow. 198), Be atetic from erep ayp Aq et soypo unease, @) ado oq sou pus joaiayt yuapeamnbo Aus zo 2an2R14 Jo 203 Og INDLIN> fu yo Bein worrusias 2x2 o129/qns Na aM wo pourEias aq aeqeiEp Na at Uo pp Ay ano (npa(qns eiep yueure(dusoo ayn ox Burj PIeG|WoHDTALO' a4 eM Senso swueyedde omy syuous xis uryaeas yeqp axinbar 0} Buypas Beetorssranuoy ap pepuoure y sopdwes yg pue widieBuuy oy syury Surureraieu Be P21 2tp ve uaso “erep Jo uonuaya jo sasod.nd Burypod 103 youag aun Bunndanoy BrP 20 3 simsopsip pur vopusias wsemioq uon>utistp v maxp [eunguuy, 241 Por royrenbun we sosadayAgejouo> jou poo pu wu op sy Bee Beth Arenbo spuy young amp Yasono}y “ONG amp oxy panousas a4 plnots sera bre ‘rep uaa e oye emp Suppuesiopumn pasieroe8 yo way tos pobdey ye Batu seq xg 2290293 wo Qa Pur puey aud a uo zouO|sTIOT ai Sted a4) woantiog a8ueyoxa pasapisuos e wasaidos soqmy Burpoany a 0 243 30 Sinveu ox) uodn sfeSse|apuadap mep uonsauoa Sulureay of ane -3u03U Bus s auoq1 xs aensuowp uorype pu wie wasaid aru) i sopny Fotpann, uy ey eungeay gee a pendaoce sem ay opuayo ayn yo away ayy 204 paueyaa steep axp yep arnses Bes P>E812P poriad e—siva4 091 Jo pouiod v soy saouayo smojsas a10ul put sst94 oe Be) Powrer2s 24 0} soouayo sourur djaanejer jo syerap 10} aptaosd asaya ‘a0UD889 $880 211d Jord Jo wonepossy ayy pu (6rossarepaud siy pure) saUOWstuTLUO-) Besrreezoyur exp uoe.ii0q yuoutzasBe you 31 ‘uoyssmosip Jo s20/qns ayn 99g pet pT Beets Be1p20M4, 30 uorsios wane ays yum souepuoaze ut play sem i th pordeove Br pur szaindiuon jeuosreu 2oyjod ayy wo poureres uaaq pel erep ‘sase> ay Te tT Tanguay, uorreaoyuy ay 04 payeadde sorsoypne ayy -s9jd;ouiad uot soqord BSP Tu pu para ays so soypearg SuayTe 2oniou yuatHaaxopua Ue UAE Yora ponios Besorssteoc 243 tonsonb uy sapyuoyne aoyod axa yawn aouapuodsazio> aatsuoras Bey rep feuosiod ax j0 Bursso2o0d ap yo ut asea ouo wy “isis prooa1 Beets 249 J0 worreiado aya qu parzoutsosumn sasodand 205 pasojstp e299 pry won Beez ae ae seo yuredutos soy ene Azeumad ays ‘aseo yoo Uy 6961 Uruot 20} Bensrsuos & yr 9 sa2tiayo aay “7afqns wep puna axp Jo ase aw pure 646 Beesir29 ostr won szar09 se] aya ‘s9[o1ya4 zo1ou Jo Sues ay) 0 Burges sooUAYO 904 Beso>2s 219 U1 $6261 wr aouayo Buys ‘ase> auo ut soouayo fouTUMED Jo parmrauos feemd eu renprarpus axa ‘ose> y>e9 uy sjenprarpur aanyp jo 12edsar 1 sasu0j 2a1jod yo NOLLOALOWd VEVG ANY xOVAINa | ZIBe provides useful evide of the fact that where data are processed! for a Been sme may continue tobe fairand lawful forlonger than othe Bfont in its advocation ofthe use of technical measures ip lofthe structure of the PNC to achi Thecaseis| he form of modi: sve data protection goals, and timeousness of data Bir data protection principle requires that ‘personal data allt Be necessary, kept up to date’. Data is regarded @ Efor misleading as to any matter of fact" ea data subject may be enti ‘sbeing inaccurate when it is In the event that Ato seek its ree age or distress. nay frequently | ersonal data is sification and, in certain cas ition for any resultant dan Ilike beauty, accuracy’ ‘ein the eye of the beholder. Although stances are re en suggested that scent error rate)” the ble ofa straightforward e of fact, objective ported of inaccurate dat for example, ithas bs ter was subject to an 86 fe will not always be suscep the Police National Comput ffwhether data is acc mply to-aniss ‘A record readin reification may .e inaccurate if Joe Bloggs is age at information supplied by at red Smith infor! ements’ Ifitis assumed that Joe al probity, can it be said tha his issue, the fourth data protection e statement may be in the format fed on three loan a a record may rej rd ns us that Joe Bloggs has Bloggs isin reality ap feb the utmost finan the statement is false? In deter principle is interpreted as follows: Se foucth princip eescy inp not to be regarded as being contravened b sonal data which Betcoller from the dat ® neeurately record information obtained by the dats Ipject or a third party ina case where B having regard to the purpose or purposes for which th further processed mas taken reasonable steps % accuracy ofthe data;and ifthe data subject ha notified the da the data rein 1e data subject’ ‘orate, the data indicate that fact” quirements are cumulative Bie second cleme’ ciple requires that necessary updating of infor Be chal be carried out. The Data Protection Act 1998 do Fement, but it would app f this pr not expand on this whether updating is required purpose to which it will be + that the question 0 Gependent upon the nature of the data and th d of atransa xr and the dataHpumaos Aue yo ‘seta yo Kizanoos eoisuyd ayo ways 9qayB¥ee yunonDY “ANSE evotvave pty ssqs0u4zoqumnuayqezapisuo7s peyiuepr sei ser a7 roma 840 wep Jo UOISSHUSLEN A s0970N soy sponse un stn08J0sunsopp pazsoysneun LOTT 0 oe rtnsap uum a0 easeplnseasurefe yep euoszad rood 0} $22n eee ervoneznaedso pur jesteqpet ayeladoudde yuausofdnu} smu Jyf01100> =P panonu sss pu iso Jo oussose ve Buyers puree a oats a0 Bone Supyei ex staanzoric uon2roag wer oypULUatuasmbaraygerediNo> AL sroutad 9a jo swusurasibas agp cpt ido wsoyp Aq paver Be csossooosd wrep Aur exp Buynsta 10} yqssuodsas 24 [1 saT}ONE? ATELORTPPY cep [euosiad 0} 2Bearep 20 30 oxinsisop 30 sso yiu9pboe rupee pre ep ouoszad jo suyssaDoud yan oP er mer rupee uaqe 2g Toys sansa euonesusizo pe era aedaxdy yep amnsuo oy pa8rygo aze xneamg saqnduso> so ss07es240 par sroyomoo ‘ep ajdisuid uonseoad erep yuuanas aun Jo suHo9 a 29H Aqunoas eved Anse ata B sresoes 30 anjea yo soto] ot ave ey stan Sursoures pure sBurPfOu we ANE Brox 105 Karjod yo usz0y auzos ayesodo szasn yexn axrH 1 0} readde prom 91419 Pronssrond exep qugarn (AL wed atHPeXPS 8661 PY won>atord eC] Pree Boson 0 suru e se pauTevureu S| map 224 UONENYES 20 WE AAS GOH 1p] rae poraod woryewm Are jo ANexo ata [HUN Hep Bupuwees 795 woreryNshl Be prion suo ‘ssa esoun8ax001 ul “rep Hoy>-z0¥rHO8 ase 2) LT od paras 03 ep UEquTeu o oreo we Z9pun 9g TN H25T HP SS Bea oy vorsaoud sn vo spundxo yuouInanstt JON» wowsanrd yrayearnbo ue Gee posate wonoovosa eect a PR ST pry 20} as0dsd 249 30 INTE so eiey soBuio| OW 405 parva aq PTH erp wy B7ENAr GPx Bey ao suoxstsond ayy ase wep 30 Aeron Jo nse 249 ot PONENT Gujdaay puora4 Jo uonenG ppoptaosd taaq axey Aquanbasqns 1ySrur yorum suonenreydxe Aue Ae rods 2g 1 aubox pons 2uE5q¢ 0 spond Jo woHveeypul Ue wOHOWH AS Beers eandoxduro re Hussassez0y por 2q Ost wrTUssoy 2.04 SOUL TEE Hees Sunyepdn xejnes suo} > pure suossap HurMUTUOD Jojstse9 oT 88 asn fureq roar onn aaa pages so awssan0u agg 9qprmoM Brean ow 29/ANs notoazowd viva anv xovanta | PITfhe information updating may’ Bployee’ssuitabil B be supplemented e fifth princi necessary for t B specified pe: re would appea riod for possib Bstier of historic B protection pri g for monitor je or relevance strollers and # processors con ft taking accou: solved: B of any secur THE DATA PROTECTION PRINCIPLES | 115 tices incorporated into computer systems, for example password requirements, of the level of training and supervision of employees. Account can also be taken he manner in which data and equipment are disposed of. A number of instan been reported of the purchasers of second-hand computers discovering that S belonging to the original owner remained in the machine’s memory. Such lapses ht constitute a breach of the principle, as might any deficiency in respect ofthe dis of printouts of computer-generated data," In 1992, the EC adopted a ‘Decision be field of the security of information systems’*” This is concerned, essentially, to asis for Community action and in its Action Line IV calls, inter alia, for H@evelopment of specifications, standardization, evaluation and certification in Bect ofthe security of information systems’ Such measures might be of significant in the field of data protection, although the diversity of processing activities Gh defeat any simple form of classification, ber 1997, the Registrar published a Consultation Paper on information Berity in the context of the need to comply with the relevant provisions of the Data sted that data controllers would be required to iak-based approach in determining the relevant standard of security. rence was made to BS 7799, which contains both a Code of Practice and Specification for Information Security Management. In Parliament, however, the Eeament rejected an amendment which would have recast the interpretative provi B attached to the principle to make specific reference to ‘the risks associated with fesing™ on the basis that asa Befencral principle of law...it is usually necessary to prove a degree of damage. The Beers ‘damage’ and ‘harm’ can be taken together, There are not many actions before Becourts th ed simply on the prospect oftheir being a problem.” feht be considered, however, that such an approach smacks of closing the stable fafcr the horse has bolted of practice Sf the most notable features of the data protection principles is their generality Es the range of applications across which they have to be applied and the multitud Bers subjected to regulation, itis difficult to envisage any other approach. In its Bet the Lindop Committee advocated th ments of general principle should Beeeplemented by around fifty statutory cades of practic iBpi92 1123/0 igs Beco Report SD (Data Protection il), col, 304,4 June Bc. 305, 4 June 1998. Bd 73411978), pars 13.26‘o)9es*r8st BY Gone anpuo> Spo sep jo swpafqns erep 01 wonvaypou Jord Surzinbax sojns pardope TmONeDOSSY SUNNY IAC ay} ‘wONEDOSSe apen soYIOUr pue HONEDOSSy § Suyspraapy aya jo ouROD ayy yep wey oy) Aq ose pue {UNO At WON erep Jo Surureiqo 112 ainsua oy A1essaDou Sea YM JO MATA SMOHEIDOSSY 24 eu reaysi8oq 2x9 “9p0> 94} 0} PrOMazO} 8 UL eH 138) yp Aq PaUDIEI Beiqnopun sem juoumdre sip yo yyBuans 94) ssy Bi aun tone Bosse apes wreaojaz v q paydope sonoesd Jo apo> e yam paussojuo> saonizesd sit queyjodde ayy 30 s[eqaq wo pandxe osye ses 3p uay|sv9 poroprsuos useq sey prey feaqo 2q eiep Yee ajdiouuad uonadeud ep ys1y amp Jo yueuiasNbar ay TAIN Gsu9juca somtise2d Suyroyye8-uopeuzoyur s ueyjadde ayy zayyays jo woRsanb 24) fs poussou0> sonsst aanqueysqns a, ,,uMHs}Ray uOHIVO4 VID 4 swOHAOLI JO Beioap fexmnqr ax ur passnosrp seat aoriead so 89p02 30 sn7ey8 247 JO 288) 3H juoumnoop aanisod agyauaypo we ut seadde prnoys 33843 Bunuioddestp Be pug 1 pue sopyroupyp 0 ats ang on Xp stat ney wr Huon oust wor}Dos sp UT pase amnpaoosd ayy spy “HEU OReUTeTExs wMoqe'*-apeUs sHUETTITOD 27 SHOU | exp aura09 ayy paydurosd sty “syreUr HOH, arexo sq} 01 ssao0e Burureaqo wory payuasoud 9q Aiea y8tus swuapnys yaya Aq Spout v oy se aozape pauireiton spedioutzg pur sroq|s2ueq)-2>1, JoaanrEATUOD 2p Aq Bopoad rey, “Burssaiq payrjenbum s.renst8oy 24: panzao91 aaey] sapo> 94} [TE 1ON, snoary si uy 203209 aanysod wee oury[dano> ons ayer ym pu aon2ead Be 2p0> sry wpim BuyAidutoo u>9q sey pouzeouod 2o8n erep ay) sO4}2Yo 1 pres Ty Bose> 2ar8 oy wonuanuy Aur st syuyjduso> yueaayor Surs9pIsu0D wr 391980] [8661 PY Son2oro1g eve] :>y 24) shim poydeso> aawy si98n erep 1eqn won eayrfen snows ue Rese fe wt 342000 29 104) ueRNSE Le ayNyNSUOD Iu SeoP 202 SHJ0 921954 reap ioaya aqp 01 enstBay ayy wor] WUT $e ureyuoo sapos aq go Atrepy ‘anpBa AoNIUOpIA2 {yuo ssossod sapo> ys ‘Ae “Ayanoe jo seaze oyroods ungpi sajdioutzd go vonejesdraiut ayy 01 se souepmd Bura18 peonpoud waaq aaey sapo> Jo equim jopisu0> v “g66] IY Han IeOIg PIE ay Jo aBessed ay 04 qUoNbosqns sxeak 24) Bensi8>y aun on uoriaxostp afqezapisues pioye 0} se route DMS UY pareTMMAIOS Rowiozmnbor sip ‘texisi8aq aya uodn pasodutt sorinp ays Jo Aureus yyis WourTO> _css\diound uonaajoad exep ayn yun Burdrduro> ut aouepin 10j aarse3d jo Bep0> ssingivou ogy oy apeuawossip on pure aedord on szasn evep Bursoudasso1po9 Eno 0 suonersosse apes afeano2us 01°0s ap oy aetidoade 3 s2ap1s009 94 224 sensiay aqp todn Aimp v sosodur yrs e ses uauupuoure ue ‘aBessed Juequouroyed sy ur 2Bes aye] ery ‘22 2ed Jo (0) attazajax OW paulte}U0> [fi oR2a}orq PIecr ay} “Peonponut ATeUTsIs0 sy NomoaLowd VLVG ANY xovARia | 9TT . PAN Aa