Security, Confidentiality and Legal Issues (SCLIM)

Background notes for session 2 - Legislation

Data Protection Acts 1984 and 1998

The full text of the 1984 act (the first of its kind in this country) is online at http://www.hmso.gov.uk/acts/acts1984/1984035.htm

It was repealed by the 1998 act which came into force on 1st March 2000.

Full text of the 1998 act available online at http://www.hmso.gov.uk/acts/acts1998/19980029.htm. More details about its background at http://www.dataprotection.gov.uk/eurotalk.htm

"An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information." [16th July 1998]

THE PRINCIPLES

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4. Personal data shall be accurate and, where necessary, kept up to date.

5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6. Personal data shall be processed in accordance with the rights of data subjects under this Act.

7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Exemptions [Article 30]

The Secretary of State may by order exempt from the subject information provisions, or modify those provisions in relation to, personal data consisting of:

"Preparing for the new law" from the DPR online at http://www.dataprotection.gov.uk/prepare.htm

The Data Protection Registrar

The Office of the DPR has its own homepage at http://www.dataprotection.gov.uk/ which gives details of its functions and how to register. The register itself can be inspected at http://www.dpr.gov.uk/.

Other data protection legislation

A list of European National Data Protection Authorities can be found at http://www.europa.eu.int/comm/dg15/en/media/dataprot/links.htm.

A useful resource is the Journal of Information, Law and Technology: http://elj.warwick.ac.uk/Jilt/

Computer Misuse Act 1990

The Act is online at http://www.austlii.edu.au/au/other/crime/125.html (courtesy of the Australasian Legal Information Institute).

This act created three new offences:

  1. Unauthorised access to computer material
  2. "A person is guilty of an offence if he causes a computer to perform any function with intent to secure unauthorised access to any program or data held in any computer and he knows at the time when he causes the computer to perform the function that that is the case." [Computer Misuse Act 1990, section 1]

  3. Unauthorised access with intent to commit or facilitate commission of further offences
  4. "A person is guilty of an offence under this section if he commits an offence under section 1 above (‘the unauthorised access offence’) with intent to commit a [further] offence; or to facilitate the commission of such an offence (whether by himself or by any other person)." [Computer Misuse Act 1990, section 2]

  5. Unauthorised modification of computer material

"A person is guilty of an offence if he does any act which causes an unauthorised modification of the contents of any computer; and at the time when he does the act he has the requisite intent and the requisite knowledge." [Computer Misuse Act 1990, section 3]

Some commentary on this (and some other legal issues) by Mark Gould (University of Bristol) is online at http://aranea.law.bris.ac.uk/JISC/.

Les Morss (Napier University) has a commentary at http://www.dcs.napier.ac.uk/~les/virus/cma90.htm.

The University of Portsmouth's regulations on the use of computing facilities (http://www.iso.port.ac.uk/docs/regs/) refer to the Act.

Other computer misuse legislation (including Australian states and USA) is listed at http://www.austlii.edu.au/au/other/crime/12.html.

Other legislation

Official Secrets Act 1911, 1989

Arrangement of sections online at http://www.hmso.gov.uk/acts/summary/01989006.htm.

Regulation of Investigatory Powers Act 2000

Home office page: http://www.homeoffice.gov.uk/ripa/ripact.htm

Access to Health Records Act 1990

The text can be downloaded from http://www.cfoi.org.uk/ahra90.html (Courtesy of the Campaign for Freedom of Information). See also their commentary on it at http://www.cfoi.org.uk/persfilesman.html.

General material

The Journal of Information, Law and Technology (JILT) has its website on data protection at http://elj.warwick.ac.uk/Jilt/.

Questions

  1. What does the Data Protection Act mean for (i) companies (ii) individuals?
  2. Describe the process of registering under the Act.
  3. What are the implications of the legislation for (i) healthcare patients; (ii) university students; (iii) people who oppose government policy?
  4. Do the cases brought so far under the Computer Misuse Act demonstrate that the law is (a) effective; (b) fair?
  5. In law, is the balance right between privacy and openness?
  6. What are the arguments for reforming the Official Secrets Act?
  7. How will the RIP Act affect computer users?
Updated to