xmlns:atom="http://www.w3.org/2005/Atom" xmlns:atom="http://www.w3.org/2005/Atom"

U.K.

F1Data Protection Act 1998

1998 CHAPTER 29

An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.

[16th July 1998]

Be it enacted by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

Textual Amendments

F1Act repealed (except s. 62, Sch. 15 paras. 13, 15, 16, 18, 19) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 44 (with ss. 117, 209, 210, Sch. 20 paras. 2-9, 17-25, 27-46, 53, 54, 58); S.I. 2018/625, reg. 2(1)(g)

Modifications etc. (not altering text)

C2Act: power to amend conferred (8.5.2008) by virtue of Criminal Justice and Immigration Act 2008 (c. 4), ss. 77(5), 153

Act: Crown status for the purposes of the Act extended (6.5.1999) by S.I. 1999/677, art. 7(3)

Act applied (1.4.2000) by 1999 c. 28, s. 19(2) (with s. 38); S.I. 2000/1066, art. 2

Act excluded (1.3.2000) by S.I. 2000/416, art. 2, Sch.

Act: functions of the Secretary of State transferred to the Lord Chancellor (26.11.2001) by S.I. 2001/3500, arts. 3, 4, Sch. 1 para. 11

Act applied by S.I. 1993/1813, art. 4(2) (as substituted by S.I. 2001/1544, art. 3(5)(6)) (the amendment coming into force in accordance with art. 1(2) of S.I. 2001/1544)

Act (except ss. 6(4)(a)(b), 28, Sch. 5 para. 12(2) for certain purposes and Sch. 6 paras. 2, 3): functions of the Lord Chancellor transferred to the Secretary of State, and all property, rights and liabilities to which the Lord Chancellor is entitled or subject to in connection with any such function transferred to the Secretary of State for Constitutional Affairs (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), arts. 4, 5, Sch. 1 (with art. 6)

Act restricted by The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818), art. 8(2) (the amendment coming into force in accordance with art. 1(2) of the amending S.I.)

Act modified by The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818), art. 11(4) (the amendment coming into force in accordance with art. 1(2) of the amending S.I.)

Act modified by The National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118), art. 5 (the amendment coming into force in accordance with art. 1(2) of the amending S.I.)

Act excluded (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 50(1)

Act applied (N.I.) (12.4.2016) by Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12), s. 1(8)

Act applied (S.) (1.4.2018) by The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66), reg. 1, sch. 6 para. 64 (with reg. 2)

C3Act applied in part (with modifications) in so far as still in force by S.I. 2003/2426, Sch. 1 para. 8AA (as amended) (17.12.2018) by The Privacy and Electronic Communications (Amendment) Regulations 2018 (S.I. 2018/1189), regs. 1, 2(2)(3)

F1Part IU.K. Preliminary

F11 Basic interpretative provisions.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F12 Sensitive personal data.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F13 The special purposes.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F14 The data protection principles.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F15 Application of Act.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F16 The Commissioner . . . .U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Part IIU.K. Rights of data subjects and others

F17 Right of access to personal data.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F18 Provisions supplementary to section 7.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F19 Application of section 7 where data controller is credit reference agency.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F19A Unstructured personal data held by public authorities.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F110 Right to prevent processing likely to cause damage or distress.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F111 Right to prevent processing for purposes of direct marketing.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F112 Rights in relation to automated decision-taking.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F112A Rights of data subjects in relation to exempt manual data.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F113 Compensation for failure to comply with certain requirements.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F114 Rectification, blocking, erasure and destruction.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F115 Jurisdiction and procedure.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Part IIIU.K. Notification by data controllers

F116 Preliminary.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F117 Prohibition on processing without registration.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F118 Notification by data controllers.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F119 Register of notifications.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F120 Duty to notify changes.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F121 Offences.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F122 Preliminary assessment by Commissioner.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F123 Power to make provision for appointment of data protection supervisors.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F124 Duty of certain data controllers to make certain information available.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F125 Functions of Commissioner in relation to making of notification regulations.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F126 Fees regulations.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Part IVU.K. Exemptions

F127 Preliminary.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F128 National security.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F129 Crime and taxation.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F130 Health, education and social work.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F131 Regulatory activity.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F132 Journalism, literature and art.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F133 Research, history and statistics.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F133A Manual data held by public authorities.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F134 Information available to the public by or under enactment.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F135 Disclosures required by law or made in connection with legal proceedings etc.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F135A Parliamentary privilege.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F136 Domestic purposes.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F137 Miscellaneous exemptions.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F138 Powers to make further exemptions by order.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F139 Transitional relief.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1 Part VU.K. Enforcement

F140 Enforcement notices.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F141 Cancellation of enforcement notice.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F141AAssessment noticesU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F141BAssessment notices: limitationsU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F141CCode of practice about assessment noticesU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F142 Request for assessment.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F143 Information notices.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F144 Special information notices.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F145 Determination by Commissioner as to the special purposes.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F146 Restriction on enforcement in case of processing for the special purposes.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F147 Failure to comply with notice.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F148 Rights of appeal.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F149 Determination of appeals.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F150 Powers of entry and inspection.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part VIU.K. Miscellaneous and General

Modifications etc. (not altering text)

F1 Functions of CommissionerU.K.

F151 General duties of Commissioner.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152 Reports and codes of practice to be laid before Parliament.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152AData-sharing codeU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152AADirect marketing codeU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152B data-sharing and direct marketing codes: procedureU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152CAlteration or replacement of data-sharing and direct marketing codes U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152DPublication of data-sharing and direct marketing codes U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F152EEffect of data-sharing and direct marketing codes U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F153 Assistance by Commissioner in cases involving processing for the special purposes.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F154 International co-operation.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F154AInspection of overseas information systemsU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1 Unlawful obtaining et ceteralaetc. of personal dataU.K.

F155 Unlawful obtaining etc. of personal data.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Monetary penaltiesU.K.

F155APower of Commissioner to impose monetary penaltyU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F155BMonetary penalty notices: procedural rightsU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F155CGuidance about monetary penalty noticesU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F155DMonetary penalty notices: enforcementU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F155ENotices under sections 55A and 55B: supplementalU.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1 Records obtained under data subject’s right of accessU.K.

F156 Prohibition of requirement as to production of certain records.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F157 Avoidance of certain contractual terms relating to health records.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1 Information provided to Commissioner or TribunalU.K.

F158 Disclosure of information.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F159 Confidentiality of information.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1 General provisions relating to offencesU.K.

F160 Prosecutions and penalties.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F161 Liability of directors etc.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Amendments of Consumer Credit Act 1974U.K.

62 Amendments of Consumer Credit Act 1974.U.K.

(1)In section 158 of the M1Consumer Credit Act 1974 (duty of agency to disclose filed information)—

(a)in subsection (1)—

(i)in paragraph (a) for “individual” there is substituted “ partnership or other unincorporated body of persons not consisting entirely of bodies corporate ”, and

(ii)for “him” there is substituted “ it ”,

(b)in subsection (2), for “his” there is substituted “ the consumer’s ”, and

(c)in subsection (3), for “him” there is substituted “ the consumer ”.

(2)In section 159 of that Act (correction of wrong information) for subsection (1) there is substituted—

(1)Any individual (the “objector”) given—

(a)information under section 7 of the Data Protection Act 1998 by a credit reference agency, or

(b)information under section 158,

who considers that an entry in his file is incorrect, and that if it is not corrected he is likely to be prejudiced, may give notice to the agency requiring it either to remove the entry from the file or amend it.

(3)In subsections (2) to (6) of that section—

(a)for “consumer”, wherever occurring, there is substituted “ objector ”, and

(b)for “Director”, wherever occurring, there is substituted “ the relevant authority ”.

(4)After subsection (6) of that section there is inserted—

(7)The Data Protection Commissioner may vary or revoke any order made by him under this section.

(8)In this section “the relevant authority” means—

(a)where the objector is a partnership or other unincorporated body of persons, the Director, and

(b)in any other case, the Data Protection Commissioner.

(5)In section 160 of that Act (alternative procedure for business consumers)—

(a)in subsection (4)—

(i)for “him” there is substituted “ to the consumer ”, and

(ii)in paragraphs (a) and (b) for “he” there is substituted “ the consumer ” and for “his” there is substituted “ the consumer’s ”, and

(b)after subsection (6) there is inserted—

(7)In this section “consumer” has the same meaning as in section 158.

Marginal Citations

F1 GeneralU.K.

F163 Application to Crown.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F163A Application to Parliament.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F164 Transmission of notices etc. by electronic or other means.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F165 Service of notices by Commissioner.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F166 Exercise of rights in Scotland by children.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F167 Orders, regulations and rules.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F168 Meaning of “accessible record”.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F169 Meaning of “health professional”.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F170 Supplementary definitions.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F171 Index of defined expressions.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F172 Modifications of Act.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F173 Transitional provisions and savings.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F174 Minor and consequential amendments and repeals and revocations.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F175 Short title, commencement and extent.U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

SCHEDULES

Section 4(1) and (2).

F1SCHEDULE 1U.K. The data protection principles

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 4(3).

F1SCHEDULE 2U.K. Conditions relevant for purposes of the first principle: processing of any personal data

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 4(3).

F1SCHEDULE 3U.K. Conditions relevant for purposes of the first principle: processing of sensitive personal data

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 4(3).

F1SCHEDULE 4U.K. Cases where the eighth principle does not apply

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 6(7).

F1SCHEDULE 5U.K. The Data Protection Commissioner . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Sections 28(12), 48(5).

F1 SCHEDULE 6U.K. Appeal proceedings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 37.

F1SCHEDULE 7U.K. Miscellaneous exemptions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 39.

F1SCHEDULE 8U.K. Transitional relief

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 50.

F1 SCHEDULE 9U.K. Powers of entry and inspection

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 53(6).

F1SCHEDULE 10U.K. Further provisions relating to assistance under section 53

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 68(1)(6).

F1SCHEDULE 11U.K. Educational records

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 68(1)(c).

F1SCHEDULE 12U.K. Accessible public records

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 72.

F1SCHEDULE 13U.K. Modifications of Act having effect before 24th October 2007

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 73.

F1SCHEDULE 14U.K. Transitional provisions and savings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 74(1).

SCHEDULE 15U.K. Minor and consequential amendments

F1Public Records Act 1958 (c. 51)U.K.

F11U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Parliamentary Commissioner Act 1967 (c. 13)U.K.

F12U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F13U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Superannuation Act 1972 (c. 11)U.K.

F14U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1House of Commons Disqualification Act 1975 (c. 24)U.K.

F15U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Northern Ireland Assembly Disqualification Act 1975 (c. 25)U.K.

F16U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Representation of the People Act 1983 (c. 2)U.K.

F17U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1 Access to Medical Reports Act 1988 (c. 28)U.K.

F18U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Football Spectators Act 1989 (c. 37)U.K.

F19U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Education (Student Loans) Act 1990 (c. 6)U.K.

F110U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F1Access to Health Records Act 1990 (c. 23)U.K.

F111U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F112U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13U.K.In section 5(3) of that Act (cases where right of access may be partially excluded) for the words from the beginning to “record” in the first place where it occurs there is substituted “ Access shall not be given under section 3(2) to any part of a health record ”.

F1Access to Personal Files and Medical Reports (Northern Ireland) Order 1991 (1991/1707 (N.I. 14))U.K.

F114U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15U.K.In Article 6(1) of that Order (interpretation), in the definition of “health professional”, for “the Data Protection (Subject Access Modification) (Health) Order 1987” there is substituted “ the Data Protection Act 1998 ”.

Tribunals and Inquiries Act 1992 (c. 53)U.K.

16U.K.In Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals under direct supervision of Council on Tribunals), for paragraph 14 there is substituted—

Data protection

14.

(a) The Data Protection Commissioner appointed under section 6 of the Data Protection Act 1998;

(b) the Data Protection Tribunal constituted under that section, in respect of its jurisdiction under section 48 of that Act.

F1Access to Health Records (Northern Ireland) Order 1993 (1993/1250 (N.I. 4))U.K.

F117U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18U.K.In Article 5(4) of that Order (cases where fee may be required) in sub-paragraph (a), for “the maximum prescribed under section 21 of the Data Protection Act 1984” there is substituted “ such maximum as may be prescribed for the purposes of this Article by regulations under section 7 of the Data Protection Act 1998 ”.

19U.K.In Article 7 of that Order (cases where right of access may be partially excluded) for the words from the beginning to “record” in the first place where it occurs there is substituted “ Access shall not be given under Article 5(2) to any part of a health record ”.

Section 74(2).

F1SCHEDULE 16U.K. Repeals and revocations

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .