data protection
data protection the law applicable to the control of the use of infor- mation about people by those into whose hands it has come. It derives from the COMMUNITY LAW of the EUROPEAN UNION (EU), which provides that member states must protect the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data. The law is not restricted to information on a computer. The system in the UK works through a Data Protection Register and the supervision of a Data Pro- tection Commissioner, all under and in terms of the Data Protection Act 1998 (replacing the 1984 Act). Those who are to use the informa- tion must register – data controllers and data processors. Even those who do not are obliged to deal properly with data as laid down in eight principles: data must be fairly and lawfully processed; be processed for limited purposes; the processing must be adequate, relevant and not excessive; the data must be accurate; data should not be kept longer than necessary; data must be processed in accor- dance with the data subject's rights; data should be kept secure; data cannot be transferred to countries without adequate protection, gen-
113
data protection commissioner
/Image_125.png){kind=small}
erally, intra-EU transfer is permitted, as is transfer to so-called safe havens like the USA. The person about whom data is held – the data subject – has certain rights: a right of access; a right to prevent pro- cessing likely to cause damage or distress; a right to prevent certain processing for the purpose of direct marketing; rights in relation to automated decision-taking; and in certain circumstances a right to compensation. There are many detailed exemptions for the security services and other lawful authorities.