Legislation to protect ICT systems: Data Protection Act

Data Protection Act 1998

The Data Protection Act regulates how personal data is used and protects data subjects from the misuse of their personal data.
If a data user wishes to store personal data, they must first register with the Information Commission. This should state the following things:

what data they want to hold
how long they intend to keep it for
what they intend to do with it
who they might pass it on to.

The data user must appoint a named data controller who ensures that the organisation complies with these principles. The data controller is an individual who is over the age of 18 and has the main responsibility for all the data held.
Data subjects have the following rights:

to see what data is being held about them
to have any errors corrected
to refuse to allow data to be processed for direct mail (sometimes called junk mail)
to refuse to allow sensitive data (e.g. political opinions, religious views) to be processed
to complain to the data protection commissioner about any abuse of the act
to claim compensation if they have been caused damage by the misuse of the act.

Getting access to your data
The act with some exceptions gives you the right to find out what data is held about you by organisations. This is known as the ‘right of subject access’. On written request, you can be provided with a copy of all the data the organization holds about you. This can also be done in person and you must be able to prove your identity by means of some form of identification.

Exemptions to the act
You cannot demand to see data that might affect national security or hinder police investigations.
Some data (for instance Electoral Roll) has to be publicly available, and you cannot refuse to allow its publication.

Role of Data Protection Commissioner
The commissioner is responsible for: