The Data Protection Act 1998 came fully into force in March 2000.  It replaced the earlier 1984 Act and brought into British law the European Directive EU/95/46.  The Act created a statutory framework for the collection, processing, storage and disclosure of personal information and sets out eight core data principles.  The Act is enforced by the Information Commissioner’s Office.

Key features include:

• it governs personal data in all formats, including paper, electronic media, photography and CCTV
• a central principle is a person’s right to privacy
• personal data cannot be obtained, stored and used without permission
• it relates to living persons only
• introduces a category of sensitive personal data.

Key responsibilities include:

• use of personal data must be covered by an annual registration with the Information Commissioner’s Office
• the security of personal data
• care in the disclosure of personal data
• rights of the data subject to access their personal data
• compliance with the data principles.