United Kingdom

[GB] Data Protection Act 1998

IRIS 1998-8:1/21

Stefaan Verhulst

PCMLP University of Oxford

The Data Protection Bill 1998 received Royal Assent at the end of July. The new Act implements Council Directive 95/46/EEC ([1995] OJ L281/31) on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The Act creates a Data Protection Commissioner with enhanced privacy protection powers and broadens the scope of the existing legislation so that it now covers for the first time information relating to living individuals held in manual files. The new Act also strengthens the individual's right of access to information held about them. It brings together access rights, which were previously dealt with under separate legislation, such as the individuals' right to have access to their own health and education records, and the right to obtain a copy of their credit reference file. All these rights will now be provided for under the Data Protection Act 1998. Personal data, which are processed for journalistic, literary or artistic purposes are exempt from most of the Bill's provisions (Clause 32) provided the processing is undertaken with a view to publication and the Data Controller reasonably believes that publication would be in the public interest. The latter criterion will be judged having regard to any relevant industry code of practice, for example, the Press Complaints and Broadcasting Standards Commissions Codes. The Act was due to come into force in October 1998 in order to meet the deadline for implementing the EU Directive on http://services.obs.coe.int/en/index.htm Data Protection, however, the UK Government recently announced that the Act will not meet this target date but will be delayed for a short period while some of the secondary legislation supporting the Act is being prepared.