Page 143 - Law and the Media

Law and the Media
to the court for an order to rectify, block, erase or destroy personal data, and he is entitled
to compensation if he suffers damage as a result of a contravention of the DPA by the data
controller.

There are a series of exceptions to some of the provisions of the DPA. The most important
exception for those working in the media is that found in Section 32 of the DPA, which
concerns ‘journalism, literature and art’.

Section 55 of the DPA creates a number of criminal offences, including unlawfully obtaining
or disclosing personal information or offering to sell personal data. Those working in the
media must be particularly careful when obtaining personal information about the subject of
an article or programme in order to avoid committing such an offence.

The DPA also extends the powers of the Data Protection Commissioner, who, along with the
Data Protection Tribunal, is authorized to deal with disputes relating to data protection law.
However, the DPA has been amended by the Freedom of Information Act 2000. The Freedom
of Information Act 2000 will be enforced by a newly established Information Commissioner,
who will also oversee the DPA, along with an Information Tribunal. In the future, the Data
Protection Commissioner will therefore become the Information Commissioner. Because the
Data Protection Act 1998 and the Freedom of Information Act 2000 both relate to
information policy, this double supervisory role should allow the Information Commissioner
to provide a coherent approach to the handling of and access to information. Some of the
changes brought about by the Freedom of Information Act 2000 will not take effect until
2005.

There has been very little judicial consideration of the provisions of the DPA. Moreover, the
DPA will now have to be construed in the light of the Article 8 European Convention on
Human Rights right to privacy introduced into English law by the Human Rights Act 1998.
Under the Human Rights Act 1998, information must not provided if it amounts to
unwarranted disclosure to a third party of personal information about any person, including
a deceased person, or any other disclosure that would constitute or could facilitate an
unwarranted invasion of privacy.

7.2.3 Definitions

Data controller
A data controller ‘determines the purposes for which and the manner in which’ personal data
is processed. The DPA applies to any data controller who is ‘established’ in and processes
data in the United Kingdom. ‘Established’ means:

An individual who is ‘ordinarily resident’
A body that is incorporated
A partnership or other unincorporated association that is formed
106