Page 144 - Law and the Media

The Data Protection Act 1998
Any of the above maintaining and regularly using an office, branch or agency
Any of the above using equipment in the United Kingdom for processing data,
unless the data is merely in transit

in and under the laws of the United Kingdom.

Data
‘Data’ includes data on computer systems as well as manual paper-based records, for
example a card index, if it is recorded for a ‘relevant filing system’.

The notion of a ‘relevant filing system’ is a complex one. It encompasses any set of
information relating to individuals that is structured, either by reference to individuals or by
reference to criteria relating to individuals, in such a way that specific information relating
to a particular individual is readily accessible.

Personal data
As well as information that can identify a person by itself or in combination with another
source that is in the possession of, or is likely to come into the possession of, the data controller,
‘personal data’ also includes any expression of opinion about the individual and any indication
of the intentions of the data controller or any other person in respect of the individual. This is a
very wide-ranging provision. It will include notes of interviews about prospective employees,
and internal memoranda about an employee’s promotion prospects.

Sensitive personal data
‘Sensitive personal data’ consists of personal data relating to such matters as race, political
opinion, health, sexuality and criminal proceedings.

Processing
Processing is a very broad concept. It extends to obtaining, recording or holding data, or
carrying out any operation or set of operations on the data. This includes organizing,
adapting, altering, retrieving, consulting, using, disclosing or even erasing the data.

It should be assumed that this definition is capable of extending to any of the many things
that can be done with data, including simply retrieving data to a computer screen. It clearly
extends to storing, adapting and retrieving data on a desktop, laptop or palmtop computer.

7.2.4 Obligations on the data controller

The data controller is subject to three main obligations. He must:

1. Notify the Data Protection Commissioner of his identity and provide a description of the
personal data to be processed and the purpose of that processing
2. Process personal data in compliance with the data protection principles
3. Provide the person who is the subject of the data with access to it.
107