Page 146 - Law and the Media

The Data Protection Act 1998
An exception applies if providing this information would involve a ‘disproportionate effort’.
‘Disproportionate effort’ is not defined, but will be measured against the prejudice to the
subject of the personal data. When the DPA was at the Committee stage, much time was
spent discussing whether a florist asked to deliver flowers must spoil the surprise by
notifying the proposed recipient.

Schedules 2 and 3
The Schedules provide minimum standards only. Compliance with the Schedules will not
automatically render any processing fair and lawful, nor will it affect whether any processing
breaches other statutes or common law principles such as the law of confidence.

For example, in 1997 British Gas wanted to notify its customers about its own and third party
products and services and pass on customer information to other companies in the British
Gas Group. The Data Protection Tribunal held that British Gas had processed data unfairly
despite the fact that it had sent an ‘opt-out’ form to all customers. The Tribunal said that the
form should have been an ‘opt-in’ form. In 1999, Midlands Electricity plc ran into similar
difficulties with a direct marketing campaign.

Schedule 2
Schedule 2 provides that processing will be unlawful under the DPA unless the subject of the
personal data has given his consent to the processing; it is necessary in order to perform a
contract, comply with a legal obligation or the administration of justice or protect the vital
interests of the subject of the personal data.

Schedule 3
At least one of the conditions set out in Schedule 3 must be met when processing personal
data:

1. The data subject has given his explicit consent to the processing of the personal data
2. The processing is necessary under employment legislation
3. The processing is necessary in order to protect the vital interests of the data subject or
another person, usually relied on by the data controller if consent cannot be given by or
on behalf of the subject of the personal data
4. The processing is carried out in the course of legitimate activities by a non-profit political,
philosophical, religious or trade union body or organization in relation to members of the
body or those connected with it
5. The information contained in the personal data has been made public as a result of steps
deliberately taken by the subject of the personal data
6. The processing is necessary in connection with legal proceedings, legal advice or legal
rights
7. The processing is necessary for the administration of justice
8. The processing is necessary for medical purposes
9. The processing is of sensitive personal data consisting of information relating to racial or
ethnic origin necessary for identifying equality of opportunity or treatment.
109