Page 147 - Law and the Media

Law and the Media
Data Protection (Processing of Sensitive Personal Data) Order 2000
The Order provides a further 10 conditions to which regard must be had in addition to
Schedule 3.

The most important conditions for media organizations and journalists are:

Condition 3, which concerns the disclosure, with a view to publication, of sensitive
personal data connected with unlawful acts, dishonesty or malpractice, unfitness or
incompetence, or for the purposes of journalism, literature or art, in circumstances
where the data controller reasonably believes such publication is in the public
interest
Condition 9, which relates to the processing of certain limited types of data for
research purposes.

7.2.5 Rights of the subject of the personal data

Right of access
A person who is the subject of personal data is entitled to apply to the data controller in
writing, on payment of a fee (which at present can be no more than £10), for information as
to whether personal data about him is being processed by or on behalf of the data
controller.

The information must be provided within 40 days. However, the data controller may
reasonably request further information in order to satisfy himself as to the identity of the
person making the request and to locate the information sought by that person. The data
controller need not comply with the request until receipt of the further information.

The data controller is obliged to provide a copy of the personal data in a permanent form
unless doing so would involve disproportionate effort, or the applicant agrees otherwise.

An applicant may apply to the court for an order if the data controller fails to comply with
a request.

Right to prevent processing: damage or distress
A person is entitled at any time to write to a data controller requesting that the controller
cease or does not begin to process personal data concerning him, because it is causing or is
likely to cause unwarranted substantial damage or distress to him or another person.
However, the right does not apply if the applicant has consented to the processing or it is
necessary for the performance of a contract, to comply with legal obligations, or to protect
the vital interests of the data subject.

The data controller must inform the applicant in writing within 21 days as to whether he has
or will comply, or whether he thinks the request is unjustified.
110