APPENDICES
¶4.4 Two particular provisions are worthy of note. Article 5 sets out the conditions for the automatic
processing of personal data including the requirement that personal data is obtained and processed fairly and lawfully, stored for legitimate purposes, is adequate and relevant for its purpose, is accurate and up to date and preserved in a form which permits identification of the data subject for no longer than required for its purposes. Article 8 grants rights to data subjects, including the right to establish the existence of an automated personal data file, to confirm whether personal data are stored in the automated data file, to receive communication of such data in an intelligible form, to obtain rectification or erasure of such data if these have been processed contrary to the provisions of domestic law and to have a remedy if a request for confirmation, rectification or erasure is not complied with.
¶4.5 Chapter III restricts the cross border flow of personal data in certain circumstances and
Chapter IV contemplates mutual assistance between the parties to the Convention in order to implement the Convention. Article 13 requires the parties to the Convention to designate one or more authorities to have responsibility for assisting other parties to the Convention and to furnish information on the law and administrative practice in the field of data protection.
¶Data Protection Act 1984 4.6 The Data Protection Act 1984 (the 1984 Act) implemented the United Kingdom's obligations
under the Convention and sought to regulate the use of automatically processed information relating to individuals and the provision of services in respect of such information.
¶4.7 The 1984 Act established the position of Data Protection Registrar and also a Data Protection
Tribunal.324 It obliged organisations holding personal data to register with the Data Protection Registrar and thereafter to abide by the principles of data protection outlined in the Act. These principles mirrored those set out in the Convention and were replicated in Schedule 1 of the 1984 Act.
¶4.8 The Data Protection Registrar had responsibility for maintaining a register of data users who
held and provided services in respect of personal data and a register of accepted applications for registration made by such users and for, determining applications to be a registered data user.325 The Data Protection Registrar was given powers to take enforcement action against registered users who had contravened the data protection principles including the power to de-register a data user for breach of the data protection principles and to issue a notice prohibiting the transfer of personal data outside the United Kingdom.326
¶4.9 The 1984 Act made no special provision in relation to the press.
¶Data Protection Directive 4.10 Directive 95/46/EC of the European Parliament and of the Council on the protection of
individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Directive) was adopted on 24 October 1995 and required implementation by October 1998. The Directive itself was a response to the Organisation for Economic Co-operation and Development guidelines and adopts a number of the same principles.
¶s3
1905¶Appendix 4 | Legal Materials
¶4.11 The Data Protection Directive requires that each member state must set up a supervisory
authority, which acts as an independent body that will monitor the data protection level in that member state, give advice to the government about administrative measures and regulations, and start legal proceedings when data protection regulation has been violated.327 In the United Kingdom, this authority is the Information Commissioner.
¶4.12 The objective of the Data Protection Directive is to protect the fundamental rights and freedoms
of natural persons, and in particular their right to privacy with respect to the processing of personal data.328 The Data Protection Directive sought to harmonise data protection legislation throughout the European Union by requiring member states to determine the conditions under which the processing of personal data is lawful, in accordance with the criteria and principles set out in the Directive.329 It is a harmonisation measure and operates by setting a minimum standard to be adopted by member states.
¶4.13 The Data Protection Directive has been supplemented by other legal instruments, such as the
e-Privacy Directive and specific rules for the protection of personal data in police and judicial cooperation in criminal matters.330
¶4.14 The Data Protection Directive defines a number of core terms which are replicated in the
¶Data Protection Act 1998.331 These terms are explored in detail below. 4.15 The general rules on the lawfulness of processing personal data are set out in Chapter II
to the Data Protection Directive. Article 6 provides that the data controller is responsible for ensuring that personal data is processed in accordance with particular criteria, including fairly and lawfully. Article 7 of the Directive sets out the specific criteria for legitimate data processing and this is subject to the provisions of Article 8 which sets out categories of processing for which specific restrictions apply.
¶4.16 By recital 37, the European Parliament and the Council recognised that the processing of
1906personal data:"for purposes of journalism or for purposes of literary or artistic expression" engaged the "right to receive and impart information, as guaranteed in particular in art 10 of the ECHR" and should therefore be exempt from the Directive's requirements to the extent necessary for the reconciliation of such conflicting rights. The Data Protection Directive requires Member States to provide exemptions or derogations from these provisions for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.332 It also gives data subjects a prima facie right to obtain from the data controller data relating to herself or himself, although this right to data may be overridden by defined exceptions.333