In May 2018, the Data Protection Act 2018 came into force alongside the new General Data Protection Regulations (GDPR). The aim of the Data Protection Act UK is to modernise UK data protection laws in conjunction with the GDPR and to ensure these laws will continue to be effective in the future.
How are the Data Protection Act UK and the GDPR different?
The GDPR affects all EU states and is the basis for data protection law within those countries. The Data Protection Act UK implements the GDPR in the UK.
The Data Protection Act UK approaches data processing under four specific categories:
a. processing within the reach of the GDPR
b. outside the reach of the GDPR
c. for law enforcement purposes
c. by the intelligence services
The Data Protection Act UK goes further than the reach of the GDPR and sets out additional guidelines in respect of:
a. data processing that falls outside EU law
b. the transposition of the EU Data Protection Directive 2016/680 into domestic UK law
c. how data protection laws should be handled by UK intelligence services
d. the responsibilities, functions, and powers of the ICO
e. how data protection laws will be enforced in the UK
The six data protection principles
Under the Data Protection Act UK, the processing of personal data must comply with the following principles:
a. the processing must be lawful and fair
b. the purposes of the processing must be specified, explicit and legitimate
c. the personal data collected must be adequate, relevant and not excessive
d. the personal data retained must be accurate and monitored to ensure it is current
e. the personal data must be retained for only as long as is necessary
f. the personal data must be processed in a manner that is secure
The rights of the data subject
Under the Data Protection Act UK, data subjects have the right:
a. to receive information on the identity and contact details of the controller and the data protection officer, the purpose for processing the data, their individual rights, the basis in law for processing their data, and how long that data will be retained
b. to be informed whether their personal data is being processed and have access to that personal data
c. to rectify and make complete any personal data, and for the body who collected the data to be informed of any such rectification or completion along with the data subject themselves
d. to erase or restrict the use of personal data and receive notification that this has been done
e. to not be subject to automated decision making
f. to exercise rights through the Information Commissioner
Key sections of the Data Protection Act UK
An overview of the DPA UK and key terms used
This preliminary section gives an overview of the Data Protection Act UK, discusses protection of personal data and lays out definitions for the key terms used in the Act, including but not limited to:
a. personal data
b. identifiable living individual
c. controller and processor
General Processing
This section gives further clarity on the GDPR requirements for data processing but also lays out how processing that falls outside of the GDPR and EU law should be handled, quoting the relevant sections of the GDPR and the DPA UK.
It is broken down into three chapters:
a. what this section covers and related definitions
b. types of processing covered by the GDPR
c. types of processing that are not covered by GDPR and EU law and are not law enforcement or intelligence services related
Chapter 2 also discusses lawful grounds for data processing, a child’s consent, special categories of personal data, criminal convictions, the limiting of fees charged by controllers, processing in the interests of the public, required documentation, safeguards, obligation of credit reference agencies, lawful automated decision making and exemptions.
In addition to listing rights of the data subject, Chapter 3 discusses data held by public authorities, historical research, and exemption for national security and defence processing other than by law enforcement bodies.
Law enforcement processing
This section covers data processing by law enforcement bodies and is split into 6 chapters:
a. what this section covers and related definitions
b. 6 data protection principles, and safeguards
c. rights of the individual (data subject)
d. controller and processor obligations
e. personal data transfer to countries outside the EU or to an international organisation
f. supplementary provisions
Under Chapter 2, there is also information on safeguards in relation to archiving and sensitive data processing.
Chapter 3 details the controller’s responsibilities, the exercise of rights through the Information Commissioner, the form the information must be provided in, dealing with excessive requests, exemptions to these rights and the time frame for complying with one of the above requests.
Intelligence services processing
This section discusses data processing and handling in the context of national security which is not covered by EU law or the GDPR.
Under the umbrella of national security, 3 intelligence services are named in the DPA UK. These are:
a. Security Service
b. Secret Intelligence Service
c. Government Communications Headquarters.
This section relates to the processing of personal data carried out by the intelligence services that is either completely, or in part, processed by automated means or that forms part of a filing system.
There are 6 chapters to this section:
a. what this section covers and related definitions
b. 6 data protection principles, and safeguards
c. rights of the individual (data subject)
d. controller and processor obligations
e. personal data transfer to countries outside the EU or to an international organisation
f. exemptions
The Information Commissioner
This section contains information on the Information Commissioner. It lays out:
a. General functions
b. International role
c. Codes of practice
d. Consensual audits
e. Records of national security certificates
f. Information provided to the Commissioner
g. Confidentiality of information
h. Guidance about privileged communications
i. Fees
j. Charges
k. Reports
Enforcement
This section details how compliance to the Data Protection Act UK will be enforced and the related powers of the Information Commissioner.
It describes the 4 types of notice that a non-compliant business might receive:
a. Information Notice
b. Assessment Notice
c. Enforcement Notice
d. Penalty Notice
and outlines the possible penalty that might be imposed with factors that would be taken into consideration.
It also details powers of entry and inspection, rights and determinations of appeal, data subject complaints, compliance orders, compensation, news-related material, and unlawful obtaining of personal data.
How legal advice can help
The Data Protection Act UK seeks to implement, clarify and expand on the General Data Protection Regulations. UK organisations are required to understand and comply with both sets of regulations under UK data protection laws.
Specialist legal advice can assist your business in ensuring that you have the correct documentation and processes in place for data collection, handling, usage and storage, to ensure your organisation is protected against complaints or non-compliance penalties.
Author
Gill Laing is a qualified Legal Researcher & Analyst with niche specialisms in Law, Tax, Human Resources, Immigration & Employment Law.
Gill is a Multiple Business Owner and the Managing Director of Prof Services - a Marketing Agency for the Professional Services Sector.
