����ý

In the 1990s, with more and more organisations using digital technology to store and process personal information, there was a danger this information could be misused. The Data Protection Act of 1998 was designed to tackle this issue.

Data stored electronically is vulnerable as it is very easy to copy it to a removable drive or to email/ transfer it via the internet. Individuals who had data stored about them (Data Subjects) had several concerns:

• Who could access this information?
• How accurate was the information?
• Could it be easily copied?
• Was it possible to store information about a person without that individual's knowledge or permission?

The Data Protection Act aims to safeguard all information held about an individual classified as personal (e.g., name, address, financial details) or sensitive (e.g., ethnicity, political opinion, religion). The act ensures data stored about you is processed fairly and lawfully. For example, there are strict rules as to who can access and alter your health records. Regular checks are made to ensure that the rules of the Data Protection Act are being followed.

Principles of the Data Protection Act:

1. Data must be collected and used fairly and inside the law
2. Data must only be held and used for the reasons given to the Information Commissioner
3. Data can only be used for those registered purposes. You cannot give it away or sell it unless you said you would initially. For example, your school could not sell pupils' data to a book or uniform supplier without permission
4. The data held must be acceptable, appropriate and not beyond what is necessary when compared with the purpose for which the data is held
5. Data must be accurate and be kept up to date. For example, making sure data subjects' contact numbers are current
6. Data must not be kept longer than is necessary. This rule means that it would be wrong to keep information about past customers longer than a few years at most
7. Data must be kept safe and secure, for example, personal data should not be left open to be viewed by just anyone
8. Data may not be transferred outside of the European Economic Area (that's the EU plus some small European countries) unless the country where the data is being sent has a suitable and similar data protection law. This part of the Data Protection Act has led to some countries passing compatible laws to allow computer data centres to be located in their jurisdiction