Data Protection Act 1998

Data Protection Act 1998 An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information. Be it enacted by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:— . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . In section 158 of the Consumer Credit Act 1974 (duty of agency to disclose filed information)— in subsection (1)— in paragraph (a) for “individual” there is substituted “ partnership or other unincorporated body of persons not consisting entirely of bodies corporate ”, and for “him” there is substituted “ it ”, in subsection (2), for “his” there is substituted “ the consumer’s ”, and in subsection (3), for “him” there is substituted “ the consumer ”. In section 159 of that Act (correction of wrong information) for subsection (1) there is substituted— Any individual (the “objector”) given— information under section 7 of the Data Protection Act 1998 by a credit reference agency, or information under section 158, who considers that an entry in his file is incorrect, and that if it is not corrected he is likely to be prejudiced, may give notice to the agency requiring it either to remove the entry from the file or amend it. In subsections (2) to (6) of that section— for “consumer”, wherever occurring, there is substituted “ objector ”, and for “Director”, wherever occurring, there is substituted “ the relevant authority ”. After subsection (6) of that section there is inserted— The Data Protection Commissioner may vary or revoke any order made by him under this section. In this section “the relevant authority” means— where the objector is a partnership or other unincorporated body of persons, the Director, and in any other case, the Data Protection Commissioner. In section 160 of that Act (alternative procedure for business consumers)— in subsection (4)— for “him” there is substituted “ to the consumer ”, and in paragraphs (a) and (b) for “he” there is substituted “ the consumer ” and for “his” there is substituted “ the consumer’s ”, and after subsection (6) there is inserted— In this section “consumer” has the same meaning as in section 158. In section 5(3) of that Act (cases where right of access may be partially excluded) for the words from the beginning to “record” in the first place where it occurs there is substituted “ Access shall not be given under section 3(2) to any part of a health record ”. In Article 6(1) of that Order (interpretation), in the definition of “health professional”, for “the Data Protection (Subject Access Modification) (Health) Order 1987” there is substituted “ the Data Protection Act 1998 ”. In Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals under direct supervision of Council on Tribunals), for paragraph 14 there is substituted— 14. (a) The Data Protection Commissioner appointed under section 6 of the Data Protection Act 1998; (b) the Data Protection Tribunal constituted under that section, in respect of its jurisdiction under section 48 of that Act. In Article 5(4) of that Order (cases where fee may be required) in sub-paragraph (a), for “the maximum prescribed under section 21 of the Data Protection Act 1984” there is substituted “ such maximum as may be prescribed for the purposes of this Article by regulations under section 7 of the Data Protection Act 1998 ”. In Article 7 of that Order (cases where right of access may be partially excluded) for the words from the beginning to “record” in the first place where it occurs there is substituted “ Access shall not be given under Article 5(2) to any part of a health record ”. 1974 c. 39. Pt. VI applied (with modifications) (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 51(1)(b) Act modified (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 432 (with ss. 117, 209, 210, Sch. 20 paras. 58, 59); S.I. 2018/625, reg. 2(1)(g) Act repealed (except s. 62, Sch. 15 paras. 13, 15, 16, 18, 19) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 44 (with ss. 117, 209, 210 and with transitional provisions in Sch. 20 paras. 2-9, 17-25, 27-46, 53, 54 and saving in Sch. 20 para. 58); S.I. 2018/625, reg. 2(1)(g) Act: power to amend conferred (8.5.2008) by virtue of Criminal Justice and Immigration Act 2008 (c. 4), ss. 77(5), 153 Act: Crown status for the purposes of the Act extended (6.5.1999) by S.I. 1999/677, art. 7(3) Act applied (1.4.2000) by 1999 c. 28, s. 19(2) (with s. 38); S.I. 2000/1066, art. 2 Act excluded (1.3.2000) by S.I. 2000/416, art. 2, Sch. Act: functions of the Secretary of State transferred to the Lord Chancellor (26.11.2001) by S.I. 2001/3500, arts. 3, 4, Sch. 1 para. 11 Act applied by S.I. 1993/1813, art. 4(2) (as substituted by S.I. 2001/1544, art. 3(5)(6)) (the amendment coming into force in accordance with art. 1(2) of S.I. 2001/1544) Act (except ss. 6(4)(a)(b), 28, Sch. 5 para. 12(2) for certain purposes and Sch. 6 paras. 2, 3): functions of the Lord Chancellor transferred to the Secretary of State, and all property, rights and liabilities to which the Lord Chancellor is entitled or subject to in connection with any such function transferred to the Secretary of State for Constitutional Affairs (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), arts. 4, 5, Sch. 1 (with art. 6) Act restricted by The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818), art. 8(2) (the amendment coming into force in accordance with art. 1(2) of the amending S.I.) Act modified by The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818), art. 11(4) (the amendment coming into force in accordance with art. 1(2) of the amending S.I.) Act modified by The National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118), art. 5 (the amendment coming into force in accordance with art. 1(2) of the amending S.I.) Act excluded (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 50(1) Act applied (N.I.) (12.4.2016) by Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12), s. 1(8) Act applied (S.) (1.4.2018) by The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66), reg. 1, sch. 6 para. 64 (with reg. 2) Act applied in part (with modifications) in so far as still in force by S.I. 2003/2426, Sch. 1 para. 8AA (as amended) (17.12.2018) by The Privacy and Electronic Communications (Amendment) Regulations 2018 (S.I. 2018/1189), regs. 1, 2(2)(3)