1. DATA PROTECTION ACT 1998

2. INTRODUCTION The Data Protection Act 1998 came into force on the 1 st March 2000. It is more far reaching than its predecessor, the Data Protection Act 1984. From October 2001 it applies to manual (paper) records as well as electronic files.

3. DEFINITIONS Data Processing Personal data Data subject Data controller Data processor Special purposes

4. RELEVANT FILING SYSTEM Relevant filing system means Any set of information relating to individuals to the extent that, although the information is not automatically processed, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible

5. ACCESSIBILE RECORD Accessible record means A health record (information relating to physical or mental health made by or on the behalf of a health professional in connection with the care of an individual), or educational record (records relating to pupils at a school processed by the governing body or a teacher, as defined in Schedule 11), or an accessible public record (housing and social services records, as defined in Schedule 12)

6. DEFINITIONS Data Processing Personal data Data subject

7. DEFINITIONS Data controller Data processor Special purposes

8. THE DATA PROTECTION PRINCIPLES Personal data shall be Processed fairly and lawfully Obtained only for specified and lawful purposes and further processed only in a compatible manner Adequate, relevant and not excessive Accurate and up to date Kept for no longer than necessary Processed in accordance with the rights of the data subjects Kept secure Transferred outside the EEA only if there is adequate protection

9. PROCESSED FAIRLY AND LAWFULLY Consent of the data subject Necessary for the performance of a contract with the data subject Legal obligation To protect vital interests of the data subject To carry out public functions To pursue legitimate interests of the controller unless prejudicial to the interests of the data subject

10. SENSITIVE DATA Racial or ethnic origin Political opinions or trade union membership Religious or similar beliefs Health Sexual life Criminal offences

11. REVISED CONDITIONS Explicit consent of the data subject To comply with employers legal duty To protect vital interests of data subject or another person Carried out by certain non profit bodies The information has been made public by the data subject

12. REVISED CONDITIONS In legal proceedings Exercising legal rights To carry out public functions For medical purposes For equal opportunities monitoring As specified by order

13. FAIRNESS Data should not be treated as processed fairly unless the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made available to him at least – The identity of the data controller The purpose(s) for which the data will be processed Any further information necessary

14. THE SECOND PRINCIPLE Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes

15. THE THIRD PRINCIPLE Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed

16. THE FOURTH PRINCIPLE Personal data shall be accurate and, where necessary, kept up to date

17. THE FIFTH PRINCIPLE Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes

18. THE SIXTH PRINCIPLE Personal data shall be processed in accordance with the rights of data subjects under this Act –A person will contravene this principle only if he/she Fails to properly respond to a subject access request Fails to respond to notices from individuals exercising their rights to prevent processing

19. THE SEVENTH PRINCIPLE Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data

20. THE EIGHTH PRINCIPLE Personal data shall not be transferred to a country or a territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data

21. How does it affect these stakeholders?