Data Protection Act

A specified party must hold or obtain (and maintain) all necessary authorisations, for example, under the UK Medicines for Human Use (Clinical Trial) Regulations 2004, and sub-ordinate/related legislation, the Data Protection Act 1998 and the Animals (Scientific Procedures) Act 1986. 

The Parties agree to adhere to the principles of medical confidentiality in relation to Clinical Trial Subjects involved in the Clinical Trial. Personal data shall not be disclosed to the Sponsor by the NHS Trust save where this is required directly or indirectly to satisfy the requirements of the Protocol or for the purpose of monitoring or adverse event reporting. The Sponsor shall not disclose the identity of Clinical Trial Subjects to third parties without prior written consent of the Clinical Trial Subject, in accordance with the requirements of the Data Protection Act 1998 and the principles set out in the Report of the Caldicott Committee on the review of patient identifiable information dated December 1997, a copy of which the NHS Trust shall supply to the Sponsor on request. 

State how the Data Protection Act has changed the way in which we record accident and first aid information at work. 

The Data Protection Act 1984 grew out of public concern about personal privacy In the face of rapidly developing computer technology. 

The Data Protection Act 1998 was passed in order to implement a European Data Protection Directive. This Directive sets a standard for data protection throughout all the countries of the European Union, and the new Act was brought Into force In March 2000. The Act gives the following useful definitions ... 

The Data Protection Act allows Individuals to have access to information held about themselves on computer and where appropriate to have it corrected or deleted. 

The HSE produced a modified Accident Book Bl 510 in May 2003 with notes on these Regulations and the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR), (see Figure 18.4) and which now complies with the Data Protection Act 1998. The Stationery Office also produces a similar accident book. 

To comply with the Data Protection Act 1998, personal details entered in an accident record must be kept confidential. The record sheets should be stored securely. 

The Court of Appeal iuT v Cropp, confirmed that Section 1 applies to insiders who access computers, as well as to remote hackers, but the Act itself prevents criminalization of employees who out of carelessness or inattention obtain access to part of an employer s data or computer system without permission, or who inadvertently step outside the scope of their authority to use the system. A person will only be guilty of the offence if the intention was to tty to gain access, knowing at the time of so doing that the access was unauthorized. The employee who is careless or inadvertent is more appropriately dealt with by disciplinary procedures at the workplace than by the criminal law. Furthermore it was confirmed ini v Bignall that an employee who has authorized access, but who uses the information obtained for an improper purpose, is not guilty of an offence under Section 1, but is more appropriately dealt with by internal disciphnary procedures or, may be liable for prosecution under the Data Protection Act. ... 

The extent to which the Data Protection Act 1984 protected privacy is debatable but, nonetheless, judicial comment and interpretation of that statute has acknowledged the link between the two. In a case which was appealed to the House of Lords, Lord Hoffman... 

English coimnon law does not know a general right of privacy and Parliament has been reluctant to enact one. But there has been some legislation to deal with particular aspects of the problem. The Data Protection Act 1984, with which this appeal is concerned, is one such statute. 

Although by the time this book is published, the implementation of the Data Protection Directive will mean that the 1984 Act will have been superseded by the Data Protection Act 1998 (see Section 12.6.3), a brief description of its provisions and application of this first statute regulating data processing in the UK is in order. Some major changes have been effected by implementation of the directive but, nevertheless, certain key concepts remain unchanged. 

As will be appreciated after the consideration of the provisions of the 1998 Act in Section 12.6, the standards required for obtaining and processing information form the basic building blocks of data protection and these decisions are likely to remain important and influential. On the other hand, the only case under the Data Protection Act 1984 to reach the House of Lords, R v Brown ([1996] 1 All ER 545), although containing some authoritative statements about privacy and data protection is unlikely to remain of direct relevance. The central issue in the case was the meaning of use in the context of unauthorized use which was a criminal offence by virtue of the provisions of Section 5(2) (b), and was also in the third data protection principle (see Table 12.4). In contrast, the criminal offences in the 1998 Act no longer contain this constraction and neither is it a feature of the new data protection principles. 

The scope of the individual protection offered by the directive is greater than that provided by the Data Protection Act 1984 in a number of significant ways. The practical effects of these changes will be considered in the discussion on the Data Protection Act 1998 which implements the directive in the UK. A summary of the major differences is given below. 

Article 32 of the Data Protection Directive required that the terms of the directive be implemented not later than three years from the date of adoption, i.e. by 24 October 1998. The Data Protection Act received the Royal Assent in July 1998 but was not brought into force until 1 March 2000 due to the need for approval of a number of crucial pieces of secondary legislation. The new Act retains the same basic stmcture as its predecessor and a state... 

Table 12.6 Comparison of the Terminology and Provisions of the Data Protection Act 1984 and the Data Protection Act 1998.

Some manual records may still be subject to transitional relief during the six years following 23 October 2001, designated as the second transitional period. For details see The Data Protection Act 1998 An Introduction available at http //www.open.gov.uk/dpr. 

The passing of the Data Protection Act 1998, implementing the Framework European Directive on data protection (1992) is less momentous than the development of the Internet. Nevertheless, it is a important and substantial change to the law relating to data protection, which will have a significant effect on the practices of many software engineers. It has led to a complete rewriting of Chapter 12. 

---