Data Protetion Act
The effect of the Data Protection Act on e-marketing
This guide is based on UK law. It was last updated in March 2008.
Topics
• Advertising and marketing • Commercial
The law relating to data protection is designed to regulate organisations known as data controllers who collect and process information relating to living and identifiable individuals and to provide those individuals with rights in relation to such data. In the UK the position is currently governed by the Data Protection Act 1998 ("the Act"), which is designed to comply with a European Union Directive on Data Protection to harmonise the different data protection laws within different Member States.
Personal data are information about a living individual who can be identified from that information and other information which is in, or likely to come into, the data controller's possession and can be minimal such as a name, address, e-mail or even a phone number. Certain data (e.g. political opinions, religious beliefs, ethnic origin, health information, sexual life, criminal convictions or membership of a trade union) are classified as sensitive personal data. To process this type of data a data controller must have special reasons for doing so.
The Act applies whenever personal data are processed. Processing covers anything done to personal data, for example when it is used, disclosed, stored, collected, amended or deleted. Once personal data have been irretrievably deleted they can no longer be processed and the Act ceases to apply.
The Act applies to data processed automatically by computers and manually, where data are stored in a structured set by reference to an individual which enables specific information about that individual to be readily accessible.
The Data Protection principles
For personal data to be lawfully processed in the UK, a data controller has to ensure that all processing activities with respect to personal data comply with the eight Data Protection
This guide is based on UK law. It was last updated in March 2008.
Topics
• Advertising and marketing • Commercial
The law relating to data protection is designed to regulate organisations known as data controllers who collect and process information relating to living and identifiable individuals and to provide those individuals with rights in relation to such data. In the UK the position is currently governed by the Data Protection Act 1998 ("the Act"), which is designed to comply with a European Union Directive on Data Protection to harmonise the different data protection laws within different Member States.
Personal data are information about a living individual who can be identified from that information and other information which is in, or likely to come into, the data controller's possession and can be minimal such as a name, address, e-mail or even a phone number. Certain data (e.g. political opinions, religious beliefs, ethnic origin, health information, sexual life, criminal convictions or membership of a trade union) are classified as sensitive personal data. To process this type of data a data controller must have special reasons for doing so.
The Act applies whenever personal data are processed. Processing covers anything done to personal data, for example when it is used, disclosed, stored, collected, amended or deleted. Once personal data have been irretrievably deleted they can no longer be processed and the Act ceases to apply.
The Act applies to data processed automatically by computers and manually, where data are stored in a structured set by reference to an individual which enables specific information about that individual to be readily accessible.
The Data Protection principles
For personal data to be lawfully processed in the UK, a data controller has to ensure that all processing activities with respect to personal data comply with the eight Data Protection