Data Protection Act 1984

PART IIRegistration and Supervision of Data Users and Computer Bureaux

Registration

4Registration of data users and computer bureaux

(1)The Registrar shall maintain a register of data users who hold, and of persons carrying on computer bureaux who provide services in respect of, personal data and shall make an entry in the register in pursuance of each application for registration accepted by him under this Part of this Act.

(2)Each entry shall state whether it is in respect of a data user, of a person carrying on a computer bureau or of a data user who also carries on such a bureau.

(3)Subject to the provisions of this section, an entry in respect of a data user shall consist of the following particulars—

(a)the name and address of the data user ;

(b)a description of the personal data to be held by him and of the purpose or purposes for which the data are to be held or used ;

(c)a description of the source or sources from which he intends or may wish to obtain the data or the information to be contained in the data ;

(d)a description of any person or persons to whom he intends or may wish to disclose the data ;

(e)the names or a description of any countries or territories outside the United Kingdom to which he intends or may wish directly or indirectly to transfer the data ; and

(f)one or more addresses for the receipt of requests from data subjects for access to the data.

(4)Subject to the provisions of this section, an entry in respect of a person carrying on a computer bureau shall consist of that person's name and address.

(5)Subject to the provisions of this section, an entry in respect of a data user who also carries on a computer bureau shall consist of his name and address and, as respects the personal data to be held by him, the particulars specified in subsection (3)(b) to (f) above.

(6)In the case of a registered company the address referred to in subsections (3)(a), (4) and (5) above is that of its registered office, and the particulars to be included in the entry shall include the company's number in the register of companies.

(7)In the case of a person (other than a registered company) carrying on a business the address referred to in subsections (3)(a), (4) and (5) above is that of his principal place of business.

(8)The Secretary of State may by order vary the particulars to be included in entries made in the register.

5Prohibition of unregistered holding etc. of personal data

(1)A person shall not hold personal data unless an entry in respect of that person as a data user, or as a data user who also carries on a computer bureau, is for the time being contained in the register.

(2)A person in respect of whom such an entry is contained in the register shall not—

(a)hold personal data of any description other than that specified in the entry :

(b)hold any such data, or use any such data held by him, for any purpose other than the purpose or purposes described in the entry ;

(c)obtain such data, or information to be contained in such data, to be held by him from any source which is not described in the entry ;

(d)disclose such data held by him to any person who is not described in the entry ; or

(e)directly or indirectly transfer such data held by him to any country or territory outside the United Kingdom other than one named or described in the entry.

(3)A servant or agent of a person to whom subsection (2) above applies shall, as respects personal data held by that person, be subject to the same restrictions on the use, disclosure or transfer of the data as those to which that person is subject under paragraphs (b), (d) and (e) of that subsection and, as respects personal data to be held by that person, to the same restrictions as those to which he is subject under paragraph (c) of that subsection.

(4)A person shall not, in carrying on a computer bureau, provide services in respect of personal data unless an entry in respect of that person as a person carrying on such a bureau, or as a data user who also carries on such a bureau, is for the time being contained in the register.

(5)Any person who contravenes subsection (1) above or knowingly or recklessly contravenes any of the other provisions of this section shall be guilty of an offence.

6Applications for registration and for amendment of registered particulars

(1)A person applying for registration shall state whether he wishes to be registered as a data user, as a person carrying on a computer bureau or as a data user who also carries on such a bureau, and shall furnish the Registrar, in such form as he may require, with the particulars required to be included in the entry to be made in pursuance of the application.

(2)Where a person intends to hold personal data for two or more purposes he may make separate applications for registration in respect of any of those purposes.

(3)A registered person may at any time apply to the Registrar for the alteration of any particulars included in the entry or entries relating to that person.

(4)Where the alteration would consist of the addition of a purpose for which personal data are to be held, the person may, instead of making an application under subsection (3) above, make a fresh application for registration in respect of the additional purpose.

(5)A registered person shall make an application under subsection (3) above whenever necessary for ensuring that the entry or entries relating to that person contain his current address; and any person who fails to comply with this subsection shall be guilty of an offence.

(6)Any person who, in connection with an application for registration or for the alteration of registered particulars, knowingly or recklessly furnishes the Registrar with information which is false or misleading in a material respect shall be guilty of an offence.

(7)Every application for registration shall be accompanied by the prescribed fee, and every application for the alteration of registered particulars shall be accompanied by such fee, if any, as may be prescribed.

(8)Any application for registration or for the alteration of registered particulars may be withdrawn by notice in writing to the Registrar at any time before the applicant receives a notification in respect of the application under section 7(1) below.

7Acceptance and refusal of applications

(1)Subject to the provisions of this section, the Registrar shall as soon as practicable and in any case within the period of six months after receiving an application for registration or for the alteration of registered particulars notify the applicant in writing whether his application has been accepted or refused; and where the Registrar notifies an applicant that his application has been accepted the notification shall contain a statement of—

(a)the particulars entered in the register, or the alteration made, in pursuance of the application ; and

(b)the date on which the particulars were entered or the alteration was made.

(2)The Registrar shall not refuse an application made in accordance with section 6 above unless—

(a)he considers that the particulars proposed for registration or, as the case may be, the particulars that would result from the proposed alteration, will not give sufficient information as to the matters to which they relate ; or

(b)he is satisfied that the applicant is likely to contravene any of the data protection principles ; or

(c)he considers that the information available to him is insufficient to satisfy him that the applicant is unlikely to contravene any of those principles.

(3)Subsection (2)(a) above shall not be construed as precluding the acceptance by the Registrar of particulars expressed in general terms in cases where that is appropriate, and the Registrar shall accept particulars expressed in such terms in any case in which he is satisfied that more specific particulars would be likely to prejudice the purpose or purposes for which the data are to be held.

(4)Where the Registrar refuses an application under this section he shall give his reasons and inform the applicant of the rights of appeal conferred by section 13 below.

(5)If in any case it appears to the Registrar that an application needs more consideration than can be given to it in the period mentioned in subsection (1) above he shall as soon as practicable and in any case before the end of that period notify the applicant in writing to that effect; and in that event no notification need be given under that subsection until after the end of that period.

(6)Subject to subsection (8) below, a person who has made an application in accordance with section 6 above shall—

(a)until he receives a notification in respect of it under subsection (1) above or the application is withdrawn; and

(b)if he receives a notification under that subsection of the refusal of his application, until the end of the period within which an appeal can be brought against the refusal and, if an appeal is brought, until the determination or withdrawal of the appeal,

be treated for the purposes of section 5 above as if his application had been accepted and the particulars contained in it had been entered in the register or, as the case may be, the alteration requested in the application had been made on the date on which the application was made.

(7)If by reason of special circumstances the Registrar considers that a refusal notified by him to an applicant under subsection (1) above should take effect as a matter of urgency he may include a statement to that effect in the notification of the refusal; and in that event subsection (6)(b) above shall have effect as if for the words from " the period " onwards there were substituted the words " the period of seven days beginning with the date on which that notification is received ".

(8)Subsection (6) above shall not apply to an application made by any person if in the previous two years—

(a)an application by that person has been refused under this section; or

(b)all or any of the particulars constituting an entry contained in the register in respect of that person have been removed in pursuance of a de-registration notice;

but in the case of any such application subsection (1) above shall apply as if for the reference to six months there were substituted a reference to two months and, where the Registrar gives a notification under subsection (5) above in respect of any such application, subsection (6) above shall apply to it as if for the reference to the date on which the application was made there were substituted a reference to the date on which that notification is received.

(9)For the purposes of subsection (6) above an application shall be treated as made or withdrawn—

(a)if the application or notice of withdrawal is sent by registered post or the recorded delivery service, on the date on which it is received for dispatch by the Post Office;

(b)in any other case, on the date on which it is received by the Registrar;

and for the purposes of subsection (8)(a) above an application shall not be treated as having been refused so long as an appeal against the refusal can be brought, while such an appeal is pending or if such an appeal has been allowed.

8Duration and renewal of registration

(1)No entry shall be retained in the register after the expiration of the initial period of registration except in pursuance of a renewal application made to the Registrar in accordance with this section.

(2)Subject to subsection (3) below, the initial period of registration and the period for which an entry is to be retained in pursuance of a renewal application (" the renewal period ") shall be such period (not being less than three years) as may be prescribed beginning with the date on which the entry in question was made or, as the case may be, the date on which that entry would fall to be removed if the renewal application had not been made.

(3)The person making an application for registration or a renewal application may in his application specify as the initial period of registration or, as the case may be, as the renewal period, a period shorter than that prescribed, being a period consisting of one or more complete years.

(4)Where the Registrar notifies an applicant for registration that his application has been accepted the notification shall include a statement of the date when the initial period of registration will expire.

(5)Every renewal application shall be accompanied by the prescribed fee, and no such application shall be made except in the period of six months ending with the expiration of—

(a)the initial period of registration; or

(b)if there have been one or more previous renewal applications, the current renewal period.

(6)Any renewal application may be sent by post, and the Registrar shall acknowledge its receipt and notify the applicant in writing of the date until which the entry in question will be retained in the register in pursuance of the application.

(7)Without prejudice to the foregoing provisions of this section, the Registrar may at any time remove an entry from the register at the request of the person to whom the entry relates.

9Inspection etc. of registered particulars

(1)The Registrar shall provide facilities for making the information contained in the entries in the register available for inspection (in visible and legible form) by members of the public at all reasonable hours and free of charge.

(2)The Registrar shall, on payment of such fee, if any, as may be prescribed, supply any member of the public with a duly certified copy in writing of the particulars contained in the entry made in the register in pursuance of any application for registration.

Supervision

10Enforcement notices

(1)If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may serve him with a notice (" an enforcement notice ") requiring him to take, within such time as is specified in the notice, such steps as are so specified for complying with the principle or principles in question.

(2)In deciding whether to serve an enforcement notice the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress.

(3)An enforcement notice in respect of a contravention of the fifth data protection principle may require the data user—

(a)to rectify or erase the data and any other data held by him and containing an expression of opinion which appears to the Registrar to be based on the inaccurate data; or

(b)in the case of such data as are mentioned in subsection (2) of section 22 below, either to take the steps mentioned in paragraph (a) above or to take such steps as are specified in the notice for securing compliance with the requirements specified in that subsection and, if the Registrar thinks fit, for supplementing the data with such statement of the true facts relating to the matters dealt with by the data as the Registrar may approve.

(4)The Registrar shall not serve an enforcement notice requiring the person served with the notice to take steps for complying with paragraph (a) of the seventh data protection principle in respect of any data subject unless satisfied that the person has contravened section 21 below by failing to supply information to which the data subject is entitled and which has been duly requested in accordance with that section.

(5)An enforcement notice shall contain—

(a)a statement of the principle or principles which the Registrar is satisfied have been or are being contravened and his reasons for reaching that conclusion; and

(b)particulars of the rights of appeal conferred by section 13 below.

(6)Subject to subsection (7) below, the time specified in an enforcement notice for taking the steps which it requires shall not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, those steps need not be taken pending the determination or withdrawal of the appeal.

(7)If by reason of special circumstances the Registrar considers that the steps required by an enforcement notice should be taken as a matter of urgency he may include a statement to that effect in the notice; and in that event subsection (6) above shall not apply but the notice shall not require the steps to be taken before the end of the period of seven days beginning with the date on which the notice is served.

(8)The Registrar may cancel an enforcement notice by written notification to the person on whom it was served.

(9)Any person who fails to comply with an enforcement notice shall be guilty of an offence; but it shall be a defence for a person charged with an offence under this subsection to prove that he exercised all due diligence to comply with the notice in question.

11De-registration notices

(1)If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may—

(a)serve him with a notice (" a de-registration notice ") stating that he proposes, at the expiration of such period as is specified in the notice, to remove from the register all or any of the particulars constituting the entry or any of the entries contained in the register in respect of that person ; and

(b)subject to the provisions of this section, remove those particulars from the register at the expiration of that period.

(2)In deciding whether to serve a de-registration notice the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress, and the Registrar shall not serve such a notice unless he is satisfied that compliance with the principle or principles in question cannot be adequately secured by the service of an enforcement notice.

(3)A de-registration notice shall contain—

(a)a statement of the principle or principles which the Registrar is satisfied have been or are being contravened and his reasons for reaching that conclusion and deciding that compliance cannot be adequately secured by the service of an enforcement notice; and

(b)particulars of the rights of appeal conferred by section 13 below.

(4)Subject to subsection (5) below, the period specified hi a de-registration notice pursuant to subsection (1)(a) above shall not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the particulars shall not be removed pending the determination or withdrawal of the appeal.

(5)If by reason of special circumstances the Registrar considers that any particulars should be removed from the register as a matter of urgency he may include a statement to that effect in the de-registration notice; and in that event subsection (4) above shall not apply but the particulars shall not be removed before the end of the period of seven days beginning with the date on which the notice is served.

(6)The Registrar may cancel a de-registration notice by written notification to the person on whom it was served.

(7)References in this section to removing any particulars include references to restricting any description which forms part of any particulars.

12Transfer prohibition notices

(1)If it appears to the Registrar that—

(a)a person registered as a data user or as a data user who also carries on a computer bureau ; or

(b)a person treated as so registered by virtue of section 7(6) above,

proposes to transfer personal data held by him to a place outside the United Kingdom, the Registrar may, if satisfied as to the matters mentioned in subsection (2) or (3) below, serve that person with a notice (" a transfer prohibition notice ") prohibiting him from transferring the data either absolutely or until he has taken such steps as are specified in the notice for protecting the interests of the data subjects in question.

(2)Where the place to which the data are to be transferred is not in a State bound by the European Convention the Registrar must be satisfied that the transfer is likely to contravene, or lead to a contravention of, any of the data protection principles.

(3)Where the place to which the data are to be transferred is in a State bound by the European Convention the Registrar must be satisfied either—

(a)that—

(i)the person in question intends to give instructions for the further transfer of the data to a place which is not in such a State ; and

(ii)that the further transfer is likely to contravene, or lead to a contravention of, any of the data protection principles; or

(b)in the case of data to which an order under section 2(3) above applies, that the transfer is likely to contravene or lead to a contravention of, any of the data protection principles as they have effect in relation to such data.

(4)In deciding whether to serve a transfer prohibition notice the Registrar shall consider whether the notice is required for preventing damage or distress to any person and shall have regard to the general desirability of facilitating the free transfer of data between the United Kingdom and other states and territories.

(5)A transfer prohibition notice shall specify the time when it is to take effect and contain—

(a)a statement of the principle or principles which the Registrar is satisfied are likely to be contravened and his reasons for reaching that conclusion ; and

(b)particulars of the rights of appeal conferred by section 13 below.

(6)Subject to subsection (7) below, the time specified in a transfer prohibition notice pursuant to subsection (5) above shall not be before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice shall not take effect pending the determination or withdrawal of the appeal.

(7)If by reason of special circumstances the Registrar considers that the prohibition should take effect as a matter of urgency he may include a statement to that effect in the transfer prohibition notice; and in that event subsection (6) above shall not apply but the notice shall not take effect before the end of the period of seven days beginning with the date on which the notice is served.

(8)The Registrar may cancel a transfer prohibition notice by written notification to the person on whom it was served.

(9)No transfer prohibition notice shall prohibit the transfer of any data where the transfer of the information constituting the data is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the United Kingdom.

(10)Any person who contravenes a transfer prohibition notice shall be guilty of an offence; but it shall be a defence for a person charged with an offence under this subsection to prove that he exercised all due diligence to avoid a contravention of the notice in question.

(11)For the purposes of this section a place shall be treated as in a State bound by the European Convention if it is in any territory in respect of which the State is bound.

Appeals

13Rights of appeal

(1)A person may appeal to the Tribunal against—

(a)any refusal by the Registrar of an application by that person for registration or for the alteration of registered particulars;

(b)any enforcement notice, de-registration notice or transfer prohibition notice with which that person has been served.

(2)Where a notification that an application has been refused contains a statement by the Registrar in accordance with section 7(7) above, then, whether or not the applicant appeals under paragraph (a) of subsection (1) above, he may appeal against the Registrar's decision to include that statement in the notification.

(3)Where any such notice as is mentioned in paragraph (b) of subsection (1) above contains a statement by the Registrar in accordance with section 10(7), 11(5) or 12(7) above, then, whether or not the person served with the notice appeals under that paragraph, he may appeal against the Registrar's decision to include that statement in the notice or against the effect of the inclusion of the statement as respects any part of the notice.

(4)Schedule 3 to this Act shall have effect in relation to appeals under this section and to the proceedings of the Tribunal in respect of any such appeal.

14Determination of appeals

(1)If on an appeal under section 13(1) above the Tribunal considers—

(a)that the refusal or notice against which the appeal is brought is not in accordance with the law ; or

(b)to the extent that the refusal or notice involved an exercise of discretion by the Registrar, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other decision or notice as could have been made or served by the Registrar ; and in any other case the Tribunal shall dismiss the appeal.

(2)The Tribunal may review any determination of fact on which the refusal or notice in question was based.

(3)On an appeal under subsection (2) of section 13 above the Tribunal may direct that the notification of the refusal shall be treated as if it did not contain any such statement as is mentioned in that subsection.

(4)On an appeal under subsection (3) of section 13 above the Tribunal may direct that the notice in question shall have effect as if it did not contain any such statement as is mentioned in that subsection or that the inclusion of the statement shall not have effect in relation to any part of the notice and may make such modifications in the notice as may be required for giving effect to the direction.

(5)Any party to an appeal to the Tribunal may appeal from the decision of the Tribunal on a point of law to the appropriate court; and that court shall be—

(a)the High Court of Justice in England if the address of the person who was the appellant before the Tribunal is in England or Wales ;

(b)the Court of Session if that address is in Scotland; and

(c)the High Court of Justice in Northern Ireland if that address is in Northern Ireland.

(6)In subsection (5) above references to the address of the appellant before the Tribunal are to his address as included or proposed for inclusion in the register.

Miscellaneous and supplementary

15Unauthorised disclosure by computer bureau

(1)Personal data in respect of which services are provided by a person carrying on a computer bureau shall not be disclosed by him without the prior authority of the person for whom those services are provided.

(2)Subsection (1) above applies also to any servant or agent of a person carrying on a computer bureau.

(3)Any person who knowingly or recklessly contravenes this section shall be guilty of an offence.

16Powers of entry and inspection

Schedule 4 to this Act shall have effect for the detection of offences under this Act and contraventions of the data protection principles.

17Disclosure of information

(1)No enactment or rule of law prohibiting or restricting the disclosure of information shall preclude a person from furnishing the Registrar or the Tribunal with any information necessary for the discharge of their functions under this Act.

(2)For the purposes of section 2 of the [1911 c. 28.] Official Secrets Act 1911 (wrongful communication of information)—

(a)the Registrar and his officers and servants ;

(b)the members of the Tribunal; and

(c)any officers or servants of the Tribunal who are not in the service of the Crown,

shall be deemed to hold office under Her Majesty.

(3)The said section 2 shall not be construed as precluding the disclosure of information by any person mentioned in subsection (2)(a) or (b) above or by any officer or servant of the Tribunal where the disclosure is made for the purpose of discharging his duties under this Act or for the purpose of proceedings under or arising out of this Act, including proceedings before the Tribunal.

18Service of notices

(1)Any notice or notification authorised or required by this Act to be served on or given to any person by the Registrar may—

(a)if that person is an individual, be served on him—

(i)by delivering it to him; or

(ii)by sending it to him by post addressed to him at his usual or last-known place of residence or business; or

(iii)by leaving it for him at that place;

(b)if that person is a body corporate or unincorporate, be served on that body—

(i)by sending it by post to the proper officer of the body at its principal office; or

(ii)by addressing it to the proper officer of the body and leaving it at that office.

(2)In subsection (1)(b) above " principal office ", in relation to a registered company, means its registered office and " proper officer ", in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs.

(3)This section is without prejudice to any other lawful method of serving or giving a notice or notification.

19Prosecutions and penalties

(1)No proceedings for an offence under this Act shall be instituted—

(a)in England or Wales except by the Registrar or by or with the consent of the Director of Public Prosecutions ;

(b)in Northern Ireland except by the Registrar or by or with the consent of the Director of Public Prosecutions for Northern Ireland.

(2)A person guilty of an offence under any provision of this Act other than section 6 or paragraph 12 of Schedule 4 shall be liable—

(a)on conviction on indictment, to a fine; or

(b)on summary conviction, to a fine not exceeding the statutory maximum (as defined in section 74 of the [1982 c. 48.] Criminal Justice Act 1982).

(3)A person guilty of an offence under section 6 above or the said paragraph 12 shall be liable on summary conviction to a fine not exceeding the fifth level on the standard scale (as defined in section 75 of the said Act of 1982).

(4)Subject to subsection (5) below, the court by or before which a person is convicted of an offence under section 5, 10, 12 or 15 above may order any data material appearing to the court to be connected with the commission of the offence to be forfeited, destroyed or erased.

(5)The court shall not make an order under subsection (4) above in relation to any material where a person (other than the offender) claiming to be the owner or otherwise interested in it applies to be heard by the court unless an opportunity is given to him to show cause why the order should not be made.

20Liability of directors etc.

(1)Where an offence under this Act has been committed by a body corporate and is proved to have been committed with the consent or connivance of or to be attributable to any neglect on the part of any director, manager, secretary or similar officer of the body corporate or any person who was purporting to act in any such capacity, he as well as the body corporate shall be guilty of that offence and be liable to be proceeded against and punished accordingly.

(2)Where the affairs of a body corporate are managed by its members subsection (1) above shall apply in relation to the acts and defaults of a member in connection with his functions of management as if he were a director of the body corporate.