Judgment Approved by the court for handing down.
R (Bridges) -v- CC South Wales & ors
ANNEX A
LEGAL FRAMEWORK
Legislation
Data Protection Act 1998 (“DPA 1998”)
1.
Section 1(1) of the DPA 1998 defined "personal data" as:
“… data which relate to a living individual who can be identified
(a) from those data, or (b) from those data and other information
which is in the possession of, or is likely to come into the
possession of, the data controller”.
2.
Section 1(1) of the DPA 1998 defined "data processing" as:
“… obtaining, recording or holding the information or data or
carrying out any operation or set of operations on the information
or data” [with a range of non-exhaustive examples given].
3.
Section 4(4) provided that it was:
“… the duty of a data controller to comply with the data
protection principles in relation to all personal data with respect
to which he is the data controller” [subject to section 27(1)
concerning the exemptions].
4.
The data protection principles were set out in Schedule 1 to the DPA 1998:
(1) Principle 1 is that personal data shall be processed fairly and lawfully and, in
particular, shall not be “processed” at all unless it is necessary for a relevant purpose
(referred to in Schedule 2 below). In the case of the police, the relevant purposes are
the administration of justice and the exercise of any other function of a public nature
exercised in the public interest.
(2) Principle 2 is that personal data may be obtained only for lawful purposes and may
not be further “processed” in a manner incompatible with those purposes.
(3) Principle 3 is that the data must be “adequate, relevant and not excessive” for the
relevant purpose.
(4) Principle 4 is that data shall be accurate and, where necessary, kept up to date.
(5) Principle 5 is that the data may not be kept for longer than is necessary for those
purposes.
(6) Principle 6 is that personal data shall be processed in accordance with the rights of
data subjects under this Act.
(7) Principle 7 is that proper and proportionate technical and organisational measures
must be taken against the unauthorised or unlawful “processing” of the data.