http://www.opsi.gov.uk/Acts/Acts1998/ukpga_19980029_en_1
Data Protection Act 1998
From Wikipedia, the free encyclopedia
The Data Protection Act 1998 (DPA) is a United KingdomAct of Parliament. It defines a legal basis for handling in the United Kingdom of information relating to people living within. It is the main/only piece of legislation that governs protection of personal data in the UK. Although the Act does not mention privacy, in practice it provides a way in which individuals can enforce the control of information about themselves. Most of the Act does not apply to domestic use, [ 1 ] for example keeping a personal address book. Organisations in the UK are legally obliged to comply with this Act, subject to some exemptions.
Compliance with the Act is enforced by an independent authority, the Information Commissioner's Office (ICO). The ICO maintains guidance relating to the Act. [ 2 ]
The Act defines eight principles of information-handling practice.
The UK Data Protection Act is a large Act that has a reputation for complexity. [ 3 ] While the basic principles are honoured for protecting privacy, interpreting the act is not always simple. Many companies, organisations and individuals seem very unsure of the aims, content and principles of the DPA. Some hide behind the Act and refuse to provide even very basic, publicly available material quoting the Act as a restriction. [ 4 ] The act also impacts on the way in which organisations conduct business in terms of who can be contacted for marketing purposes, not only by telephone and direct mail, but also electronically and has led to the development of permission based marketing strategies...
http://en.wikipedia.org/wiki/Data_Protection_Act_1998