Data protection regime—DPA 1998

ARCHIVED:This Overview provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998) and Directive 95/46/EC (the Data Protection Directive). This Overview is for background information only and is not maintained.

Prior to the 25 May 2018, the DPA 1998 governed the processing of personal data in the UK. It incorporated the provisions of the Data Protection Directive into UK law and obliged those handling personal data to comply with eight core data protection principles (discussed below), giving individuals a number of rights in relation to information that is about them, including a right of access.

The General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) was published in the Official Journal of the European Union on 4 May 2016. The provisions of the GDPR are directly applicable and fully enforceable in all EU Member States from 25 May 2018 and it replaces DPA 1998 and Data Protection Directive. For more information, see Practice Note: Introduction to the EU GDPR and UK GDPR.

Position under the DPA 1998

Background

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Information Law weekly highlights—19 December 2024

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

ICO warns against Google's fingerprinting policy change, issues draft guidance

The Information Commissioner's Office (ICO) has responded to Google's announcement permitting fingerprinting techniques from February 2025, warning that businesses must still comply with data protection laws. The ICO has published draft guidance on how data protection law, including PECR, applies to storage and access technologies such as fingerprinting. The ICO emphasises that organisations must provide transparency, obtain consent, and ensure fair processing when using fingerprinting for advertising purposes. The regulator plans to release a comprehensive strategy in the new year to give users meaningful control over personalised advertisement. A consultation on this guidance opens on Friday, 20 December 2024.

MI5 wins case against lawyer accused of being Chinese spy

Law360, London: A solicitor accused of being a Chinese spy has lost her legal challenge against MI5, after a tribunal found 17 December 2024 that the UK security service acted lawfully when it warned parliamentarians that she was trying to interfere with the political process.

OpenAI, X, Google can use legitimate interest for AI models, EDPB says

MLEX: OpenAI, X, Google and Meta will be able to use legitimate interests as a legal basis for processing personal data for developing and deploying AI models provided that adequate mitigation measures are in place, the European Data Protection Board (EDPB) said in an influential opinion today. The EDPB opinion also touched upon how to address unlawful data processing for AI model development, and in what circumstances AI models can be considered anonymised.

View Information Law by content type :

News