WS 2 – COPYRIGHT & DATA PROTECTION

Copyright

Introduction Is the right to prevent copying and is not a registered IP right. Main legislation is Copyright,
Designs and Patents Act 1988 – CDPA 1988.

• Copyright arises automatically.

• There are two categories of copyright, if an item cannot fit into a category then there
is no protection.

The two categories have no legal distinction:

1. LDMA Copyright – Literary, Dramatic, Musical and Artistic works contained in section
1(1)(a) CDPA 1988. (CLASSIC)

2. Entrepreneurial Copyrights, which protect those that invest in the creativity of the author

STRUCTURE FOR COPYRIGHT QUESTIONS

1. would copyright arise?? S1(1) – is it classical or entrepreneurial copyright??

2. What type of copyright applies??

• S3 / S4 and which subsection?
• Original requirements?
• Minimum effort?
• Recording? Subsistence

3. Who owns it and for how long??

• Assignment / licence – look at the common intentions of the parties

4. What rights does ownership give? Ie stop people copying

5. Has the rights been infringed?

• Presumption of infringement
• Primary
• Secondary
Infringement

6. If yes, defences / exceptions?

7. If none, remedies?

In exam the question will be subsistence OR infringement?? Use the P(rincipal) E(xplain) R(elate) C(onclude) approach

IF infringement – still need to go through steps 1 – 7 to prove subsistence.

1
THE STRUCTURE

NB – Does not protect an idea – unless written down

1. Must fall within S.1(1) CDPA:

Copyright is a property right which subsists in accordance with this Part in the following
descriptions of work:
(a) original literary, dramatic, musical or artistic works,  Classic Copyright
(b) sound recordings, films or broadcasts, and  Entrepreneurial Copyright

2.

2
Step Details

1 What type of copyright applies??

s.3. Literary, dramatic and musical works

(1) “literary work” means any work, which is written, spoken or sung, and
accordingly includes
(a) a table or compilation other than a database,
(b) a computer program,
(c) preparatory design material for a computer program and
(d) a database – Go to database protection Page 8

Can include: something written that’s intended to be performed.

‘Literary’ does not include, but can be copyright;

• “dramatic work” includes a work of dance or mime;

• “Musical work” means a work consisting of music, exclusive of any words or

action intended to be sung, spoken or performed with the music.
• Words of the song aren’t protected by musical copyright but by Literary copyright.
• The song itself is protected by both literary and musical copyright. They can be
separately owned.

s.4. Artistic works

(1) In this Part “artistic work” means—
(a) a graphic work, photograph, sculpture or collage, irrespective of artistic
quality,
(b) a work of architecture being a building or a model for a building, or
(c) a work of artistic craftsmanship.

For s.5A (sound recording) , s.5B (films) , s.6 (broadcasts) – see Entrepreneurial
Rights below

2 It must be ORIGINAL:

S1(1)(a) original
• It must be the author’s own independent creation, that is, not copied
• Has to originate from the author
• Originality of expression and form is important, not of idea or content
• Has it been copied from somewhere else?

3 There must be MINIMUM EFFORT:

‘A work’ as required by 1(1)(a) and 3(1) OR 4(1), thus there is a level of minimum effort required.

• The threshold of effort required for literary works is very low.

• The writing must be substantial enough to constitute a ‘work.’
• No requirement of Artistic Merit. Can have copyright in work ‘irrespective of artistic
quality.’
• The courts require, following the Exxon Case, that the work provides ‘information,
instruction or pleasure.’
• The title is not substantial enough a work to have copyright as it only consists of 2 words. If
it were a work it would be literary work.

4 The work must be recorded as required by section 3(2).

Must be recorded ‘in writing or otherwise.’ I.e. any medium is sufficient

.
For s.4(1) artistic works…
no recording required as this is excluded by s.3(2).
But some degree of permanence is needed.

5 Who will be classed the OWNER?

3
Moral It is the idea that the creative author or artist should retain certain rights in relation to his creation, even after he
rights has sold the copyright to somebody else.

The moral rights are as follows:

(a) The right to be identified (‘right of paternity’) (s 77). This applies only if the right has been asserted by the
author. This is usually done in the copyright assignment or licence.

(b) The right to object to derogatory treatment (s 80). For example, a novelist might object if his novel were
abridged in a way that compromised its artistic integrity. OK if there was nothing prejudicial to the honour
and reputation of the author of the original work. Confetti Records and Others v Warner Music UK Ltd

(c) The right against false attribution of a work (s 84).

(d) The right to privacy in private photographs and films (s 85).

Entrepreneurial Copyrights, which protect those that invest in the creativity of the author.

N.B. Protects works already satisfying the CLASSIC copyright questions therefore the general requirements for originality
and minimum effort are not required, cannot copy though.

N.B. Of the entrepreneurial rights, only films have moral right which vest in the director..

Classes of Graphical representations of published material

entrepreneurial
copyright: a. Section 5A CDPA 1988 sound recordings.

P195 An attempt has been made to make the definitions of ‘film’, ‘sound recording’, etc
technology neutral so that they will cover future technological developments. So, for
example, ‘film’ includes, videos, DVDs and many ‘multi-media’ recordings where you have
moving images. These can be ‘films’ even though they may be interactive.

b. Section 5B CDPA 1988 films

‘film’ includes any recording on any medium from which a moving image can be produced.
It therefore includes, videos, DVDs and multi-media recordings.

The soundtrack of a film is protected by film copyright unless it is issued as a stand-alone

entity, when it would be protected as a sound recording. S.5B(5)

c. Section 6 CDPA 1988 broadcasts

includes terrestrial broadcasts, satellite and cable and some internet transmissions

A ‘broadcast’ has been redefined to make the definition generic, so as to include not only
terrestrial broadcasts (BBC and ITV, etc), but also satellite (Sky) and cable broadcasts
(NTL) and some Internet transmissions.

d. Section 8 CDPA 1988 published editions of literary, dramatic or musical works.

Differences between (a) There is no general requirement of originality and minimum effort. Because everything
classic and protected by the entrepreneurial rights is based on something else.
entrepreneurial
copyrights (b) no requirement for recording as by their nature E Rights are all recorded.

(c) Of the entrepreneurial copyrights, only films have moral rights. These vest in the director.
The thinking behind this is, of course, that it is the director who has given the artistic input.
He is the person who might want to defend his artistic integrity.

(d) The rules about ownership of the entrepreneurial rights vary (see 14.3.3).

4
 (e) The duration of the entrepreneurial rights varies

Problem:
• What happens if you copy music on to PC? In theory, because there is no requirement of
originality you could be said to create another copyright sound recording.
• The Act provides that there is no copyright if they are simply copies of other work.

Ownership of Ownership goes to the ‘creator,’ yet who the creator is varies.
entrepreneurial
copyright? Sound recording - producer

Film - producer and principal director – s.9(2)

Broadcast - person making the broadcast

Cable programme - person providing the cable service

Typographical arrangement - publisher eg book

Duration of Varies according to the type of entrepreneurial copyright involved.

entrepreneurial
copyright? Sound recording - 50y from making or being released (if later)

Film - 70y from end of life of last to die of principal

director/author of screenplay/author of dialogue/composer of
specially written music

Broadcast - 50y from first broadcast

Cable programme - 50y from first broadcast

Typographical arrangement - 25y from publication

INFRINGEMENT

Introduction Follow this structure:

1. Section 16, the owner has exclusive rights to do ‘acts restricted by copyright’:

16(1)(a) copy the work

16(1)(b)issue copies of the work
16(1)(ba) rent or lend the work to the public
16(1)(c) perform, show or play the work in public
16(1)(d)communicate the work to the public
16(1)(e)make an adaptation of the work  go to s.21 below

2. Copyright of the owner is infringed by someone who does an ‘act restricted by copyright’
or allows someone else to do such an act [section 16(2)].

Is there a licence?? If so, then no infringement.

3. Section 16(3) says that to infringe copyright one can do it in relation to the whole of the
work or a substantial part of it and it can be done directly or indirectly.

Need to identify which category of right it is in order to apply infringement rules in relation to

5
 restricted acts.

Most common infringements are

• copying
• making an adaptation
• giving public performance

There are two types 1. Presumption of infringement,

of infringement:
Raise the presumption first.

1. Are the works similar?

2. Has there been an opportunity to copy? Eg access to the product

The presumption is rebutted with evidence that the product has not been copied and is
original. Simple comparison of two products is required.

2. Primary infringement, in which one is liable regardless of his state of mind

There is no requirement of knowledge. The product does infringe by copying.

Primary infringement is done by the actually author or employer etc

• Section 17 Infringement by copying.

17(2) Copying re an LDMA work means ‘reproducing the work in any material form.’

One does not need to copy the whole work, copyright is infringed by copying ‘a
substantial part of the work’ Question of fact.
• Not quantity but quality, so copying famous line from a play is enough.
• Need not be an exact copy, so copying the plot is enough.

If defendant’s work and claimant’s work are similar and defendant had access to
claimant’s work then there is a presumption of copying

17(3) re artistic work

17(4) re film or broadcast
17(5) re typographical arrangement

• Section 21 Infringement by making adaptation or act done in relation to adaptation.

21(1) Adaptation is made when it is recorded in writing or otherwise

21(3) Meaning of ‘adaptation:’

21(3)(a)(i) re literary work or dramatic work

21(3)(ab) re computer program
21(3)(ac) re database
21(3)(b) re musical work

3. Secondary infringement, in which one is only liable if one knew or had reason to
believe he was dealing with an infringing copy.

Knowledge must be proven to be successful.

Usually done by retailers / publishers

NB – From practical point of view you would inform client to write to the secondary party
involved so they would then be considered to have knowledge.

Concerns dealing with infringing copies; knowledge is required.

6
 Example of secondary infringement:

Section 22 Importing infringing copy

Section 23 Possessing or dealing with infringing copy
Section 24 Providing means for making infringing copies

Proving copying Can be difficult

• Defendants seldom leave any trace of how they did the copying.
• Law helps Claimant by presuming that the D copies the C’s work if the two works are
similar, and the D had access to the C’s work.
• If the presumption applies it is for the D to disprove copying.

Copying can be indirect.

• e.g. novel adapted into play with or without permission of novelist.

• Copy play without permission – infringes copyright in the novel as well as the play even
though the copying of the novel is only indirect.

Computer software

• Normally don’t infringe copyright just by using someone’s work.

• But computer has to make transient copy onto hard drive, so using software infringes
copyrights.
•

Remedies: Section 96 says that infringement of copyright is actionable by the copyright owner.

Section 99 – right of copyright owner to order delivery up of offending items

Section 100 – right of copyright owner to seize offending articles (if in public domain)

Injunction – Interim leading up to case and then upon judgement full

Damages (loss of sales) OR Account of profits (easier to prove a/c of profits)

S.99 – delivery up of infringing copies

S.114 – destruction of infringing copies
S.111 – order preventing importation of infringing copies
S.97(1) – cannot claim if innocent infringement

Sanctions: Section 107 provides for criminal liability for making or dealing with infringing copies.

Defences: 1. Fair dealing for purposes of research or private study (s29)

applies to LDMA works
applies to published editions
Must be ‘non-commercial’ research since directive 2001/29/EC

2. Fair dealing for purpose of criticism and review [s30(1)]

The question whether within the exception depends mainly on:

(a) the purpose for which the quote is used – The quote must be commented on
rather than just copied to use it to tell people something; and

(b) how big the quote is.

3. Fair dealing for the purpose of reporting current events [s30(2)]

7
 • applies to all works, apart from photographs
• may need to give an acknowledgement, if in paper or magazine
• question of what is fair depends on purpose and how much is taken
• must be for genuinely reporting current events

4. Argue that the item does not deserve protection, that the right in question is not valid
and/or the claimant does not have the right to sue for infringement. Common with IP
rights.

5. Argue that had consent of the copyright holder.

Data Protection Checklist Structure – following on from section 3(1)(d) on page 2

1. The database right prevents unauthorised use of the database or a substantial part of it and arises
automatically.
Does work
constitute a Requirements;
database?
i. It must be a database as defined by section 3A(1) CDPA 1988. ‘Database’ means ‘a collection of
independent works, data or other materials which –

(a) are arranged in a systematic or methodical way, and

(b) are individually accessibly by electronic or other means’

ii. It must be original; that is not copied. S.3A(2) ‘constitute the author’s own intellectual creation’. This is a
higher threshold test

iii. The way the database is put together must constitute the author’s intellectual creation; taking into
account two criteria: s.3A(2) there is only originality if arrangement or selection of material is
creative in some way.

As such, it is unlikely that literary copyright will subsist in a database. This is a tough test to satisfy.

2. Regulation 13 of CRDR 1997 says that the database right will subsist in a database ‘if there has been a
substantial investment in:
Does the • obtaining,
right subsist • verifying or
in the • presenting
database? the contents of the database.

Need a substantial investment (human, financial or technical) in either the quality or quantity of the
database or in obtaining, verifying or presenting the data.

3. The maker of a database is the first owner of database right in it per reg 15.

Ownership s.14. The maker of a database

of the (1) the person who takes the initiative in obtaining, verifying or presenting the contents
database of a database and assumes the risk of investing in that obtaining, verification or
right? presentation shall be regarded as the maker of, and as having made, the database.

Exceptions:
s.14
(2) Where a database is made by an employee in the course of his employment, his
employer shall be regarded as the maker of the database, subject to any agreement
to the contrary.

Duration of The database right, per reg 17, lasts the longer of 15 years from the end of the calendar year of
the completion of the database or the year in which the database was first made available to the public.
database
right: 17(3) says that any ‘substantial new investment’ in the database recommences the period of protection.

8
 Thus, an annual publication has a rolling 15-year period.

INFRINGEMENT

Requirements Regulation 16 says that ‘a person infringes database right in a database if, without the consent
of the owner of the right, he extracts or re-utilises all or a substantial part of the contents of the
database.’

Extraction – per reg 12(1) – ‘the permanent or temporary transfer of those contents to another
medium by any means or in any form.’

Re-utilisation – per reg 12(1) – ‘making those contents available to the public by any means.’

Substantial is in terms of quality, or quantity or both.

N.B. Reg 16(2) provides that ‘the repeated and systematic extraction or re-utilisation of
insubstantial parts of the contents of a database may amount to the extraction or re-utilisation
of a substantial part of those contents.’

Many insubstantial parts becomes substantial.

Exceptions to The right is not infringed by:

infringement:
i. fair dealing with a substantial part of a database made available to the public if dealing
is for illustration in teaching or research and sufficient acknowledgement is given per
regulation 20(1).

ii. by dealing with the database available for public inspection as a statutory record with
the permission of the database keeper.

N.B. Can assign/licence the database right and copyright in the database.

Data Protection and Freedom of Information

Legislation Data Protection Act 1998

The main aims of the Act are to protect the right of individual privacy and to harmonise UK
law with that of other Member States. The scheme of the Act is to require a ‘data controller’
to be registered before he can lawfully ‘process’ any ‘personal data’ about a ‘data subject’.

The enforcement of the Act is in the hands of the Information Commissioner (formerly known
as the Data Protection Commissioner), who, along with his department, regulates, enforces
and prosecutes on behalf of the public.

Freedom of Information Act 2000

The big difference between the DPA 1998 and the FOIA 2000 is that the former deals with
the private protection of personal data, whereas the latter is concerned with public access to
government information.

9
Overview and scope of The DPA 1998 improved upon the DPA 1984 in a number of ways:
DPA 1998
(a) manual files are now included as well as automated data;
(b) new conditions for legal processing of data were laid down;
(c) a new category of personal data was created – ‘sensitive data’;
(d) transfer of personal data to countries outside the European Economic Area was
prohibited, unless certain conditions were met;
(e) minimum security requirements for data were introduced; and
(f) more rights for individuals were introduced, including the right to compensation for
damage or distress caused by unlawful processing.

The two effects of the DPA 1998;

1. to allow individuals access to information held about them, for example the
information held about people by credit reference agencies.

2. to protect information about individuals from being disclosed improperly.

Checklist to application 1. the data subject must be a living individual;

of DPA 1998
2. data (within s 1(1)) must be in question; that may, but will not necessarily, involve
consideration of whether a relevant filing system is involved;

3. the data are personal data;

4. some processing is involved;

5. at least one precondition for processing within Sch 2 is met, and if sensitive personal
data are involved, at least one from Sch 3 is met too;

6. the data are processed in accordance with all the relevant data protection principles in
Sch 1.

The definitions of S1(1) of the DPA 1998, by reference to each other, so that each and every definition and
‘data controller’, element must be satisfied in order to apply the law to the particular fact situation:
‘personal data’,
‘processing’ , • ‘data controller’ means . . . a person who (either alone or jointly or in common with other
‘data subject’ persons) determines the purposes for which and the manner in which personal data are, or
are to be, processed;

• ‘personal data’ means data which relate to a living individual who can be identified—

(a) from those data, or

(b) from those data and other information which is in the possession of, or is
likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication
of the intentions of the data controller or any other person in respect of the
individual;

• ‘processing ’, in relation to information or data, means obtaining , recording or holding the

information or data or carrying out any operation or set of operations on the information or
data, including—

(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,
(c) disclosure of the information or data by transmission, dissemination or
otherwise making available, or
(d) alignment, combination, blocking, erasure or destruction of the information

10
 or data;

• ‘data subject’ means an individual who is the subject of personal data.

So, it is fairly easy to see the data controller becomes responsible to the data subject from the
first moment of dealing with any personal information that could identify the data subject as a
living individual.

‘Personal data’, The definition of ‘personal data’ in s 1(1) is itself defined by reference to ‘data’.
‘data’,
‘relevant filing The problem with that is that the s 1(1) definition of ‘data’ includes five, alternative classes of
systems’ information, of which the most significant involves a ‘relevant filing system’, which term is then
further defined in s 1(1).

• ‘data’ means information which—

(a) is being processed by means of equipment operating automatically in response to

instructions given for that purpose;

(b) is recorded with the intention that it should be processed by means of such
equipment;

(c) is recorded as part of a relevant filing system or with the intention that it should form
part of a relevant filing system; (include paper-based systems)

(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as
defined by section 68; (includes health and education records) or

(e) is recorded information held by a public authority and does not fall within any of
paragraphs (a) to (d)

• ‘relevant filing system’ means any set of information relating to individuals to the extent that,
although the information is not processed by means of equipment operating automatically in
such a way that specific information relating to a particular individual is readily accessible.

A mere collection of documents would not suffice (Durant v Financial Services Authority)

• ‘personal data’, only if the data concerned a person’s privacy. Two tests were suggested:

(a) Is the information biographical in a significant sense?

(b) Does the information have the individual as its focus, rather than other persons or
matters?

The individual’s name will be ‘personal data’ only where the name appears together with
other information about the named individual such as address, telephone number or
information regarding his hobbies. (Information Commissioner)

Provided the information in question can be linked to an identifiable individual the following
counts:
(a) information about the medical history of an individual;
(b) an individual’s salary details;
(c) information concerning an individual’s tax liabilities;
(d) information comprising an individual’s bank statements; and
(e) information about an individual’s spending preferences.

Following examples of information would not normally be personal data:

(a) mere reference to a person’s name where the name is not associated with any other
personal information;
(b) incidental mention in the minutes of a business meeting of an individual’s
attendance at that meeting in an official capacity; or
(c) where an individual’s name appears on a document or e-mail indicating only that it

11
 has been sent or copied to that particular individual, the content of that document or
e-mail does not amount to personal data about the individual unless there is other
information about the individual within it.

If an individual cannot be identified from the data in question then it is not ‘personal data’, and
therefore not subject to the DPA 1998.

The eight principles of Anyone processing personal information must comply with eight enforceable principles of good
good practice information handling practice (DPA 1998, s 4(4)). These principles, contained in Sch 1, state
that data must be:

1. fairly and lawfully processed;

2. processed for limited purposes;
3. adequate, relevant and not excessive;
4. accurate and up-to-date;
5. not kept longer than necessary;
6. processed in accordance with the individual’s rights;
7. secure; and
8. not transferred to countries outside the European Economic Area unless the country has
adequate protection for the individual.

The six conditions for At least one of the following conditions, seen in Sch 2 to the DPA 1998, must be met for
data processing personal information to be considered as having been processed fairly:

(a) the individual has consented to the processing;

(b) processing is necessary for the performance of a contract with the individual
(c) processing is required under a legal obligation;
(d) processing is necessary to protect the vital interests of the individual;
(e) processing is necessary to carry out public functions, eg administration of justice; and
(f) processing is necessary in order to pursue the legitimate interests of the data controller

Sensitive personal The relevant definition of ‘sensitive personal data’ is in s 2:

data
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a t rade union (within the meaning of the Trade Union and
Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him,
the disposal of such proceedings or the sentence of any court in such proceedings.

Sensitive personal data must be processed in accordance with the requirements of Sch 3;

• Sch 3.1. The data subject has given his explicit consent to the processing of the personal
data.
• Sch 3.2(1) The processing is necessary for the purposes of exercising or performing any
right or obligation which is conferred or imposed by law on the data controller in connection
with employment.

The rights of the data These matters are dealt with in Pt II of the Act. The seven rights are:
subject and other
persons under DPA The right to subject access (s 7)
1998
Entitles a data subject to be informed by a data controller, upon request in writing;
• whether any personal data are being processed,
• what they comprise,
• the purposes for which they are being processed, and

12
 • to whom the data are or may be disclosed.

NB - A data controller is not required to notify a data subject automatically

The right to prevent processing likely to cause damage or distress (s 10)

Any data subject is entitled to require, by written notice, that a data controller cease or not
commence processing, or restrict processing, of his personal data, where the processing
would otherwise be likely to cause unwarranted damage or distress to anyone at all.

Does not apply if paras 1–4 of Sch 2 is fulfilled;

• where the data subject has already consented to processing ,
• the processing is necessary for the purposes of complying with contractual
arrangements of the data subject,
• to meet legal or regulatory requirements upon the data holder
• to protect the vital interests of the data subject.

The data controller must reply to the notice within 21 days

The right to prevent processing for purposes of direct marketing (s 11)

Any data subject to require, in writing, a data holder to cease, or not begin, any processing
carried out for the purposes of allowing any person to direct advertising or marketing
material towards particular individuals.

Rights in relation to automated decision taking (s 12)

The section provides that a data subject can require a data controller to ensure that such a
decision is not to be made based solely on the automatic processing, or, if one has
already been made, the data subject is to be notified that it was made on that basis, as
soon as reasonably practicable.

The data subject then has 21 days to require the data controller to reconsider the decision,
or to take a fresh decision on a different basis.

There are some categories of ‘exempt decisions’ in s 12(6) and (7),

The right to compensation (s 13)

Any individual, whether data subject or otherwise, can sue one or more data controllers as
primarily or vicariously liable for breaches of the Act that lead to damage and/or distress.

There is a defence against compensation claims if the data controller has taken
reasonable care to comply with the Act (s 13(3)).

The right to rectification, blocking, erasure and destruction (s 14)

This gives the court the power to order the data controller to rectify, block, erase or destroy
any personal data, about the data subject or anyone else, which are inaccurate and
personal data which contain expressions of opinion which appear to be based upon the
inaccurate data.

The right to ask the Commissioner to assess whether the Act has been contravened
(s 42)

This gives a discretion to the Commissioner as to the form and manner of making such an
assessment, at the instance of any person who is, or who believes himself to be, directly
affected by any processing.

This is backed up by criminal sanctions under s 47 if there is failure in compliance with the
notice. A data controller has a right of appeal to the Tribunal against service of such
notices.

13
The obligations of the The two principles of most concern in regard to disclosure of personal data:
data controller and
disclosure restrictions 1st principle: fair and lawful processing

As ‘processing’ is defined widely, the first principle has wide application to all use
of personal data. It can be divided into four obligations:

(a) to process personal data fairly;

(b) to process such data lawfully;
(c) to comply with at least one of the Sch 2 conditions; and
(d) to comply additionally with at least one of the Sch 3 conditions if sensitive
personal data are processed.

The Information Commissioner suggests that in judging whether processing is necessary,

data controllers would need to consider whether:

(a) the purposes for which the data are being processed are valid;
(b) such purposes can be achieved only by the processing of personal data; and
(c) the processing is proportionate to the end pursued.

2nd principle: processed for limited purposes

The concept of processing for limited purposes means that the data should be processed
only for the purposes to which the data subject has consented. The legal guidance from
the Information Commissioner is in f act slightly wider and refers to different purposes
which are not being ‘envisaged’ by the data subject at the time of the collection of the
information.

Exemptions These are seen in ss27 to 39 and Schs 7 and 8.

The reasons for most of the exempt situations are based on public policy. Matters such as
national security, crime, taxation, social work, examination marks, legal professional privilege,
etc

Exemptions for crime prevention and legal proceedings

Under s 29(3), personal data are exempt from the non-disclosure provisions and the right of
subject access where the disclosure is for the purposes of preventing or
detecting crime, apprehending or prosecuting offenders, or assessing or
collecting tax.

Under s 35(2): Personal data are exempt from the non-disclosure provisions where the
disclosure is necessary—

(a) for the purpose of, or in connection with, any legal proceedings (including
prospective legal proceedings), or
(b) for the purpose of obtaining legal advice,

or is otherwise necessary for the purposes of establishing, exercising or defending

legal rights.

Enforcement, offences The Act creates a wide range of criminal offences; Most are ‘either way’ offences, punishable
and civil damages by fine.
• notification offences,

14
 those matters arising out of Pt III of the Act, which deals with the obligations of the
data controller to notify the Commissioner of ‘registrable particulars

• enforcement offences,

found in Pt V of the Act and arise where there is a failure by the data controller to
comply with the enforcement mechanisms employed by the Commissioner.

• disclosure offences.

o Section 21 discussed above (eg, simply handling data without being

registered).
o Section 55 creates a wide-ranging offence where personal data are obtained
or disclosed without the consent of the data controller.
o Section 55(6) advertising the sale is treated as offering to sell the data
o Section 59 creates an offence of wrongful disclosure by the Commission itself

15