Policy responses and statements

Name of organisation:: Ministry of Justice
Name of policy document:: Call for Evidence on the Current Data Protection Legislative Framework
Deadline for response:: 06 October 2010

Background: The College has received a letter from the Ministry of Justice stating that "the Government has launched a Call for Evidence about the current law on data protection. This comes in advance of negotiations on a new EU data protection instrument, expected to start in early 2011.

Our current domestic data protection legislation, the Data Protection Act 1998 (DPA), transposes the EU Data Protection Directive into UK law. We would like to gather evidence from you about how the sector you represent believes the current legislation is working. This will help us to participate constructively in the EU negotiations and ensure our position is informed by the experience of UK data controllers and data subjects.

The Call for Evidence paper enclosed with this letter provides more detailed information about the areas where we are particularly keen to gather evidence. The key themes set out in the paper are:

definitions used in the DPA;
data subjects' rights;
obligations of data controllers;
powers and penalties of the Information Commissioner;
the principles-based approach;
exemptions under the DPA; and
international transfers.

Alongside the Call for Evidence, we would like to seek your views on the provisional Post-Implementation Review (PIR) of the DPA, which is also enclosed with this letter. Through the PIR we want to capture the costs and benefits of the DPA for those organisations you represent. To do this most effectively I have enclosed a questionnaire which asks specific questions about the impact that the DPA has had on them. The questions are detailed, but I would encourage you to take the time to consider what evidence you have or could gather to answer those relevant to your sector. This will both enable us to review how successfully the DPA has met its objectives, and to adopt a more informed position when considering future changes to the data protection framework.

The Call for Evidence will end on 6 October 2010. I would warmly welcome your response with your views for both the Call for Evidence and the provisional PIR in good time before then. The views you express in your responses will help inform the UK Government's approach to the negotiations on the new EU data protection instrument and could help influence the future shape of data protection law in the UK."

The Call for Evidence is not a formal consultation, but an evidence gathering exercise.

Executive summary:

This call for evidence seeks information from organisations, businesses, individuals and other stakeholders about the current law on data protection. It is aimed at everyone who has an interest in data protection, whether in the public sector, private sector or third sector.
To negotiate effectively for a new EU data protection instrument, the Government needs information about different aspects of the Data Protection Act 1998 (DPA), the domestic legislation which transposes it. This document is arranged into a number of chapters on those issues about which we particularly seek evidence. They are:

definitions;
data subjects’ rights;
obligations of data controllers;
powers and penalties of the Information Commissioner;
the principles-based approach
exemptions under the DPA; and
international transfers.

These are key areas of the current legislation. However, if you would like to raise issues about any other aspect of the data protection framework either things that are working well or working badly, please provide us with relevant evidence. We will be in a more informed position to consider change for the future where we have clear evidence of the benefits and costs of the DPA.

Call for Evidence on the Current Data Protection Legislative Framework

Introduction

The current data protection legislation, the Data Protection Act 1998 (DPA), transposes the EU Data Protection Directive 95/46/EC (“the Directive”) into UK law. The Directive was conceived and negotiated during the early 1990s. This was at a time when computer technology was primitive by today’s standards and the internet was in its early stages. Cross border data exchange was increasing. The view at the time was that inconsistent data protection legislation amongst EU Member States was a barrier to the free flow of personal data across borders. One of the aims of the Directive therefore was to harmonise data protection legislation throughout the EU.
However, while all the technological advances of the past 15 years have taken place, the Directive has remained static. This has led to calls for its review. In 2008, the then UK Information Commissioner, Richard Thomas, said: “European data protection law is increasingly seen as out of date, bureaucratic and excessively prescriptive. It is high time the law is reviewed and updated for the modern world”. These views were echoed by the current Information Commissioner Christopher Graham at his January 2010 appearance before the House of Commons Justice Committee.
On 18 March 2010 Viviane Reding - Vice-President of the European Commission responsible for Justice, Fundamental Rights and Citizenship – released a press statement in which she stated that she intends to produce “… a legislative proposal reforming the Directive before the end of the year”.
In order to be properly informed and prepared for this proposal, the UK has launched this call for evidence. The purpose is to seek information about areas of the Directive (and therefore the DPA) that may be out of date or could be improved, and also those areas that are working well and should be retained. At the same time as launching this call for evidence, we are also publishing a provisional post implementation review impact assessment of the DPA. We would particularly welcome evidence on this impact assessment’s assumptions and figures which will strengthen our evidence base and provide a sensible starting point for our negotiations in the EU.
We would encourage members of the public, businesses, the public sector, and the third sector, as well as regulatory bodies, to respond to this call for evidence. We would also strongly encourage everyone to comment on the accompanying provisional post implementation review of the DPA: this complements the call for evidence and publication of a full Impact Assessment is planned for the end of 2010. All evidence will be carefully considered and will inform our negotiating position, which may in turn lead to proposals and a consultation. Views will also be sought through stakeholder workshops, the details of which will be announced in due course.
Copies of this paper are being sent to the organisations listed at Appendix A. The list is not meant to be exhaustive and responses are welcomed from anyone with an interest in the subject covered by this paper.

Download this consultation response as a .pdf

Copies of this response are available from:

Lesley Lockhart,
Royal College of Physicians of Edinburgh,
9 Queen Street,
Edinburgh,
EH2 1JQ.

Tel: 0131 225 7324 ext 608
Fax: 0131 220 3939

[12 February 2010]