Data
Protection Act 1998
The processing of personal data carries certain legal obligations which
must be complied with. E-commerce trading environments are highly likely
to involve the processing of such data within the meaning of the Data
Protection Act 1998. Broadly speaking the business responsible for such
trading will be required to register as a data controller and comply
with the 8 data protection principles set out in the Schedule 1 to the
Act. These are:
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and
lawful purposes, and shall not be further processed in any manner
incompatible with that purpose or those purposes.
3.Personal data shall be adequate, relevant and not excessive in
relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be
kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken
against unauthorised or unlawful processing of personal data and against
accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory
outside the European Economic Area unless that country or territory
ensures an adequate level of protection for the rights and freedoms of
data subjects in relation to the processing of personal data.
Often the practical implication of this is that the consent of any
customer will need to be obtained at the point of processing their
details and that those details must be processed fairly and lawfully.
Consent means consent to the information being used and collected for
the purposes and in the manner in question. This is a complex and
important piece of legislation on which professional advice should be
sought by all e-commerce traders.