4 Rights in relation to automatic decision-taking. An
individual can ask a data controller to ensure that no
decision which significantly affects him is based solely on
the processing of his personal data by automatic means.
Examples of the purposes for which automatic decision-
taking might be used include establishing creditworthiness
or reliability. There are some exemptions to these rights.
5 Right to compensation. The data subject can claim
compensation from a data controller for damage or dam-
age and distress caused by a breach of the DPA 1998,
where the data controller is unable to show that he or
she has taken such care as is reasonable to ensure com-
pliance. Damages for distress alone can be claimed only
where the breach of the DPA 1998 relates to processing
personal data for special purposes.
6 The right of rectification, blocking, erasure and
destruction.Individuals can apply to the court for an
order requiring a data controller to rectify, block, erase
or destroy personal data which are inaccurate or contain
expressions of opinion based on inaccurate data.
7 The right to request an assessment. Any individual
may ask the Commissioner to assess whether the pro-
cessing of personal data is being carried out in com-
pliance with the DPA 1998. Depending on the outcome
of the Commissioner’s assessment, this may lead to
enforcement action.
Exemptions
The nature and extent of each exemption is a complex
matter and the guidance produced by the Information
Commissioner should be consulted.
Exemptions are referred to as either ‘primary’ exemp-
tions, meaning that they are more likely to be claimed or
more wide ranging in scope, or ‘miscellaneous’ exemptions.
‘Primary’ exemptions include personal data related to:
■safeguarding national security;
■prevention and detection of crime;
■assessment and collection of taxation;
■health, education and social work;
■regulatory activity of certain bodies;
■special purposes covering journalism, artistic and lit-
erary purposes;
■historical or statistical research;
■information made available to the public by statute;
■disclosures required by law or in connection with any
legal proceedings;
■domestic purposes, i.e. household matters.
The ‘miscellaneous’ exemptions include:
■confidential references given in connection with, for
example, employment;
■information which would prejudice the combat effect-
iveness of the armed forces;
■processing personal data in connection with judicial
appointments and honours;
■processing personal data in connection with assess-
ing suitability for Crown employment and Crown or
ministerial appointments;
■personal data used by businesses in connection with
management forecasting and planning;
■personal data consisting of the intentions of the data
controller in relation to any negotiations with the
data subject;
■personal data processed in connection with a corpor-
ate finance service, where there may be concerns in
relation to price sensitivity;
■personal data recorded by candidates in examinations;
■in the case of examination marks, a candidate’s right
of access can be delayed for up to five months or 40 days
from the announcement of the results;
■personal data subject to professional legal privilege;
■self-incrimination by complying with a subject access
request.Offences under the DPA 1998
The DPA 1998 creates a number of criminal offences.
These include processing personal data without com-
plying with the notification requirements, unlawfully
obtaining or disclosing personal data without the consent
of the data controller and unlawfully selling personal data.
The Criminal Justice and Immigration Act 2008 makes
two changes to the DPA to strengthen enforcement:
1 The Secretary of State acquires the power to increase
the maximum penalty for an offence under s 55 (knowingly
or recklessly, without the consent of the data controller,
obtaining or disclosing personal data or procuring the
disclosure of personal data to another person). The
penalties may be increased to six months’ imprison-
ment on summary conviction (increasing to 12 months
when the sentencing powers of the magistrates’ court are
increased) or two years’ imprisonment if convicted on
indictment in the Crown Court. A new defence against
the s 55 offence is provided where a person acts for
journalistic, literary or artistic purposes with a view to
the publication of any journalistic, literary or artisticPart 4Business resources