Evaluation of Data Protection Act

...

(i.e., a duty to act in order to comply with the Convention) in protecting the rights of individuals.

Article 8 of the Charter provides that ‘Everyone has the right to the protection of personal data concerning him or her’. It also lays down the criteria for the processing of personal data, in ensuring high level of protection. Firstly, personal data must be processed fairly and lawfully. The processing of personal data must also be adequate, relevant and not excessive in relation to the purposes for which they were collected and/or further processed. These principles are also set out in Schedule 1 of the 1998 Act. For the processing of non-sensitive data, one of the conditions in Schedule 2 of the 1998 Act must be complied with. Essentially, it requires the processing to be necessary for the performance of a contract to which the data subject is a party, and that the data subject has given his consent to the processing.

On the other hand, Jon has the right of access to personal data, as provided under s.7 of the 1998 Act, which must be requested in writing. This means that Jon will be able to view a copy of the information Instagram has about him, in which Instagram must respond within 40 calendar days. In the case of Durant, the Court of Appeal said data subject access was not an automatic key to anything in which the subject might be named or involved. Its purpose was to enable him to check whether the data controller’s processing of his personal data unlawfully infringed his privacy and, if so, to take such steps as the Act provided to protect it. Furthermore, under the 1998 Act, Jon has the right to prevent the processing of data that is likely to cause damage or distress, that will be used for the purposes of direct marketing, or in relation to automated decision making.

In the event if Jon suffers damage, or damage and distress, as the result of any contravention of the requirements of the Act by Instagram, he is entitled to compensation, and this scenario was illustrated in the case of Johnson. If Instagram fails, or refuses to comply with the provisions of the 1998 Act, the Information Commissioner’s Office (ICO) has a range of both criminal and administrative sanctions at its disposal, which may include an enforcement notice or a monetary penalty notice.