Page 163 - Deception at work all chapters EBook

164 Deception at Work

To comply with these very fair principles, controllers of computers and the very rare structured
manual systems must register with, or notify, the Information Commissioner (the artiste
formerly known as the ‘Data Protection Registrar’ or ‘Data Protection Commissioner’) and
conform with various standards.

It is an offence under Section 17 to process personal data etc., without first making the
appropriate registration. Under Section 22 the Commissioner is required to assess the notifica-
tion and it may be declined if it appears that processing will cause substantial damage, distress
or otherwise significantly prejudice the rights and freedoms of the data subject. Otherwise
if the Commissioner is satisfied, the appropriate entry will be made in the register, which is
accessible to the public.

Part IV of the Act makes substantial exemptions for specified purposes including (under
section 29(1)), the prevention or detection of crime, the apprehension or prosecution of of-
fenders and the assessment or collection of taxes. The Commissioner has extensive powers to
issue enforcement notices and to require the production of information.

Section 55 makes it a criminal offence for any person, knowingly or recklessly, without the
consent of the data controller to obtain or disclose personal data, except (under subsection
(2)) when the person shows that:

• the obtaining, disclosing or procuring was necessary for the purpose of preventing or de-
tecting crime or was otherwise authorized;

• that he acted in the reasonable belief that he had the right in law to procure, disclose etc.;
• that he acted in the reasonable belief that he would have had the consent of the data con-

troller;
• that in the particular circumstances the obtaining, disclosing etc was justified in the public

interest.

Section 55(4) makes it a criminal offence for anyone to sell, or offer to sell, illegally obtained
personal data. Interestingly, Section 56 states that it is a criminal offence for a person to re-
quire a data subject to supply a record which relates to his criminal convictions or cautions
in connection with recruitment, continued employment or the provision of services, ‘unless
it is in the public interest’.

Section 56(4) clarifies the position and specifically states that requiring the production
of certificates of criminal records (under Part V of the Police Act 1997) is ‘not … justified as
being in the public interest on the ground that it would assist in the prevention or detection
of crime’. This is a good example of political duplicity. On one hand businesses are held liable
if they recruit bad people and on the other the law takes away a critical means of checking.

A few recent decisions also illustrate how the law is being applied and the scope of data protec-
tion legislation being extended far beyond its principles: the Soham case was just one of many.

CLOSED CIRCUIT TELEVISION

In November 2001, the Information or structured manual system. Fortunately,
Commissioner put out guidelines for the exceptions apply when a specific crime is
use of closed circuit television (CCTV) being investigated, although for general
in public places and the collection and crime prevention purposes, warnings that
processing of images. It is difficult to see recordings might be made have to be
how CCTV can be regarded as a computer displayed.