Ws2 - Copyrights And Data Protection Consolidated

WS 2 – COPYRIGHT & DATA PROTECTION Copyright Introduction

Is the right to prevent copying and is not a registered IP right. Main legislation is Copyright, Designs and Patents Act 1988 – CDPA 1988. • •

Copyright arises automatically. There are two categories of copyright, if an item cannot fit into a category then there is no protection.

The two categories have no legal distinction:

1. LDMA Copyright – Literary, Dramatic, Musical and Artistic works contained in section 1(1)(a) CDPA 1988. (CLASSIC) 2. Entrepreneurial Copyrights, which protect those that invest in the creativity of the author

STRUCTURE FOR COPYRIGHT QUESTIONS 1.

would copyright arise?? S1(1) – is it classical or entrepreneurial copyright??

2.

What type of copyright applies?? • S3 / S4 and which subsection? • Original requirements? • Minimum effort? • Recording?

3.

Who owns it and for how long?? • Assignment / licence – look at the common intentions of the parties

4.

What rights does ownership give? Ie stop people copying

5.

Has the rights been infringed? • Presumption of infringement • Primary • Secondary

6.

If yes, defences / exceptions?

7.

If none, remedies?

Subsistence

Infringement

In exam the question will be subsistence OR infringement?? Use the P(rincipal) E(xplain) R(elate) C(onclude) approach IF infringement – still need to go through steps 1 – 7 to prove subsistence.

1

THE STRUCTURE NB – Does not protect an idea – unless written down 1.

Must fall within S.1(1) CDPA: Copyright is a property right which subsists in accordance with this Part in the following descriptions of work: (a) original literary, dramatic, musical or artistic works,  Classic Copyright (b) sound recordings, films or broadcasts, and  Entrepreneurial Copyright

2.

2

Step

Details

1

What type of copyright applies?? s.3. Literary, dramatic and musical works (1) “literary work” means any work, which is written, spoken or sung, and accordingly includes (a) a table or compilation other than a database, (b) a computer program, (c) preparatory design material for a computer program and (d) a database – Go to database protection Page 8 Can include: something written that’s intended to be performed. ‘Literary’ does not include, but can be copyright; • “dramatic work” includes a work of dance or mime; •

“Musical work” means a work consisting of music, exclusive of any words or action intended to be sung, spoken or performed with the music. • Words of the song aren’t protected by musical copyright but by Literary copyright. • The song itself is protected by both literary and musical copyright. They can be separately owned.

s.4. Artistic works (1) In this Part “artistic work” means— (a) a graphic work, photograph, sculpture or collage, irrespective of artistic quality, (b) a work of architecture being a building or a model for a building, or (c) a work of artistic craftsmanship. For s.5A (sound recording) , s.5B (films) , s.6 (broadcasts) – see Entrepreneurial Rights below 2

It must be ORIGINAL: S1(1)(a) original • It must be the author’s own independent creation, that is, not copied • Has to originate from the author • Originality of expression and form is important, not of idea or content • Has it been copied from somewhere else?

3

There must be MINIMUM EFFORT: ‘A work’ as required by 1(1)(a) and 3(1) OR 4(1), thus there is a level of minimum effort required. • • • • •

4

The threshold of effort required for literary works is very low. The writing must be substantial enough to constitute a ‘work.’ No requirement of Artistic Merit. Can have copyright in work ‘irrespective of artistic quality.’ The courts require, following the Exxon Case, that the work provides ‘information, instruction or pleasure.’ The title is not substantial enough a work to have copyright as it only consists of 2 words. If it were a work it would be literary work.

The work must be recorded as required by section 3(2). Must be recorded ‘in writing or otherwise.’ I.e. any medium is sufficient . For s.4(1) artistic works… no recording required as this is excluded by s.3(2). But some degree of permanence is needed.

5

Who will be classed the OWNER?

3

Moral rights

It is the idea that the creative author or artist should retain certain rights in relation to his creation, even after he has sold the copyright to somebody else. The moral rights are as follows: (a) The right to be identified (‘right of paternity’) (s 77). This applies only if the right has been asserted by the author. This is usually done in the copyright assignment or licence.

(b) The right to object to derogatory treatment (s 80). For example, a novelist might object if his novel were abridged in a way that compromised its artistic integrity. OK if there was nothing prejudicial to the honour and reputation of the author of the original work. Confetti Records and Others v Warner Music UK Ltd (c) The right against false attribution of a work (s 84).

(d) The right to privacy in private photographs and films (s 85).

Entrepreneurial Copyrights, which protect those that invest in the creativity of the author. N.B. Protects works already satisfying the CLASSIC copyright questions therefore the general requirements for originality and minimum effort are not required, cannot copy though. N.B. Of the entrepreneurial rights, only films have moral right which vest in the director.. Classes of entrepreneurial copyright:

Graphical representations of published material a. Section 5A CDPA 1988 sound recordings.

P195

An attempt has been made to make the definitions of ‘film’, ‘sound recording’, etc technology neutral so that they will cover future technological developments. So, for example, ‘film’ includes, videos, DVDs and many ‘multi-media’ recordings where you have moving images. These can be ‘films’ even though they may be interactive. b. Section 5B CDPA 1988 films ‘film’ includes any recording on any medium from which a moving image can be produced. It therefore includes, videos, DVDs and multi-media recordings. The soundtrack of a film is protected by film copyright unless it is issued as a stand-alone entity, when it would be protected as a sound recording. S.5B(5) c.

Section 6 CDPA 1988 broadcasts includes terrestrial broadcasts, satellite and cable and some internet transmissions A ‘broadcast’ has been redefined to make the definition generic, so as to include not only terrestrial broadcasts (BBC and ITV, etc), but also satellite (Sky) and cable broadcasts (NTL) and some Internet transmissions.

d. Section 8 CDPA 1988 published editions of literary, dramatic or musical works. Differences between classic and entrepreneurial copyrights

(a) There is no general requirement of originality and minimum effort. Because everything protected by the entrepreneurial rights is based on something else. (b) no requirement for recording as by their nature E Rights are all recorded. (c) Of the entrepreneurial copyrights, only films have moral rights. These vest in the director. The thinking behind this is, of course, that it is the director who has given the artistic input. He is the person who might want to defend his artistic integrity. (d) The rules about ownership of the entrepreneurial rights vary (see 14.3.3).

4

(e) The duration of the entrepreneurial rights varies Problem: • What happens if you copy music on to PC? In theory, because there is no requirement of originality you could be said to create another copyright sound recording. • The Act provides that there is no copyright if they are simply copies of other work. Ownership of entrepreneurial copyright?

Duration of entrepreneurial copyright?

Ownership goes to the ‘creator,’ yet who the creator is varies. Sound recording

-

producer

Film

-

producer and principal director – s.9(2)

Broadcast

-

person making the broadcast

Cable programme

-

person providing the cable service

Typographical arrangement

-

publisher eg book

Varies according to the type of entrepreneurial copyright involved. Sound recording

-

50y from making or being released (if later)

Film

70y from end of life of last to die of principal director/author of screenplay/author of dialogue/composer of specially written music

Broadcast

-

50y from first broadcast

Cable programme

-

50y from first broadcast

Typographical arrangement

-

25y from publication

INFRINGEMENT Introduction

Follow this structure: 1. Section 16, the owner has exclusive rights to do ‘acts restricted by copyright’: 16(1)(a) copy the work 16(1)(b)issue copies of the work 16(1)(ba) rent or lend the work to the public 16(1)(c) perform, show or play the work in public 16(1)(d)communicate the work to the public 16(1)(e)make an adaptation of the work  go to s.21 below

2. Copyright of the owner is infringed by someone who does an ‘act restricted by copyright’ or allows someone else to do such an act [section 16(2)]. Is there a licence?? If so, then no infringement. 3. Section 16(3) says that to infringe copyright one can do it in relation to the whole of the work or a substantial part of it and it can be done directly or indirectly. Need to identify which category of right it is in order to apply infringement rules in relation to

5

restricted acts. Most common infringements are • copying • making an adaptation • giving public performance There are two types of infringement:

1. Presumption of infringement, Raise the presumption first. 1. Are the works similar? 2. Has there been an opportunity to copy? Eg access to the product The presumption is rebutted with evidence that the product has not been copied and is original. Simple comparison of two products is required. 2. Primary infringement, in which one is liable regardless of his state of mind There is no requirement of knowledge. The product does infringe by copying. Primary infringement is done by the actually author or employer etc •

Section 17 Infringement by copying. 17(2) Copying re an LDMA work means ‘reproducing the work in any material form.’ One does not need to copy the whole work, copyright is infringed by copying ‘a substantial part of the work’ Question of fact. • Not quantity but quality, so copying famous line from a play is enough. • Need not be an exact copy, so copying the plot is enough. If defendant’s work and claimant’s work are similar and defendant had access to claimant’s work then there is a presumption of copying 17(3) re artistic work 17(4) re film or broadcast 17(5) re typographical arrangement

•

Section 21 Infringement by making adaptation or act done in relation to adaptation. 21(1) Adaptation is made when it is recorded in writing or otherwise 21(3) Meaning of ‘adaptation:’ 21(3)(a)(i) re literary work or dramatic work 21(3)(ab) re computer program 21(3)(ac) re database 21(3)(b) re musical work

3. Secondary infringement, in which one is only liable if one knew or had reason to believe he was dealing with an infringing copy. Knowledge must be proven to be successful. Usually done by retailers / publishers NB – From practical point of view you would inform client to write to the secondary party involved so they would then be considered to have knowledge. Concerns dealing with infringing copies; knowledge is required.

6

Example of secondary infringement: Section 22 Importing infringing copy Section 23 Possessing or dealing with infringing copy Section 24 Providing means for making infringing copies

Proving copying

Can be difficult •

Defendants seldom leave any trace of how they did the copying.

•

Law helps Claimant by presuming that the D copies the C’s work if the two works are similar, and the D had access to the C’s work. If the presumption applies it is for the D to disprove copying.

•

Copying can be indirect. • •

e.g. novel adapted into play with or without permission of novelist. Copy play without permission – infringes copyright in the novel as well as the play even though the copying of the novel is only indirect.

Computer software • • • Remedies:

Normally don’t infringe copyright just by using someone’s work. But computer has to make transient copy onto hard drive, so using software infringes copyrights.

Section 96 says that infringement of copyright is actionable by the copyright owner. Section 99 – right of copyright owner to order delivery up of offending items Section 100 – right of copyright owner to seize offending articles (if in public domain) Injunction – Interim leading up to case and then upon judgement full Damages (loss of sales) OR Account of profits (easier to prove a/c of profits) S.99 – delivery up of infringing copies S.114 – destruction of infringing copies S.111 – order preventing importation of infringing copies S.97(1) – cannot claim if innocent infringement

Sanctions: Defences:

Section 107 provides for criminal liability for making or dealing with infringing copies. 1.

Fair dealing for purposes of research or private study (s29) applies to LDMA works applies to published editions Must be ‘non-commercial’ research since directive 2001/29/EC

2.

Fair dealing for purpose of criticism and review [s30(1)] The question whether within the exception depends mainly on:

(a) the purpose for which the quote is used – The quote must be commented on rather than just copied to use it to tell people something; and

(b) how big the quote is. 3.

Fair dealing for the purpose of reporting current events [s30(2)]

7

• • • •

applies to all works, apart from photographs may need to give an acknowledgement, if in paper or magazine question of what is fair depends on purpose and how much is taken must be for genuinely reporting current events

4.

Argue that the item does not deserve protection, that the right in question is not valid and/or the claimant does not have the right to sue for infringement. Common with IP rights.

5.

Argue that had consent of the copyright holder.

Data Protection Checklist Structure – following on from section 3(1)(d) on page 2 1.

The database right prevents unauthorised use of the database or a substantial part of it and arises automatically.

Does work constitute a database?

i.

Requirements; It must be a database as defined by section 3A(1) CDPA 1988. ‘Database’ means ‘a collection of independent works, data or other materials which – (a) are arranged in a systematic or methodical way, and (b) are individually accessibly by electronic or other means’

ii.

It must be original; that is not copied. S.3A(2) ‘constitute the author’s own intellectual creation’. This is a higher threshold test iii. The way the database is put together must constitute the author’s intellectual creation; taking into account two criteria: s.3A(2) there is only originality if arrangement or selection of material is creative in some way. As such, it is unlikely that literary copyright will subsist in a database. This is a tough test to satisfy.

2. Does the right subsist in the database?

Regulation 13 of CRDR 1997 says that the database right will subsist in a database ‘if there has been a substantial investment in: • obtaining, • verifying or • presenting the contents of the database. Need a substantial investment (human, financial or technical) in either the quality or quantity of the database or in obtaining, verifying or presenting the data.

3.

The maker of a database is the first owner of database right in it per reg 15.

Ownership of the database right?

s.14. The maker of a database (1) the person who takes the initiative in obtaining, verifying or presenting the contents of a database and assumes the risk of investing in that obtaining, verification or presentation shall be regarded as the maker of, and as having made, the database. Exceptions: s.14 (2) Where a database is made by an employee in the course of his employment, his employer shall be regarded as the maker of the database, subject to any agreement to the contrary.

Duration of the database right:

The database right, per reg 17, lasts the longer of 15 years from the end of the calendar year of completion of the database or the year in which the database was first made available to the public. 17(3) says that any ‘substantial new investment’ in the database recommences the period of protection.

8

Thus, an annual publication has a rolling 15-year period.

INFRINGEMENT Requirements

Regulation 16 says that ‘a person infringes database right in a database if, without the consent of the owner of the right, he extracts or re-utilises all or a substantial part of the contents of the database.’ Extraction – per reg 12(1) – ‘the permanent or temporary transfer of those contents to another medium by any means or in any form.’ Re-utilisation – per reg 12(1) – ‘making those contents available to the public by any means.’ Substantial is in terms of quality, or quantity or both. N.B. Reg 16(2) provides that ‘the repeated and systematic extraction or re-utilisation of insubstantial parts of the contents of a database may amount to the extraction or re-utilisation of a substantial part of those contents.’ Many insubstantial parts becomes substantial.

Exceptions to infringement:

The right is not infringed by: i.

fair dealing with a substantial part of a database made available to the public if dealing is for illustration in teaching or research and sufficient acknowledgement is given per regulation 20(1).

ii.

by dealing with the database available for public inspection as a statutory record with the permission of the database keeper.

N.B. Can assign/licence the database right and copyright in the database.

Data Protection and Freedom of Information Legislation

Data Protection Act 1998 The main aims of the Act are to protect the right of individual privacy and to harmonise UK law with that of other Member States. The scheme of the Act is to require a ‘data controller’ to be registered before he can lawfully ‘process’ any ‘personal data’ about a ‘data subject’. The enforcement of the Act is in the hands of the Information Commissioner (formerly known as the Data Protection Commissioner), who, along with his department, regulates, enforces and prosecutes on behalf of the public. Freedom of Information Act 2000 The big difference between the DPA 1998 and the FOIA 2000 is that the former deals with the private protection of personal data, whereas the latter is concerned with public access to government information.

9

Overview and scope of DPA 1998

The DPA 1998 improved upon the DPA 1984 in a number of ways: (a) (b) (c) (d)

manual files are now included as well as automated data; new conditions for legal processing of data were laid down; a new category of personal data was created – ‘sensitive data’; transfer of personal data to countries outside the European Economic Area was prohibited, unless certain conditions were met; (e) minimum security requirements for data were introduced; and (f) more rights for individuals were introduced, including the right to compensation for damage or distress caused by unlawful processing. The two effects of the DPA 1998;

Checklist to application of DPA 1998

The definitions of ‘data controller’, ‘personal data’, ‘processing’ , ‘data subject’

1.

to allow individuals access to information held about them, for example the information held about people by credit reference agencies.

2.

to protect information about individuals from being disclosed improperly.

1.

the data subject must be a living individual;

2.

data (within s 1(1)) must be in question; that may, but will not necessarily, involve consideration of whether a relevant filing system is involved;

3.

the data are personal data;

4.

some processing is involved;

5.

at least one precondition for processing within Sch 2 is met, and if sensitive personal data are involved, at least one from Sch 3 is met too;

6.

the data are processed in accordance with all the relevant data protection principles in Sch 1.

S1(1) of the DPA 1998, by reference to each other, so that each and every definition and element must be satisfied in order to apply the law to the particular fact situation: •

‘data controller’ means . . . a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which personal data are, or are to be, processed;

•

‘personal data’ means data which relate to a living individual who can be identified— (a) (b)

from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual; •

‘processing ’, in relation to information or data, means obtaining , recording or holding the information or data or carrying out any operation or set of operations on the information or data, including— (a) (b) (c) (d)

10

organisation, adaptation or alteration of the information or data, retrieval, consultation or use of the information or data, disclosure of the information or data by transmission, dissemination or otherwise making available, or alignment, combination, blocking, erasure or destruction of the information

or data; •

‘data subject’ means an individual who is the subject of personal data.

So, it is fairly easy to see the data controller becomes responsible to the data subject from the first moment of dealing with any personal information that could identify the data subject as a living individual. ‘Personal data’, ‘data’, ‘relevant filing systems’

The definition of ‘personal data’ in s 1(1) is itself defined by reference to ‘data’. The problem with that is that the s 1(1) definition of ‘data’ includes five, alternative classes of information, of which the most significant involves a ‘relevant filing system’, which term is then further defined in s 1(1). •

‘data’ means information which— (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should be processed by means of such equipment; (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system; (include paper-based systems) (d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68; (includes health and education records) or (e) is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d)

•

‘relevant filing system’ means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in such a way that specific information relating to a particular individual is readily accessible. A mere collection of documents would not suffice (Durant v Financial Services Authority)

•

‘personal data’, only if the data concerned a person’s privacy. Two tests were suggested: (a) Is the information biographical in a significant sense? (b) Does the information have the individual as its focus, rather than other persons or matters?

The individual’s name will be ‘personal data’ only where the name appears together with other information about the named individual such as address, telephone number or information regarding his hobbies. (Information Commissioner) Provided the information in question can be linked to an identifiable individual the following counts: (a) information about the medical history of an individual; (b) an individual’s salary details; (c) information concerning an individual’s tax liabilities; (d) information comprising an individual’s bank statements; and (e) information about an individual’s spending preferences. Following examples of information would not normally be personal data: (a) mere reference to a person’s name where the name is not associated with any other personal information; (b) incidental mention in the minutes of a business meeting of an individual’s attendance at that meeting in an official capacity; or (c) where an individual’s name appears on a document or e-mail indicating only that it

11

has been sent or copied to that particular individual, the content of that document or e-mail does not amount to personal data about the individual unless there is other information about the individual within it. If an individual cannot be identified from the data in question then it is not ‘personal data’, and therefore not subject to the DPA 1998. The eight principles of good practice

Anyone processing personal information must comply with eight enforceable principles of good information handling practice (DPA 1998, s 4(4)). These principles, contained in Sch 1, state that data must be: 1. fairly and lawfully processed; 2. processed for limited purposes; 3. adequate, relevant and not excessive; 4. accurate and up-to-date; 5. not kept longer than necessary; 6. processed in accordance with the individual’s rights; 7. secure; and 8. not transferred to countries outside the European Economic Area unless the country has adequate protection for the individual.

The six conditions for data processing

At least one of the following conditions, seen in Sch 2 to the DPA 1998, must be met for personal information to be considered as having been processed fairly: (a) (b) (c) (d) (e) (f)

Sensitive personal data

the individual has consented to the processing; processing is necessary for the performance of a contract with the individual processing is required under a legal obligation; processing is necessary to protect the vital interests of the individual; processing is necessary to carry out public functions, eg administration of justice; and processing is necessary in order to pursue the legitimate interests of the data controller

The relevant definition of ‘sensitive personal data’ is in s 2: (a) (b) (c) (d) (e) (f) (g) (h)

the racial or ethnic origin of the data subject, his political opinions, his religious beliefs or other beliefs of a similar nature, whether he is a member of a t rade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992), his physical or mental health or condition, his sexual life, the commission or alleged commission by him of any offence, or any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Sensitive personal data must be processed in accordance with the requirements of Sch 3; • •

The rights of the data subject and other persons under DPA 1998

Sch 3.1. The data subject has given his explicit consent to the processing of the personal data. Sch 3.2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

These matters are dealt with in Pt II of the Act. The seven rights are: The right to subject access (s 7) Entitles a data subject to be informed by a data controller, upon request in writing; • whether any personal data are being processed, • what they comprise, • the purposes for which they are being processed, and

12

•

to whom the data are or may be disclosed.

NB - A data controller is not required to notify a data subject automatically The right to prevent processing likely to cause damage or distress (s 10) Any data subject is entitled to require, by written notice, that a data controller cease or not commence processing, or restrict processing, of his personal data, where the processing would otherwise be likely to cause unwarranted damage or distress to anyone at all. Does not apply if paras 1–4 of Sch 2 is fulfilled; • where the data subject has already consented to processing , • the processing is necessary for the purposes of complying with contractual arrangements of the data subject, • to meet legal or regulatory requirements upon the data holder • to protect the vital interests of the data subject. The data controller must reply to the notice within 21 days The right to prevent processing for purposes of direct marketing (s 11) Any data subject to require, in writing, a data holder to cease, or not begin, any processing carried out for the purposes of allowing any person to direct advertising or marketing material towards particular individuals. Rights in relation to automated decision taking (s 12) The section provides that a data subject can require a data controller to ensure that such a decision is not to be made based solely on the automatic processing, or, if one has already been made, the data subject is to be notified that it was made on that basis, as soon as reasonably practicable. The data subject then has 21 days to require the data controller to reconsider the decision, or to take a fresh decision on a different basis. There are some categories of ‘exempt decisions’ in s 12(6) and (7), The right to compensation (s 13) Any individual, whether data subject or otherwise, can sue one or more data controllers as primarily or vicariously liable for breaches of the Act that lead to damage and/or distress. There is a defence against compensation claims if the data controller has taken reasonable care to comply with the Act (s 13(3)).

The right to rectification, blocking, erasure and destruction (s 14) This gives the court the power to order the data controller to rectify, block, erase or destroy any personal data, about the data subject or anyone else, which are inaccurate and personal data which contain expressions of opinion which appear to be based upon the inaccurate data. The right to ask the Commissioner to assess whether the Act has been contravened (s 42) This gives a discretion to the Commissioner as to the form and manner of making such an assessment, at the instance of any person who is, or who believes himself to be, directly affected by any processing. This is backed up by criminal sanctions under s 47 if there is failure in compliance with the notice. A data controller has a right of appeal to the Tribunal against service of such notices.

13

The obligations of the data controller and disclosure restrictions

The two principles of most concern in regard to disclosure of personal data: 1st principle: fair and lawful processing As ‘processing’ is defined widely, the first principle has wide application to all use of personal data. It can be divided into four obligations: (a) to process personal data fairly; (b) to process such data lawfully; (c) to comply with at least one of the Sch 2 conditions; and (d) to comply additionally with at least one of the Sch 3 conditions if sensitive personal data are processed. The Information Commissioner suggests that in judging whether processing is necessary, data controllers would need to consider whether: (a) the purposes for which the data are being processed are valid; (b) such purposes can be achieved only by the processing of personal data; and (c) the processing is proportionate to the end pursued. 2nd principle: processed for limited purposes The concept of processing for limited purposes means that the data should be processed only for the purposes to which the data subject has consented. The legal guidance from the Information Commissioner is in f act slightly wider and refers to different purposes which are not being ‘envisaged’ by the data subject at the time of the collection of the information.

Exemptions

These are seen in ss27 to 39 and Schs 7 and 8. The reasons for most of the exempt situations are based on public policy. Matters such as national security, crime, taxation, social work, examination marks, legal professional privilege, etc Exemptions for crime prevention and legal proceedings Under s 29(3), personal data are exempt from the non-disclosure provisions and the right of subject access where the disclosure is for the purposes of preventing or detecting crime, apprehending or prosecuting offenders, or assessing or collecting tax.

Under s 35(2): Personal data are exempt from the non-disclosure provisions where the disclosure is necessary— (a) for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or (b) for the purpose of obtaining legal advice, or is otherwise necessary for the purposes of establishing, exercising or defending legal rights. Enforcement, offences and civil damages

14

The Act creates a wide range of criminal offences; Most are ‘either way’ offences, punishable by fine. • notification offences,

those matters arising out of Pt III of the Act, which deals with the obligations of the data controller to notify the Commissioner of ‘registrable particulars •

enforcement offences, found in Pt V of the Act and arise where there is a failure by the data controller to comply with the enforcement mechanisms employed by the Commissioner.

•

disclosure offences.

o Section 21 discussed above (eg, simply handling data without being registered).

o Section 55 creates a wide-ranging offence where personal data are obtained or disclosed without the consent of the data controller.

o Section 55(6) advertising the sale is treated as offering to sell the data o Section 59 creates an offence of wrongful disclosure by the Commission itself

15