History

1980

OECD working party drafted a set of Guidelines, which have subsequently been amended most recently in 1999? Organization for Economic Co-Operation and Development, Guidelines on the Protection of Privacy and Transborder Flows of Personal Data This document set out the recommendations of the OECD for protection of personal data, in the form of seven key principles.
NoticeData subjects should be given notice when their data is being collected.
PurposeData should only be used for the purpose stated and not for any other purposes.
ConsentData should not be disclosed without the data subject’s consent.
SecurityCollected data should be kept secure from any potential abuses.
DisclosureData subjects should be informed as to who is collecting their data.
AccessData subjects should be allowed to access their data and make corrections to any inaccurate data.
AccountabilityData subjects should have a method available to them to hold data collectors accountable for following the above principles.

1981

The Council of Europe negotiated "The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data". This convention obliges the signatories to enact legislation concerning the automatic processing of personal data, which many duly did.

1984

UK Data protection act 1984, Wikipedia.
1.The information to be contained in personal data shall be obtained, and personal data shall be processed, fairly and lawfully.
2.Personal data shall be held only for one or more specified and lawful purposes.
3. Personal data held for any purpose or purposes shall not be used or disclosed in any manner incompatible with that purpose or those purposes.
4. Personal data held for any purpose or purposes shall be adequate, relevant and not excessive in relation to that purpose or those purposes.
5.Personal data shall be accurate and, where necessary, kept up to date.
6. Personal data held for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
7. An individual shall be entitled-
(a) at reasonable intervals and without undue delay or expense- (i) to be informed by any data user whether he holds personal data of which that individual is the subject; and
(ii) to access to any such data held by a data user; and
(b) where appropriate, to have such data corrected or erased.
8. Appropriate security measures shall be taken against unauthorised access to, or alteration, disclosure or destruction of, personal data and against accidental loss or destruction of personal data.

The act creates the post of "Data Protection Registrar", to issue guidance as to which data uses do not need to be registered, and to assemble the register of organizations, with data bases that do register.

1987

UK Access to personal files ACT.

1995

DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 October 1995

1998

UK act of Parliament incorporating the 1995 treaty in to UK law. Wikipedia

The text of the act can be found on the government website.

2000

UK The Data Protection (Notification and Notification Fees) Regulations 2000

The responsibilities of the "Data Protection Registrar" transferred to the new post of "Information Commissioner".

The updated list data use that is exempt from the need to register, is in the schedule.

2003

UK the Privacy and Electronic Communications (EC Directive) Regulations 2003

International implications

The EU directive mandates that personal data, can not be transferred outside of the EU, unless the destination either at the country level, or at the company level. Provides equivalent enforcement of the principles.

USA

No legal universal data protection framework. In 2001 the United States Department of Commerce set up a volentery Safe Harbor scheem, for which individual companies can register. http://en.wikipedia.org/wiki/International_Safe_Harbor_Privacy_Principles

Information Commissioner

In the UK the roles of advising, and enforcment fall under the remit of the Information Commissioner. The information commissioner has there own website.

The website contains lots of usefull information. The office ot he information commisioner, is resposible for enforcing good practise with regards to the use and care of data within four main areas.

Links