Processing of personal data is governed in the UK by the Data Protection Act 1998 (DPA). Although the Act was drafted taking into account the principles of the Human Rights Act (HRA), the provisions of the DPA represent a compromise between two key requirements under the HRA. Article 8 of the European Convention on Human Rights states that everyone has the right to respect for his private and family life, his home and his correspondence. Inevitably, the collection and use of personal data will have the potential to infringe that right. On the other hand, Article 10 recognises the right to freedom of expression and specifically provides that this includes freedom to receive and impart information without interference by public authority.
Both of these important rights are qualified in the Convention. Exercise of each right may legitimately be restricted to the extent necessary in a democratic society. Any data protection regime therefore has to steer between the two principles. Further changes in legislation will reflect a wish to change the balance, primarily in order to give greater protection to the individual.
A number of likely developments can be identified. One relates to the use of "third party data". At present, it is quite common in the financial sector to carry out searches in relation to family members or persons living at the same address as a prospective customer. This practice could fall foul of Article 8 and by the end of next year it is likely to be outlawed or strictly restricted.
Another likely development relates to the use of "opt in" and "opt out" boxes. A data controller may wish to pass information on to third parties for marketing purposes. Currently, it is usually permissible to include an "opt out" box for the individual to tick if he or she does not want personal data to be passed on in this way. The Data Protection Commissioner has already made clear that she would prefer organisations to be required to use "opt in" boxes. Now that the HRA is in force it is likely that there will be a move to achieve this.
In relation to advertising, it is likely that future developments will be triggered by Article 10. Although national governments can control the content of advertisements, the HRA will make it more difficult to restrict advertising activities. For example, a number of tobacco companies successfully challenged the lawfulness of the EU Directive banning tobacco advertising. One of their grounds of complaint was that the ban breached their right under Article 10 to impart information.
Future changes in the law relating to the use of confidential data will reflect concerns that the balance between the competing demands of Articles 8 and 10 of the Convention needs adjustment. In addition some existing data protection provisions are bound to be challenged in the courts and changes in statute law may be driven by court decisions.
The information and opinions contained in this publication are provided by national law firm Hammond Suddards Edge. They should not be applied to any particular set of facts without seeking appropriate legal or other professional advice.