Explanatory Memorandum to the Draft Model Bill on the Protection of Personal Information and the Recommendation From Senior Officials to Law Ministers

Summary

---

Law Enforcement. National Security. Annex. Draft model legislative provisions protection of personal information act [......]. Arrangement of Sections. Part I. Preliminary. Section. Part II. Processing of personal information. Part III. Duties of organisations with respect to records of personal information. Part IV. Access to personal information. Part V. Investigation of complaints. Bill. Part I. Preliminary. Short title. Commencement. Object of Act. Interpretation. Application of Act. Saving of certain other enactments. Part II. Processing of personal information. Appropriate purpose. Requirement of knowledge and consent. Collection of personal information. Source of personal information. Collection without knowledge or consent. Limits on use of personal information. Limits on disclosure of personal information. Condition for use or disclosure of personal information. Use of personal information outside [name of country]. Disclosure of personal information outside [name of country]. Part III. Duties of organisations with respect to records of personal information. Accuracy of information. Security of information. Note of uses and disclosures without consent. Retention of records. Information practices. Part IV. Access to personal information. Right of access to personal information. Procedure for access. Fees for access. Copy of record. Sensory disability. Duty to sever. Correction of personal information. Part V. Investigation of complaints. Receipt and investigation of complaints. Mode of complaint. Notice of investigation. Regulation of procedure. Investigations in private. Powers of [Privacy Commissioner] in carrying out investigations. Dispute resolution. Findings and recommendations of [Privacy Commissioner]. Review of compliance with certain provisions. Report to Parliament. Security requirements. Confidentiality. Protection of [Commissioner] etc from criminal or civil proceedings. Obstruction. Part VI. Miscellaneous. Delegation by head of organisation. Regulations.

See the full content of this document

Extract

---

Explanatory Memorandum to the Draft Model Bill on the Protection of Personal Information and the Recommendation From Senior Officials to Law Ministers

1. At the 2002 Commonwealth Law Ministers and Senior Officials Meeting in Kingstown, St. Vincent and the Grenadines, Senior Officials agreed that the Model Bill on the Protection of Personal Information needed more reflection on the balance between privacy and the legitimate needs of governments in respect of law enforcement and security. Senior Officials therefore recommended that Law Ministers refer back the matter for further consideration and asked the Secretariat to prepare an amended draft in light of written comments from governments. On the basis of this request, the Commonwealth Secretariat sought expert views from the UK Information Commissioners Office. The following analysis was received from them and is based on UK legislation (the UK Data Protection Act 1998).

2. The UK's Data Protection Act 1998 is based on a set of enforceable standards for handling personal information, 'the data protection principles', and on a set of individuals' rights. The standards for handling personal information require that personal information be:

* obtained and handled fairly and lawfully;

* obtained for specified and lawful purposes;

* adequate, relevant and not excessive;

* accurate and up-to-date;

* not kept for longer than is necessary;

* processed in accordance with individuals' rights;

* kept secure;

* not transferred overseas unless there is adequacy of protection.

3. The Data Protection Act 1998 gives the individual a right to:

* gain access to information held about him or her;

* prevent records being used for direct marketing;

* appeal decisions made solely by automatic means;

* obtain compensation in certain circumstances;

* have records rectified, blocked or erased in certain circumstances.

4. The Act also contains certain 'conditions for processing'. These are essentially 'gateways' that restrict the purposes for which personal information can be processed. These have a particular effect on the processing of sensitive personal information, such as that concerning the offences that a person has committed. The way the legislation works in the UK is that all the information standards must be adhered to, and all the individuals' rights delivered, unless a particular exemption applies. However, the Act contains several exemptions that can be applied in the contexts of law enforcement and national security.

Law Enforcement

5. Personal information processed for the prevention of crime or for the apprehension or prosecution of offenders, such as information contained in intelligence records held by the police, is exempt from the requirement to obtain information fairly and lawfully. The normal standard under data protection law is for the individual to be informed when and why information about him or her is being collected. Clearly it would not be possible for policing to be carried out effectively should law enforcement agencies always be required to tell individuals that information about them has been obtained...

See the full content of this document

---