DATA PROTECTION LEGISLATION
1. The Data Protection Act is an important piece of legislation.
(a) State the eight principles of the 1998 Data Protection Act. (8)
(b) Describe two exemptions to the Act. (4)
(c) Describe twp obligations of data users under the legislation. (4)
2. A college maintains an extensive database of its full-time students. The database
contains personal data, the courses students attend, and higher education or
a) Describe how the college might keep the personal data of the students up to date.
b) The college wishes to sell the personal data to local sports retailer. Describe three
issues, relating to the data that should be included in this agreement. (3)
3. A national distribution company advertises its products by sending personalised
letters to thousands of people across the country each year. This type of letter is
often known a ‘junk mail’. The distribution company purchases the list of names
and addresses from an agency.
a) Describe two ways in which the use of information technology has increased the
use of ‘junk mail’. (4)
b) The company wishes to target letters to people who are likely to buy its products.
How might this be done? (2)
c) A person receiving this type pf mail writes to the company that it is acting illegally
under the terms of the Data Protection Act. Give three statements the company
may use in it’s reply to show that it is operating within the terms of the Act. (3)
Hint: An example of a statement may be: We follow the fifth principle of the Data
Protection Act by deleting all personal information that we no longer use.
4. Charlie Reid wishes to buy a washing machine on hire purchase. He is refused
credit as he has a bad credit rating on the computer. He asks why and he is told
that his son, who lives at home, has a bad credit rating. When he asks why his son
has a bad credit rating, he is told that his son used to live at an address 100 miles
away in Lancashire. Another resident at the Lancashire address owes his bank
£1000. He complains to the bank that they’ve broken the Data Protection Act.
They deny that they have. Explain whether you think the DPA has been broken or
5. In 1997 the information Commissioner, Elizabeth France, threatened to take two
utility companies to court for breaking restrictions in the Data Protection Act. The
companies were sending direct mail leaflets and advertisements to their customers.
The official notice from the registrar to the two companies said they should stop
using the customer list for advertising. Write briefly to one of the companies
explaining which principle of the Data Protection Act may have been broken. (6)