Report - Guardian

152 The LSE Identity Project Report: June 2005ConclusionThe Identity Cards Bill raises many questions concerning compatibility with existingData Protection legislation. The remaining lack of clarity of purpose and the widerangingscope for the Secretary of State to amend the various elements of the legislationby Order, mean that the elements of transparency and certainty sought by the First DataProtection Principle may not be provided. The lack of clarity has a knock on effect forsatisfying the remaining principles – if the purpose is not clear it is difficult to assesswhether information stored is relevant or excessive. The Bill also proposes turning theprinciple that it is the data controller’s duty to ensure the accuracy of their data on itshead by laying this onus on the individual themselves. Furthermore, though not clearlystated, it is implicit that the information fed into the Register will be kept indefinitely.The Bill in many ways seeks to obviate the requirements of the DPA by taking thewhole ID card outside the data protection regime: “The Government’s commitment tomake the scheme consistent with the data protection legislation can be summarized asoutline proposals to exempt the scheme from five of the eight data protection principlesthrough the use of statutory powers.” 369DefinitionsData subject means an individual who is the subject of personal data.Personal data means data, which relate to a living individual who can be identified –a) from those data, orb) from those data and other information which is in the possession of, or is likely tocome into the possession of, the data controller.Sensitive personal data means personal data consisting of information as toa)the racial or ethnic origin of the data subject,b) their political opinions,c) their religious beliefs or other beliefs of a similar nature,d) whether they are a member of a trade union,e) their physical or mental health or condition,f) their sexual life,g) their criminal convictions or alleged convictions.Processing, in relation to information or data, means obtaining, recording or holding theinformation or data or carrying out any operation or set of operations on the informationor data includinga)organisation, adaptation or alteration of the information or data,b) retrieval, consultation or use of the information or data: this will include simplylooking at information on a computer screen and making a decision about theindividual based on that information which is then recorded elsewhere.c) disclosure of the information or data by transmission, dissemination or otherwisemaking available, ord) alignment, combination, blocking, erasure or destruction of the information or data.Data controller means, a person who (either alone or jointly or in common with otherpersons) determines the purposes for which and manner in which any personal data are,or are to be, processed.369 Memorandum submitted by the Editors of ‘Data Protection and Privacy Practice’ to the Select Committee onHome Affairs.