5.1.8 Data protection laws
The Data Protection Act 1998 is designed to ensure the fair and lawful processing of the personal data of living individuals and updates previous legislation. It obliges organisations to provide a reasonable degree of confidentiality for information about people, and to respect their privacy. The Act has come into force by degrees and initially related only to personal data held on computer systems, but now also applies to personal data held in paper based files.
Archives and records are essential for freedom of information and data protection and the legislation provides opportunities for improving record keeping by public bodies. Data protection legislation is UK-wide, while freedom of information legislation is devolved to Scotland, but not in Wales.
In the early to mid 1990s there was considerable concern amongst UK cultural organisations and charities about the potential impact of data protection requirements, which were seen, for example, as preventing the common practice of exchanges of mailing lists between arts / cultural organisations. The obligation for prospective recipients to "opt-out" rather than "opt-in" to mailing lists for promotion has generally allayed such concerns.