Specific Legislation 5. Wider concerns about the security of data held on computers has led to a body of legislation which criminalises misuse and unauthorised access to computerised information. NHS bodies which use computerised information must register with the Data Protection Registrar the purposes for which they hold personal information, sources and disclosures. It is a criminal offence to hold or disclose information in breach of the registration requirements of the Act. The Computer Misuse Act 1990 provides criminal sanctions against unauthorised access or damage to computerised information.
Authorised users have permission to use certain programmes and data.
If those users go beyond what is permitted, it is a criminal offence. The Act makes provision for accidentally exceeding permitted activities and also covers fraud, extortion and blackmail. EC Data Protection Directive 6. The Directive will not become law until legislation has been enacted in this country and consideration of its impact is necessarily somewhat speculative at present. Although a degree of caution is warranted, there are a number of general points which can be made.