Legal compliance did very little to sustain, let alone improve, an individual's right to privacy. The new Data Protection Act received Royal Assent on the 16 July 1998. The Act and the secondary legislation required to support it, will be brought into force on the 1 March 2000. The new Act has a clear focus on individual privacy. The Information Commissioner's initial interpretation of the new Act illustrates this.
Stricter conditions apply to the processing of sensitive data.
This category includes information relating to racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, health, sex life and criminal convictions. Personal data may only be transferred to third countries if those countries ensure an adequate level of protection for the rights and freedoms of data subjects. When determining adequacy data controllers should consider, for example, the nature of the data, the country of origin and final destination, and the law or any relevant codes of conduct in force. The definition of data in the new Act has been extended so that it now catches information which is recorded as part of a relevant filing system where the records are structured, either by reference to individuals or by reference to criteria relating to individuals, so that specific information relating to a particular individual is readily accessible. This definition will catch some types of manual data as well as automated forms of processing.