12.21  The Data Protection Act 1998 has been extended to both Houses of Parliament[508]. The Act gives individuals (data subjects) a general right of access to personal information held about them, subject to certain exemptions. It also places a duty on all data controllers to comply with the eight Data Protection Principles (Schedule 1 to the Act). These relate to the collection, use, maintenance, accuracy and security of personal information. The Clerk of the Parliaments has the role of data controller in relation to the processing of personal data by or on behalf of the House of Lords. Under section 35A of the Act[509] personal data are exempt from certain provisions of the Act if the exemption is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

509   Added by Schedule 6 to the Freedom of Information Act 2000. Back