Part II Registration and Supervision of Data Users and Computer Bureaux
Registration
5 Prohibition of unregistered holding etc. of personal data.
(1)
A person shall not hold personal data unless an entry in respect of that person as a data user, or as a data user who also carries on a computer bureau, is for the time being contained in the register.
(2)
A person in respect of whom such an entry is contained in the register shall not—
(a)
hold personal data of any description other than that specified in the entry;
(b)
hold any such data, or use any such data held by him, for any purpose other than the purpose or purposes described in the entry;
(c)
obtain such data, or information to be contained in such data, to be held by him from any source which is not described in the entry;
(d)
disclose such data held by him to any person who is not described in the entry; or
(e)
directly or indirectly transfer such data held by him to any country or territory outside the United Kingdom other than one named or described in the entry.
(3)
A servant or agent of a person to whom subsection (2) above applies shall, as respects personal data held by that person, be subject to the same restrictions on the use, disclosure or transfer of the data as those to which that person is subject under paragraphs (b), (d) and (e) of that subsection and, as respects personal data to be held by that person, to the same restrictions as those to which he is subject under paragraph (c) of that subsection.
(4)
A person shall not, in carrying on a computer bureau, provide services in respect of personal data unless an entry in respect of that person as a person carrying on such a bureau, or as a data user who also carries on such a bureau, is for the time being contained in the register.
(5)
Any person who contravenes subsection (1) above or knowingly or recklessly contravenes any of the other F1foregoing provisions of this section shall be guilty of an offence.
F2(6)
A person who procures the disclosure to him of personal data the disclosure of which to him is in contravention of subsection (2) or (3) above, knowing or having reason to believe that the disclosure constitutes such a contravention, shall be guilty of an offence.
(7)
A person who sells personal data shall be guilty of an offence if (in contravention of subsection (6) above) he has procured the disclosure of the data to him.
(8)
A person who offers to sell personal data shall be guilty of an offence if (in contravention of subsection (6) above) he has procured or subsequently procures the disclosure of the data to him.
(9)
For the purposes of subsection (8) above, an advertisement indicating that personal data are or may be for sale is an offer to sell the data.
(10)
For the purposes of subsections (7) and (8) above, “selling”, or “offering to sell”, in relation to personal data, includes selling, or offering to sell, information extracted from the data.
(11)
In determining, for the purposes of subsection (6), (7) or (8) above, whether a disclosure is in contravention of subsection (2) or (3) above, section 34(6)(d) below shall be disregarded.