Data Protection Act, 1988
|
Duty of care owed by data controllers and data processors. |
7.—For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data controller or a data processor, shall, so far as regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject concerned: | |
Provided that, for the purposes only of this section, a data controller shall be deemed to have complied with the provisions of section 2 (1) (b) of this Act if and so long as the personal data concerned accurately record data or other information received or obtained by him from the data subject or a third party and include (and, if the data are disclosed, the disclosure is accompanied by)— | ||
(a) an indication that the information constituting the data was received or obtained as aforesaid, | ||
(b) if appropriate, an indication that the data subject has informed the data controller that he regards the information as inaccurate or not kept up to date, and | ||
(c) any statement with which, pursuant to this Act, the data are supplemented. |