It is unlikely that the draftsmen responsible for the Data Protection Act 1998 (DPA) anticipated that it would be used as a tool for litigators to pre-empt the disclosure rules set out in the Civil Procedure Rules (CPR). Anecdotal evidence suggests, however, that individuals are engaging in speculative fishing expeditions to assist them with a claim.
The subject access provisions of the DPA are set out in sections 7-9. Section 7(1) sets out the right of a data subject to be informed whether personal data, of which that individual is the data subject, are being processed – by or on behalf of the data controller – and, if so, to have communicated to him such information.
