Have a look at section 55 of the Data Protection Act 1998
55 Unlawful obtaining etc. of personal data
(1) A person must not knowingly or recklessly, without the consent of the data controller—
(a) obtain or disclose personal data or the information contained in personal data, or
(b) procure the disclosure to another person of the information contained in personal data.
(2) Subsection (1) does not apply to a person who shows—
(a) that the obtaining, disclosing or procuring—
(i) was necessary for the purpose of preventing or detecting crime, or
(ii) was required or authorised by or under any enactment, by any rule of law or by the order of a court,
(b) that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person,
(c) that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or
(d) that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.
(3) A person who contravenes subsection (1) is guilty of an offence.
(4) A person who sells personal data is guilty of an offence if he has obtained the data in contravention of subsection (1).
(5) A person who offers to sell personal data is guilty of an offence if—
(a) he has obtained the data in contravention of subsection (1), or
(b) he subsequently obtains the data in contravention of that subsection.
(6) For the purposes of subsection (5), an advertisement indicating that personal data are or may be for sale is an offer to sell the data.
(7) Section 1(2) does not apply for the purposes of this section; and for the purposes of subsections (4) to (6), “personal data” includes information extracted from personal data.
(8) References in this section to personal data do not include references to personal data which by virtue of section 28 are exempt from this section.
-
“data” means information which—
(a)
is being processed by means of equipment operating automatically in response to instructions given for that purpose,
(b)
is recorded with the intention that it should be processed by means of such equipment,
(c)
is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, or
(d)
does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68;
-
“personal data” means data which relate to a living individual who can be identified—
(a)
from those data, or
(b)
from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
For good measure:
2 Sensitive personal data
In this Act “sensitive personal data” means personal data consisting of information as to—
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the [1992 c. 52.] Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
I think this probably means that it is improper to publish, or to post links to, this material
Accordingly, I will be editing this site to remove links. Sorry.
…but on the other hand
LC in the comments below says:
The European Court of Human Rights has held in its judgment in The Sunday Times v. The United Kingdom (no.2) and the Observer and Guardian v. The United Kingdom that the state may not
punish people for publishing information already in public circulation, even though the initial leaker is punishable under law.
So if the government should attempt to punish people for reading the membership list online, it’s in for a very negative ruling from the ECHR.
Since the HRA incorporates the court’s interpretation of Article 10, the mitigates the reach of the Data Protection Act to the latter imposes a disproportionate punishment for publication of publicly available information.
