What do you get when government departments don’t understand technology and introduce contradictory legislation? The answer is the current confusion regarding e-mail.
Let’s start with the Data Protection Act 1998 (DPA.) This was introduced by the DTI to comply with a European Union directive regarding the processing of personal data. It impacts e-mail because personal data can be sent by e-mail raising security implications. In addition, e-mail automatically contains personal data by virtue of the address. This is because "personal data" is defined as any data that identifies an individual. As e-mail goes from A to B it is processed, within the meaning of the DPA by a number of ISP’s. Not only is the processing done without the active consent of the data subject but it is also done without the knowledge of the ISP. It is simply an automatic process. When the legislation was devised I doubt if anyone gave any thought to this.
