Can a website display personal details?

Alasdair Taylor's answer to Can a website display personal details? (1369772744)

Displaying personal information on a website is a form of "processing" under the Data Protection Act 1998.  The Act says that personal data can only be processed in accordance with the data protection principles, which are set out in Schedule 1. The key principles affecting the question of whether data may be published on a website include:

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless— (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.


Assuming that there is no "sensitive personal information" (e.g. health information) involved, the relevant conditions in Schedule 2 include:

1. The data subject has given his consent to the processing.

2. The processing is necessary— (a) for the performance of a contract to which the data subject is a party, or (b) for the taking of steps at the request of the data subject with a view to entering into a contract.


6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.


So, if any of these conditions (or the other conditions in Schedule 2) is met in relation to the display of (non-sensitive) personal information on the website, and the processing otherwise accords with the requirements of Schedule 1, then it should be lawful under the Data Protection Act 1998.

Other legal claims that may in principle arise from the publication of personal informaiton on a website include: (i) claims for breach of the right of privacy; and (ii) claims for breach of confidence.