The 1998 Data Protection Act in the UK largely restates existing good practice: individuals have a right to know what data are held about them and why; and those processing data have a duty to proceed ...