Legal background General processing
Convention 108 became open for signature in 1981. The Convention contained a set of principles to govern data processing, including that there should be fair and lawful obtaining and processing of personal data and storage of data only for specified purposes. In addition, states should not restrict trans-border data flows to other states which signed the Convention. States could only sign up to the Convention where they had national law in place guaranteeing compliance with the standards set out in it.
	Accordingly, Parliament passed the Data Protection Act 1984 and ratified the Convention in 1985, partly to ensure the free movement of data. The Data Protection Act 1984 contained principles which were taken almost directly from Convention 108 – including that personal data shall be obtained and processed fairly and lawfully and held only for specified purposes.
	The 1995 Directive stemmed from the European Commission’s concern that a number of Member States had not introduced national law related to Convention 108 which led to concern that barriers may be erected to data flows. In addition, there was a considerable divergence in the data protection laws between Member States. The focus of the 1995 Directive was to protect the right to privacy with respect to the processing of personal data and to ensure the free flow of personal data between Member States.
	The 1995 Directive was implemented in the UK through the 1998 Act which came into force on 1 March 2000. The 1998 Act repealed the Data Protection Act 1984. The scope of the 1998 Act is wider than the 1995 Directive, and covers all general data processing, including data processing for national security purposes, albeit with appropriate exemptions.
	The 2000 Act introduced a new category of data which extended the definition of "data" in the 1998 Act to include any information held by a public authority which would not otherwise be caught by the definition.
	The GDPR was published in the Official Journal of the European Union1 on 4 May 2016 and directly applies from 25 May 2018. It replaces the 1995 Directive. Regulations do not normally require implementation as they are directly applicable as a result of Article 288 of the Treaty on the Functioning of the European Union ("TFEU"). In Case 39/72 Commission v Italy [1973] ECR 101 the court held it was wrong to duplicate the provisions of EU regulations in domestic law. The Act therefore does not reproduce the text of the GDPR but instead exercises available derogations.