The legal framework
Section 4 of the Constitution protects respect for private and family life. The Data Protection Act 2011 was passed but only certain provisions — chiefly the general privacy principles and the Information Commissioner's office — have been proclaimed; the substantive obligations on private bodies remain largely unproclaimed.
Key points
| Constitution | Section 4(c): respect for private and family life |
|---|---|
| Statute | Data Protection Act 2011, only partially in force |
| Consequence | Many obligations on private organisations are not yet operative |
| Freedom of information | Freedom of Information Act applies to public authorities |
| Remedy | Constitutional motion in the High Court |
| Online abuse | Offences under the Offences Against the Person Act and cybercrime provisions |
| Section 14 | Constitutional redress for breach of fundamental rights |
| Unproclaimed obligations | Most private sector duties are not in force |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- Use the freedom of information route where a public authority holds the records.
Where to go
- Office of the Information Commissioner.
- High Court constitutional motion.
- Legal Aid and Advisory Authority.
Worth knowing
Because most of the 2011 Act is unproclaimed, there is no effective data protection regulator for private sector complaints: the constitutional motion is the realistic route, and it needs a lawyer. With most of the data protection statute unproclaimed, the constitutional motion is the only meaningful remedy — and it needs a lawyer.
Official sources and links
- UN Human Rights Office — ratified treaties and country reviews
- ILO NATLEX — national legislation database