The 1998 Data Protection Act (DPA) is the main tool for the public to take control of its personal data, but there are concerns that the law is falling behind the technological curve.

Based on a legal framework handed down from the European Union, the DPA gives consumers the right to demand the personal information on them held by any organisation or individual. Records may be on paper or computer.

Requests to companies need to be made in writing. It is best to contact the company secretary and to refer to the 1998 Act. The website of the Information Commissioner’s Office, the watchdog that oversees the use of personal information – ico.gov.uk – has a Personal Information Toolkit, which includes a template for a standard letter. The data-holder may request a fee of £10 and must reply within 40 days.

If they do not, or if the response is deemed unsatisfactory and the individual has sent all the required information, a second letter should be sent by recorded delivery and a copy kept.

If there is still no reply or the individual believes that the data is incomplete, they can refer to the Data Commissioner or pursue the matter through the courts. The Act also spells out a rule of thumb that says that groups cannot pass on an individual’s information to others unless that person agrees to it.

There are, however, circumstances in which companies can try to sidestep a request – for example, if it is considered unreasonable.

Consumers may also find it difficult to request data from web companies that operate overseas, according to Calum Murray, a partner for Kemp Little, the law firm. Groups that collect data in the UK must register with the Information Commissioner’s Office. “The difficulty comes where organisations are gathering information outside Europe,” Mr Murray said. “There is a likelihood that organisations operating outside the EU will attempt to avoid complying with the regulations that protect UK data subjects.”

Smaller companies – especially unscrupulous operations that run spam e-mail set-ups – can easily fall into this category, he added.

Meanwhile, civil liberties groups argue that, in the decade since its introduction, the DPA’s guiding principles have fallen behind advances in data “mining” – or processing – technologies.

Google, which requires users to opt in to its next generation of “personalised search” services, recently bowed to concerns and cut the length of time that it stores data to two years from an indefinite period.

However, the Article 29 Working Group, which represents data watchdogs across Europe, wrote to the company this week requesting clarification on what it will do with the data it collects and for a justification for it being held.

Groups such as Liberty are concerned that the eight data protection principles that underpin the DPA are being stretched by web companies – especially the measure that says data can “not be further processed” in ways beyond “specified and lawful purposes”.

Gareth Crossman, Liberty policy director, said: “The ability to process and match data has outstripped the Act. We need new legislation.”

Explore Law

• Columnists

• Law Panel

• Law Reports

• Student Law

Times Recommends

• The best legal yarns this Christmas
• Legal school 'earned £1m by exploiting bar course'
• Axe may fall on 5,000 more City lawyers