Hi everyone,

As part of my final year project at my university, I've been tasked with researching the legislation that affects computer forensic investigations in the United Kingdom. I've already found a list of some of the Acts of legislation that would have an impact on a computer forensics investigation.

I've got a quick question in regard to the Data Protection Act 1998, during computer forensics investigations, are the investigators regarded as Data Controllers or Data Processors?

In case it is needed, the project involves studying a forensic computing laboratory that is attached to the university that would like to start processing digital evidence, so they would be doing this in a corporate environment governed by contract law (so I'm unsure of whether the exemptions given to the police apply, I'm assuming not until I find information that suggests otherwise.).  

See Section 1(1) of the act:

www.legislation.gov.uk.../section/1

If you're doing your investigation on behalf of another entity you're probably going to be a data processor rather than a data controller.

Details of exemptions can be found in Part IV:

www.legislation.gov.uk...29/part/IV

Most are restricted to public sector employees acting in specific circumstances, but some can also be used by those in the private sector.  

Excellent response pragmatopian. I took a leaf out of your book and thought that since you identified the legislation I wondered whether the ACPO Guidelines had anything to say on this important matter.

Jamie (he's not a bad old chap) kindly put up a page so forum members could download the Guidelines:

www.forensicfocus.com/...20Evidence

ShadowViper, I couldn't find anything in the ACPO Guidelines that specifically categorises the roles which you mentioned. So as record of your study perhaps you may wish to take it that you've uncovered an absence, omission, or identified operator sub-category status within the role of those involved in 'extracting and harvesting data' from digital devices.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

Thanks for the responses so far, very helpful links pragmatopian, I'm definitely going to be using those in my project.

And since I am going to be covering standards and guidelines as well, I can definitely follow through with trewmte's suggestion about the ACPO guidelines.

Thanks again!  

Be sure to take a look at the Data Retention Directive the EU put in place in 2009. It impacts some of that act.  

- Dilogoat

Be sure to take a look at the Data Retention Directive the EU put in place in 2009. It impacts some of that act.

Also, consider the "news":
ec.europa.eu/justice/n...125_en.htm
it is likely that there will soon be changes in EU legislation.....

Talking of news, the OP last posted one year ago (2011), I hope (for him) that he is well past his final year....

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

I didn't even look. I was doing an assignment relating to a similar topic last week so I got excited.