The Irish rules are based largely on the Data Protection Act of 1988 and the Data Protection (Amendment) Act of 2003, which brought Ireland into line with the provisions of the EU Data Protection Directive. In the UK, the Directive was brought into effect under the Data Protection Act of 1998.
A ruling last December on a dispute between an individual, Michael Durant, and the Financial Services Authority, had the effect of restricting the interpretation of "personal data" under the UK legislation. In response, the UK's Information Commissioner issued new guidelines in February. These have been largely followed by the Irish Data Protection Commissioner.