WE SHOULD BEGIN this review of information policy provisions for data protection by putting it in the context of social and government action. Unlike issues of censorship, which tend to be dealt with at government level and imposed largely at the behest of governments, data protection is an issue that gets its momentum from grassroots activism. We saw with Cohen's model for protecting speech that the main concern is over-regulation of speech, and that there are several issues relating to the character of the society that we live in that make it imperative to generate action to reduce over-regulation. Governments have a lazy interest in prohibiting speech – such action might reduce the risk of political dissent, and of discord and disruption of the civil order between sections of society, and it can protect the government's own interests where there is a need to protect national secrets or a desire to prohibit investigation of government action.

Issues of privacy and data protection are not matters of concern to government, except in so far as individual members of government have an interest in restricting public knowledge of and comment on their own actions. Beyond that the only government interest lies in ensuring a minimum of discord among its subjects or citizens, and by protecting data or recognizing privacy some small level of civil order may be maintained. Recent events in several countries, particularly the UK, have shown that governments or their agents or agencies are lamentably inept at protecting data about citizens. Records of millions of citizens contained on computers or computer readable media have been lost, found in rubbish dumps, or stolen. Such records often include sensitive financial or health information that might expose those whose names are on the list to financial loss or other distress. Governments are not alone: banks, which also keep huge files of the financial details of their customers, have also lost such data.

In most societies the only agency with the authority and power to protect data is the apparatus of the state. This includes the promotion and passage of legislation; the establishment of oversight agencies and responsible personnel; and the identification of illegal acts, penalties, processes of redress and if necessary punishment, and codes of conduct to ensure the safety of data.