Media recipients of the Iraq campaign medal were given no indication that their personal data would be placed in the public domain. Disclosure of the relevant names would therefore breach the first and second data protection principles (see Schedule 1 to the Data Protection Act 1998), which require that data subjects must not be deceived or misled about the purposes for which personal data is processed.