Rosemary Jay was Legal Adviser to the Data Protection Registrarbut has recently taken up a new post with Masons in Manchester. She may becontacted on 0161 234 8234.
On 12 July the Government announced that the Data Protection Act 1998 willcome into force on 1 March 2000, giving computer users just enough time torecover from the millennium effect before having to deal with the new Act. Thisappears to be a firm date, although sight of the secondary legislation onnotification is still awaited.
The main telecoms regulations, the Telecommunications (Data Protection andPrivacy) Regulations 1999 (SI 1999/2093), were laid before parliament on 26 July1999 and will also come into effect on 1 March 2000. Until then SI 1998/3170,which implemented those parts of the telecoms data protection directive(97/66/EC) which deal with unsolicited faxes, telephone calls and automatedcalling systems from 1 May 1999, will remain in force. SI 1998/3170 will berepealed when the main regulations come into force. The main regulations alsocover the processing of traffic and billing data, deal with itemised billing andcaller line identification and entries in directories.
A further three draft statutory instruments under the DPA have been publishedand have been available on the Home Office site since 21 July: the DataProtection (Designated Codes of Practice) Order; the Data Protection(International Co-operation) Order and the Data Protection (Subject Access)(Fees and Miscellaneous Provisions) Regulations. These follow the six draftstatutory instruments which were published on the Home Office Web site in May (www.homeoffice.gov.uk).
The proposed designated Codes Order lists five codes, compliance with whichmay be taken into account in determining whether the publication of personaldata is in the public interest, one of the elements necessary to claim theexemption for journalistic, literary or artistic purposes under s´32 of the newAct. As might be expected the codes are those issued by the main mediaorganisations: the ITC, the Broadcasting Standards Commission, the PressComplaints Commission, the BBC Producers’ Guidelines, and the Radio Authority.
The proposed International Co-operation Order contains a number of differentelements. It implements the requirement of Art 25 of Directive 95/46/EC, whichimposes an obligation on Member States to tell the Commission if they havedecided that a third country has inadequate protection for personal data. The UKCommissioner will have to notify the EU Commission if she serves an enforcementnotice on this basis. It also authorises the Commissioner to raise an objectionif another Member State makes a transfer to a third country outside the EEAwhich the Commissioner thinks has inadequate protection. Finally it provides forsupervisory authorities to co-operate in those (hopefully rare) cases where adata controller is processing in one jurisdiction while subject to the laws ofanother and manages to fall foul of the relevant law (assuming those involvedcan work out which law applies).
The proposed Subject Access Order sets different rules for access to creditfiles, health records and education records than for other files. Subject accesswill continue to cost £10. However requests for credit information only willcost £2 and the data controller will have to answer the request within sevendays. The fees for having copies of education records (as opposed to being toldthe contents of the record) will range from £1 to £50, depending on the numberof sheets the subject requests (for £50 the subject can get a whopping 500 ormore pages) and the data controller is given a 15-day compliance period. Manualhealth records are given their own special transitional arrangements. UntilOctober 2001 a fee of up to £50 can be charged for copies of records, althoughsubjects who want to see what the doctor has written about them in the previous40 days will continue to be able to do so free of charge. The Order also decreesthat data subjects who want to be informed of the logic involved in anyautomated decision making will have to ask for that specifically. Other accessrequests will be treated as being requests for all the information thecontroller is under a duty to supply.
Freedom of Information
The draft Freedom of Information Bill, under which the Registrar would becomethe Information Commissioner with responsibility for both data protection andfreedom of information, was published on 24 May 1999. It was considered bycommittees of both Houses: a Select Committee of the House of Lords and theSelect Committee on Public Administration Committee of the House of Commons. Inher evidence the Registrar commented on the complexity of the proposed interfacebetween data protection and freedom of information where information concerningindividuals is involved. The Lords Committee reported on 27 July 1999 and theCommons Committee on 28 July. The Government’s response was published on 27October but has not gone as far as many commentators would like in acceptingchanges to the draft Bill. The Queen’s Speech is awaited as I write, to seewhether the Government are to go ahead with the legislation in the forthcomingParliamentary year.
Some further guidance on approaches to the new Act has been published by theRegistrar’s Office. A paper advising data controllers on how to deal withdecisions relating to transborder data flows is now available and a bookletentitled Private Lives and Judges’ Powers, which provides a brief guideto the new Act and a question and answer section on the increased individualrights, has been prepared in conjunction with the Judicial Studies Board and isbeing distributed to all judges in England and Wales. These and other currentguidance are available on the Registrar’s re-vamped and re-named Web site atwww.dataprotection.gov.uk. A specialist advice sheet on information sharingunder the Crime and Disorder Act has also been issued.
Wilmslow Sports Star
And finally on a sporting them… those who have had dealings with them willrealise that the staff on the Helpline in Wilmslow are unsung champions whosesterling work rarely gets into the spotlight, so it has been nice to see one ofthem, Ben Elliott, getting some of the recognition he deserves. Admittedly (asthere is so far no national championship for giving telephone help) this hasbeen by winning silver medal and bronze medals in the British Grass CyclingChampionships but congratulations to him nevertheless.
