Judging from the lack of detailed advice on how to cope with the new Data Protection Act, we must assume most people are relying on the (First) transitional period until 24 Oct 2001, before they feel the need to do anything. Has your Internet Service Provider given you a written contract yet? See the Seventh Principle and Sch 1, Part II, paras 11 and 12. It is worth looking at the basis for the transitional relief.
Section 39 of the Data Protection Act 1998 gives force to the transitional exemptions of Sch 8. Schedule 8 defines the transitional relief and has definitions in Part I. In particular it defines ‘eligible data’ – ie data to which the transitional relief applies. We are told (para 1(1) that: ‘personal data are ”eligible data” at any time if, and to the extent that, they are at that time subject to processing which was under way immediately before 24th October 1998’.
Schedule 8, para 1(2) then directs us to s´1(1) with a definition of ‘eligible automated data’, which means eligible data ‘which fall within paragraph (a) or (b) of the definition of ”data” in section 1(1)’. That section tells us ‘. unless the context otherwise requires – ”data” means information which –
(a) is being processed by means of equipment.
(b) is recorded with the intention that it should be processed by means of such equipment’.
The first thing to notice is that in the Act – contrary to current usage by everyone in the world – data is a plural noun. This is carried forward by the definition of personal data in the same section (‘data which relate to a living individual who can be identified’).
If we try to apply Sch´8 in practice, we notice that, whatever else this may or may not mean, it must require that data which was not begun to be processed until after 24 October 1998 is not exempt but must comply with the Act from 1 March 2000. (My Internet Service Provider was not processing data on my behalf (I am the data controller for this purpose) before 24 October 1998.)
But ‘data’ is not a static thing. Suppose your company has a Human Resources system, which records relevant data about all your employees and that this system began to be used in 1996 – well before 24 October 1998. Mr A joined your firm in 1996, and is still with you though he had promotion last month with a new job title and new salary; Mr B joined at the same time as Mr A and left in 1999; Ms C joined in 1999. The identity of the database remains the same – your employees. But the identity of the data, meaning the plural of each datum does not. Mr A’s and Mr B’s records began to be processed before 24 October 1998. Ms C’s record did not exist then. Does Ms C’s record fail to get the transitional relief? Does even Mr A’s record get relief in that the data about Mr A which existed before 24 October 1998 has subsequently been changed? Can it be that only Mr B’s data is eligible for relief?
To make sense of Sch´8 we have to assume that data does not mean individual aggregates of items of data (any one such datum referring to one person) but a database. It is just as well that s´1(1) began with the words ‘unless the context otherwise requires’.
I remember many years ago looking at an old-fashioned bureau contract where ‘data’ meant variously the paper records submitted by the customer to the bureau, the customer’s records stored on the bureau’s machine, and the bureau’s processed printout of the customer’s records. It was not a very satisfactory contract. Watch out for other places in the Act where ‘data’ means a database and not the individual items of data.
