The First Transitional Period for the Data Protection Act 1998 came to an end on 24 October 2001. Part II of Schedule 8 to the Act lists the data which are exempt from some of the provisions of the Act until that date.
Manual Data
Leading the list is eligible manual data. Much discussion has taken place about what a ‘relevant filing system’ was. Section1(2) defines it as ‘a set of information relating to individuals . structured, either by reference to those individuals or by reference to criteria relating to those individuals, in such a way that specific information relating to a particular individual is readily accessible’. The general view has been that card-indexes and the like were being targeted.
When the Bill was first published much was made of the intolerable burden which the provision of bringing manual records within the purview of the Act would produce. No doubt the provision was to counter the belief, supported by anecdotal evidence though not so far as I am aware by much else, that firms were regularly keeping customer or personnel records in manual filing systems so as to evade the provisions of the 1984 Act. (I remember advising Members of Parliament under the 1984 Act not to keep computer records of electors with comments such as ‘very truculent’ or ‘always drunk after 12 noon’ by a name.)
However, in the intervening time since the 1984 Act, the use of manual records has surely declined apace. Whereas the card index was ubiquitous in many – particularly small – offices in 1984 and still around in the mid ’90s, it must be very rare now. Furthermore automatic typewriters have gone and in the end is the Word and not much else. (I had occasion to see a personal letter from President Clinton towards the end of his reign. It was typed on an old manual typewriter, not even an automatic. There’s posh for you – the nearest thing to quill and parchment the White House could provide.) So all the letters are on computer and therefore those naming identifiable living individuals, surely almost all, are already within the ambit of the Act and have been since it came into force in March 2000.
Other Exemptions
Exemption was also provided during the First Transitional Period for payroll and accounts systems (Sch8, Part II, para 6). This carried forward in nearly the same words the similar exemption provided by s32 of the 1984 Act. I never really understood the basis for this, but I suppose it was to save having to bring under the Act old-fashioned dedicated payroll machines such as that provided by Kalamazoo. Again where are they now?
This leaves only the following main types of data whose status changes on 24 October 2001:
- eligible data not processed by reference to the data subject (Sch8, Part II, para 5);
- unincorporated members’ clubs and mailing lists (paras 7-11);
- back-up data (para 12).
The first of these is the oddest: eligible automated data was not (until 24 October 2001) regarded by the Act as being ‘processed’ unless the processing was by reference to the data subject. Processing, as has often been remarked, is defined by the Act very widely to include organisation, adaptation, alteration, retrieval, consultation, use, disclosure, alignment, combination, blocking, erasure or destruction (s1(2)). Not all of these can be visualised in relation to the data subject, but can it be the case that wholesale disclosure by a hacker (by posting on the Internet a file he happens to have access to in order to expose the inadequacies of the security system supposedly protecting it) might not be disclosure within the meaning of the Act because the hacker is not concerned with the individuals or their data? It might seem so. But it is surely hard to think of a less tortured example.
The unincorporated clubs’ data is a more important issue. Again, as with the manual records we discussed above, there must now be few clubs whose membership lists are not fully automated. But by definition such clubs are run by amateurs many of whom may be unaware of the application of the Act to their files.
Another odd exemption until 24 October 2001 is back-up data which was exempt from s7 (which deals with the rights of data subjects). So data controllers and data processors under the Act were required to comply with the rights of the subject under s7 but only for their main data leaving their back-up data not compliant. I have to say as an IT professional that back-up data which is not in every respect identical to the main data is not in my view back-up data. All I can presume is that if, for example, earlier versions of data were stored for back-up purposes on a monthly basis (and it would have to be a pretty inactive database which required backing up so infrequently), then it might be permissible for a version of (say) February 2000 not to be compliant provided all the later versions after March 2000 were compliant. Again one can only presume that there are no back-up versions left which are non-compliant.
Summary
So what does the First Transitional Period amount to and what should we be telling clients about its passing? When the Act first came into force we were all glad of any reduction in the burden which it entailed and many were relieved by the First Transitional Period. But now it seems the Period did not amount to much since, by the ordinary march of technology, manual records, mechanical accounting systems, and back-up data must be all either extinct or compliant now. Data processed not by reference to the data subject must always have been a strange and rare animal. Only the secretaries and treasurers of unincorporated clubs need to get acquainted with the Act and do something positive.
