UK: Data Privacy Bulletin

Last Updated: 12 November 2001
Article by Kate Brimsted

1. The Data Protection Act Transitional Periods – the Beginning of the End

Data protection in the UK is governed principally by the Data Protection Act 1998 (the Act) which, despite receiving royal assent on 23 October 1998, came into force only on 1 March 2000.

Due to the radical changes to the data protection regime introduced by the Act, in particular the inclusion of manual (i.e. non-electronic) personal data within its scope, it was recognised that data controllers would need time to comply. Two periods of transitional relief were prescribed, the first lasting for three years from 24 October 1998 (the originally intended commencement date) and the second, consecutive period for six years until 23 October 2007.

Transitional relief is framed in terms of eligible data (see definitions section at the end), exempting the processing of qualifying (i.e. eligible) data from some, although usually not all, of the requirements of the Act. Schedule 8 to the Act contains the provisions relating to transitional relief and the applicable exemptions.

The first transitional period ended on 24 October 2001

In order to ensure compliance is achieved following the start of the second transitional phase, it is important for businesses and organisations to understand what exemptions available to them during the first transitional period have since ceased to apply.

 

2. The Transitional Exemptions

Transitional Timetable

First transitional period

1 March 20001 – 23 October 2001

Scope: eligible manual data and eligible automated data

Second transitional period

24 October 2001 – 23 October 2007

Scope: limited types of eligible manual data2

 

Manual Data in the First Period

Eligible manual data i.e. personal data subject to processing already under way immediately before 24 October 1998 (not part of an accessible record or financial information held by a credit reference agency) were exempt from the eight data protection principles3 and Parts II and III of the Act until 24 October 2001.

Guidance published by the Information Commissioner suggests that what amounts to processing already under way is a matter of fact in each case. The phrase has its origins in the Directive4 and is not separately defined in the Act. For transitional relief to have applied it was not necessary for personal data to have been in existence immediately before 24 October 1998 but in assessing whether they were eligible or not the actual processing to which the personal data were subject must have been going on immediately before 24 October 1998. The key factor was the manner and purposes of processing rather than the content.

If a data controller merely:

  • added a new data subject’s personal data e.g. an insurer adds Mr H. Smith as a new policyholder for a pre-1998 established insurance product;
  • amended data on an existing data subject e.g. the same insurer updates the record of its policyholder Mrs Jones to show her new address; or
  • added personal data on an existing data subject;

then it is unlikely that the controller would have been changing the processing that was already under way in which case any transitional exemption should have continued to be available.

 

Exemptions for Eligible Manual Data

Prior to 24 October 2001 eligible manual data were exempt from:

  • the eight data protection principles;
  • Part II of the Act (which gives rights to data subjects and others in respect of any personal data processed about them including subject access, rights in relation to automated decision-making, compensation rights, rights to require rectification, blocking, erasure or destruction of data, the right to prevent processing likely to cause damage or distress and the right to prevent processing for the purposes of direct marketing); and
  • Part III of the Act (the notification requirements and criminal offences under the Act).

Note that special rules apply to manual data which are part of an accessible record or which are held by a credit reference agency. These are not dealt with here.

 

Automated Data in the First Period

Eligible automated data were exempt from the following provisions of the Act before 24 October 2001 provided the processing was by reference to the data subject.

  • the first data protection principle (fair and lawful processing) insofar as it required fulfilment of a Schedule 2 and/or Schedule 3 criterion (but certain information still had to be provided to the data controller and processing still had to be fair)
  • the seventh data protection principle (security) to the extent it required a data processor only to process data under written contractual terms, on instructions from the data controller subject to obligations equivalent to those imposed on a data controller by the seventh principle
  • the eighth data protection principle (restriction on transfers of personal data outside the EEA)
  • parts of the subject access provisions
  • a data subject’s right to (1) prevent processing likely to cause damage or distress, (2) prevent processing of their data for direct marketing purposes, (3) request that any decision affecting him/her was not taken solely by automated means, (4) compensation (subject to certain exceptions)

It follows that, even during the first transitional period, data controllers processing eligible automated data were not exempt from a large number of the Act’s requirements, for example, these principles applied:

  • The first principle (amended) – processing shall be fair and lawful
  • The fourth and fifth principles – respectively, personal data must be accurate and up to date and data shall not be kept for longer than is necessary
  • The seventh principle (amended) – appropriate technical and organisational measures must be taken against unauthorised or unlawful processing of personal data and against loss or destruction of, or damage to, personal data.

A small number of exemptions available under the previous legislation, the Data Protection Act 1984, was extended for eligible automated data during the first transitional period. These exemptions are listed below.

Exempt Activity

Detail

payrolls and accounts: Eligible automated data processed solely for calculating remuneration or pension payments payable to employees or for keeping accounts relating to any business or other activity were exempt until 24 October from:

the eight data protection principles;

Part II

Part III

unincorporated members clubs: Eligible automated data processed by an unincorporated members’ club and relating only to the members of the club were exempt until 24 October 2001 from:

the eight data protection principles

Part II

Part III

mailing lists: Eligible automated data processed for maintaining and using a mailing list were exempt until 24 October 2001 from:

the eight data protection principles

Part II

Part III

provided that in each case the data subject had been asked whether he objected to his data being processed in this way and there had been no objection

back-up data: Eligible automated data which comprise back-up data were exempt until 24 October 2001 from

the subject access request provisions

 

Exemptions in the Second Transitional Period

The second transitional exemptions are much more restricted in scope than those in the first period. With minor exceptions they apply only to manual personal data which were immediately before 24 October 1998 both (1) subject to processing under way and (2) held by the data controller. The range of the relief is also reduced, comprising exemptions from the following provisions of the Act:

  • the first data protection principle (fair and lawful processing) except to the extent to that it requires compliance with paragraph 2 of Part II of Schedule 1. (This means that now the data subject must be given the following information: (1) the identity of the data controller; (2) if it has nominated a representative for the purposes of the Act, the identity of that representative; (3) the purpose or purposes for which the data are intended to be processed; and (4) any further information which is necessary, having regard to the specific circumstances in which the data are processed, to enable the processing to be fair);
  • The following data protection principles: the second (personal data obtained for lawful purposes), the third (personal data must be adequate, relevant and not excessive), the fourth (personal data must be accurate and up to date) and the fifth (personal data must not be kept longer than necessary); and
  • The provisions relating to rectification, blocking, erasure and destruction of data on the application of a data subject to the court.

As was the case with first set of transitional reliefs, exemptions during the second transitional period will not necessarily continue to apply throughout that period. The Commissioner’s guidelines make it clear that adopting new practices or systems involving processing that was already under way will result in the transitional relief being lost by the data controller.

 

Practical Implications for Businesses Following 24 October 2001

The practical value of the second transitional period exemptions is fairly minimal for the average business, which may require a considerable amount of effort to bring its processing in line with the Act now if it has not already done so.

Businesses should consider the following points in particular:

1. Can the business process personal data in accordance with the rights of data subjects under the Act? For example, can subject access requests be easily complied with within the 40 day time period? Following 24 October 2001 the maximum amount that can be charged for a subject access request is £10, regardless of whether the data are manual or automated. Are the systems you have in place cost-effective?

2. Can the eight data protection principles be complied with? The following are suggested as being of particular importance:

first fair and lawful processing

fourth personal data must be accurate and up to date

fifth personal data must not be kept longer than necessary

seventh appropriate security measures must be taken to protect the personal data

If the company engages in international activities and personal data are transferred to countries outside the EEA, the eighth principle will also be relevant.

3. Has the business complied with the notification requirements?

4. Has the business designated a data protection officer to monitor the drafting and implementation of data privacy policies? Whilst not a legal requirement, this is increasingly likely to be regarded as best practice in the field.

The Perils of Non-Compliance

Negative publicity is a possibility that must not be overlooked – the Information Commissioner publishes details on her web site as well as in her Annual Report of some of the companies she is investigating and/or proceeding against. Damage to customer confidence and the resultant impact on the company’s goodwill are likely to be far more costly than any fine imposed by the Commissioner or the cost of implementing a system which would have enabled compliance in the first place.

The Act created a number of criminal offences for breaches of its provisions. Where an offence has been committed with the "consent or connivance of or is attributable to any neglect of" a company officer then s/he, as well as the company, can be prosecuted for the offence.

 

3. Case Study – Just-the-Job Limited

In this section, we look at how a company might have reviewed and altered its processing in the run up to the end of the first transitional period.

Just-the-Job Limited, a recruitment agency, prides itself on being at the forefront of data protection compliance. When the Act came into force in March 2000, Just-the-Job was fully aware and prepared to take full advantage of the first transitional period to meet its compliance obligations. It carried out an internal review to identify measures it would need to have taken by 24 October 2001. Below are examples of some of its findings and actions.

Payroll: Just-the-Job’s payroll has been prepared by Cash in Hand Services, a third party data processor, for many years without a formal written contract. Just-the-Job, having identified that (following 24 October 2001) this arrangement now needs to be evidenced in writing to satisfy the seventh principle, has issued a draft document to Cash in Hand Services and has arranged a meeting to finalise the document as soon as possible.

Internet Site: The company’s web site collects personal data on-line in the form of names and addresses of users requesting information packs to be sent to them. Data collected in this way are added to a central database held and maintained (in the UK) by a third party data processor for Just-the-Job. The data processor sends out the information packs on behalf of Just-the-Job. In the past the company’s US sister company, Jobs R Us, Inc., also routinely had access to this database. To meet the new requirements the following steps are being taken: (1) Just-the-Job is putting in place a written data processor agreement with the third party (seventh principle) and (2) Jobs R Us has agreed to sign up to the Safe Harbor scheme at Just-the-Job’s request (eighth principle).

Candidates’ and Clients’ Paper Files: Today new candidates’ and client details are entered into Just-the-Job’s computer system. This was installed only a year ago and is radically different to its predecessor with the result that none of the first period exemptions applied to data held in it (these data were not eligible automated data). However, Just-the-Job satisfied itself at the time of installation that the use of the system and related procedures fully complied with the Act.

Prior to 24 October 2001 the company held around 1500 paper files relating to both corporate clients and prospective employees some of which dated back 15 years. Many of these files were obsolete although Just-the-Job continued to use a small number of them relating to long-established but still active clients. Just-the-Job lacked the resources to review and weed the out-dated files to comply with the fifth principle and took advantage of the breathing space allowed by the first transitional period. Just-the-Job now needs promptly to review its files and destroy some of them5.

Notification: Just-the-Job needed to amend its data protection notification to include its processing of manual data, as the data protection principles will apply to their processing for the first time.

 

This scenario illustrates a limited number of the many data protection issues which could arise. We will be discussing further questions in future issues of the Data Privacy Newsletter.

Any similarity to any real persons or businesses is entirely coincidental.

 

FOOTNOTES

  1. Some relief pre-dates 1 March 2000, being a continuation of exemptions available under the Data Protection Act 1984.
  2. The relief applies also to eligible automated data for historical purposes only.
  3. The eight data protection principles were discussed in issue 1 of the Data Privacy Newsletter.
  4. EC Directive 95/46/EC.
  5. The second period exemptions may be of limited application where a particular (now obsolete) file has not had personal data added to it since 23 October 1998, as the processing of data contained in it should benefit from second transitional period exemptions from the fourth and fifth principles. In practical terms, however, Just-the-Job is unlikely to seek to rely on such exemptions since to try to do so would probably lead to more complications than benefits.

D E F I N I T I O N S

accessible record

(a) a health record; (b) an education record; or (c) an accessible public record

eligible data

data subject to processing "already under way immediately before" 24 October 1998

eligible automated data

eligible data which (a) are being processed by means of equipment operating automatically in response to instructions given for that purpose, or (b) are recorded with the intention that they should be processed by means of such equipment

eligible manual data

eligible data which are not eligible automated data

personal data

data which relate to a living individual who can be identified from those data or identified from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller. This includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual

processing

includes obtaining, recording, holding information, carrying out any operations on the data including organisation, adaptation, alteration, retrieval, consultation, disclosure, transmission, combination, blocking, erasure and destruction of the data

relevant filing system

any set of information relating to individuals to the extent that, although not processed by means of equipment operating automatically in response to instructions, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible

 

 

 

"© Herbert Smith 2002

The content of this article does not constitute legal advice and should not be relied on as such. Specific advice should be sought about your specific circumstances.

For more information on this or other Herbert Smith publications, please email us."

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
 
In association with
Related Topics
 
Related Articles
 
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
 
Email Address
Company Name
Password
Confirm Password
Position
Mondaq Topics -- Select your Interests
 Accounting
 Anti-trust
 Commercial
 Compliance
 Consumer
 Criminal
 Employment
 Energy
 Environment
 Family
 Finance
 Government
 Healthcare
 Immigration
 Insolvency
 Insurance
 International
 IP
 Law Performance
 Law Practice
 Litigation
 Media & IT
 Privacy
 Real Estate
 Strategy
 Tax
 Technology
 Transport
 Wealth Mgt
Regions
Africa
Asia
Asia Pacific
Australasia
Canada
Caribbean
Europe
European Union
Latin America
Middle East
U.K.
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions