Data Protection news: Worth a read

[Nattie]

http://www.legalweek.com/Navigation/...+personal.html

[Tools]

Re: Data Protection news: Worth a read

Thanks Nattie a good read

Organisations beware — changes in the definition of personal data mean that emails, minutes of meetings and even telephone bills may now be classified as personal data. The Data Protection Act 1988 lays out a strict framework for the treatment of personal data. Only data falling within the definition set out in the Act will be subject to the rules of good information practice imposed by the Act, so a clear definition is crucial for both organisations seeking to use, and individuals wishing to protect, their personal data. The rules in the Act can create worry and expense for organisations holding personal data and they could find themselves at risk of having to disclose confidential documents.
In June 2007, the European Union article 29 working party issued an opinion analysing the elements making up the concept of personal data as set out in EC Directive 95/46/EC. The opinion adopted a much wider interpretation than the controversial Court of Appeal case of Durant v Financial Services Authority [2003]. As a result, the Information Commissioner has issued a technical guidance note/flowchart on what constitutes personal data for the purposes of the Act, which is also at odds with the interpretation in Durant. The guidance does not cover the issue of ‘relevant filing systems’, which was also a hot topic in Durant. The main aims of the guidance are to help provide businesses with greater clarity as to the meaning of personal data and to help public authorities understand how their obligations, under the Freedom of Information Act 2000, interrelate with those under the Act.
So what is personal data? The key points of the guidance are set out below:
- Can a living individual be identified from the data, or, from the data and other information in the possession of, or likely to come into the possession of the data controller? As well as the name of the individual, personal data can include other information such as an address or a description. For example, ‘the lady with the red umbrella who drives a blue Jaguar’. It can also include CCTV images.
- Does the data ‘relate to’ the identifiable living individual, whether in personal or family life, business or profession? Data can relate to individuals when it is processed to learn or record something about that individual or where its processing has an impact upon that individual. Data can therefore ‘relate’ to an individual in several different ways.
- Is the data ‘obviously about’ an individual? Examples would include medical, employment or criminal records. Examples of data, which is not obviously about an individual but is about their activities, include personal bank statements or itemised telephone bills.
- Is the data ‘linked to’ an individual so that it provides particular information about an individual? There will be cases where the data itself is not personal data but when linked to other information can be, such as salary details about a job.
- Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual? An example would be the market value of a house, which might just be used for statistical purposes. However, it could be used to calculate an individual’s Council Tax liability in which case it could be personal data. Another issue is where different organisations process data for different purposes. The guidance provides an example of photographs being taken of a party. One set of photographs is taken by a journalist for a photo library; the other set is taken by the police for identifying possible troublemakers. In the hands of the police the photographs are personal data.
- Does the data have any biographical significance in relation to the individual? For example, being listed as an attendee in the minutes of a meeting could be significant as the minutes state that the individual was in a particular place at a particular time.
- Does the information concentrate on the individual? This can be significant in the context of minutes of meetings or being a party to emails. Being the subject of a meeting — for example, an appraisal meeting — would constitute personal data.
- Does the data impact or have the potential to impact on an individual, whether in a personal, family, business or professional capacity? Can data about objects be personal data about an individual even though the data controller does not currently use such data to learn, record or determine something about that individual? For example, the main purpose of a taxi-tracking device would be to locate a taxi. However, it could be used to locate the driver, for example, if a family member wanted to contact the driver.
Businesses may find that the new wider definition creates difficulties after they have come to rely on the more restrictive interpretation in the Durant case and they need to be aware of and be prepared for it when dealing with subject access requests and when considering the storage of data. They may also find a long guidance note unnecessarily complicated when establishing which data comes within the Act. There may also be a rise in the number of court and information tribunal disputes. Companies should try and avoid this by understanding the implications of the changes and by being prepared.
Helen Hart is a senior associate in the commercial team at Stevens & Bolton.