Data Privacy Bulletin

1. The Data Protection Act Transitional Periods - the Beginning of the End

Data protection in the UK is governed principally by the Data Protection Act 1998 (the Act) which, despite receiving royal assent on 23 October 1998, came into force only on 1 March 2000.

Due to the radical changes to the data protection regime introduced by the Act, in particular the inclusion of manual (i.e. non-electronic) personal data within its scope, it was recognised that data controllers would need time to comply. Two periods of transitional relief were prescribed, the first lasting for three years from 24 October 1998 (the originally intended commencement date) and the second, consecutive period for six years until 23 October 2007.

Transitional relief is framed in terms of eligible data (see definitions section at the end), exempting the processing of qualifying (i.e. eligible) data from some, although usually not all, of the requirements of the Act. Schedule 8 to the Act contains the provisions relating to transitional relief and the applicable exemptions.

The first transitional period ended on 24 October 2001

In order to ensure compliance is achieved following the start of the second transitional phase, it is important for businesses and organisations to understand what exemptions available to them during the first transitional period have since ceased to apply.

†

2. The Transitional Exemptions

   Transitional Timetable

   First transitional period

   1 March 20001 - 23 October 2001

   Scope: eligible manual data and eligible automated data

   Second transitional period

   24 October 2001 - 23 October 2007

   Scope: limited types of eligible manual data2

   †

   Manual Data in the First Period

   Eligible manual data i.e. personal data subject to processing already under way immediately before 24 October 1998 (not part of an accessible record or financial information held by a credit reference agency) were exempt from the eight data protection principles3 and Parts II and III of the Act until 24 October 2001.

   Guidance published by the Information Commissioner suggests that what amounts to processing already under way is a matter of fact in each case. The phrase has its origins in the Directive4 and is not separately defined in the Act. For transitional relief to have applied it was not necessary for personal data to have been in existence immediately before 24 October 1998 but in assessing whether they were eligible or not the actual processing to which the personal data were subject must have been going on immediately before 24 October 1998. The key factor was the manner and purposes of processing rather than the content.

   If a data controller merely:

   added a new data subject's personal data e.g. an insurer adds Mr H. Smith as a new policyholder for a pre-1998 established insurance product;

   amended data on an existing data subject e.g. the same insurer updates the record of its policyholder Mrs Jones to show her new address; or

   added personal data on an existing data subject;

   then it is unlikely that the controller would have been changing the processing that was already under way in which case any transitional exemption should have continued to be available.

   †

   Exemptions for Eligible Manual Data

   Prior to 24 October 2001 eligible manual data were exempt from:

   the eight data protection principles;

   Part II of the Act (which gives rights to data subjects and others in respect of any personal data processed about them including subject access, rights in relation to automated decision-making, compensation rights, rights to require rectification, blocking, erasure or destruction of data, the right to prevent processing likely to cause damage or distress and the right to prevent processing for the purposes of direct marketing); and

   Part III of the Act (the notification requirements and criminal offences under the Act).

   Note that special rules apply to manual data which are part of an accessible record or which are held by a credit reference agency. These are not dealt with here.

   †

   Automated Data in the First Period

   Eligible automated data were exempt from the following provisions of the Act before 24 October 2001 provided the processing was by reference to the data subject.

   the first data protection principle (fair and lawful processing) insofar as it required fulfilment of a Schedule 2 and/or Schedule 3 criterion (but certain information still had to be provided to...