Data Protection - End of the Exemption on Manual Records

The Data Protection Act 1998 (the Act) has been generally in force since March 2000. Many organisations will therefore be familiar with their obligations to comply with the data protection principles. But until now the Act has not applied to certain types of data or data processing. This exemption ended on 24 October this year.

This article discusses the types data and data processing that are no longer exempt from the Act and explains the impact this may have on organisations.

Previous Exemption

Under transitional provisions, certain types of data were exempt from the scope of the Act until October this year. The most important aspect exemption applied to manual records. For most businesses, this probably had most relevance to the information held on personnel files. This data will now need to be checked to see if it complies with the Act.

The exemption had been significant because it is often more difficult for businesses to comply with the principles under the Act if the data is contained in manual, as opposed to, electronic records. For instance, it is generally less cumbersome and time consuming to respond to requests for access to personal data held about an individual where the data is held electronically rather than on manual records.

So what exactly will no longer be exempt from the Act?

manual records containing personal data, which are

part of a relevant filing system, that was

subject to processing already under way as at 24 October 1998.

A "relevant filing system" is any filing system which is structured in such a way that information about a certain individual is readily accessible.

Extended Exemption

A more restricted exemption regime is still in place until 2007. This is relevant where the data was held before 24 October 1998. But for the extended exemption to apply, the processing of the relevant filing system must also have started before October 1998. Also, the 6th, 7th and 8th data protection principles will apply to this type of data in any event. These are discussed below.

Other Automated Data Previously Exempt

The general exemption to 24 October 2001 also applied to types of automated data and not just to manual data. These were:

automated data processed to calculate salary or pensions or to keep accounts of sales and other transactions;

automated data processed only to replace other data which may be lost or destroyed (i.e. back up data); and

automated data processed to compile and distribute mailing lists.

...