Information and data protection officers, not to mention lawyers, are busy planning for the implementation of the 'right to know' from next January, under the 2000 Freedom of Information Act. But another change made by the same act should clarify how the data protection law applies to manual files. Clearer rules are needed following a controversial decision in the Court of Appeal late last year.
Durant v Financial Services Authority concerned two issues. First, what makes 'data' into 'personal data'.
as opposed to a transaction in which they are involved - and affect their privacy.
This leaves scope for further argument, but this was not the main problem. The court considered which documents held in manual files fell within the definition of a 'relevant filing system', and so within the current 1998 Data Protection Act. It held that the act applies only to files which are broadly equivalent to computerised systems.
This was surprising because the 1998 act had extended data protection for the first time from computer files to some types of manual data. And the Freedom of Information Act will next year extend it to most of them.
The court said that a manual filing system would be covered only if its structure and referencing system showed a searcher at the outset whether and where it contained personal data, and was sufficiently detailed for specific information to be readily located.
As a result, the information commissioner recommends the 'temp test'. If a temporary member of staff can extract specific information about an individual without any particular knowledge of your type of work or documents, the file falls within the act.
Councils should note, however, that so-called 'accessible records', including health and education records, are unaffected by the judgment.
While the Durant case may appear convenient in the short term for hard-pressed councils facing subject access requests, lawyers and administrators need to be alert to the possible anomalies. The same data may or may not be open to a subject access request, or other data protection rights, depending on how the file is organised. A file kept in chronological order falls outside the act. Files organised simply by name also fall outside the act. But those organised by name and then sub-divided by category do not. Nor do those devoted to a topic but which either contain an index, or are sub-divided by name.
The distinctions depend on decisions made for administrative rather than legal reasons, probably some time ago, and almost certainly without a thought for the data protection consequences. This may not be a reliable basis on which to rest both individuals' rights and the responsibilities of public authorities.
The law will change again with the implementation of the changes in the Freedom of Information Act. Unstructured manual data, except for personnel records, will be brought within the data protection regime.
Barrister, 2-3 Gray's Inn Square