Data protection guidance and statement

Informal guidance for researchers consulting archives containing information covered under the Data Protection Act.

The following information is not legal advice, nor a substitute for it, but is guidance intended to provide practical support for the use of personal data under the Act and to promote good practice.

Definitions

Under the Data Protection Act 1998, a researcher is responsible for any personal data concerning living individuals that s/he takes away from Archives and Special Collections (i.e. her / his notes, research data, photocopying). To use the terminology of the Act, the researcher becomes the ‘data controller’ of the information (that is, the person who determines the purposes for which, and the manner in which any personal data are, or are to be, processed).  Data subject means an individual who is the subject of personal data. In other words, the data subject is the individual whom particular personal data is about. The Act does not count as a data subject an individual who has died or who cannot be identified or distinguished from others.

Provision for research use of personal data

Section 33 of the Act allows archive repositories to retain and hold personal data indefinitely and for a different purpose (i.e. research) from that for which it was created. The Data Protection (Processing of Sensitive Personal Data) Order 2000 gives the circumstances in which sensitive personal data may be processed.  Adherence to these conditions will also permit the researcher the same rights with respect to her/his subsequent use of data taken from Archives and Special Collections, provided that data is used for the purposes of research, history and statistics. The conditions are:

  • That the data are not processed to support measures or decisions with respect to particular individuals
  • That the data are not processed in such a way that substantial damage or substantial distress is, or is likely to be, caused to any data subject.
Archives and Special Collections grants researchers access to material available for general access provided they sign in on arrival to confirm that they will comply with this Data Protection guidance and statement.  When we provide information in the form of copies where the user is not physically present, we will either supply a copy of this statement with the copies or include a link to this document on our website.

Researchers responsibilities for the data

  1. Not to cause substantial damage or distress to data subjects. This is the overriding principle that should guide the researcher’s use of personal data
  2. Not to use the data to support measures or decisions concerning an individual.
  3. Anonymise where possible. It is best practice to anonymise identities when notetaking whenever possible. This reduces the risks and effort attendant in the subsequent use/reuse of a researcher’s notes. If the results of research or any statistics are not made available in a form which identifies individuals then this will also exempt the researcher from the data subjects’ right of access to their personal information. In deciding when it is appropriate to use/publish personal information, consider:
  • Is the individual still alive? Even if the individual is deceased, consideration should be given to family members who may still be alive and be identifiable from the information, or to other duties of confidentiality other than Data Protection considerations which may apply.
  • Is the individual a public figure? (this may mean that information is more likely to be in the public domain, is less sensitive, or that its publication is more likely to be in the public interest)
  • Does the information belong to a sensitive category of information as defined by the Act? The researcher may need to acquire permission from the data subject to publish if s/he doesn’t anonymise.  Sensitive personal data are defined as:
    • Racial or ethnic origin;
    • Political opinions;
    • Religious or other similar beliefs;
    • Membership of trade unions;
    • Physical or mental health or condition;
    • Sexual life; and
    • Convictions, proceedings and criminal acts.
  • As well as anonymising names, be mindful of context, which may identify an individual as clearly as giving a name: (e.g.) Disciplinary Hearing: Headmaster, Borsington School, 1978.

Transfer of data outside of the EEA

Under Principle 8 of the Act, personal data should not be transferred outside the EEA.

Public Interest Test

There is an exemption under Section 32 for journalism, literature and art. This provides an exemption for publication where it is in the public interest, although deciding what constitutes the public interest can be difficult to decide and one should make reference, where possible, to agreed codes of practice.

Notification to the Information Commissioner

Where personal data is held, there is a legal obligation to notify the Information Commissioner of the purposes for which personal data is processed together with the types of individuals who are the subject of the data (data subjects), the types of data being processed (data classes), the individuals or organisations to which the researcher discloses (or intends to disclose) data, and the countries, if any, to which the data is transferred. Where information is held for personal/domestic use there is no obligation to notify. There is an obligation to notify for research projects, where the project may collect/hold/process personal data [and the information is organised with reference to living individuals], although this obligation will lie with the researcher’s University. The research of staff and students is the legal property/responsibility of the institution. The University of Leicester's notification can be found on the Information Commissioner's Office website.

Notification to the data subject

Personal data which are processed only for research purposes are exempt from section 7 of the Act (which obliges a data controller to notify data subject(s) of the processing of the data) if:

  • they are processed in compliance with the relevant conditions (i.e. the data are not processed to support measures or decisions with respect to particular individuals and the data are not processed in such a way that substantial damage or distress is, or is likely to be, caused to any data subject) and
  • the results of the research or any resulting statistics are not made available in a form which identifies data subjects.

The Data protection Principles

NB. Researchers are exempted from nos. 2 and 5 under Section 33 if the relevant conditions (see above) are met.

  1. Personal data shall be processed fairly and lawfully.
  2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
  3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
  4. Personal data shall be accurate and, where necessary, kept up to date.
  5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
  6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
  7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Material transferred to Archives and Special Collections is held as an archive for the purposes of historical research under section 33 of the Act. Organisations whose material may be held here are prohibited under the Act from reactivating files in order to make decisions concerning an individual, even where they retain ownership of the material. Information may be used for historical/reference/evidential purposes, but reactivating a file (i.e. using it for another purpose from that for which it is currently held) is illegal.

Overall points to remember

  • The Act only concerns the personal data of living individuals. The data may be in manual (paper) or electronic format and includes images (any means by which an individual is identified).
  • Don’t cause substantial distress or damage to the individuals whose data have been seen, used or held. Don’t use the material to make or support decisions or measures that will affect data subjects.
  • Keep any personal information held secure (protect from unauthorised access or transfer).
  • Anonymising names/personal details is good practice and the safest way to avoid an infringement of the Act. Anonymise as early as possible in the use of the data.
  • Sensitivity generally diminishes over time.
  • The researcher is liable for the personal data they take away and the subsequent use they make of it.

The guidance in this sheet is based on the JISC Data Protection Code of Practice for the HE and FE Sectors, Version 2.0, and the Public Record Office (later the National Archives), Society Of Archivists and Records Management Society Code Of Practice For Archivists And Records Managers Under Section 51(4) of The Data Protection Act 1998, Version 2, submitted to the Information Commissioner on 20 April 2002 and revised in 2006.

Further guidance on the Act can be found on the Information Commissioner’s website.

Share this page: