Most paper records, though, will still be exempt, and the change
in the law will affect far fewer organisations than some have
predicted, according to one data protection expert.
"It is hard to see where any normal data controller is likely to
have significant problems," said Rosemary Jay, a data protection
expert with Pinsent Masons, the law firm behind OUT-LAW.COM,
earlier this year. "The end of the transition period only affects
information held on structured manual files – not all manual files
– so it is not applicable to all old pieces of paper."
Some experts have warned that a massive number of paper records
will suddenly be covered by the Data Protection Act, causing a
massive administrative headache for public authorities in
particular.
But Jay said that the Act applies so selectively to paper
records that not many will be covered. The Act applies only to
filing systems which are extremely highly-structured and easy to
search within.
In a landmark data protection ruling in 2003 the Court of Appeal
said that the Act only applied to filing systems which were so
complex that they were as sophisticated as a computer system when
it came to organisation and searching.
In the aftermath of that ruling, a case brought by Michael
Durant against the Financial Services Authority, the Information
Commissioner's Office (ICO) updated its guidance on what filing
systems were covered by the Act.
That new guidance said that the files must be organised so that
"the content will either be so sub-divided as to allow the searcher
to go straight to the correct category and retrieve the information
requested without a manual search, or will be so indexed as to
allow a searcher to go directly to the relevant page/s".
It said that a simple organisational principle such as
chronology is not sufficient to qualify a system as coming under
the scope of the Act.
"From 24th October this year the Data Protection Act 1998 will
apply in full to all personal information covered by the Act and
data controllers will need to ensure that the way personal
information is processed is compliant with all the provisions of
the Act," says guidance on the change to the Act issue provided by
the ICO. "Individuals will also have full rights to go to court to
rectify any inaccurate information about them that pre-dates 24
October 1998 under Section 14 of the Act. The Act does not require
that data controllers digitise or computerise old manual
records."
Jay said that the change was unlikely to have a significant
effect because most files will have been added to since the Act
came into force in 1998. That means that they will have been
treated since then in line with the Act anyway.
The reality is that since this only applies to information held
in these structured files, and the rest of the file – that is the
information generated since 1998 – has been subject to the DPA
anyway since the Act came into force, data controllers have been
treating all the information in the same way," she said.
