## Data Protection And Personal Information

 First published: May 2016 Reviewed: June 2019 

## © Crown Copyright 2019

You may re-use this publication (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. To view this licence visit nationalarchives.gov.uk/doc/open-government-licence; or write to the Information Policy Team, The National Archives, Kew, Richmond, Surrey, TW9 4DU; or email: psi@nationalarchives.gov.uk. Any enquiries regarding this publication should be sent to us at governmentaudience@nationalarchives.gov.uk 

## Introduction

The purpose of data protection legislation is to ensure the proper use of personal information about living individuals. The legislation imposes obligations on those who hold such personal information, while giving rights to those the information is about - data subjects. Archivists have a different role in relation to personal data from those who collected the personal data in the first place, as: 

 They do not control the type of data collected because they were not involved in why, 
when and how it was originally collected and used for business purposes, 
 Their interest in the personal information lies in its value as a record of its time that can be 
used in future research, and its current accuracy is therefore not of concern, 
 They have no interest in the future of the individual data subject, only their past.  
This means that the activities of archivists can sit uneasily within the data protection legislative field, as at times they are obliged to comply with provisions which were designed for a different purpose. However, the Data Protection Act 2018 (DPA) and General Data Protection Regulations, which came into force in March 2018, recognise the importance of data being kept for historical purposes, and contains provisions for this to be achieved within the framework of the legislation. The DPA imposes a duty on those holding personal data to register such data with the Information Commissioner, to comply with data protection principles, and to allow individuals to access and, in certain circumstances, to correct and remove data that relates to them. The implementation of the Freedom of Information Action (FOIA) in 2005, extended the Data Protection Act 1998 in scope so it that it applied to all information about living individuals held by public authorities, whatever the format or structure of the records, and this continues under the 2018 Act. In 2018 with other interested bodies The National Archives produced A Guide to Archiving Personal Data, and there is further advice for archives. 

## Processing For Archiving In The Public Interest, Research And Statistical Purposes: Safeguards

There is a new explicit concept of 'archiving in the public interest' in Article 89 of GDPR which means there is greater visibility for archiving in the new legislation. This makes a distinction between the collection, preservation and management of data, and its future use for research. This with similar processing for scientific or historical research and statistical purposes, permits exemptions to some of the principles and some of the rights of data subjects, so long as there are certain safeguards. These safeguards are set out in section 19 of the Data Protection Act 2018, with wording similar to section 33 of the Data Projection Act 1998. This ensures continuity of processing for transferring departments. These provisions exempt the processing of personal data from some of the principles and rights under GDPR and DPA where this is necessary to enable the identification, permanent preservation, management and, where appropriate, research and other uses of personal data in the general public interest. This is important for records managers and archivists, as it lays down the conditions with which the data controller of an archive should comply if the archive is to be exempt from compliance with various other requirements of GDPR and DPA. Without the benefit of such provisions, archiving data could be in breach of the data protection principles. Additionally processing for research purposes should be compatible with the purposes for which the data were collected, and the data may be kept indefinitely if the relevant conditions apply. 

These are that the data are not processed to support decisions about individuals, and that substantial damage or substantial distress is not likely to be caused to any data subject. Personal data can be selected for permanent preservation, and stored, if these two conditions apply, on condition that the other data protection principles are complied with. Note that The National Archives has registered personal data in transferred records to the Information Commissioner with the special purpose of processing for the purposes of archival preservation and has information regarding personal data in records transferred to the archival holdings in its Privacy Notice. 

The GDPR has additional and more granular requirements to inform data subjects of the processing undertaken. Transferring organisations should ensure that their Privacy Notices include a statement to the effect that:  
A very small percentage of government records containing personal information are selected for permanent preservation at The National Archives. They are made available in accordance with the Freedom of Information Act 2000, as amended by the Data Protection Act 2018. 

## Closure Of Personal Information

The most common reason for records at archives services to be closed is that they contain personal information about identifiable living individuals and disclosure would breach one of the Data Protection Principles and consequently is exempt under FOI exemption 40. Note that the name of a person may not in itself be enough to make the person identifiable and it usually depends on the context in which it appears or the presence of supplementary information enabling a person to be identified. This is especially true of information held in a digital format or where access is not controlled, for example available online and will be exposed to search engines, the name will enable linking to other information that could identify the person, and should therefore be redacted.  
Any records (paper or digital) that are indexed by name or other identifier, generally case files, should be closed for the lifetime of that individual Usually such information falls within GDPR's definition of special categories of personal data within Articles 9 and 10, namely information on a data subject's: 

 racial or ethnic origin  political opinions  religious, or other, beliefs  trade union membership  
 processing of genetic and biometric data for the purpose of uniquely identify an individual. 
Personal data relating to criminal convictions and offences are not included, but similar 
extra safeguards apply to its processing (see Article 10). 
 health (physical or mental)  
 sex life or sexual orientation  offences, committed or allegedly committed  details of proceedings for offences  

## However, There Is Also The Consideration Of Whether Release Is Fair, Therefore The Information

Commissioner's Office has issued guidance on what personal information should be considered exempt. Note that not all personal information must be withheld for the full lifetime of the data subject, release is about it being fair and lawful to do so. The particular content and context of the information may allow earlier access. Therefore, guidance on closure periods should be applied on a case-by-case basis. 

One difficulty is establishing whether the person to whom the information relates is still alive. In practice, it is usually impossible for a department or archives service to know if an individual is still living and impracticable for them to find out. The Advisory Council approved a recommendation that a lifetime of 100 years should be assumed, and this is replicated in A Guide to Archiving Personal Data. Thus if a person is aged 30 in a 1950 record (therefore a date of birth of 1920), the information should not be released during their lifetime, and a closure period applied that would last for 70 years until the end of 2020 (opening on 1 January 2021). If a person's age is unknown, estimate the closure period. If it is obvious the person is an adult then the estimated age at the time of the record should be 16. If it is not obvious what age a person is from contextual evidence then the full 100 year closure period should be used, for example, a child who is the victim of crime.  
It may be possible from contextual evidence to reduce the closure period, for example, if it is known a person has a professional qualification that requires several years of training or where a person is applying for a benefit such as a pension that has a minimum age. In these circumstances the closure period should be reduced accordingly.