2. Fair and proportionate……?
Personal data in UK public archives
Malcolm Todd, Head of Information Policy
10 October – Academy Palace, Brussels

4. Confessional
Post-UK Referendum, unable to comment on future UK policy until ministers have announced it
In last decade, published two papers on the themes of this Congress:
Archivaria Vol. 61 [2006]: Power, identity, integrity, authenticity and the archives. A triangulation study looking at the challenge presented to archival preservation by contemporary developments in privacy protection from multiple archival scientific viewpoints
Archival science, research special edition, [2007]: The long term retention and preservation of identifiable personal data [co-authored with Dr Livia Iacovino, Monash University]. comparative regulatory study

5. Themes
Managing personal data in the UK Freedom of Information environment
Effects of data transparency on traditional assumptions, applying wider than the archival record
Application of Data Protection principles to certain physical records
Shrinking scope for ethical decision-making by archivists
Need for policy engagement to have ability to match against key life events (especially deaths) because there is no “100 year rule”

6. UK legal framework: FOIA / DPA interface
40 Personal information
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which do not fall within subsection (1), and
(b) either the first or the second condition below is satisfied.
(3 )The first condition is—
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene—
(i) any of the data protection principles, or
(ii)section 10 of that Act (right to prevent processing likely to cause damage or distress), and
(b) in any other case, that the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
(further text on the access rights of data subjects and the duty to confirm or deny which are not relevant here)

7. Quotation from Todd, 2006
“…. the response to global terror and freedom of information (FOI) have combined with concerns about electronic government initiatives to tighten privacy regulation in many jurisdictions. ………. For archivists, the main challenges come from very prosaic roots. To begin, we now have to manage privacy at the sub-record level .…..”

8. Personal sensitivity trajectory
*sensitivity = extent of personal information tempered by legal mandate to publish

9. DP and physical records
UK went beyond 1995/46/EC in Data Protection Act 1998
Applied principles to manual records if held in assemblies where personal data was part of the principle of arrangement and PD readily accessible (“relevant filing systems”)
UK went even further in FOIA 2000 by bringing physical records …….. (“Section 9a records” aendment to DPA)
S. 9a Data Subject access requirements applying to archives give some measures of control against speculative searching in unstructured physical records

10. FOIA amendment to DPA 1998
69 Right of access to unstructured personal data held by public authorities.
(1) In section 7(1) of the Data Protection Act 1998 (right of access to personal data), for “sections 8 and 9” there is substituted “sections 8, 9 and 9A”.
(2) After section 9 of that Act there is inserted—
“9AUnstructured personal data held by public authorities.
(1) A public authority is not obliged to comply with subsection (1) of section 7 in relation to any unstructured personal data unless the request under that section contains a description of the data.
(2) Even if the data are described by the data subject in his request, a public authority is not obliged to comply with subsection (1) of section 7 in relation to unstructured personal data if the authority estimates that the cost of complying with the request so far as relating to those data would exceed the appropriate limit.
……..”

11. Implications UK archivists very well used to DP administration
Traditional unit of description / production is now not always the unit of access management
Data Subject access requests, objections to processing more frequent
Same issues with managing UK official Gazette
Possible to argue compliance with DP Principles on grounds of ‘proportionality of processing’

12. But….
Digitisation of descriptions is undeniably more processing and could make aggregation “relevant”
Digitisation of content another order of processing
Reclosure of some previously open records well over 30 years old can be the result …… of FOI implementation

13. Administrative devices to balance
Removal from sight of crawlers of internet search engines
‘Takedown’ from web presentation
Re-closure (record, parts of record or parts of description)
Annotation
(de-Accession)
Policy interventions
Exemption for archives from “disregard” provisions of Protection of Freedoms Act 2012
Data matching / sharing discussions with General Register Office

14.
Questions?