Data Protection Act - Important Changes Oct 2008

The Background

The Data Protection Act was introduced in 1998 to give the public access to data held about them on organisations' files. It was introduced to help people see and understand the information which firms were using and holding about them. Through accessing this information the public has the opportunity to see if files are correct, relevant or incomplete and can advise the record holding organisation accordingly.

Currently, the DPA gives people the right to claim to view personal information held about themselves, whether it is on paper or held electronically. Requests must be made in writing to the company or individual who holds the data.  For any electronically held data, relating to updates after 1998, an organisation must supply all files within 40 days.

Previous Implications (October 2007)

On 24th October 2007, the DPA changed, and firms have to supply ALL data from 1998 onwards, not just information held on electronic files, within 40 days of the initial request. New documents that fall under the act include manual data - health records, local authority, housing and social services records for example as well as records on active files which has not been put onto an electronic system.

Firms that cannot provide their records to an enquirer within the 40 day period will be liable under the law, most probably with a fine. There is a legal right of recourse through the courts for the public to challenge organisations that are late with information and also to enforce changes to data to ensure it is accurate.

It is therefore more important than ever that firms and organisations have quick access to accurately stored and retrievable information.

October 2008 Implications

There is one remaining period left for companies to be aware of. In October of 2008 the final exception from the Act, whereby records predating 1998, held in manual filing systems, will also fall under the Act's jurisdiction. These files will also need to be accessed and forwarded to the enquirer within 40 days.

For now, firms and organisations are strongly recommended to review their filing systems and ensure that their processes for data management and storage are rigorous and comply with the DPA changes.

For the full run down of the Data Protection Act visit the Government's Office of Public Sector Information website.