Background

The Data Protection Act 1998 (the “Act”) came into force on 1 March 2000 and replaced the (previous) Data Protection Act 1984 in its entirety. The new Act applies not only to personal data which is automatically processed (ie held on computer), but also to paper-based personal data stored in filing systems. Every company and organisation is legally obliged to process any personal data which it holds in a fair and proper way. The Act regulates when and how personal data relating to individuals may be obtained, held, used and disclosed, and provides mechanisms (such as registration procedures and enforcement powers) to ensure that those in control of personal data comply with the law. It also provides the subjects of personal data with mechanisms for gaining access to that data, challenging any misuse or abuse of that information and seeking redress if they suffer damage or distress as a result of breaches of the law.

New legislation

Employers were given several years in order to comply with the new legislation in respect of existing paper-based records. Although the Act came into force on 1 March 2000, some of its requirements were phased in. The second transitional period was from 24 October 2001 to 23 October 2007 and applies to manual data held immediately before 24 October 1998 and manual health records that do not form part of a relevant filing system. During the transition period, companies and employers were exempt from various data protection principles in relation to manual data. The transitional period expires on 24 October 2007, and at this point the remaining provisions of the Act will come into full force.

Effect on employers

As this second transitional period is drawing to a close, it is essential that employers review their data storage and processing systems. Employers should ensure that manual filing systems that were in existence before 24 October 1998 – which will include all paper-based personnel records that form part of an organised filing system - are compliant with the data protection provisions under the Act