Comments by David Flint

David Flint
Member - 3 posts

Lisa,

Thanks for your enquiry.

The question that you must ask is whether the comments on the review form constitute personal data of the tutors to which they have a right of access. To constitute personal data the information must be biographical of the tutor to a significant degree and have the tutor as its focus. Recent case law also suggests that the information should be capable of affecting the tutor's right to privacy in some way. The Information Commissioner's most recent guidance indicates that the affect should be a negative one.

In this case the fact that the review forms are directed specifically at the performance of the tutor I would have thought that the basic constituent elements for personal data exist.

However, if the review forms exist only on paper form then even if the information they contain is biographical to a significant degree, have the tutor as their focus and contain information capable of adversely affecting the tutor's privacy the information will not be personal data to which the Tutor has a right of access unless they form part of a structured paper filing system known as a relevant filing system.

The Court of Appeal recently indicated that:

?it is not enough that a filing system leads a searcher to a file containing documents mentioning the data subject. To qualify [as a relevant filing system] under the Directive and the Act, it requires??.a file to which that search leads to be so structured and/or indexed as to enable easy location within it or any sub-files of specific information about the data subject that he has requested? ; and

?it is only to the extent that manual filing systems are broadly equivalent to computerised systems in ready accessibility to relevant information capable of constituting ?personal? data that they are within the system of data protection?.

The most crucial passage from a practical perspective, however, is:

?Parliament intended to apply the Act to manual records only if they are of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system. That requires a filing system so referenced or indexed that it enables the data controller?s employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them. To leave it to the searcher to leaf through files, possibly at great length and cost, and fruitlessly, to see whether it or they contain information relating to the person requesting information and whether that information is data within the Act bears?..no resemblance to a computerised search.?

You should consider whether the paper file in which the review forms are filed meets these tests. If the review forms are only held on paper then that should be your first step. If the file has the requisite structure then the next step would be to assess whether they are sufficiently biographical and focused to amount to personal data.

I hope this helps.

Regards

David Flint

Partner

Technology, Media and Communications Group

MacRoberts Solicitors

152 Bath Street, Glasgow G2 4TB

Scotland

(Tel: +44 141 332 9988; Fax: +44 141 332 8886)

URL: http://www.macroberts.com

FOR DETAILS OF OUR UPCOMING DATA PROTECTION TRAINING SEMINARS on 23rd & 24th March 2004 contact: marketing@macroberts.com

David Flint
Member - 3 posts

Mark,

Thanks for your enquiry.

A person's image is personal data of that individual by virtue of the Data Protection Act. However, unless your face discloses information about you that can be characterised as sensitive personal data it is offered no more protection than your telephone number or other every day personal data.



It is possible that a person's face could disclose sensitive personal data about that individual. For instance, a person's face may disclose a particular ethnicity or medical condition or religious persuasion. Accordingly, the safest way to proceed is to proceed on the basis that every photograph may involve the processing of sensitive personal data and plan to ensure fairness and lawfulness based on that standard.



This analysis, while unusual, should proceed along well known principles. For instance, if you want to take photographs of all external visitors to a business then you should provide fair notice of who the business is that is taking the photograph, the purposes for which the photograph is being taken and the uses to which it will be put and other information to make the processing fair. In this context, I think that that would involve an explanation as to why taking a photograph is regarded as a proportionate thing to do, details of a person?s right of access to the information that you hold about them and details of the person?s right to serve a notice stopping processing which causes unwarranted prejudice. I would also include details as to how the photograph will be stored and for what length of time and the class or classes of individuals who may have access to that photograph. Accordingly, if that photograph was going to be passed to any third party such as the Police or if it is going to undergo some automated decision making process then I would specify that in any notice.

I am presuming that you want to take individuals? photographs for the purposes of increasing the security of the building? This is a fairly onerous security access procedure and, as good practice, you should ensure that it is a proportionate thing to do.

If it is being done to prevent or detect terrorism then it can be done without consent if you can establish that it is in the substantial public interest for this to happen and it is necessary for the purpose of prevention or detection of any unlawful Act and that seeking the explicit consent of an individual would prejudice those purposes.

You would have some challenges here because it would be difficult to establish that this particular procedure was absolutely necessary for those purposes. Other less intrusive security access checks may accomplish the same thing. Also, if somebody refused their explicit consent could they simply not be denied access to the building, thereby maintaining the security of the building without imposing this process on an individual without consent?

In light of these difficulties, my suggestion in this particular circumstance would be to seek explicit consent in some manner. It need not be in writing but should be signified by some positive indication of consent and should be fully informed.

Human rights influences may also be important here. I am presuming that Nomura International are not a public sector body and so the Human Rights Legislation has no direct impact on you. However, any act which is seen to disproportionately impact on a person?s privacy is, at the very least, likely to increase the chances of negative publicity. To manage this I think that the Fair Collection Notice given to visitors to the building would have to be very clear and very full.

Hope this helps.

Regards

David Flint

Partner

Technology, Media and Communications Group

MacRoberts Solicitors

152 Bath Street, Glasgow G2 4TB

Scotland

(Tel: +44 141 332 9988; Fax: +44 141 332 8886)

URL: http://www.macroberts.com

E-Mail: df@macroberts.com