Out-Law News 3 min. read
04 Nov 2004, 12:00 am
The Government has also decided neither to extend the protection of the data protection principles to all manual employee records nor to give the Scottish Parliament a say in whether or not employees of Scottish public authorities should be treated differently.
The right of access by employees to their own manual records in most manual filing systems was significantly diminished by a decision of the Court of Appeal involving a case between an individual, Michael Durant, and the Financial Services Authority.
In this case, the Court concluded that personal information stored in a "relevant filing system", if it was to be personal data subject to the right of access and afforded the full protection of the Data Protection Act 1998 (DPA), had to be stored in a manual filing system which possessed a high degree of structure. In effect, the Court determined that a relevant filing system had to possess almost the functionality of a relational database on computer, so that particular information about a specific individual could be precisely located within that system.
After the case, the Information Commissioner issued guidance which stated that, "following the Durant judgment it is likely that very few manual files will be covered by the provisions of the DPA. Most information about individuals held in manual form does not, therefore, fall within the data protection regime" (Commissioner's emphasis).
This means that many employee manual records are not subject to the right of access and there is no obligation under the DPA to protect such records with an adequate level of security.
Additionally, the Principles which limit disclosure of employee records for other purposes or which relate, for example, to records which contain irrelevant, out-of date or inaccurate comments, do not apply. This position could be exploited by employers who want to keep health or criminal records in unstructured manual employee records indefinitely.
The UK Government's view that the rights of access of public and private sector employees exclude many manually held employee records emerged in response to a Parliamentary Question from Harry Cohen, Labour MP for Leyton and Wanstead.
The Secretary of State for Work and Pensions was asked whether he would "bring forward legislation to permit employees to gain access to records of their employment stored by employers in unstructured manual form".
The Government responded that "Individuals' right of access to their employment and other records is regulated by the Data Protection Act 1998, as amended by the Freedom of Information Act 2000". It added, "We have no plans to extend the application of the 1998 Act to unstructured manual personnel records".
The Government's response that, from 1st January 2005, the Freedom of Information Act (FOIA) extends the scope of "personal data" to include any recorded personal information held by all public authorities in England and Wales, is incomplete. It does not remind Parliament that the FOI legislation also contains an exemption which states that all manual employee records which are not held in relevant filing systems are exempt from all the data protection principles and from all the rights granted to data subjects by the DPA.
It is this exemption which is now being applied to Scottish employees of a Scottish public authority by means of the obliquely titled Freedom of Information (Scotland) Act 2002 (Consequential Modifications) Order 2004, now before the Westminster Parliament.
It contains provisions to extend "data" to any recorded information held by a Scottish public authority, but at the same time will engage the exemption which excludes many manual employee records from the right of access and the protection of the Principles.
Dr Chris Pounder of Masons and Editor of Data Protection and Privacy Practice, said:
"The move to widen access to personal information held by a Scottish public authority is welcome. However, it is very surprising that Scottish MSPs have not been given the opportunity to express a view as to whether it should be able extend access rights to its own employees in Scottish public authorities."
Dr Pounder continued:
"It is difficult to see any reason why the Scottish Parliament should not be given the opportunity to take a different view from that found in Westminster – especially as any decision only applies to Scots working for Scottish public authorities subject to control of the Scottish Parliament and regulated by the Freedom of Information Scotland Act enacted by that Parliament."
Dr. Pounder concluded:
"It is fairly straightforward to extend the protection of the Act to all employee records. All that needs to be done is to define employee records as new class of 'accessible record' in the definition of 'data' under the DPA."