DATA PROTECTION ACT 1998
End of Transitional Arrangements - October 2007

5th September, 2007

In October 2007 the regulations of the Data Protection Act will change.

Background:
The Data Protection Act was introduced in 1998 to give the public access to data held about them on organisations' files. It was introduced to help people see and understand the information which firms were using and holding about them. Through accessing this information the public has the opportunity to see if files are correct, relevant or incomplete and can advise the record holding organisation accordingly.

Currently, the DPA gives people the right to claim to view personal information held about themselves, whether it is on paper or held electronically. Requests must be made in writing to the company or individual who holds the data.

For any electronically held data, relating to updates after 1998, an organisation must supply all files within 40 days.

October 2007 Implications:
On 24th October 2007, the DPA will change, and firms will have to supply ALL data from 1998 onwards, not just that held on electronic files, within 40 days of the initial request.

New documents that will fall under the act include manual data - health records, local authority, housing and social services records for example as well as records on active files which has not been put onto an electronic system.

Firms that cannot provide their records to an enquirer within the 40 day period will be liable under the law, most probably with a fine. There is a legal right of recourse through the courts for the public to challenge organisations that are late with information and also to enforce changes to data to ensure it is accurate.

It is therefore more important than ever that firms and organisations have quick access to accurately stored and retrievable information.

October 2008 Implications:
There is one remaining period left for companies to be aware of. In October of 2008 the final exception from the Act, whereby records predating 1998, held in manual filing systems, will also fall under the Act's jurisdiction. These files will also need to be accessed and forwarded to the enquirer within 40 days.

For now, firms and organisations are strongly recommended to review their filing systems and ensure that their processes for data management and storage are rigorous and comply with the DPA changes.