DP: no duty to digitise
Contrary to what is being suggested by some data management companies, there is no impending requirement to digitise pre-1998 manual records
The Data Protection Act 1998 has been in force since March 2000, but in recognition of the major change it represented in data protection law, several transitional reliefs were built into the Act. These were intended to allow data controllers (those who hold data and have decision-making powers over them) time to adjust to the requirements of the Act.
The last such transitional relief comes to an end on 23 October 2007. It relates to some manual (i.e. non-digitised) records created before 24 October 1998, including those held in structured manual filing systems.
Under the relief, such old manual records were exempt from most of the provisions of the first five data protection principles (sched 1 to the Act), and the data subject’s right under s 14 of the Act to apply to the court for an order requiring a data controller to rectify, block, erase or destroy inaccurate data.
From 24 October 2007, this relief will no longer apply, meaning that the personal data contained in such records will be subject to the 1998 Act in its entirety, including all eight data protection principles and the provisions of s 14.
Some enterprising data management companies have been using the expiry of this relief as a pretext for suggesting that the Act now requires all pre-October 1998 manual records to be digitised. This is not the case. While digitising records may for some data controllers represent a way of helping compliance with the 1998 Act by making it easier to manage old records, it is not compulsory under the Act.
Angus G MacLeod, Partner, Wright, Johnston & Mackenzie LLP, Glasgow