answer text |
<p>We recognise the importance of the permanent preservation of archives for long-term
public benefit by museums, galleries, archives and libraries. The General Data Protection
Regulation (GDPR) and the Data Protection Bill permit such organisations to process
personal data (including sensitive personal data) without consent, where necessary
for “archiving purposes in the public interest”, subject to appropriate safeguards
for the rights and freedoms of data subjects. It also exempts archiving services from
complying with certain rights of data subjects (for example, rights to access, rectify
or erase their data), where the exercise of such rights would seriously impair or
prevent them from fulfilling their objectives.</p><p> </p><p>‘Archiving in the public
interest’ is a new term in data protection law. The Data Protection Act 1998 made
no express reference to it and it is not defined in the GDPR, but Recital 158 to the
GDPR may help to understand it. It says:</p><p> </p><p>“Public authorities or public
or private bodies that hold records of public interest should be services which, pursuant
to Union or Member State law, have a legal obligation to acquire, preserve, appraise,
arrange, describe, communicate, promote, disseminate and provide access to records
of enduring public value for general public interest.”</p><p> </p><p>This is likely
to apply to a wide variety of community, private, public sector, charitable/trust
and voluntary sector archives. It could also include archives that may be closed to
researchers at the present time, but which would become accessible at some future
date, and archives which are held in analogue or digital format. The definition would
not, however, cover organisations which gather and use data, information and records
purely for their own commercial gain or that have no enduring public value.</p><p>
</p><p>We recognise that concerns have been raised about the reference in the Recital
to archiving organisations being under a ‘legal obligation’ to archive. While this
may reflect the archival system in some other EU member states, it does not reflect
the position in the UK. Many smaller archives, particularly in the private sector,
are unlikely to have any statutory obligations to archive.</p><p> </p><p>We do not
think the best approach is to create new statutory duties requiring organisations
to archive. This could force organisations to archive that had no intention or means
of doing so. Instead, we want to reassure bona fide archiving services that they will
be able to continue to process personal data for the purposes of archiving in the
public interest, regardless of whether they have a statutory obligation to do so.
The reasons for this are:</p><p> </p><ul><li>Recitals act as explanatory notes to
European regulations and have no direct legal effect. They may be taken into account
by regulators and the courts when interpreting and applying the law, but they are
not the law.</li><li>In any event Recital 158 should be read in conjunction with Recital
41 which says that “where this regulation refers to a legal basis or legislative measure,
this does not necessarily require a legislative act adopted by a parliament”, providing
that such a legal basis is clear and precise and its application is foreseeable to
persons subject to it.</li><li>In the UK, most archives operate on a permissive basis
under the general provisions of common law or statutory permissive powers, such as
the British Library Act 1972 or the Local Government (Records) Act 1962. It may be
open to organisations to rely on such a basis to satisfy the requirements of Recital
158.</li><li>Where there are no clear permissive powers, organisations may still be
able to point to funding agreements, management agreements or constitutional documents
which set out the purposes of the archive, particularly if the failure to adhere to
such purposes could have legal or quasi-legal effects, for example for a body’s charitable
status. Although this may not amount to a statutory obligation to archive, it would
give organisations a legal basis upon which to rely.</li><li>Up until now, organisations
responsible for archiving may have relied on exemptions from subject access rights
under the ‘historical research’ provisions in section 33 of the Data Protection Act
1998. These provisions will continue in the new Data Protection Bill, and have not
been abolished by GDPR. Most of the exemptions from data subjects’ rights in relation
to archiving also exist in relation to historical research. If archiving services
cannot confidently rely on the exemptions for archiving in the public interest, they
may be able to rely on exemptions for historical research as an alternative. We recognise
that there is some debate about this point within the sector because some archives
may not exist for historical research purposes. In that case, a legal basis for archiving
will be needed, but it does not need to be statutory.</li></ul>
|
|