Data Protection Act 1998

A Guide to the Registration Requirements for Genealogists

WHAT IS DATA PROTECTION ?

The Data Protection Act regulates the holding and use of information which is held on computer in order to protect the rights and freedoms of Individuals. The Data Protection Registrar aims to promote respect for the private lives of individuals and in particular for the privacy of their information.

The Data Protection Act requires that data users (i.e. those legal person who control the contents and use of particular collections of personal data) register the purposes for which they hold personal data. They are also required to provide a brief description of that data, including the source from which the data are obtained and the persons to whom that data might be disclosed.

A registered data user is further obliged to comply with the eight Data Protection Principles. These are a set of enforceable rules for good data protection practice.

Computer bureau are also required to register under the Act. A computer bureau is an individual or organisation who processes personal data on behalf of a data user or who allows a data user to use his computing equipment.

WHAT TYPE OF INFORMATION IS COVERED ?

The Act defines 'personal data' as information relating to a living individual who can be identified from that information (or from that and other information in the possession of the data user). The Act applies to as little as a name and address. It applies to data collected from a public source. Therefore, unless a genealogist only holds historical data about deceased people, the Data Protection Act will apply to the data which they hold.

WHO NEEDS TO REGISTER ?

There are several specific exemptions from the requirement to register. If a data user can rely on one or more of the exemptions, registration is not required. The exemptions have strict conditions attached to them. It is the responsibility of the data user to satisfy himself that an exemption applies. The exemptions are explained in chapter 6 of the Guidelines (available from the Registrar's Office).

If a data user is unsure about whether registration is required he should contact the Registrar's Office for further advice.

THE EXEMPTIONS

Domestic or Recreational Use

Personal data held by an individual and concerned only with the management of his own personal, family or household affairs or held by him only for recreational purposes are exempt from registration.

Therefore, a genealogist holding personal data simply in connection with his own studies and research would not be required to register such data.

However, the Registrar considers that the genealogist would no longer hold such personal data solely for his personal recreational purposes if he disclosed the data to another genealogist, or any other person, and the exemption would no longer apply.

Similarly, the exemption would not apply where a genealogist holds personal data which is shared with, and provided by, a group of genealogists who share research information, or held in connection with a local society of genealogists, or a 'one-name' society.

Unincorporated Members' Clubs

There are several exemptions from registration which might apply to a club whose members are genealogists.

These include an exemption for accounting, mailing lists and an exemption for unincorporated members' clubs which can cover personal data relating to members which are held with the consent of the members. These exemptions are set out in detail in a separate factsheet for clubs and societies which is available from the Registrar's Office.

However, a genealogists club which held research data about living individuals who are not members of the club would be required to register.

Word processing

In addition to the exemptions from registration, there is a provision for word processing. A person or an organisation does not become a data user simply by using the editing facilities provided by a simple word processor, with the sole purpose of producing a letter or other document, even though that document, when printed, may contain personal data.

However, if the documents are held on a computer as a store of personal data then this 'exemption' would not apply.

HOW DO WE REGISTER ?

If you are satisfied that you need to register, please telephone our Registration Department on (01625) 545740. You will be asked the broad nature of your business. A registration form designed to cover your own particular business will be sent to you.

You will be required to check the details, make any amendments and return the form with the registration fee. The current fee is £75.00 for three years.

THE DATA PROTECTION PRINCIPLES

Registration alone does not ensure compliance with the Data Protection Act. Once registered, a data user must comply with the eight Data Protection Principles. The Principles are enforceable rules for good practice.

Broadly, the Principles state that personal data must be:

1. Obtained and processed fairly and lawfully;

2. Held for the lawful purposes described in the data user's entry;

3. Used only for those purposes, and disclosed only to those people described in the register entry;

4. Adequate, relevant and not excessive in relation to the purpose for which they are;

5. Accurate and, where necessary, kept up-to-date;

6. Held no longer than is necessary for the registered purpose;

7. Accessible to the individuals concerned who, where appropriate, has the right to have information about themselves corrected or erased;

8. Surrounded by proper security.

The principles are described in further detail in chapter 4 of the Guidelines, available from the Registrar's Office on request.

The Registrar's staff will be happy to assist with any further questions about the requirements of the Data Protection Act.

The Information Commissioner's Office (formerly the Data Protection Registrar)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 08456 30 60 60 or 01625 54 57 45
Fax: 01625 524510