Data Protection Act 1998

Definitions

Personal data

The DPA defines personal data in section 1(1) as:

"data which relate to a living individual who can be identified -

  1. from those data, or
  2. from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed with the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.

When considering 'biographical significance', what is important is whether the data go beyond recording the individual's casual connection with a matter or event which has no personal connotations for him. Does the processing of this data affect, or is it likely to affect, the individual? Data may, for example, have personal connotations for an individual if it provides information about an individual's whereabouts or actions at a particular time.

Example: Where an individual is listed as an attendee in the minutes of a meeting then the minutes will have biographical significance for the individual in that they record the individual's whereabouts at a particular time. The fact that an individual attended the meeting will be personal data about that person. However, this does not mean that everything in the minutes of that meeting is personal data about each of the attendees. Whether the content of the minutes includes any additional personal data, beyond attendance data, about the attendees at the meeting may be determined by the focus of the minutes.

Does the information concentrate on the individual?

Again, it is important to remember that it is not always necessary to consider 'focus' to determine whether data is personal data. In many cases data may be personal data because it is 'obviously about' an individual, or because it is clearly 'linked to' an individual because it is about the individual's activities. You need to consider the 'focus' of the data only where information is not 'obviously about' an individual or clearly 'linked to' them.

More guidance on the definition of 'personal data' from the Information Commissioner's Office:

Data subject

An individual who is the subject of personal data.

Data controller

A person or organisation who controls the purposes and manner in which data are processed.

The University of Cambridge is a data controller, and the point of contact is the University Data Protection Officer.

Relevant filing system (paper files)

A "relevant filing system" is defined in section 1(1) of the DPA as "any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured either by reference to the individual or to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible".

This means that

"a 'relevant filing system' for the purposes of the Act, is limited to a system:

  1. in which the files forming part of it are structured or referenced in such a way as to clearly indicate at the outset of the search whether specific information capable of amounting to personal data of an individual requesting it under section 7 is held within the system and, if so, in which file or files it is held; and
  2. which has, as part of its own structure or referencing mechanism, a sufficiently sophisticated and detailed means of readily indicating whether and where in an individual file or files specific criteria or information about the applicant can be readily located".

Quick guide to understanding the DPA definition of 'relevant filing systems'

  1. Does your filing system contain information about individuals?
    Yes - go to Q. 2.
    No - you do not have a 'relevant filing system'.
  2. Does the filing system use the names of individuals (or another unique identifier) as the file name?
    Yes - go to Q. 4.
    No - go to Q. 3.
  3. Does the filing system use criteria relating to individuals (eg. sickness absence, pensions, or qualifications) as the file name?
    Yes - go to Q. 4.
    No - you do not have a 'relevant filing system'.
  4. Is the information in your files held solely in chronological order?
    Yes - you do not have a 'relevant filing system'.
    No - go to Q. 5.
  5. Is the content of your files indexed or subdivided to allow direct access to specific information about the individual?
    Yes - you are likely to have a 'relevant filing system'.
    No - you do not have a 'relevant filing system'.