In light of a recent Court of Appeal ruling, the Information Commissioner's Office - which is responsible for enforcing the Data Protection Act 1998 - has issued revised guidance for businesses.

The Act sets the standards by which "personal data" must be processed. Processing encompasses practically anything done with personal data, including storing, disseminating or even destroying it.

Until recently, data has been deemed "personal" if it consists of any information about a living individual, stored either on computer or in a structured filing system, including manual records. The Court of Appeal, however, has ruled in a case involving the Financial Services Authority that data is only personal where:

a particular individual is the focus of the data;

unauthorised disclosure of the data may affect that individual's privacy; and

the data is held in a structured filing system indexed by reference both to that individual and to the types of information held about that individual.

Where, for example, a business is in possession of documents which merely mention individuals without potentially having an impact on their privacy or where documents are held in a manner which does not allow them to be found quickly by reference to an index, the business may not now have to pay regard to the Act in respect of those documents. One of the most significant effects of this ruling will be its impact on the handling of Subject Access Requests.

Where businesses receive a request from an employee, customer or supplier for a copy of all information held about that person, the request must generally be complied with within 40 days unless a statutory exemption applies. If, however, some of the information held about that person is deemed not to be "personal data", that information will fall outside the ambit of the Act and will not need to be disclosed.

In deciding whether the Act applies to particular records, business should bear in mind that there are a range of enforcement methods open to the Information Commissioner which he has made clear he will not hesitate to use against those who flout the law.

These include the ability to order an investigation and to conduct prosecutions against sole traders, partnerships, companies and their Directors personally where evidence of wrongdoing is uncovered.

It has never been more important for businesses to audit their records and seek professional advice where they are in any doubt as to whether they are complying with what has proven to be one of the most complex and controversial pieces of legislation in recent times.

Rollits, Rowntree Wharf, Navigation Road, York YO1 9WE Telephone 01904 625790

Fax: 01904 625807

Email: info@rollits.com

Website: www.rollits.com

Updated: 09:36 Tuesday, March 23, 2004