The National Archives today has published a new set of guidelines for archiving personal data.
The rules for handling information about living people in archives and records intended for transfer to archive services changed on 25 May 2018. The Data Protection Act 1998 was replaced by The Data Protection Act 2018 (DPA 2018). This is as a result of new legislation in the EU: the General Data Protection Regulation (GDPR). The DPA 2018 makes additional provisions around areas not covered by GDPR. In general, ‘archiving’ which complied with the 1998 Data Protection Act will continue to be permitted under the new law and no major changes are required.
Malcolm Todd, Head of Information Policy at The National Archives said:
“History and all sorts of research cannot be done without information about people. Archivists have been trusted to manage personal data carefully for generations. The new Guide focuses on how this works in the age of the cloud and social media.”
Archives services sit in many different types of organisations – galleries, libraries, schools and museums as well as voluntary and community organisations. They are the homes for our collective memory. They help us to understand the past, make sense of the present and guide us for the future.
Reflecting this unique role, there is now greater visibility for archiving in the new data protection law than before. The Guide focuses on the key concepts and their implications in the reformed data protection legal environment around the new concept of archiving in the public interest. Under this, provided the specified safeguards are met, certain of the other requirements of GDPR and the new DP Act apply in adapted form such as data rectification, storage limitation and initial notification of processing to data subjects.
This guide has been produced in partnership with National Records of Scotland, The Welsh Government, Public Record Office of Northern Ireland, Archives and Records Association (ARA) and National Archives, Ireland under independent chairmanship.
To see the guide, please visit Guide to archiving personal data