|
|
|
|
Introduction
5.1 The experience of statutory Freedom of Information regimes elsewhere is that applications for access to personal information form a large proportion of the requests received. This is understandable as a significant proportion of government records consists of personal information. Moreover many people tend to be rather more concerned with information about their own personal affairs than issues of government policy.
5.2 A number of statutory avenues are open already to individuals wishing to obtain personal information held about themselves (both in the private and public sector). These are specified in the following legislation:-
5.3 Access to personal information held by the Scottish Executive may also be provided under the Code of Practice on Access to Scottish Executive Information.
Data protection
5.4 General access arrangements to personal information are provided by the Data Protection Act 1984. In addition to providing access to personal information held on computer, the Act's provisions also protect an individual's personal information from misuse by organisations. The 1984 Act will be replaced from 1 March 2000 by the Data Protection Act 1998 which implements the provisions of EC Data Protection Directive 95/46. This Act is wider than the 1984 Act in a number of ways. In particular, the new Act will apply to some personal information held manually in addition to information held on computer. These manual records in question are defined in the Act as meaning information held as part of a "relevant filing system" which is structured in such a way that specific information relating to a particular individual is readily available.
5.5 The 1998 Act will also provide for access to personal information held in what the Act calls 'accessible records'. This relates to access to social work, housing, health and certain educational records including school pupil reports. The current legislation dealing with these access arrangements, primarily the Data Protection Act 1984 and the Access to Personal Files Act 1987, will be repealed by the 1998 Act.
5.6 The data protection regime is enforced by the Data Protection Commissioner. The consultation paper issued with the draft Westminster Freedom of Information Bill proposes that the role of the Data Protection Commissioner should be combined with that of an Information Commissioner, who would enforce both the data protection and the UK Freedom of Information regimes. Data protection (including the Data Protection Act 1998 and Council Directive 95/46/EC) is a reserved matter as specified in Schedule 5 to the Scotland Act 1998. The UK Information Commissioner will therefore have responsibility for enforcing the data protection regime in Scotland but will not (see Chapter 6) be responsible for enforcing the statutory Scottish Freedom of Information regime.
Data protection and Freedom of Information
5.7 The UK White Paper Your Right to Know envisaged that there would be dual access rights to personal information under the data protection and Freedom of Information regimes. It acknowledged however that there would be some practical difficulties over this as the access rights and the underlying principles of each regime are fundamentally different. Data protection is concerned with the safeguarding of an individual's personal privacy, while Freedom of Information is concerned with openness and the availability of information.
5.8 The draft Westminster Freedom of Information Bill does not propose a dual access regime. Requests for access to personal information will, with a few exceptions, be required to be dealt with under the data protection regime. The Data Protection Act 1998 covers most types of personal data, including that held on computer, in structured files, in relevant filing systems and in 'accessible records' (health, social work, housing tenancy and certain educational records). The Act does not however cover personal information held in what are called 'unstructured files', e.g. information concerning an individual held incidentally on a file about another topic. Under the UK Government's proposals, the Westminster Freedom of Information Bill would amend the Data Protection Act 1998 so that all personal information held by public authorities would be subject to access rights, but this amendment would not apply to information held by Scottish public authorities. As personal data in 'unstructured files' may be difficult for public authorities to trace, applicants would have to provide public authorities with a description of the data that is being sought. Also, with regard to this particular type of information, only the rights of access and rights to data accuracy afforded under the Data Protection Act 1998 would be extended.
5.9. The draft Westminster Freedom of Information Bill appears to strike the right balance between the need to protect personal privacy and extending the scope of the data protection regime to allow an applicant access to all personal data held on the applicant by public authorities. We propose therefore that there will not be dual access rights to personal information (as defined in the Data Protection Act 1998); access rights to this information will be met solely under the data protection regime.
5.10 The Scottish Freedom of Information legislation will exclude all personal information from its provisions except for that personal information held by Scottish public authorities which is not covered by the definition of manual data in the Data Protection Act 1998, i.e. information held on unstructured files. It is proposed that the Scottish Freedom of Information legislation will provide a right of access to this type of personal information held by Scottish public authorities. This will provide the Scottish citizen with exactly the same rights of access to personal information as those proposed for the rest of the UK. As is proposed in the draft Westminster Freedom of Information Bill, if an applicant is seeking information held on unstructured files he or she will have to provide the authority with a description of the material. It is envisaged however that the great majority of requests for personal information will be handled under the data protection regime.
Further work
5.11 The subject of data protection is complex. Further consideration will be given to the relationship between the Scottish Freedom of Information regime and the data protection regime, in particular to take into account the detailed plans, as they emerge, for implementation of the Data Protection Act 1998.
|
|
|