Schools need to start clearing out their filing cabinets and carrying out an audit of all their employee records in preparation for changes in the law on data protection.
The Data Protection Bill, which has just been published, proposes to give employees access to most of their personal records. These will include records held on card index and similar manual filing systems, in addition to the computerised records which employees and other “data subjects” are already entitled to see.
The Bill also aims to protect individuals’ privacy. This means schools and other organisations will no longer be able to collect sensitive information about individuals’ religious and political beliefs, race, health and sexuality without their consent.
The proposed legislation gives effect to the EC Data Protection Directive. This puts the onus on employers and other data users to tell individuals what information is kept about them, how it is used and of their right to see it.
To comply, organisations will have to find out exactly what information they hold on their current and former employees and why. They will also be well-advised to check the accuracy of their records before the Bill becomes law later this year.
“Schools should be thinking carefully about what they put on file and excluding information not based on fact,” says Olga Aikin, senior partner at the Aikin Driver Partnership employment law firm.
“Opinions not based on fact are likely to cause upset and disagreement, and people will seek correction.”
Job applicants will have the right to see interview notes, and interviewers who destroy them will run the risk of breaking the law.
The Data Protection Directive says that personal data must be “adequate, relevant and not excessive” for the purposes for which it was collected. The directive covers data held in “structured” filing systems, which almost certainly includes files arranged alphabetically or by employee number. But it is not clear whether a system counts as structured if each file within it contains a jumble of different types of documents or if it is badly organised in some other way.
Recognising the difficulty of finding a precise definition, the Government has given the Data Protection Registrar, who will be known as the Data Protection Commissioner, the power to adjudicate in disputes.
