Data Protection: Notification - the Obligation to Register

Notification is the new term for registration. Despite the change in the terminology between the 1984 and the 1998 Data Protection Acts, the obligation to notify is still commonly referred to as registration.

What information is covered by the 1998 Act?

Information stored only on manual files which are not indexed in such a way that the information can be searched in a way equivalent to an automated search will not normally be covered. The Information Commissioner has provided recent guidance on this issue, which can be found at on the Information Commissioner’s website: see related links at the side of this page.

However, information stored on computer readable media e.g. diskettes or CD-ROMs is covered, although microfiches alone are not. This is because it does not fall within the definition of “data”.

The information must be information which relates to an individual from which they can be identified or which together with other information in the barrister’s possession would enable such identification. This is known as “personal data”.

A detailed description of the definition of “personal data” can be found in the Court of Appeal decision in Durant v FSA [2003] EWCA Civ 1746, 28, 29. This link can be found in related links at the side of this page.

What is processing?

Processing is defined in s. 1 of the 1998 Act and covers a wide range of activities. In relation to information or data (as defined) it means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, and includes:

(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

(d) alignment, combination, blocking, erasure or destruction of the information or data.

Who has to notify?

Every data controller who carries out non-exempt processing must notify. In practice this means that every barrister and second six pupil and squatter who uses a computer themselves for processing information described above or gives instructions to other to use computers for their practise for such processing is potentially a data controller and therefore potentially obliged to notify their processing.

If you fall within the following categories you should notify your processing:

1. If you use a computer for word processing and emails, this will frequently involve the incorporation of information about individuals, particularly witnesses and lay clients and professional clients. It may involve sensitive information concerning, for example, the physical or mental health of an individual or an allegation of the commission of an offence by an individual.

2. If you give instructions for such processing to another person, for example a chambers’ typist or personal assistant working on a computer.

3. If you are a second six pupil doing work on your own account, on your own computer or giving instructions as set out in (2) above.

Separate considerations apply to processing for chambers administration. These are not addressed here. The Information Commissioner has provided a guidance note on notification of barristers' chambers which can be found on the ICO website and is accessible through the related links at the side of this page.

Who does not have to notify?

1. Employees of a barristers’ chambers or of an individual barrister who simply follow their instructions will not normally have to notify for this processing, since they are only processing data for the data controllers.

2. If you are a first six pupil, the work you do should be performed under the direction and control of your pupil supervisor, and therefore you will not normally have to notify for this processing, since you are only a data processor not a data controller.

3. If all the processing you perform is exempt processing, there is no obligation to notify, although you can choose to do so. However, it is unlikely that all the processing performed by a barrister will be exempt since these categories are limited. The exempt categories include: staff administration, advertising, marketing and public relations, accounts and records and processing for not for profit organisations. However, the exemptions are limited to specific classes of data subjects, data and processing. For further details of exempt processing see The Data Protection (Notification and Notification Fees) Regulations 2000 (SI188/2000).

4. If you do not carry out or direct the carrying out of “automatic” processing of information or processing of information which is contained within a relevant filing system (as defined) or record any information with the intention that it be processed automatically or that it should form part of a relevant filing system, this is not covered by the 1998 Act, since such information is not “data” as defined under the 1998 Act and you do not have to notify for this processing.

Why should I notify?

Failure to notify by a data controller who is carrying out processing which is not exempt is an offence, punishable by a fine. Alternatively, the Information Commissioner may issue an enforcement notice requiring compliance with the Act. Failure to comply with such a notice is also an offence.

How much does it cost?

£35 p.a.- the easiest way to pay is direct debit, although you can pay by cheque or BACS.

How to notify

You can notify on-line at: www.informationcommissioner.gov.uk/eventual.aspx?id=322, by post (after printing out and completing the online form offline) or by telephone (01625 545740).

The Information Commissioner has produced a draft description of processing which is considered by the Information Commissioner to be appropriate for most processing performed by or for barristers. If you telephone the Information Commissioner’s office a draft will be sent to you. However, it is sensible to check that the draft meets your particular needs; it is your responsibility to ensure that the description accurately reflects the processing carried out by you or on your behalf.

What happens if the processing I carry out changes?

There is no charge for amending the notification. However, the amended notification must be made within 28 days of the start of the new processing.