We recognise the importance of the permanent preservation of archives for long-term public benefit by museums, galleries, archives and libraries. The General Data Protection Regulation (GDPR) and the Data Protection Bill permit such organisations to process personal data (including sensitive personal data) without consent, where necessary for “archiving purposes in the public interest”, subject to appropriate safeguards for the rights and freedoms of data subjects. It also exempts archiving services from complying with certain rights of data subjects (for example, rights to access, rectify or erase their data), where the exercise of such rights would seriously impair or prevent them from fulfilling their objectives.
‘Archiving in the public interest’ is a new term in data protection law. The Data Protection Act 1998 made no express reference to it and it is not defined in the GDPR, but Recital 158 to the GDPR may help to understand it. It says:
“Public authorities or public or private bodies that hold records of public interest should be services which, pursuant to Union or Member State law, have a legal obligation to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring public value for general public interest.”
This is likely to apply to a wide variety of community, private, public sector, charitable/trust and voluntary sector archives. It could also include archives that may be closed to researchers at the present time, but which would become accessible at some future date, and archives which are held in analogue or digital format. The definition would not, however, cover organisations which gather and use data, information and records purely for their own commercial gain or that have no enduring public value.
We recognise that concerns have been raised about the reference in the Recital to archiving organisations being under a ‘legal obligation’ to archive. While this may reflect the archival system in some other EU member states, it does not reflect the position in the UK. Many smaller archives, particularly in the private sector, are unlikely to have any statutory obligations to archive.
We do not think the best approach is to create new statutory duties requiring organisations to archive. This could force organisations to archive that had no intention or means of doing so. Instead, we want to reassure bona fide archiving services that they will be able to continue to process personal data for the purposes of archiving in the public interest, regardless of whether they have a statutory obligation to do so. The reasons for this are:
- Recitals act as explanatory notes to European regulations and have no direct legal effect. They may be taken into account by regulators and the courts when interpreting and applying the law, but they are not the law.
- In any event Recital 158 should be read in conjunction with Recital 41 which says that “where this regulation refers to a legal basis or legislative measure, this does not necessarily require a legislative act adopted by a parliament”, providing that such a legal basis is clear and precise and its application is foreseeable to persons subject to it.
- In the UK, most archives operate on a permissive basis under the general provisions of common law or statutory permissive powers, such as the British Library Act 1972 or the Local Government (Records) Act 1962. It may be open to organisations to rely on such a basis to satisfy the requirements of Recital 158.
- Where there are no clear permissive powers, organisations may still be able to point to funding agreements, management agreements or constitutional documents which set out the purposes of the archive, particularly if the failure to adhere to such purposes could have legal or quasi-legal effects, for example for a body’s charitable status. Although this may not amount to a statutory obligation to archive, it would give organisations a legal basis upon which to rely.
- Up until now, organisations responsible for archiving may have relied on exemptions from subject access rights under the ‘historical research’ provisions in section 33 of the Data Protection Act 1998. These provisions will continue in the new Data Protection Bill, and have not been abolished by GDPR. Most of the exemptions from data subjects’ rights in relation to archiving also exist in relation to historical research. If archiving services cannot confidently rely on the exemptions for archiving in the public interest, they may be able to rely on exemptions for historical research as an alternative. We recognise that there is some debate about this point within the sector because some archives may not exist for historical research purposes. In that case, a legal basis for archiving will be needed, but it does not need to be statutory.