Data protection guidance for readers

This page provides guidance on research access to personal data contained in archival records held in the National Archives of Scotland (NAS). It does not apply to personal data generated or collected by NAS in the course of its business activities. The NAS is responsible for the selection, preservation and provision of access to the public, legal and private records which constitute Scotland’s national archives. The NAS has a duty to ensure that the personal data contained within these historical records are fairly and lawfully used as specified by the Data Protection Act 1998 (the Act). The following guidance explains the responsibilities of researchers using such data in the course of their research at the NAS. It offers practical guidance only. It does not represent legal advice nor is it a substitute for it.

Access to personal data

Section 33 of the Act allows records containing the personal data of identifiable living individuals to be used for historical or statistical research purposes provided that:
• the data are not processed to support measures or decisions with respect to particular individuals
• the data are not processed in such a way that substantial damage or distress is, or is likely to be, caused to any data subject
The Act therefore permits researchers to use personal data accessed in the NAS search rooms provided they abide by these conditions and nos. 1, 3, 4, 6, 7 and 8 of the Data Protection Principles.

The Data Protection Principles
1. Personal data shall be processed fairly and lawfully
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under the Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures and adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Access to Sensitive Personal Data
The Act categorises the following types of personal data as sensitive, which are information as to:

• the racial or ethnic origin of the data subject
• his political opinions
• his religious beliefs or other beliefs of a similar nature
• whether he is a member of a trade union
• his physical or mental health or condition
• his sexual life
• the commission or alleged commission by him of any offence
• any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

The Data Protection (Processing of Sensitive Personal Data) Order 2000 provides the circumstances in which such sensitive personal data may be processed. Paragraph 9 allows processing for research purposes provided this:

• is in the substantial public interest
• is not used to support measures or decisions about an individual without their explicit consent
• does not cause, nor is likely to cause, substantial damage or distress to any person.

As a general rule, in order to protect the privacy of the individuals concerned, archival material of this nature is closed to public access for the lifetime of the individual. In some circumstances, however, the NAS will provide access to sensitive personal data in its collections for research purposes. If you wish to consult closed archival collections which contain sensitive personal data, you should complete an ‘Application to Consult Sensitive Personal Data’ form available from the search room supervisor. On receipt of the application, a judgement on access will be reached based on the sensitivity and nature of the personal data involved. The access assessment will be made by the NAS and, if possible, the record creator. If an application is rejected, a full summary of the decision will be sent to the applicant.

Your Responsibilities as a Researcher
As a researcher you are responsible for any personal data concerning living individuals that you collect in NAS whether in the form of notes taken or copies of records obtained. This includes any personal information you may come across in open records. When you take away information you become the data controller of this information and are liable for it and any subsequent use made of it. It is your responsibility under the Act, to ensure that the personal data which you have gained access to is used only for historical or statistical research.

• You must not use data to cause substantial damage or distress to data subjects.

• You must not use data to support measures or decisions concerning individuals.

• You should anonymise identities wherever possible. This is good practice when taking notes as it reduces the risk of subsequent unauthorised disclosure or misuse. Also data subjects have a right of access to their information so if you anonymise information it will not be open to subject access requests.

If you intend to publish personal information you should give consideration to the following:

• Whether the data subject is still living.

• Whether the information has already been published or placed in the public domain.

• Whether the individual is a public figure. If so the information is more likely to have already been made public.

• Whether it is in the public interest to publish. Section 32 allows the processing of personal data with a view to the publication of journalistic, literary and artistic material if you believe publication would be in the public interest. Determining what constitutes the public interest can be problematic, but the Information Commissioner has provided guidance.

• Whether the information is sensitive personal data. If so you may need to obtain the permission of the data subject prior to publication unless you anonymise the information. Processing must be in the substantial public interest.

• Redacting names may not always be sufficient to anonymise information. The context of the personal data can also reveal identity.

• The sensitivity of personal data diminishes over time.

Compliance and Unlawful Use
The NAS provides access to the personal data in its collections for research purposes and to meet statutory obligations under the Act. By signing the declaration at the bottom of the NAS reader’s ticket form you are undertaking to abide by the conditions of access and use as outlined in this fact sheet. You are, therefore, taking on responsibility for your own compliance with the Act in relation to any use by you of the personal data obtained from the archival materials made available by the NAS. Failure to abide by these terms will lead to the withdrawal of your reader’s ticket.

If you use the personal data which you have accessed at the NAS for any purposes other than historical and statistical research or publication of journalistic, literary or artistic material in the public interest, or you process this personal data to support measures or decisions about the subject of the data without their consent, you may be guilty of an offence under section 55(1) of the Act, and could be prosecuted.

Read more about the NAS Data Protection Policy

If you require further advice about how Data Protection applies in NAS please contact our Data Protection Officer directly using the contact details below:

Data Protection Officer
National Archives of Scotland
HM General Register House,
Edinburgh, EH1 3YY

Tel: 0131 535 1314

Email: dataprotection@nas.gov.uk