Thanks to those who sent replies to my question:

"Suppose you are an organisation which is committed to protecting the
personal data you hold, but also recognises the reality that all systems
involving humans are fallible. Therefore you wish to also put in place
appropriate procedures for recovering should personal data be accidentally
disclosed. Are there any guidelines or best practices for such procedures?
I'm not thinking of "engage a PR consultant" here, but how should a
responsible data controller act in these circumstances?"

The replies I've received are below. I'm not sure I'm fully satisfied as a
result: we seem to be relying on "best efforts" at the moment rather than
"best practice". Maybe once we have finished implementing DPA1998 (only
joking!) this will get revisited.

All the best,
Andrew

======
         I think I read somewhere that the data subject about whom the
accidental disclosure was made should be informed.

         I note the Act states that data controllers should put in place
appropriate security measures  with regard to "the harm that might result
from unauthorised or unlawful processing or from accidental loss or
destruction and damge of the personal data."

         This suggests that you would know the consequences for the data
subject beforehand and not have to find out after the event!

======
  The big problem with the DPA is that it is administrative law. There are
  two difficulties with this.  First, is the problem of definitions.  It is
  easy to define a theft (either you were caught with the stolen car or you
  were not) but how do you define "fair processing"?  Further, there is no
  complementary case law to guide the practitioner.  Given this situation,
  you can only provide best practice guidance and hope you don't make a
  #@*&^$-up!

  However, lest that sounds too depressing, here are some practical points.

  1. Staff at the front end of services are the first to encounter problems.
  They must be trained in DPA practical applications and be aware that they
  must resolve any user problems immediately.  If they can, they will avoid
  many later issues with the member of the public.  Difficulties really
  occur when problems are missed.  So concentrate on them.

  2. Managers must have a positive attitude to the DPA and to information
  management.  This concept takes the DPA a stage further.  All
  organisations use data (manual and electronic) and it's planning,
  organisation, management and disposal are all part of information
  management.  If you manage your information well, you are unlikely to
  encounter DPA problems (and possibly HRA ones as well).

  3. You must have proper guidance in place.  This will be on two levels;
  high level management "directives" endorsed by your CX (or equivalent) and
  low level ones that are written in words of one syllable that provide
  something like a check list of points to remember.  (A public statement to
  your client group might also be an idea but beware of raising
  expectations.)

  4. Guidance is not the same a procedures and you must have these as well.
  There are obvious topics like what to do if you have a subject access
  request but you will need to look at your own operational requirements
  carefully to understand where you might need to provide line-by-line
  procedures.  (Information disposal is one that I'm pursuing here.) Here,
  there will probably be different procedures for different Departments as
  their operational needs may differ.

  Hope that helps.  At the end of the day, that memorable phrase "decent,
  legal, honest and truthful" is worth remembering.  I'm drumming this in to
  staff here.  It's not difficult to be "decent, honest & truthful" with the
  public (or what ever is your client group) and if do so while trying very
  hard with policies and procedures aimed at keeping you within the DPA
  rules, I don't think the Commissioner will be too displeased.  At worst
  you might get a wrap over the knuckles if somebody drops the proverbial
  clanger.

======
Not sure if I have read your e mail correctly.  Are you looking for advice
on disaster prevention and recovery.  Information falling under the 1998
Data Protection Act needs to be protected whatever the format be it film,
paper, or electronic.  BSI publish a book -

PD00113:199 Records Management - A Guide to Disaster Prevention and
Recovery.  The Temperatures and humidity need updating in line with the
UNESCO recommendations but the rest is OK
--------------------------------------------------------------
Andrew Cormack
Head of CERT
UKERNA, Atlas Centre, Chilton, Didcot, Oxon. OX11 0QS

Phone:  01235 822 302    E-mail: [log in to unmask]
Fax:    01235 822 398