 |
 |
"Let us put the proposition that 'personal data' is the entire set of data held by the data controller which 'relates' to the individual concerned, even though some of it does not aid identification of the individual."
-------- Original Message --------
| Subject: | Re: Exam scripts - Personal Data Exempt - Marks Not |
|---|---|
| Date: | Tue, 05 Oct 1999 13:48:44 +0100 |
| From: | [log in to unmask] |
| To: | "Street, Terry" <[log in to unmask]> |
| CC: | [log in to unmask] |
| BCC: | [log in to unmask] |
| References: | <86FBC86D0511D21189B500805FD74AFA53D73E@CVTE203E> |
Please do highlight the FOI amendments concerned. If unstructured data is covered there is a related issue. Also, what 'personal data' includes will remain relevant to others.
The flaw in the argument regarding comments on scripts must lie in trying to separate the data that 'relates' to an individual into;-
Instead of breaking up the data into discrete elements of 'personal' and other 'data', let us do the opposite.
Let us put the proposition that 'personal data' is the entire set of data held by the data controller which 'relates' to the individual concerned, even though it does not aid identification of the individual.
This begs another question. What criteria should be used to decide what limit is to be put on the set of data which 'relates' to the individual under the DPA 98. Is there no limit?
A judge may well take a pragmatic view on a case by case basis, but a data controller has to plan for all potential cases.
For example, the following may be items on a database: '51 No Through
Road, Oldham is a magnificent road' and 'Fred Jones, 51 No Through Road,
Oldham'. Is the first statement to be considered part of the data
set which relates to 'Fred Jones'?
"Street, Terry" wrote:
I note that in the current FOI bill all public bodies have the coverage of--
Data Protection extended to "unstructured" data too.
(unstructured = not forming part of a set of structured information)
I'm not sure if universities are treated as public bodies for this piece of
legislation but if so it might make some of this debate academic.I can highlight FOI amendments if you need details.
Terry Street
Terry Street Acting ALM Coventry
Strategic Support Manager, Siemens Business Services Coventry, 2nd Floor
Waters Court, Salt Lane, Coventry, CV1 2GX
note these new codes (024) and numbers 76xx xxxx become fully effective from
April 2000 in the interim you need to dial the full code even if making a
local call.
Tel. 024 76 831160 Mobile 0385 916060 fax. 024 76 831050
home 024 76 417574 Email [log in to unmask]
This message contains information which is confidential and may also be
privileged. It is for the exclusive use of the addressee/s. If you are not
the addressee, please note that any distribution, copying or use of this
message and the information is prohibited. If you receive this communication
in error, please advise the sender and delete it immediately.
The information on costs and charges is provided for indicative purposes
only and does not constitute an offer capable of acceptance. The views
expressed are those of the Author and do not represent the Company.> -----Original Message-----
> From: [log in to unmask]
> [SMTP:[log in to unmask]]
> Sent: Monday, October 04, 1999 4:59 PM
> To: Charles Oppenheim
> Cc: [log in to unmask]
> Subject: Re: Exam scripts - Personal Data Exempt - Marks Not
>
>
>
> Charles Oppenheim wrote:
>
> I don't understand this argument. The student is identifiable because on
> the front of the exam paper is his/her name or some other method of
> identifying him/her such as a registration number. A set of exam scripts
> form a database that is searchable by student name. So, the student is
> certainly identifiable from other data in the data controller's posession.
>
> Ergo, the examination comments are personal data. To argue that "because
>
> the comments *on their own* do not allow the student to be identified
> means
> the comments are not personal data" seems nonsensical to me. Or am I
> missing something here?
>
> Professor Charles Oppenheim
> Dept of Information Science
> Loughborough University
> Loughborough
> Leics LE11 3TU
>
> Tel 01509-223065
> Fax 01509-223053
>
>
> If the definition of 'personal data' is interpreted strictly, for the
> comment to qualify as 'personal data' the student must be identifiable
> from the comment and other data in the data controller's possession.
>
> The definition is conjunctive. It uses 'and', not 'or'.
>
> Your argument is that the student is identifiable because on the front of
> the exam paper is his/her name or some other method of identifying him/her
> such as a registration number.
>
> If you use that information you are not using the comment at all to
> identify the individual.
>
> If the definition said the individual had to be identifiable 'from that
> data or other data', the position would be different.
>
> Assume the comment is 'Good analysis'. Assuming that comment can be
> considered to 'relate' to the individual, it still does not help identify
> an individual.
>
> It also does not aid identification even when combined with other
> information which does, such as the information on the front of the exam
> paper.
>
> I agree the argument does seem strange. Part of the answer must be to
> read the 'and' as not exclusively conjunctive, but as meaning 'and/or'.
>
> Additionally, perhaps it is not valid to attempt to break up the data into
> discrete blocks and attempt to decide which data qualify under the DPA 98
> as 'personal' and which do not.
>
> Both these latter approaches have the disadvantage for the data controller
> (and advantage for the data subject) of making a wider data set fall
> within the definition of 'personal data'. They are also a matter of
> construction and interpretation as the DPA 98 does not contain a complete
> answer.
From:
Clifford G. Miller
CLIFFORD MILLER
Coborn House
Coborn Road
London E3 2DA
England
http://www.millercompany.demon.co.uk
Tel: + 44 181 983 6688
Fax: + 44 181 983 6699