Nurseries should resist the tactics of some unscrupulous private agencies regarding the Data Protection Act, warns Mary Evans
Confusion about whether and how early years settings need to register under the Data Protection Act 1988 has been made all the greater by commercial agencies targeting small businesses and offering to handle their registration for them - for a fee.
Some such agencies are also adopting scare tactics by reminding businesses that failure to register is a criminal offence, for which the current maximum fine is 5,000.
Brian Griffiths, who with his wife Joan runs Burton Latimer Day Nursery near Kettering, Northamptonshire, is just one of the nursery owners to be have been targeted.
He explains, 'I received a letter from one of them and I had to read it twice before I realised that it didn't come from the Information Commissioner [formerly known as the Data Protection Registrar].
'From the whole way the letter is set out and the way it is written ,you would believe it came from a Government department unless you were clued up. 'What they are doing is gathering information to register on behalf of people and taking a big fee for doing so, when you can do it for yourself.'
Notification process
In fact, such agencies need have no part in the 'notification' (registration) process. Instead, 'data controllers' (businesses, organisations, etc holding personal data) should apply directly to the Information Commissioner. The process can be done online or by post.
Information commissioner Elizabeth France says, 'I advise data controllers to ignore any approach made by these businesses, who appear to be charging up to 95 plus VAT for notification. Other than paying the annual statutory notification fee of 35, on which no VAT is payable, there is no charge made by this office to any data controller wishing to notify.'
The agency that wrote to Mr Griffiths, Data Protection Agency Registration Services Ltd, of Kirkby, Merseyside, charges a total of 117.25 made up of the 35 notification fee and a further 70 plus VAT for its services. It is one of seven companies named by the Information Commissioner on the website www.dpr.gov.ukwith the introduction: 'Warning. Do not be misled.'
Notification
It is the role of the Information Commissioner to maintain a public register of data controllers, listing their names and operational addresses and giving a general description of the personal data that they are processing. So which early years settings need to register?
The Data Protection Act 1988, which came into force in March 2000 and supersedes the 1984 Data Protection Act, requires every data controller who is processing personal data to notify - unless they are exempt.
Exemptions are possible for:
- some not-for-profit organisations
- processing personal data for any or all of the following purposes in relation to your business:
- staff administration, including your payroll
- advertising, marketing and public relations
- accounts and records
- manually held records.
Early years settings that keep computerised data on the children in their care, including, for example, health details listing food allergies or family information, do have to notify, as do settings with CCTV.
Schools are also required to notify. Previously, under the 1984 Data Protection Act, schools were obliged to submit two entries, one covering the head teacher and the other for the governing body. The 1988 Act rationalised this and when these notifications, which run for three years, expire, schools will only be required to make one annual renewal entry.
Claire Schofield, communications manager of the National Day Nurseries Association, says, 'Our advice on data protection is that nurseries who keep data about children and parents on a computer/computers and are profit-making enterprises should notify.
'Those nurseries that keep data about children and parents on a computer/computers and are not-for-profit enterprises probably do not need to notify. However, we would advise that they contact the Office of the Information Commissioner to confirm this.'
The Information Commissioner's office runs a helpline and experienced advisers can talk to childcare providers to determine whether they need to notify and to help them complete the necessary forms. There is also a self-assessment guide, available via the internet, which organisations can work through to establish whether they need to notify (see Further Information).
Compliance
However, all early years settings, including not-for-profit settings and those holding only paper records, must comply with the provisions of the Data Protection Act - even if they are exempt from notification.
Here, settings must comply with the eight Data Protection Principles, which require that data is:
- fairly and lawfully processed
- processed for limited purposes
- adequate, relevant and not excessive
- accurate
- not kept longer than necessary
- processed in accordance with the data subjects' rights
- secure
- not transferred to countries outside the EEA without adequate protection. (See Further Information.)
Access
Data Protection legislation allows individuals to find out what information is held about themselves on computer and some paper records, such as school pupil records. This is known as the right of subject access, and any early years setting receiving such a request would have to respond promptly. The law further allows individuals to apply to the courts to order a data controller to rectify, block, erase or destroy personal details if they are inaccurate or if they contain expressions of opinion which are based on inaccurate data. The courts may also award compensation for any damage that the individual has suffered and any associated distress as a result of inaccurate personal data held on them.
Complaint
As for the rogue agencies, the Information Commissioner's office is exploring what action can be taken against them. It suggests that settings wishing to complain about such companies should contact their local Trading Standards Office.
The National Day Nurseries Association is also aware of the problem and will be sending members an update on Data Protection this month.
The agencies are still in operation. When Nursery World phoned Data Protection Agency Registration Services Ltd about its business, a spokesman said only, 'No comment.' and hung up.
