F.5 Legislation applicable to the gathering, storage, use and supply of archaeological information#

In recent years, a number of major pieces of legislation have been introduced which affect how HERs can gather, store, maintain and supply information. This legislation is predicated on two principles : that information held by central or local government should be made as widely available as possible but that personal information held by these authorities should remain closely controlled, and where necessary, confidential.

Three pieces of legislation are of particular relevance.

F.5.1 The Data Protection Act (1998)#

The Data Protection Act (HMSO 1998) is concerned with both manual and automated personal data. All automated data must already be compliant as must manual data added to existing systems since October 1998. Manual data processed before October 1998 is, however, exempt until 2007. 'Personal' data is defined as data relating to a living individual who can be identified from those data or by a combination of those data and other information held by the 'data controller' for example the local authority.

The Act identifies a number of principles that should govern use of personal data. These stipulate that people should know what information is being gathered, why, and what it is to be used for. It must be accurate, held no longer than necessary and must be stored securely. Before personal data can be processed (recording, holding or carrying out any operation on the information) the subject must give permission, the processing must be deemed (or demonstrated to be) necessary to carry out a legal or financial obligation or for 'the exercise of other functions of a public nature carried out in the public interest'. Extra provisions apply to 'sensitive personal data' – information relating to the racial/ethnic origin of the subject, political opinions, religious beliefs, trades union membership, physical or mental health, sexual life or criminal record. Processing of sensitive data requires either explicit consent or a legal basis from schedule 2 of the Act plus one from schedule 3.

Under the Act, individuals have a number of rights:

  • Right of subject access (that is to information about themselves). A request must be made in writing and there is a fee involved.
  • Right to prevent processing likely to cause damage/distress or for direct marketing purposes
  • Right to prevent automated decision-making
  • Right to compensation for contravention of the DPA
  • Right to enforce blocking, erasure or correction of incorrect data
  • Right to request an assessment of our service in terms of DPA

Contravention of any of these rights could lead to prosecution and the Data Commissioner has extensive powers to investigate and enforce the DPA.

Implications for HERs of the Data Protection Act#

In most HERs there is little personal information of any kind, particularly structured information. Within development control files, information submitted as part of a planning application remains in the public domain. Information submitted for other reasons, for example pre-application enquiries, which may not be in the public domain, is not exempt and so would have to be assessed for whether it meets the DPA principles or not.

Nevertheless, there are a number of precautionary actions that HERs may wish to carry out:

  • assess the extent of personal information in files for direct risk, that is stand-alone and indirect risk, that is, in combination with other information held by the organisation
  • remove redundant or unnecessary personal information
  • de-personalise information using organisation names where relevant
  • put a data protection clause in future specifications and contracts
  • put a data protection clause plus padlock symbol in questionnaires/forms
  • prepare checklist for handling personal data
  • establish a procedure for dealing with Subject Access Requests as such requests are time limited and clear procedures could help reduce delays.

F.5.2 The Freedom of Information Act (2000), The Freedom of Information (Scotland) Act 2002#

The Freedom of Information Acts (The Stationery Office 2000 and 2002) provide a general right of access to all types of information held by public authorities whilst permitting a number of exemptions from that right. They came fully into force on 1st January 2005.

Under the Acts, any person may make a request to the public authority for information and, unless the information is exempt, it must be supplied in a form of the applicant's choice. Even if the information is exempt, however, the authority must consider whether it is really in the public interest to withhold it and this spirit of accessibility is what underlies the Act. Public authorities are strongly encouraged to adopt a liberal approach to information and make it available unless limiting access is truly necessary.

The only exemptions likely to be relevant to HERs are:

  • information intended for future publication
  • information affecting commercial interests, which is exempt if its disclosure under the Act would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it)
  • information provided in confidence, if the disclosure of that information was actionable
  • environmental information (as this can be accessed via the Environmental Information Regulations (see F 5.3)

In addition to the exemptions, a Freedom of Information Act request does not have to be complied with if insufficient information is passed to the authority, if the enquirer has not paid the required fee, if the enquiry is vexatious or if the information has already been supplied. Moreover, if the supplying of the information requested would contravene the DPA, then it must not be complied with. The Data Protection Act takes precedence over the Freedom of Information Act.

The Acts are meant to work in tandem and complement each other. If a request is received under FOI for information which includes personal data then all that happens is that the personal data drops out of FOI via section 40 (FOI). The person making the request would have to be told to apply for this detail under the DPA, if it was their own personal data. If the personal data relates to third parties a release of information under FOI may be made, provided that the third party data is treated according to the principles of the DPA. In practice this is probably going to mean redaction. However, it may be possible to release some of this third party data un-redacted if that would serve the public interest more than the redacted version. To determine this it would be necessary to apply the FOI public interest test.

F.5.3 The Environmental Information Regulations (2004), The Environmental Information (Scotland) Regulations 2004#

Any request for environmental information held by a public authority or a body carrying out a public function is technically a Freedom of Information Act request in the first instance. Section 39 of the Freedom of Information Act then exempts environmental information from being dealt with under the Freedom of Information Act and stipulates that it should be dealt with under the Environmental Information Regulations 2004. (The Stationery Office 2004a and 2004b).

The provisions of the Regulations are similar to those for the Freedom of Information Act but comprise a slightly different set of rights and exemptions. In particular the draft Regulations permit the withholding of information where its release "would adversely affect the environment to which it relates".

Whether requests for historic environment information fall under the Freedom of Information Act or the Environmental Information Regulations will depend on how they are phrased and exactly what information is being sought. The Information Commissioner has stated that they could fall under either. As more cases occur this will become clearer.

The definition of Environmental Information is very wide and includes written, electronic, visual or audio information on:

  1. the state of the elements of the environment, for example air, atmosphere, water, soil, land, landscape and natural sites, biological diversity and its components, including genetically modified organisms;
  2. factors affecting the environment for example substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases;
  3. measures (including administrative measures) and activities affecting or designed to protect the environment for example policies, legislation, plans, programmes, environmental agreements;
  4. reports on the implementation of environmental legislation;
  5. cost-benefit and other economic analyses and assumptions used within the framework of environmental measures and activities;
  6. the state of human health and safety, including the contamination of the food chain, conditions of human life, cultural sites and built structures in as much as they are affected by the state of the environment, or factors, measures or activities affecting the environment.

The main points of the EIR are:

  • requests do not have to be made in writing, unlike under the Freedom of Information Act.
  • that information can only be withheld if the public interest in doing so clearly outweighs the public interest in disclosure
  • that enforcement powers are given to the Information Commissioner
  • that a 20 working day deadline is stipulated for responding to requests
  • that a schedule of fees be declared
  • that the rules apply not only to public authorities themselves but also to environmental information held by organisations under the control of a public authority, such as waste contractors
  • The applicant can request that the information be provided in a certain form or format (unlike FOI there are no restrictions as to the form that can be requested).
  • Charging will be different under the EIR, for example there is a cost limit in FOI unlike EIR.
  • The public interest test is applicable to all exceptions under the EIR (unlike FOI where some exemptions do not require the public interest to be considered).

The legal position in Scotland is broadly similar thought there may be slight differences in the wording of the legal instruments.

As with the FoI Act, the Environmental Information Regulations contain a number of exemptions. A public authority may refuse to disclose information if:

  • it does not hold that information when an applicant's request is received
  • the request for information is manifestly unreasonable
  • the request for information is formulated in too general a manner
  • the request relates to material which is still in the course of completion, to unfinished documents or to incomplete data
  • the request involves the disclosure of internal communications.

The public authority may also withhold the information if it would adversely affect:

  • international relations, defence, national security or public safety
  • the course of justice, the ability of a person to receive a fair trial or the ability of a public authority to conduct an inquiry of a criminal or disciplinary nature
  • intellectual property rights
  • the confidentiality of the proceedings of that or any other public authority where such confidentiality is provided by law
  • the confidentiality of commercial or industrial information where such confidentiality is provided by law to protect a legitimate economic interest
  • the interests of the person who provided the information where that person was not under, and could not have been put under, any legal obligation to supply it to that or any other public authority, did not supply it in circumstances such that that or any other public authority is entitled apart from these Regulations to disclose it; and has not consented to its disclosure
  • the protection of the environment to which the information relates.

F.5.4 Implications for HERs of Freedom of Information Act / Environmental Information Regulations#

Most HER information is freely available and so is unlikely to be the subject of a Freedom of Information Act/Environmental Information Regulations request. If a request for information is received, then although the exemptions may be invoked, the Commissioner's Office has said that they would still take a dim view of using them to systematically withhold information. In general, if a HER has an open access policy then no significant problems should be encountered.

Useful websites#

Information Commissioner's Office http://www.ico.gov.uk/

Scottish Information Commissioner http://www.itspublicknowledge.info/

For a useful explanation of the differences between the Freedom of Information Act and the Environmental Information Regulations: http://lawzone.thelawyer.com/cgi-bin/item.cgi?id=112586