A lot of modern archive material contains sensitive material or personal data. Such material is subject to the Data Protection Act.
Some material will not be available at all. Other material will be available in part, or subject to certain restrictions. Only a limited amount of information may be available in the catalogue, and the contents may need to be reviewed by an archivist to check if it can be made available.
Special Collections is authorised (under Section 33 of the Data Protection Act 1998) to retain and hold personal data in archival collections indefinitely, for research purposes.
Two conditions apply:
- Data is not processed to support measures or decisions with respect to particular individuals.
- Data is not processed in such a way that substantial damage or substantial distress is, or is likely to be caused to any data subject.
Researchers can use data from Special Collections material for the purposes of research, history, and statistics, but must adhere to the same conditions.
Assessment of material
Modern archival material is assessed to judge whether it can legally be made available to researchers.
When material is closed, a date for review is agreed and published in the catalogue.
When material is restricted but not completely closed, researchers should fill in an application for access to restricted material (DOCX) and state the nature of their research before the material can be made available.
Access to particularly sensitive may need to be discussed with the Head of Special Collections and will depend upon the purpose of use.
An application for access to restricted material may require further review before we can make a decision. This may take some time, depending on the size and nature of the material. Please don’t expect to access restricted material on the day it is requested.
Your responsibilities as a researcher
As a researcher, you are responsible for any personal data concerning living individuals that you take away from Special Collections (including any notes, digital images and/or photocopies). You become a "data controller" of the personal data held about the individual/s (the "data subject/s").
As a data controller you have certain responsibilities:
- You must not cause substantial damage or distress to data subjects.
- You must not use data to support measures or decisions concerning individuals.
- You must anonymise identities whenever possible when note-taking, in results of research and statistics.
- You must respect the confidentiality of any documents and information not connected with your research but which you have seen in the course of it.
In deciding whether it is appropriate to use or publish personal information consider:
- Is the person alive?
- Is the information already published or in the public domain?
- Is the individual a public figure?
- Does the information belong to a sensitive category of information as defined by the Data Protection Act?
- Could the context of the information disclose data about an individual by default?
You can find out more about the Data Protection Act on the Information Commissioner's website.