The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

What is Manual Data and what is a Relevant Filing System

The definitions in the Acts read:

"manual data" means information that is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;

"relevant filing system" means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible;

The following are this Office's recommended tests / guidance that should be applied in determining if manual data is part of a "relevant filing system" and therefore subject to the Data Protection Acts 1988 & 2003.

(a) the personal data must be part of a set i.e. a regular filing system within a particular organisation which the organisation maintains for conducting its business. If the organisation maintains different Departments in different locations, the data subject should specify the subject matter and, if known to him/her, the department/office where he/she believes the file/data is located;

(b) the set must be structured by reference to individuals or by reference to criteria relating to individuals. If a file exists with a person's name or ID number on it this meets the criterion. If the file does not have a name on it but has sub-divisions with a name or ID, and the file title indicates that it contains personal data e.g. record of sick absences then this would also meet the criterion. If the file has a subject matter on its title, rather than a person's name, and it is known that the subject matter relates to individuals, then it meets the criterion - e.g. a file concerning a competition for promotion within a workplace;

(c) the data must be readily accessible. If files are archived and are not used for decision–making as part of the day to day operations of the organisation, and retrieval involves disproportionate effort (or perhaps even cost where a storage company is used), then the data could be said to be not readily accessible. In such a circumstance, the data subject would need to be able to identify particular data by file reference or date so that on a reasonable view of things the data could be said to be readily accessible;

(d) electronically created documents are usually stored on computer databases. Frequently such documents are copied on to manual files. If, in searching for electronically stored documents by reference to an individual, a data controller finds a reference number for a manual file, that manual file should be considered to form part of a relevant filing system.