Get ready for new Data Protection Act
The issue of Data Protection is one that market researchers have had to live with for many years, right from the introduction of the 1984 Act. It's very easy, therefore, to assume that the new 1998 Act is nothing to worry about. Unfortunately, life is just not that simple.
Historically, confidential survey research was treated as a special case under the 1984 legislation. This allowed the profession to develop and conduct research in line with the MRS Code of Practice. But how, with the new legislation, will market research be treated in what is a very different research landscape?
It seemed pointless to sit back and wait for the Office of Data Protection renamed the Office of the Information Commissioner (OIC) to pronounce. Instead, an industry wide task force MRS, AQR, BMRA, AURA developed a detailed document describing the specifics of our industry, laying out the issues and highlighting those areas thought suitable for discussion and clarification.
It was a pro-active approach, designed to aid in the interpretation of the legislation in a way that is pertinent to research, and as such was appreciated by the OIC. We agreed to prepare papers on processes, currently in development, for researchers to follow. In the meantime, there are some points that qualitative researchers and recruiters need to follow.
What do I do?
Qualitative researchers and recruiters do need to go through the process of 'Notification' replacing the process of 'Registration' with the OIC because they are likely to have electronically held personal data that identify individuals. If you were registered, you'll only have to 'Notify' when your registration expires. Organisations must Notify the OIC once a year. It costs £35 a year.
The main areas of difficulty arise when client lists are used for recruitment. The client then has the prime responsibility for ensuring that the Act's requirements are met in respect of the data supplied. Client lists can be used for confidential survey research providing the client has complied with the Act.
Once you merge any survey results with the personal data supplied by the client, however, you create a new database for which you assume responsibility, becoming the data controller. So, again, you must ensure you have complied with the Notification procedures.
Many of the Act's requirements replicate aspects of the Code of Conduct and are there to protect us all. There are, however, more rigorous procedures for consent for recording and release, focusing on the need for tighter security. The key to both Code and Act is the need to maintain transparency and confidentiality.
The MRS is currently preparing a Notification Guidance note and new Qualitative Research Guidelines will be available for consultation this summer. The main point is do not ignore this. Notify the OIC and encourage your recruiters to go though the Notification process. Finally, remind clients about the Act's requirements because ignorance is no defence in law.
Copyright © Association for Qualitative Research, 2001