Consultancy brief: Developing Generally Recognised Standards for the data protection purpose “archiving purposes in the public interest”

12 May

Following the introduction of the Data (Use and Access) Bill into the UK Parliament the Archives and Records Association noted the requirement to agree “generally recognised standards” relating to the data protection purpose “archiving purposes in the public interest”. The ARA supports the need for the generally recognised standards to be agreed.

Together with other sector bodies the ARA has agreed to commission a specialist consultant to draft the generally recognised standards with the support of data protection specialists from the archive and records management sector. The proposal involves the sector and leading sector organisations to ensure that the resulting standards are adopted across the sector without objection.

Please find the tender information below and attached here as a pdf and we invite you to put in a proposal. Please contact John Chambers at john.chambers@archives.org.uk for any further information.

Consultancy brief

Developing Generally Recognised Standards for the data protection purpose “archiving purposes in the public interest”.

Introduction – Archives and Records Association (ARA)

The ARA is the professional and membership organisation for archivists, records managers and archive conservators in the UK and Republic of Ireland. The ARA is independent of government. The ARA aims to support its membership through training, continuous professional development, professional help and advice, and by providing a community to which the membership can belong and from which they draw benefit through open discussion and debate, as well as through gathering of information and advice.

Our strategic aims and further information about ARA is available in full on our website www.archives.org.uk

Following the introduction of the Data (Use and Access) Bill into the UK Parliament the ARA noted the requirement to agree “generally recognised standards” relating to the data protection purpose “archiving purposes in the public interest”. The ARA supports the need for the generally recognised standards to be agreed. It believes archive and record services should be transparent and follow clear principles.

Context

The following partner organisations have all agreed with this proposal:

The National Archives
National Records of Scotland
Public Record Office of Northern Ireland
Welsh Government Department for Museums, Archives and Libraries Information and Records Management Society
Business Archives Council Scottish Council on Archives
Archives and Records Council Wales British Records Association

As well as the ARA these organisations represent the archives and records management sector in the UK, both individuals and organisations.

The Information Commissioner’s Office has confirmed its support and will be involved as a consultee.

This tender is to seek a consultant(s) to draft what will become the generally recognised standards. The organisations listed above will provide input via nominated archivists and records managers with detailed and practical knowledge of data protection and archives and records. These representatives will be available for guidance and comment at the start of the project, at the interim report stage and at the final report stage.

Aims and Objectives

The appointed contractor will develop the generally recognised standards

and will address the requirements set out in the Annex to this Commission.

Key sources of information

The bill and its progress through parliament can be found here: https://bills.parliament.uk/bills/3825

Current sources of guidance include:

https://publications.parliament.uk/pa/bills/cbill/58- 03/0314/amend/datapro_day_rep_1129.pdf

See page 152 here for the amended archiving in the public interest definition as below:

Secretary Michelle Donelan _Gov_208 Schedule 2, page 145, line 20, at end insert— “Disclosure for the purposes of archiving in the public interest 1A. This condition is met where— (a) the processing— (i) is necessary for the purposes of making a disclosure of personal data to another person (“R”) in response to a request from R, and (ii) is carried out in accordance with Article 84B, (b) the controller in relation to the processing collected the personal data based on Article 6(1)(a) (data subject’s consent), (c) the request from R states that R intends to process the personal data only for the purposes of archiving in the public interest, and (d) the controller reasonably believes that R will carry out that processing in accordance with generally recognised standards relevant to R’s archiving in the public interest.” Member's explanatory statement This amendment enables certain further processing of personal data, for the purposes of archiving in the public interest, where the original processing was based on consent of the data subject.

And also see

https://hansard.parliament.uk/commons/2023-11-29/debates/46EF0AA6- C729-4751-A3DA-6A3683EB8B87/DataProtectionAndDigitalInformationBill

‘On disclosure for the purposes of archiving in the public interest, the Government recognise the importance of archives in permanently preserving Britain’s rich history for long-term social benefit. We also know that archivists currently have very little agency to dictate what lawful ground was used when obtaining personal data from a wide range of sources. We are therefore amending the Bill to ensure that a controller is able to reuse personal data for the purpose of archiving in the public interest, regardless of the lawful ground the personal data was originally collected on. That will be particularly helpful for archivists that are not public authorities and are therefore unable to use a public task lawful ground for their processing. We have worked closely with the National Archives in bringing forward our amendment.’ (Hansard, 29 November 2023 column 875)

Guide to Archiving Personal Data https://cdn.nationalarchives.gov.uk/documents/information- management/guide-to-archiving-personal-data.pdf

Methodology

Please tell us in your proposal what your methodology will be including research methods and how any working/steering group will be involved in the work.

Product

The generally recognised standards should be provided as a MS Word document which will be converted to both a PDF and html format for dissemination. All copyright and IP will belong to the ARA. The standards will be published and made freely available under a CC BY-NC-ND (Attribution- Non-Commercial-No Derivatives) license, which allows others to copy and distribute the material in any medium or format in unadapted form only, but only for non-commercial purposes.

Costs

Please provide an indicative budget, stating inclusive or net of VAT.

Timetable

Please include a project timetable with key milestones in your proposal.

Liability Insurance

Please include a copy of your professional liability cover with the proposal.

Contractor Personnel

Please include in your proposal details of who would be working on the project with a clear indication of who will be leading.

Monitoring

This project will be managed by John Chambers, Chief Executive of the ARA.

Quotations and timings

Completed proposals should be sent by e-mail to John Chambers, Chief Executive, Archives and Records Association, john.chambers@archives.org.uk by 12pm on Friday 27th June 2025.

For an informal discussion contact: John Chambers

ANNEX

This annex describes the aims and objectives of this Commission, and particularly the resources to be provided in the generally recognised standards which it is to develop.

Background

Current standards, advice and guidance on data protection for the archive sector focus on the processing under the Data Protection legislation of personal data of living individuals found in the archival collections of institutions and on how archive professionals should respond to data access requests from data subjects and from third parties.

The existing guidance does not cover the processing of personal data where it is passed from a data controller into the custody of an archive service.

Data controllers must be certain that they have the legal ability to pass the personal data into the custody of an archive service. Archive managers should be certain of the legal route to enable them to accept and accession new record collections containing personal data.

The Data (Use and Access) Bill currently before Parliament protects the ability of archives to preserve personal data originally obtained with the consent of the data subject, where they are archiving in the public interest. The Bill however requires archives receiving such personal data to act in accordance with ‘generally recognised standards’ to enable the data controller to transfer (or disclose) the records into the custody of an archive.

What is the change proposed in the Bill?

The Bill includes a clause in Schedule 5 setting out a purpose limitation to enable disclosure by a data controller to an archive (that is archiving in the public interest) of personal data originally obtained under consent. It reads as follows:

Disclosure for the purposes of archiving in the public interest

2. This condition is met where—

(a) the processing—

(i) is necessary for the purposes of making a disclosure of personal data to another person (“R”) in response to a request from R, and

(ii) is carried out in accordance with Article 84B,

(b) the controller in relation to the processing collected the personal data based on Article 6(1)(a) (data subject’s consent),

(c) the request from R states that R intends to process the personal data only for the purposes of archiving in the public interest, and

(d) the controller reasonably believes that R will carry out that processing in accordance with generally recognised standards relevant to R’s archiving in the public interest.

It is the provision of these generally recognised standards which is the purpose of this Commission.

The standards are not specified in the Bill, allowing flexibility to the sector in how it meets this condition. The exemption provides a lawful route for a data controller to pass personal information obtained under data subject consent to an archive which has asked for it, which is archiving in the public interest and which is following the generally recognised standards.

The new standards should:

establish standards for the archival processing of personal data obtained under consent in the course of acquiring, transferring and accessioning the personal data (i.e. archival processing before the personal data becomes part of the archive’s collection), including reference to the requirement to carry out processing in accordance with GDPR Article 84B.
reference (but not re-write) existing guidance on the handling of personal data in archive collections, and set out new standards where gaps in current guidance are found, to enable archives to demonstrate that they are following the generally recognised standards in archiving.
describe the documentation needed by an archive to demonstrate, if challenged, that it is complying with the generally recognised standards.
set out and explain the legal routes by which archives can acquire personal data obtained under consent:
- For the independent archive sector this will be using the new Schedule 5 process, including the standards to be followed on acquiring the new archive material.
- For archives with a statutory role this will usually be GDPR Article 6(1)(e), where processing is necessary for the “performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”
- For clarity, the standard should also explain the legal routes available to archives where personal data was not obtained under consent, (which will usually be by GDPR Article 6(1)(e) for public sector archives, and by GDPR Article 6(1)(f) for independent archives), as well as the additional requirements for appropriate safeguards in GDPR Article 6(4)(e).
describe the standards to be followed where the data to be passed into an archive’s custody was not obtained under consent, or where the data subjects did consent to archiving, in as far as they may be different to the standards required for the Schedule 5 process.
describe the standards to be followed by a public sector archive in as far as they are different to the standards required for the Schedule 5 process (public sector archives will usually be acquiring personal data obtained under consent on the basis of a statutory basis under GDPR Article 6(1), usually article 6(1)(e). In such cases the data controller will still require a legal route to enable the personal data to be disclosed to an archive, so the Schedule 5 process may still be required.
set out that an archive which does not have a statutory remit, or is not archiving in the public interest, does not have a legal route to acquire personal data obtained under consent from another data controller, and describe the steps needed to be taken by such an archive to enable it to take advantage of the Schedule 5 process.
Refer to existing published guidance documents which describe factors that indicate that an archive may, or may not, be archiving in the public interest. This will enable archives, and data controllers who are considering passing personal data to an archive, to judge whether an archive is archiving in the public interest.

Tender

Deborah Mason