Archiving disclosure response compatibility condition

In detail

• What is the archiving disclosure response compatibility condition?
• When is the archiving disclosure response compatibility condition likely to be appropriate?
• How do we decide what’s necessary for this compatibility condition?

What is the archiving disclosure response compatibility condition?

You may be asked to share personal information you hold with an archiving body. For example, if the information may have some future historical value, it may want to archive the information in the public interest. When you originally collected the information, you may not have expected to be asked to share it with an archiving body. In this case, sharing the information with the archiving body is for a new purpose.

If you originally collected information using the consent lawful basis, you are more restricted in when you can reuse it and when doing so is compatible with your original purpose. This is because people have only consented to you using their information for a specific purpose and not for other purposes they haven’t agreed to.

However, data protection law allows you to reuse personal information originally collected based on consent to share it in response to a request to archive it in the public interest. This reuse of information is considered compatible with your original purpose.

Annex 2 says:

“Disclosure for the purposes of archiving in the public interest

2.This condition is met where— 

(a) the processing— 

(i) is necessary for the purposes of making a disclosure of personal data to another person (“R”) in response to a request from R, and 
(ii) is carried out in accordance with Article 84B, 

(b) the controller in relation to the processing collected the personal data based on Article 6(1)(a) (data subject’s consent), 

(c) the request from R states that R intends to process the personal data only for the purposes of archiving in the public interest, and

(d) the controller reasonably believes that R will carry out that processing in accordance with generally recognised standards relevant to R’s archiving in the public interest.”

We call this the ‘archiving disclosure response compatibility condition’ (although this term is not used in the legislation itself). You must meet the requirements of this compatibility condition for your disclosure of personal information to be compatible with your original purpose.

You must share the personal information only for the purposes of archiving in the public interest. Archiving in the public interest ensures the permanent preservation and usability of records of enduring value for general public interest. The aim of archiving is to maintain information and provide long-term access to it for public use.
 
Article 84B of the UK GDPR sets out requirements for organisations using personal information for the purposes of research, archiving and statistical processing.

To meet the archiving disclosure response compatibility condition, you must reasonably believe the requesting organisation will use the information by following “generally recognised standards”. This means you must reasonably believe it will act in line with these standards. To be able to do this, you should be aware of what these standards are. The factors that may affect whether you reasonably believe the requesting organisation will comply with these standards include: 

• what the organisation tells you; and 
• what your relationship is with the organisation.

Remember, this compatibility condition is only relevant if you originally collected the information using the consent lawful basis. This means you must consider whether it is reasonable to ask for consent for the new processing. If this is not possible, you must identify another lawful basis before you reuse the information. 

You may also reuse personal information for archiving purposes in the public interest if you originally collected it using another lawful basis. This is considered compatible with your original purpose if you comply with the requirements in article 8A(3). (For more details, see 'What is a ‘compatible’ purpose?'.)

When is the archiving disclosure response compatibility condition likely to be appropriate?

Sharing personal information under the archiving disclosure response condition is only compatible if all its requirements are met. These requirements are that:

• another organisation asks you to share or disclose personal information;
• that organisation states in its request that it needs this information only for the purposes of archiving in the public interest;
• you originally collected the information under the consent lawful basis;
• you must reasonably believe the requesting organisation will act in line with generally recognised standards;
• your disclosure of the personal information is necessary to respond to their request; and
• the information must be handled in compliance with the requirements for processing for research, archiving and statistical processing purposes.

If these requirements aren’t met, it doesn’t mean you can never share personal information in this way. It just means you can’t use this compatibility condition for the reuse of the information.

An organisation making a valid request should do the following:

• Put it in writing (eg by email or post).
  The UK GDPR doesn’t specify the form of the request. But both you and the organisation making the request must be accountable and be able to demonstrate compliance with the law. As part of this, you should both have an effective audit trail of your data sharing activities. Remember, you must include details of any sharing of personal information in your record of processing activities. If a requesting organisation makes a verbal request to you, you should tell it to put the request in writing. 
• Specify what personal information it is asking for.
  A requesting organisation should explain what personal information it is asking you to share. If its request isn’t clear enough for you to identify the personal information required, you should ask it to provide more details.  

Remember, this compatibility condition is only about sharing personal information between you and the requesting organisation for the purposes of archiving. So, if the request asks you to do something else, you can’t rely on this compatibility condition.  

It’s your choice whether to share the personal information in response to the request. The UK GDPR doesn’t say you have to share it. This compatibility condition allows you to disclose personal information in compliance with the purpose limitation principle.

How do we decide what’s necessary for this compatibility condition?

The necessity test for this compatibility condition differs from most of the other conditions in annex 2. For archiving disclosure responses, it’s about what processing is necessary for you to share the personal information that the other organisation requests. 

The UK GDPR says the requesting organisation must tell you that it intends to only use this personal information for the purpose of archiving in the public interest. You can rely on that declaration. You don’t need to know or be able to demonstrate that the information has some potential enduring value. But you must reasonably believe that the requesting organisation follows generally recognised standards for archiving.

When deciding what personal information to share with the requesting organisation, you must not disclose more than it has requested. This links to the UK GDPR principle of data minimisation. You must only share the minimum amount of personal information needed to answer the request. If you share more information than is necessary, you are likely to breach the data minimisation principle.