This is another addition to the now‐familiar Aslib Know‐how guides series. These pocket‐sized paperbacks cover “issues of current interest or concern to those working or teaching in the field of library and information services”.
The author, now an independent information systems consultant, has been involved with data protection issues since the 1984 act was published.
There are longer and bigger books than this about the provisions of the Data Protection Act 1998. A short bibliography gives details of some of these. This book does not contain the text of the Act, as is often the case with books which explain laws. This is not a criticism. Most people who are looking to get an understanding of data protection law will have no need to see the original document. Besides, we are information professionals – we know where to find a copy of an Act if we want one. Other books, too, allocate a larger amount of space to considerations of, for example, data protection in the telecommunications sector or for those who are involved in transferring data across borders.
As you would expect, having read the title, the book is about the rights of individuals in respect of the information which you hold, and the responsibilities of the organisation to keep their data secure, accurate, only for as long as it is needed, and to use it only for reasonable purposes. It gives a good indication of what it is that you have to do; what you are allowed to do; and has examples of circumstances when you might choose to ask for an expert opinion.
Like myself, most people who read this book will not be data protection compliance officers or data controllers. That is to say that the ultimate responsibility for their organisation’s compliance with the terms of the Act will rest with someone else. I am quite pleased that this is not my job, as it means that I am not the one who has to pick up on enquiries such as “Can we pass brief data to another organisation, so that their computer recognises that our users should be allowed into their premises?” or “We have CCTV recordings made for security purposes. Are there data protection implications which we should be aware of?” Both of these are topics which have cropped up for discussion locally in the recent past. However, having read this book I have good idea of the answers.
The layout of the book is clear, and the font is large enough to read without your glasses. The author has avoided jargon, and there is hardly an abbreviation in the book, which is almost unheard of in something which has the words “information services” in the title. The information is broken up into bite‐sized chunks, which makes it easier to digest when you are in a hurry. The method of explaining through examples the principles just discussed makes it even easier.
It was a pleasant surprise to discover an index which stretches to a respectable ten pages. I say “surprise”, as it is easy enough to find your way around the book via the excellent contents pages, or even by just flicking through and checking the page headings. It is probable, too, that the reader will want to see a whole section in order to have their point of interest in context.
Not being responsible for data protection compliance, and never finding myself with idle hands, I had managed to learn almost nothing about the 1998 Act. Awareness of some of the issues had crept up on me, and I knew a bit about the 1984 Act. However, there are advantages in agreeing to produce a review for Program: I had to read the book. I confess that this was the first whole book on an information systems topic that I had read since the last one I reviewed. Reading it was not a hardship – it is well written; it is not so long that the subject has time to become boring; and it has already proved useful.
