While this standardising of data protection law originates from the European Community, it will, unusually in present circumstances, remain Brexit-proof. It represents an updating, or ‘housekeeping’ approach, rather than root-and-branch wholesale reform of data protection. However, there are some significant tweaks, which will need to be borne in mind by practitioners and agencies (Jenkins, 2018).

Data protection has been governed in the United Kingdom by the Data Protection Act (DPA) 1998, and in Ireland by the similar 2003 Act. While the GDPR sets out the broad guidelines and requirements to be followed, the current UK Data Protection Bill will make further changes. These will largely apply to specialist fields, such as law enforcement and national security, although the final format of the Bill, as the Data Protection Act 2018, cannot be known precisely at this stage.

Changes from DPA 1998: 

Key definitions remain largely unaltered under the GDPR. Hence, a ‘data controller’ “says how and why personal data and the [data: PJ] processor acts on the controller’s behalf” (ICO, 2017: 3).  Personal data includes all information about an identifiable living individual, with the definition now slightly expanded to include more recent potential identifiers, such as a PC or laptop IP address, or biometric data, such as eye or face recognition data. The formal legal basis for processing personal data remain largely unchanged, but the key change does relate to the legal basis likely to be used by most therapists and agencies for such processing and recording, namely that of consent. The major change here from the DPA 1998 is to raise the threshold for processing clients’ personal data from that of ‘consent’, to the higher standard of ‘explicit consent’, namely “a freely given, specific, informed and unambiguous indication of the person’s wishes” (ICO, 2017: 10). Explicit consent was previously only required for processing client personal data in specific sensitive areas, such as their mental, physical or sexual health, but is now generalised to become to the new standard applicable to any such processing. What was previously termed ‘sensitive personal data’, such as ethnicity, mental, physical or sexual health, is now categorised in terms of ‘special categories of personal data’. The Information Commissioner’s Office (ICO) does caution about automatically assuming the need to ‘repaper’ or refresh all existing DPA client consent forms, in order to comply with this higher standard of explicit consent. However, it does require evidence that the higher standard is in operation from May 2018, so one option would clearly be to update existing client consent forms, in order to ensure compliance with best practice regarding the GDPR.

One of the major changes introduced by the previous DPA 1998 was to extend data governance from computer files to manual, or handwritten, files. This became an increasingly complex field in terms of data protection law, dependent upon the status of records as health, education or social work files, or their compliance with ‘relevant filing systems’, following the court judgment in the Durant case of 2003. While the exact implications for data governance of manual records are unclear, it seems likely that the GDPR will embrace wider sets of manual records then before. This could include manual records held in filing systems, which are organized simply in chronological order, rather than meeting the higher threshold of constituting part of a more sophisticated ‘relevant filing system’.  Chronologically ordered manual records would therefore be likely to include a basic client record system of handwritten notes kept by a therapist for client work, on a sequentially dated weekly or monthly basis.

Changes regarding client access:

Other major changes signaled by the GDPR include the easing of client (‘data subject’) access to electronic and manual files, normally within one month of making the request, with the removal of the standard £10 charge to the client for accessing their personal data. Clients will enjoy greater rights for compensation for damage or distress caused by inaccurate recording – the courts have been moving independently in this direction in any case, since a recent Appeal Court judgment against Google in 2015. Issues of client access to records and resulting potential damage or distress call into question the format and content of therapeutic recording. This is often learned on training placement and then adapted to personal or agency preference, rather than being based on more of a standardised model, as is common in other professions, such as medicine, nursing and social work. Research suggests that the DPA 1998 brought about a significant shift in therapeutic recording, towards briefer, more factual recording, with much less reliance on subjective process recording by the therapist (Jenkins and Potter, 2007). Jenkins suggests a flexible template for therapy recording, which could be adapted to suit a range of needs and contexts (Jenkins, 2017).

Much of the recent GDPR publicity has tended to highlight provision for a higher level of fines and penalties for non-compliance or breach of data protection law, which can rise to 4% of global turnover in the case of larger companies. However, in practice, the ICO tends to take much more of an educative, rather than a punitive, role in encouraging data protection compliance, making it clear that it does not benefit financially from fines levied as a source of income.

Implications for practice: Fees:

Somewhat curiously, individuals and agencies are no longer required to register with, or ‘notify’ the ICO regarding their data processing activities. However, they are still required to pay a fee for data processing, under s.108, of the Digital Economy Act 2017. There will be a simple self-assessment guide to whether or not a fee is required via the ICO website, broadly similar to the previous one for eligibility for registering with the ICO (www.ico.gov.uk). Existing ICO fees will carry over until the new fee system becomes operational. As opposed to the existing dual flat rate for notification under the DPA 1998 of £35 for individuals or small employers, and £500 for agencies with 250 or more staff, there will be a new, tiered system of fees. With effect from 2018, Tier 1 fees will increase to £40, Tier 2 to £60 and Tier 3 to £2,900

Fee Structure under GDPR from May 2018