Do UK Mental Health Professionals Need to Register (Notify) Under the Data Protection Act?

Within the mental health profession in the UK, there seems to be a widespread perception that practitioners are exempt from registering under the Data Protection Act 1998. To my mind, this seems like collective professional self-deception.

Notifying Under the Data Protection Act 1998

The UK’s Data Protection Act is intended to safeguard the handling of personal data using computers (and, in certain specific cases, the handling of personal data using manual filing systems). One of its primary requirements is that, with certain exemptions, those who process personal information using computers must notify the government that they are doing so. This is not an especially onerous task: the actual mechanics of notification under the DPA amount to little more than completing a set of forms and paying a small fee.

Yet, for some reason that I have never seen explained or justified, it has become ‘received wisdom’ within the UK mental health professions that practitioners (or, where appropriate, their parent organizations) are exempt from notifying under the act. Apparently, one or two ‘authorities’ within the profession have pronounced that it is unnecessary, and that is the end of it.

What the Law Really (?) Requires

Yet, the Information Commissioner’s Office provides a step-by-step self-assessment guide intended to help answer the question of whether you are exempt from notification, and question 4 of that guide specifically lists education, health administration and provision of health services, and pastoral care as examples of activities which are not exempt. To be fare, none of these actually says “mental health”, or “counselling”, or “psychotherapy” — but to my mind, this initial list of the types of activities which are not exempt offers the first clue that something is amiss when the authorities of the mental health world pronounce confidently on the question of exemption.

Moreover, if you read the actual Data Protection Act itself, you will discover that section 30 is dedicated to exemptions for ‘Health, education and social work’. There, you will find mental health explicitly mentioned as being eligible for a specific exemption from parts of the act — but not, apparently, from the requirement of notification. (It is only the ‘subject information provisions’ being addressed in this section, which are in turn defined in section 7 and paragraph 2 of Part II of Schedule 1.)

Try Online Counseling: Get Personally Matched

So, it seems, mental health work is exempt from some DPA requirements — but apparently not from the requirement to notify.

Law is Law

Of course, it is also worth pointing out that UK practitioners are still required to follow the law as set down by the Data Protection Act 1998, even if it should turn out that they are not required by the legislation to notify the government of their activities! In other words, exemption from notification does not equate to exemption from following the rest of the law.

Of Course I Could Be All Wrong

I am not a lawyer, and it is entirely possible that I have grossly misunderstood the whole issue and needn’t have bothered exercising myself about it!

But while not a lawyer, I’m also not entirely incapable of understanding English — and from what I have actually read of the law itself (not to mention the self-assessment guide), there is every indication that mental health professionals processing personal data using a computer are not exempt from notification. And I trust my own assessment of what I have read with my own eyes more than I trust unqualified assertions from ‘experts’ and ‘authorities’ who may claim that mental health professionals are exempt.

If you are a mental health professional in practice in the UK, and you process personal data using a computer, I urge you to read and judge for yourself.

• ethics
• in practice
• law enforcement
• security and privacy