Preparing for re-opening

With lockdown restrictions being gradually lifted, Derbyshire Record Office begins operating a limited public service from today. This is the third time I have seen us in relaunch mode. 

• Relaunch 1: Towards the end of 2011, we closed our New Street site to everyone other than contractors in their yellow vests and hard hats, and upped sticks to a terrapin building in County Hall car park known as The Creche.  There, we supplied a restricted service for the duration of the extension and refurbishment project
• Relaunch 2: In early 2013, with the building project completed (on time and within budget!) we breathed a sigh of relief, went back to New Street, and flung the doors open again.
• Relaunch 3: 9 July 2020, and we are preparing to provide as much public service as COVID-19 conditions will safely permit.  As it was in the Creche era, the new service is a limited one.  If you want to make use of it, it is really important that you start by reading our website’s Visiting Us page.

One of the most noticeable changes is that, just like at the Creche, you will need to book your visit. Also, we are dividing the day into morning and afternoon sessions, so that we can close over lunch time to clean the public areas of the building.

On the subject of lunch: one of the most pleasing aspects of the 2013 relaunch was that for the first time we could offer you a break room, giving somewhere comfortable to sit, chat, have a hot drink and enjoy a packed lunch if you had brought one. Regrettably, we can’t offer this facility as part of the new restricted service, so the break room will stay locked for the time being.

In the days of the Creche, we had a pretty good idea how long the changes would need to stay in place, but that’s clearly not the case this time round.  However, we can at least promise you that we will cast off these irritating restrictions just as soon as we safely can.  In short, this won’t be forever.

Let me say a bit about records management.  One of the changes that has been forced on us is that we have to take down your contact details in case a fellow record office user should test positive for COVID-19, in which case NHS Test and Trace could ask us for the names of staff and visitors who were in the building at the same time as the infected person.

It’s not a nice thought.  However, it is a sensible precaution, and the latest government guidance urges services like ours to keep a visitor record, in just the same way that your local pub or hairdresser will be doing right now.

In practice, we already keep visitor records, so the challenge for me is to think about how we can adapt what we already do to fit in with the law, namely the Data Protection Act 2018 and the General Data Protection Regulation 2016 (GDPR).

Even something as simple as asking visitors their names and addresses in case we need to contact them counts as data processing, so we need to have one of the GDPR Article 6 lawful bases:

(a) Consent: sounds nice, but it won’t help in this case.  To use Consent as lawful basis, the data subject (that’s you) has to be able to refuse Consent yet still receive the service.  That’s not what we are saying in this case.  If you want to us to let you in the building, we are going to need your contact details.

(b) Contract: this is the basis we normally use, because your application for an Archives Card is effectively a contract with the Archives and Records Association (ARA) for the provision of archive services.  Your application for a temporary card, on the other hand, forms a contract with Derbyshire County Council.

(c) Legal obligation: no good unless there’s a specific law that requires us to gather your details.  The government has been passing emergency legislation during this crisis, but nothing so far that explicitly gives us a legal obligation to take visitor details.

(d) Vital interests: applies if the data processing is to protect someone’s life.  That will sometimes be the case, where this virus is concerned – but it’s an indirect threat, and the “vital interests” test sets a higher bar than that.

(e) Public task: thanks to the helpful advice of my legally-qualified council colleagues, this is the lawful basis of processing we will rely on, if we need to give the names of visitors to NHS Test and Trace.  Helping in this way would be performing a task in the public interest.

(f) Legitimate interests: I suppose this is the basis used by your hairdresser or publican for collecting your contact details.  It only applies if the processing is in your legitimate interests or the legitimate interests of a third party (so they wouldn’t be able to use it for marketing and suchlike).  It can’t be used by a public authority performing official tasks, which is why we are ignoring it in this case.

Whatever the lawful basis of processing, we are legally bound to tell you about it – so thanks for reading this far!  We have also updated the privacy notice for users of archive services and the Community Services privacy notice which also covers the libraries and museum.  Doubtless more updates will be needed, to explain how other council services have adapted their data processing activities to pandemic conditions – so keep an eye on the website if you (like me) have turned into a GDPR nerd!