The Regulations contain provisions relating to directories of subscribers to publicly available electronic communications services, which are made available to the public or to a section of the public. We interpret this to mean any directory whose sole or main function is to list the phone, fax or email contact details of network subscribers, where this information can be obtained by any person who has a minimum amount of information (such as name and approximate address). We take the view that the Regulations do not apply to other forms of directory (for example trade directories) where electronic communications are not the sole or main part. This means the Regulations cover only directories of the electronic contact details of residential and business subscribers.
It has been suggested that the Regulations about directories may cover a WHOIS ‘lookup’ service. From the description above, it is difficult to see that they will do so, as the main purpose of WHOIS is to give the searcher information about the identity of the person who operates a website (a person who may well not be party to a contract with the WHOIS provider). For now, the Commissioner intends to interpret Regulation 18 as applying only to directories of phone numbers (including mobile phone numbers), fax numbers and email addresses.
The Regulations make it clear that these directories may be in printed or electronic form or may be those relied on by a directory enquiry service, for example the ‘118’ services. The provisions do not apply to any edition of a directory first published before 11 December 2003.
Individual subscribers
The personal data of an individual subscriber must not be included in a directory unless that subscriber has, free of charge, been:
- informed of the directory’s purposes by the collector of the personal data; and
- given the opportunity to decide whether the personal data that the directory producer considers relevant should be included in the directory.
The first requirement outlined above is in line with the fair processing requirements of the Data Protection Act. The first data protection principle requires the data controller to be transparent about what they want to use the data for, any intended disclosures to third parties, and any further information that is necessary, taking into account the specific circumstances of the processing so that it is fair.
To meet the transparency requirements, those collecting information from subscribers that is to be made available in public directories will need to ensure subscribers understand that:
- their information will be made available through various directory products and services, and
- this will enable those who know their name and address to get their phone number.
Where there are a range of ex-directory options, the subscriber should be told about all of them. So subscribers should understand the consequences of choosing particular directory options. Although subscribers must be given the opportunity to choose whether or not they are included in a directory, the Regulations do not specify whether subscribers should be required to positively ‘opt in’ to such inclusion or whether it would be enough for them to ‘opt out’. In the Commissioner’s view, it is reasonable for inclusion in a directory to be the default position, provided:
- subscribers are made fully aware that this is so; and
- it is simple and straightforward for them to opt out, if they choose.
In line with the second requirement listed above, there is an established competitive market in telephone directory information services and products. So, in the interests of practicality, the producer of a directory can decide the personal data they think is relevant to include in their directory. In other words, there should be a core list of the minimum information reasonably needed to run a directory service efficiently. But the Commissioner’s view is that the more the data included in a directory differs from that traditionally published in such products, the more information the directory producer is likely to have to provide to the data subject to ensure the processing of that data is fair.
If the data of an individual subscriber has been included in a directory, that subscriber may verify, correct or withdraw that data free of charge at any time. Amendments as a result of a withdrawal or correction request will apply only to editions of a directory produced after the directory producer has received that request.
Reverse searching
Directory information should only be made available in line with subscribers’ wishes and expectations. Generating a name or address (or both) from a phone or fax number (reverse searching) has not traditionally been offered in the UK and is not what subscribers generally expect. So the Regulations prohibit reverse searching unless the subscriber has given their prior informed consent. This requirement was originally set out in the 1998 Code of Practice on Telecommunications Directory Information Covering the Fair Processing of Personal Data.
The idea of reverse searching may not be fully and generally understood, so additional specific consent must be obtained from subscribers agreeing to allow their information to be made available on this basis. It will not be enough for this consent to be combined with various other terms and conditions, which someone might agree to without fully appreciating the consequences.
Corporate subscribers
The Regulations do not give corporate subscribers the full range of rights available to individual subscribers, although a corporate subscriber may ask for their number to be excluded from the directory if they want to.
Directory enquiry services and ex-directory numbers
If there is no entry relating to a subscriber or no entry relating to their number, the Regulations do not prevent the enquirer being told the reason or the possible reason why there is no such entry. This means the enquirer can be told that the subscriber has asked for their number to be excluded from the directory (as has traditionally been the position in the UK), rather than merely being told that a number is not listed. The Commissioner understands that directory providers are considering whether there is any scope for giving subscribers a choice of having a listing, without this fact being given to an enquirer. If this choice is offered, enquirers would have to be told that there is no public listing for the name and address concerned.