ICO informed me: 'A request may be made to the Commissioner by or on behalf of any person who is, or believes himself to be, directly affected by any processing of personal data for an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of this Act.'
On 11 August 2008, the ICO made its assessment:
'On the basis of the further information that you have provided I am changing our original assessment. It is now out view that the inclusion of your date of birth in the notice about your ban was likely to have contravened the third principle.'
The said third principle of the UK Data Protection Act 1998 states that 'personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.'
From the ICO Annual Report 2006/2007 page 14:
'More than half of data protection cases required us to simply provide advice and guidance. In some
cases this advice was relatively straightforward, in others extremely complex. In the remainder of
cases, we considered whether a breach of the Data Protection Act or Privacy and Electronic
Communications Regulations was likely to have occurred.
In one third (35.28%) of these cases we decided a breach was likely to have occurred and the
organisation took remedial action in three quarters (77.49%) of these cases. Such remedial actions
may include a data controller correcting an individual’s record, implementing a data protection
policy or training staff.
Outcome of cases closed (in pie chart form):
Advice & guidance 56.45%
Breach likely 15.36%
Breach unlikely 12.24%
Assessment criteria not met 14.55%
I am informed that in court proceedings a judge will respect an assessment from the Information Commissioner's Office (ICO) that a breach of the Data Protection Act is likely to have occurred.
My advice to editors of athletics publications is that they should shy away from providing full date-of-birth when it not necessary to the context, particularly when the context is negative to the data subject. But that should obvious, unless of course the editor, or the organisation behind him, intended to cause offence anyway.
In the normal case where the context is positive to the data subject, for instance Tim Grose's admirable Athletics Data ranking lists, then there should be no problem at all in publishing full date-of-birth. For safety's sake however, in the very unlikely event that an athlete might object, then it would be advisable to provide the data subject (athlete) even there with a means of opting out of having full date-of-birth published.