The Prospective Filing System Inclusion factor is used to determine the scope of applicability of data protection laws within a jurisdiction by considering whether personal data is intended to be part of a filing system, regardless of whether it is processed by automated means or not.

Relevant Provision(s)

• DCG Art.2 (1) in Liechtenstein: 1) This Act shall apply to the processing of personal data by public bodies. For non-public bodies, this Act shall apply to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system with the exception of processing personal data by a natural person in the course of a purely personal or domestic activity.
• DIFC DPL Art.6(2)(b) in UAE - DIFC: (2) This Law applies to the Processing of Personal Data: (b) other than by automated means where the Personal Data forms part of a Filing System or is intended to form part of a Filing System.
• GDPR Recital 15 in EU: (15) In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used. The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system.
• LPDP Art.3(1) in Serbia: This Law shall apply to processing of personal data which is performed, in its entirety or in a part thereof, by automated means, as well as to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
• № 152 - FZ Art.1(1) in Russia: 1. This Federal Law regulates activities related to the processing of personal data by federal government bodies, state bodies of constituent entities of the Russian Federation and other state bodies (hereinafter referred to as “state bodies”), by local government bodies and other municipal bodies (hereinafter referred to as “municipal bodies”), by legal entities and private entities, both automatically, including in data telecommunications networks, and without the use of such means, provided that the data processing is by its nature similar to the actions (operations) of automatic data processing, that is, allowing users to search personal data recorded in physical media or contained in card catalogs or other systematized legislation of personal data in accordance with the specified algorithm and (or) to have access to such personal data.
• PDPL Art.1(1) in Ukraine: This Law shall be applied to the activities associated with personal data processing by automated means in whole or in part, as well as with the processing of personal data contained in or to be entered into the filing system by non-automated means.

Analysis of Provisions

The provisions indicate that the Prospective Filing System Inclusion factor is used to extend the application of data protection laws to manual processing of personal data that is intended to be part of a filing system. For instance, the GDPR Recital 15 states that "the protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system". Similarly, the DCG Art.2 (1) in Liechtenstein applies to "the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system".

The rationale behind incorporating this factor is to prevent circumvention of data protection laws by manual processing of personal data. By including manual processing of personal data intended to be part of a filing system, lawmakers can ensure that data protection laws are technologically neutral and effective in protecting natural persons.

Implications

The Prospective Filing System Inclusion factor has significant implications for companies processing personal data. For example:

• A company in the EU that manually processes personal data intended to be part of a filing system would be subject to the GDPR, regardless of whether the processing is automated or not.
• A company in Liechtenstein that processes personal data by non-automated means, but intends to form part of a filing system, would be subject to the DCG.

These examples illustrate how the Prospective Filing System Inclusion factor can extend the application of data protection laws to companies processing personal data, even if the processing is not automated.