Today (Wednesday 24 October), the second transitional period of the Data Protection Act takes effect in the UK, meaning that companies are required by law to provide all the personal data they store on anyone, if that person requests it.

This has far-reaching implications for all UK businesses but more significantly (from our perspective anyway) it means all UK Web sites, Web sites with servers based in the UK, and companies that have cookies or Web bugs on UK Web sites will have to review their approach if they are not to fall foul of the new law.

The new laws do have fairly complex repercussions, but only if a site is using the data it has gathered to personally identify visitors. If, as is the case with The Register, any data gathered on the site is used only to build impersonal stats, it is not affected.

There are however two main areas of concern for most Web sites: cookies and email addresses. If a cookie is installed on your machine so a site knows exactly who you are when you visit, the data protection laws come into effect. Also, if visitors are asked to insert personal details such as an email address, name, address etc, that also falls under the new laws.

The security distributor Allasso recently claimed that nine out of ten UK sites collect at least one type of identifying information, and most do so without the visitors' permission, going against the Act.

In essence, if data that can identify you is gathered, a Web site has a legal duty to tell you what exactly is being gathered, what use that will be put to and who will be given access to that information. It will also have to ask you if you are happy with that.

In much of Europe, there is an "opt-in" policy, so a visitor will have to actively click a box to say that information can be used. Legislation going through the EC may soon mean that the UK follows along the same lines and so the Information Commissioner suggests that UK sites adopt the same policy as "best practice". However, legally at the moment, sites need only give you the option, which you need to unclick.

Other main points are:

• A privacy statement on its own is not enough if you are taking personally identifiable data. People should be made aware if you are taking this data at the time or before you are taking it. The Register's privacy statement is here (http://www.theregister.co.uk/content/31/16588.html).
  
• Storing IP addresses is not in itself much of a problem because most visitors will be coming in on dynamic addresses (i.e. they will come from a different IP address every time they visit). Static IP addresses are fine unless a site uses that address to link with other data held on someone.
  
• Companies have to be careful with data obtained from outside their own sites. Using spiders to gather email addresses is very likely to cross the threshold. If a company buys an email marketing list, it will need to ensure those addresses were obtained legally.
  
• Web bugs - if used to gather personally identifiable data - are likely to infringe the Act because, by design, they are not observable to the visitor. This sits badly with the Act assertion that all data be "obtained fairly".
  
• In cases where it is possible, Web sites should tell a visitor if they have information on them which they obtained from a third party.
  
• Extra care needs to be taken when dealing with kids.
  
• The company running a Web site needs to make sure that any personal data stored is secure.
  
• Placing personal data on a Web site is not allowed, first because of security but also because it allows that information to be picked up outside the EU. This doesn't apply if that information is already out in the public domain.
  
• If a company changes its privacy statement, all data gathered before that point is still subject to the old statement. It a company wants that statement apply to all that it has already, users' consent to that change will need to be sought.
  
• Companies that do gather personal data have to, by law, notify the Information Commissioner that they are doing so. This costs £35 a year.
  
• If one company takes over another, it will need to take account of how that company's data was gathered before using it under its own privacy statement.

Basically, the best way to view all this is as a tidying up of what has been a very contentious issue for several years. If you don't mind what companies do with the information they pick up from you, there's no problem. If you do, then you have some recourse.

Check out the Data Protection Web site (http://www.dataprotection.gov.uk) for a lot more information. ®

[This story was first published on Monday 22 October]

Related Links

Data Protection site (http://www.dataprotection.gov.uk)

Related Stories

The Register's privacy policy (http://www.theregister.co.uk/content/31/16588.html)
Data Protection Act kicks in (http://www.theregister.co.uk/content/7/22434.html)