Feeds

New guidance on data protection and outsourcing

Info commissioner issues advice for small.biz

Choosing a cloud hosting partner with confidence

The Information Commissioner’s Office (ICO) has published advice to businesses on how to comply with data protection rules when outsourcing the processing of personal information, aimed primarily at smaller companies without an inhouse data protection expert.

The good practice note follows requests for clarification on outsourcing, not only by organisations which hold personal information, such as payroll, but also by individuals who are concerned about how their information is protected when it is outsourced to companies both in the UK and overseas.

The advice stresses that when a business uses an outside organisation to process personal information on its behalf, it retains liability for the security and accuracy of information and full control over how it is used. This means the business remains liable for any breaches of the Data Protection Act, even if the outsourced company is based abroad.

Deputy commissioner David Smith acknowledged that many companies outsource some of their data processing functions to other companies, quite often overseas.

"There have been several highly publicised instances recently which suggest that personal information is not always held securely," he said. "Companies considering outsourcing must ensure that they choose companies that can be relied upon to take proper care of the personal information they are entrusted with."

He added that they should put in place mechanisms so that when the personal information has been outsourced they can check that it is being properly looked after.

"The Information Commissioner’s Office takes the failure to take proper care of personal information very seriously, and we will not hesitate to investigate where companies have failed to fulfil their obligations under the Data Protection Act. Such investigations could result in formal enforcement action."

The good practice note covers, for example, the selection of a service provider, ensuring the contract is enforceable, checking for security, and auditing that provider.

Daradjeet Jagpal, a solicitor with Pinsent Masons, the law firm behind OUT-LAW.COM, said: "Businesses need to remember that just because personal information is processed thousands of miles away, it does not mean that it takes away their responsibility for complying with the DPA."

Jagpal, a data protection specialist, continued: "A contract with the foreign processor is necessary, requiring the processor to respect the same security obligations that the business has to. Not getting this right means not only risking enforcement action from the Information Commissioner, but from aggrieved individuals, too, who may claim compensation for damage or damage and distress suffered due to breach of security obligations."

Another member of the Pinsent Masons information law team, Louise Townsend, added: "Straightforward guidance from the Information Commissioner on this topic is to be welcomed. Many organisations will have standard terms and conditions and it is a simple task to review these to ensure that they meet the requirements of the Data Protection Act."

Copyright © 2006, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.