Feeds

ICO issues data protection guidance for SMEs

It's just run of the mill business

Reducing security risks from open source software

Small companies should try to answer data protection queries in the normal course of business rather than treat them as formal requests, according to advice published by the Information Commissioner's Office (ICO).

The ICO has issued guidelines (PDF) to help small companies deal with requests for information under the Data Protection Act (DPA). Aware that small companies can often feel overwhelmed by such requests and the complexity of the Act, the ICO has advised that as many requests as possible be treated informally.

"Individuals have a right under the Act to make a request in writing for a copy of the information you hold about them on computer and in some manual filing systems," explains the advice. "This is called a subject access request. They are also entitled to be given a description of the information, what you use it for, who you might pass it on to, and any information you have about the source of the information.

"Where you are happy to provide the information requested it often makes sense to do so as part of your normal course of business, rather than treating any written request for personal information as a formal request under the Act."

That informal process involves simply giving out the information, such as a guarantee number for a fridge or simple information related to a service that a company provides to an individual.

More complicated requests which are made formal can involve more data and can trigger some fixed rules. If you charge a fee for processing information, which can only be up to £10, you must provide the information within 40 days of receiving that fee, for example.

The guidance also says that any codes used in the data held by a company must be fully explained so that the person receiving the information is able to make full sense of it.

Companies must also be careful when providing information that involves a third party. Unless it has the explicit permission of a third party to pass on data to the requester, the company must black out that information, while providing as full a disclosure as it can to the person who made the request.

"The Data Protection Act gives us all important rights, enabling us to check the personal information that is held about us and to correct that information where necessary," said David Smith, the Deputy Information Commissioner. "This guidance sets out clear advice for small and medium sized businesses to help them deal with requests from individuals for access to information an SME might keep about them."

The guidance says a company that is confused about exactly what an individual wants from a request should seek clarification, and that it should ensure that its staff are trained to recognise a subject access request when they see one.

Copyright © 2007, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Seven Steps to Software Security

More from The Register

next story
Stick a 4K in them: Super high-res TVs are DONE
4,000 pixels is niche now... Don't say we didn't warn you
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Philip K Dick 'Nazi alternate reality' story to be made into TV series
Amazon Studios, Ridley Scott firm to produce The Man in the High Castle
Amazon Reveals One Weird Trick: A Loss On Almost $20bn In Sales
Investors really hate it: Share price plunge as growth SLOWS in key AWS division
Bose says today is F*** With Dre Day: Beats sued in patent battle
Music gear giant seeks some of that sweet, sweet Apple pie
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Too many IT conferences to cover? MICROSOFT to the RESCUE!
Yet more word of cuts emerges from Redmond
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.