Feeds

ICO strengthens criticism of Government data sharing

Changes mind, speaks up a bit

Security for virtualized datacentres

The Government's controversial plans to share personal data between departments and with the private sector are "too wide" and the safeguards "weak" according to privacy watchdog the Information Commissioner's Office (ICO).

The ICO has released its second opinion on the contents of the Coroners and Justice Bill, which proposes legalising greater sharing of information between Government departments and with outside contractors and private companies who request it.

When the Bill's proposals were first published, the ICO was less critical.

"Some have suggested that the Bill’s information sharing provisions represent an unwarranted interference with the privacy of personal information. We do not agree. The provisions of the DPA will continue to apply to the sharing of personal information whether undertaken within the scope of an information order or otherwise," said its opinion, published on 22 January.

The ICO now believes that the proposed new law poses some dangers to privacy and for Government's accountability for the processing of personal data it has collected.

"The Bill’s information-sharing provisions are too wide, and its safeguards relatively weak," it said. "The provisions should only apply in precisely defined circumstances where there is a legal barrier to information sharing that would be in the public interest."

Rosemary Jay, a privacy law expert at Pinsent Masons, the law firm behind OUT-LAW.COM, warned of similar concerns when the Bill was published.

"It would allow for information to be shared with banks or other financial institutions," she said in January. "There is no restriction on purpose of the sharing so for example it would enable the Minister to make an order empowering the tax authorities to disclose the earnings of individuals to credit reference agencies."

Jay said that such disclosures could be made without the person whose information is being shared ever knowing about it.

The ICO is also concerned that the law will allow Government to make major changes in the field of information law without consulting Parliament.

"The Bill needs an additional safeguard, to prevent the use of information-sharing orders in the context of large-scale data sharing initiatives that would constitute significant changes to public policy," said the opinion.

The Bill allows the ICO to investigate Government departments it suspects of not processing or sharing information properly through the issuing of an assessment notice.

"The Assessment Notice provisions need to be widened, so the Information Commissioner can serve an assessment notice on any data controller," said the ICO's latest opinion. "The risks can be just as great outside the public sector and the boundary lines between the sectors are increasingly blurred. The House of Lords Select Committee on the Constitution supported this conclusion at paragraph 238 of its recent ‘Surveillance: Citizens and the State’ report."

In its first and its latest opinions, the ICO stressed that the fact that there is no penalty for failing to comply with an assessment notice makes it difficult to enforce them.

"The Bill should provide for a sanction for data controllers that fail to comply with an assessment notice," it said. "It is inconsistent that whilst there is a right of appeal against an assessment notice, there is no sanction for failure to comply with one."

The ICO also called attention to a definitional problem in the Bill. It says that "a person shares information if the person…consults or uses the information for a purpose other than the purpose for which the information was obtained."

The ICO said that this definition will cause problems. "This definition of ‘information sharing’ will cause considerable difficulty," it said. "Sharing information and using it for a different purpose are quite different activities; it is possible to share information without using it for a different purpose, or to use if for a different purpose without sharing it."

"This legally convoluted definition will pose a considerable and avoidable obstacle. If a definition of ‘information sharing’ is needed at all, [this section] should be deleted from it. If there is a need to address use of information for a different purpose, and we do not believe there is, then this should be covered by a separate provision," said the ICO. 

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Security for virtualized datacentres

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Why Oracle CEO Larry Ellison had to go ... Except he hasn't
Silicon Valley's veteran seadog in piratical Putin impression
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.