Feeds

Code for handling personal data is muddled, says lawyer

Further confusion in an already bewildering area

Build a business case: developing custom apps

A code of conduct for handling personal data was launched in London yesterday. But the document is inconsistent on the need for consent when collecting personal data, according to a data protection expert. Sometimes consent is not necessary, he said.

The Personal Data Guardianship Code was published jointly by the British Computer Society and the Information Security Awareness Forum (ISAF) in response to the number of high profile data breaches in recent years. Its aim is to change the culture of organisations towards the handling of personal data.

According to its authors, the Code "follows on the success of the BCS petition objecting to the changes in the Coroners and Justice Bill which would have seen drastic changes to the way in which government departments could have used personal information."

In March the Ministry of Justice announced that, in response to criticism from many groups, it would scrap plans that featured in the draft legislation to allow Government departments to share citizens' personal information with each other and with the private sector.

The new Code is intended to help organisations and the people in them who handle personal data to understand their individual responsibilities. It aims to promote best practice and provide 'common sense' guidance, and also lays out information for the data subject.

However, William Malcolm, a specialist in data protection law at Pinsent Masons, the law firm behind OUT-LAW.COM, described the Code as muddled.

"The Code's high-level guidance on the data life-span, stewardship and accountability is helpful but very much echoes existing guidance from the Information Commissioner's Office and Government," he said. "It's an alternative approach but it's certainly not a new approach."

Malcolm added that some references to the need for consent were wrong.

"The guidance on consent seems inconsistent and therefore muddled," he said. "The initial 'Principles' section [of the Code] suggests consent should be obtained where appropriate, which is the correct position. But the other sections seem to suggest that consent should be collected as a matter of course in a variety of situations."

The 'Principles' section of the Code states: "Individuals should be given as much control as is possible over how their personal information is used and disclosed. This means giving them clear information about this when they provide their personal data and seeking their consent where this is appropriate."

Malcolm says this is consistent with the Data Protection Act and with existing guidance from the ICO.

Another section, though, implies that consent is always required when collecting data. Under the heading 'Responsibilities of the data handler' the Code states: "Data handlers tasked with the collection of personal data should verify that the consent of the data subject has been obtained for the personal data collected."

Malcolm said that notification will suffice in many cases.

"Consent is one ground for processing data, but it is not the only ground. In many cases an organisation only needs to notify individuals that it will be processing their data – it does not need their consent," he said. "As the 'Principles' section of the Code notes, the focus should be on giving clear information about how data will be processed at the point of collection."

Louise Bennett, Chair of the BCS Security Forum, said that the Code is the culmination of two years' work. "The consultation work we've undertaken in that time exposed the need for practical help in changing culture to embed good data guardianship principles in all organisations," she said.

"This is the equivalent of the Highway Code for motorists – it will help all those involved in the management of personal data understand their role and enable them to carry out their jobs better."

Another guide to data protection compliance was launched today. British Standard BS 10012, Data protection – Specification for a personal information management system has been developed to establish best practice and aid compliance with data protection legislation. It is the first standard from BSI for the management of personal information. OUT-LAW will report on BS 10012 shortly.

The code can be downloaded from here. (Link to pdf)

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

The Essential Guide to IT Transformation

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
Nadella: Apps must run on ALL WINDOWS – PCs, slabs and mobes
Phone egg, meet desktop chicken - your mother
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
Samsung threatens to cut ties with supplier over child labour allegations
Vows to uphold 'zero tolerance' policy on underage workers
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.