Data regulator issues guidance for online data

Best practise, as long as you've got Flash

By John Oates, 7th July 2010

The Information Commissioner's Office has issued what it calls new rules for the processing of information online.

They're not actually new rules, however - it's just a new 44-page pdf. The leaflet is also available in ebook format.

The failing regulator - facing court action for not meeting minimum European data protection standards and also lined up for reform by the coalition government - claims the pamphlet is the first of its kind.

The pamphlet reminds businesses of their responsibilities under the Data Protection Act, whether the information is online or in another format.

A spokeswoman for the ICO said the most important changes to best practise were around the use of social networking sites, cookies and behaviourial advertising.

There is a shorter pdf with advice for consumers on cookies, browser settings and social networking sites.

Commissioner Christopher Graham said companies faced a double whammy of enforcement and damaged reputation for data breaches.

The European Commission issued its final warning to the UK government to beef up data and privacy regulation or face a hearing in front of the Court of Justice. The Coalition government yesterday asked for feedback on fundamental reform of the regulator.

Viviane Reding said last month: "Having a watchdog with insufficient powers is like keeping your guard dog tied up in the basement."

The ICO has been criticised in the past for failing to act over Google mass-Wi-Fi snoop , Phorm's intercept programme and the government's loss of the entire child benefit database , to name but three.

In its defence the ICO would say governments have consistently refused its repeated demands to be given real, proactive rather than reactive, powers. ®

What you need to know about cloud backup

COMMENTS

House Rules Send Corrections

All Reader Comments (8)

Highly Rated

Posted Wednesday 7th July 2010 14:12 GMT

Anonymous Coward

Wuff.

Viviane Reding said last month: "Having a watchdog with insufficient powers is like keeping your guard dog tied up in the basement."

Which is ironically what you have to do these days, lest you get caught by the DDA. So the ICO is following suit. Nice to hear.

Posted Thursday 8th July 2010 00:05 GMT

Anonymous Coward

WOT ENFORCEMENT?

As the stock response of the ICO (currently facing a 6month backlog on consumer complaints) when I complain to them is to do absolutely nothing, even when faced with clear evidence of DPA breaches, I really don't know what Mr Graham means by "enforcement". WHAT enforcement? They did nothing about Phorm or BT, nothing about Google, and even the latest cases that they got excited about, (involving TalkTalk was it?) seem to have suddenly gone all quiet. Given the massive numbrer of data losses that we read about almost every fortnight, why are there not more reports of enforcement action? I know the powers are limited, but we hear virtually nothing about companies actually suffering any sort of penalty for their DPA and PECR breaches.

I have yet to be convinced that the ICO wants to assist consumers. It is still geared to giving legal advice to companies rather than taking enforcement action against offenders. Oh yes - and could they please tell us the ratio of IT qualified to legally qualified staff right now, and whether it has changed recently?

Use the powers you already have to protect consumers, and then we might consider giving you some more.

Posted Friday 9th July 2010 16:57 GMT

Acxiom

ICO Code

The ICO’s code of practice should definitely be welcomed, a lot of time, effort and consultation has gone into its drafting, to produce a good workable code that will help both Public and private sectors to improve customer trust and confidence in their online activities.

Above all, transparency is key. Information sharing online can be a force for good, but it’s essential for the consumer to be told what’s being done and why. Sometimes organisations themselves aren’t aware when they’re sharing data, let alone whether they’re doing it legitimately or not. The code of practice aims to ease these pressures, outlining how organisations can increase transparency and compliance with the Data Protection Act.

There is an argument that says ‘If we shared less data we’d have less risk’ but the reality is that organisations need data, and will have to get it from somewhere, so lets do it properly. The ICO’s code of practice is the first of its kind in the world - there is no one country that has set the example for others to follow so far. Organisations need to take note of the guidance given within the document. While following the code is not a legal requirement, applying its advice on good practice with online consumer interaction will help build consumer trust, brand reputation and limit the likelihood of regulator enforcement and fines.

Neil Matthews,

UK Privacy Officer

Acxiom