Agentless Backup is Not a Myth
How a data exemption would work
The DPA contains an exemption which states that personal data can be processed for the purposes of the prevention or detection of crime without having to inform individuals if informing the individuals would jeopardise the ability to prevent or detect crime.
Wynn said organisations involved in any new data sharing initiative should conduct a privacy impact assessment (PIA) prior to entering such a scheme as one means of safeguarding individuals' right to privacy.
"A thorough PIA would identify only the data that was necessary for the specific purposes of the scheme was processed," she said. "While it is one thing to make it more convenient to share personal information it should not be at the cost of privacy so the PIA would allow the bodies to balance those interest and allow them to identify the least intrusive way of sharing data."
Where practical, organisations involved in any new personal data sharing scheme should anonymise the personal data (so that individuals are no longer identifiable) prior to the information being made available through the scheme, Wynn said. Alternatively government departments and public bodies could anonymise or pseudonymise data they obtain from other organisations involved in the initiative, she said.
"In terms of any new legislation the devil will be in the detail, but it could be that it cuts across the fundamental principles of the DPA. However, if the privacy safeguards are robust it may result in only minor changes to the existing law. In any case data-sharers would have to consider the draft European Data Protection Regulation which seeks to enhance data subjects' rights. Government should encourage organisations to liaise with the Information Commissioner's Office (ICO) to allow it to audit any data sharing processes as this would demonstrate their commitment to privacy publically and show that the rights of the individual are considered to be a priority."
According to guidance issued by the UK's data protection watchdog last May, organisations must establish whether it is justified to share information in the first place and ensure that only the information required to achieve the objective of the sharing is disclosed.
The ICO's guidance advises organisations to employ 'need to know' principles to restrict access to personal data they hold, and assess whether a data sharing arrangement needs to be ongoing or on a one-off basis. Common rules should be established for how data is shared to make sure it is secure, and reviews of the processes should be made, it said.
"We are aware that the Cabinet Office is developing proposals to enable greater data sharing across government and the public sector," the ICO said in a statement. "We look forward to commenting on these proposals when they are published.
“In the meantime we continue to advise bodies involved in data sharing on how they can comply with the Data Protection Act. This includes explaining the privacy safeguards that must be in place. We have published a statutory code of practice on Data Sharing and will continue to work closely with central government and associated stakeholders to ensure that individuals’ information rights are protected.”
Copyright © 2012, Out-Law.com
Out-Law.com is part of international law firm Pinsent Masons.
COMMENTS
Re: So what?
"There is no fundamental right to life, privacy, liberty, whatever." -- You will find some rights in the Declaration of Human Rights, such as the right to life, a family and free (as in freedom) travel.
Why Bother?
I don't know why they are even wasting their time thinking about such things - everyone knows that these organisations only care about the DPA in terms of "can we tick the box" and never actually adhere to it's principals.
I'm sure that there will be nothing to stop individuals short-cutting any process that is put in place by simply copying data to a (unencrypted) thumb drive then giving it to whoever has asked for it (over the phone with no formal request or paper trail of course).
Making people worried about giving sensitive information to the police is merely gibberingly insane.
Making people worried about giving sensitive information to their doctors, and the doctors worried about collecting such information, goes rather beyond that.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Cloud based data management
Enabling efficient data center monitoring
Agentless Backup is Not a Myth
