Feeds

Expert: UK would break its own rules with web-snoop law

Hello there, Data Protection Act

SANS - Survey on application security programs

How a data exemption would work

The DPA contains an exemption which states that personal data can be processed for the purposes of the prevention or detection of crime without having to inform individuals if informing the individuals would jeopardise the ability to prevent or detect crime.

Wynn said organisations involved in any new data sharing initiative should conduct a privacy impact assessment (PIA) prior to entering such a scheme as one means of safeguarding individuals' right to privacy.

"A thorough PIA would identify only the data that was necessary for the specific purposes of the scheme was processed," she said. "While it is one thing to make it more convenient to share personal information it should not be at the cost of privacy so the PIA would allow the bodies to balance those interest and allow them to identify the least intrusive way of sharing data."

Where practical, organisations involved in any new personal data sharing scheme should anonymise the personal data (so that individuals are no longer identifiable) prior to the information being made available through the scheme, Wynn said. Alternatively government departments and public bodies could anonymise or pseudonymise data they obtain from other organisations involved in the initiative, she said.

"In terms of any new legislation the devil will be in the detail, but it could be that it cuts across the fundamental principles of the DPA. However, if the privacy safeguards are robust it may result in only minor changes to the existing law. In any case data-sharers would have to consider the draft European Data Protection Regulation which seeks to enhance data subjects' rights. Government should encourage organisations to liaise with the Information Commissioner's Office (ICO) to allow it to audit any data sharing processes as this would demonstrate their commitment to privacy publically and show that the rights of the individual are considered to be a priority."

According to guidance issued by the UK's data protection watchdog last May, organisations must establish whether it is justified to share information in the first place and ensure that only the information required to achieve the objective of the sharing is disclosed.

The ICO's guidance advises organisations to employ 'need to know' principles to restrict access to personal data they hold, and assess whether a data sharing arrangement needs to be ongoing or on a one-off basis. Common rules should be established for how data is shared to make sure it is secure, and reviews of the processes should be made, it said.

"We are aware that the Cabinet Office is developing proposals to enable greater data sharing across government and the public sector," the ICO said in a statement. "We look forward to commenting on these proposals when they are published.

“In the meantime we continue to advise bodies involved in data sharing on how they can comply with the Data Protection Act. This includes explaining the privacy safeguards that must be in place. We have published a statutory code of practice on Data Sharing and will continue to work closely with central government and associated stakeholders to ensure that individuals’ information rights are protected.”

Copyright © 2012, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

High performance access to file storage

More from The Register

next story
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Banks slap Olympus with £160 MEEELLION lawsuit
Scandal hit camera maker just can't shake off its past
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.