Feeds

Expert: UK would break its own rules with web-snoop law

Hello there, Data Protection Act

Providing a secure and efficient Helpdesk

How a data exemption would work

The DPA contains an exemption which states that personal data can be processed for the purposes of the prevention or detection of crime without having to inform individuals if informing the individuals would jeopardise the ability to prevent or detect crime.

Wynn said organisations involved in any new data sharing initiative should conduct a privacy impact assessment (PIA) prior to entering such a scheme as one means of safeguarding individuals' right to privacy.

"A thorough PIA would identify only the data that was necessary for the specific purposes of the scheme was processed," she said. "While it is one thing to make it more convenient to share personal information it should not be at the cost of privacy so the PIA would allow the bodies to balance those interest and allow them to identify the least intrusive way of sharing data."

Where practical, organisations involved in any new personal data sharing scheme should anonymise the personal data (so that individuals are no longer identifiable) prior to the information being made available through the scheme, Wynn said. Alternatively government departments and public bodies could anonymise or pseudonymise data they obtain from other organisations involved in the initiative, she said.

"In terms of any new legislation the devil will be in the detail, but it could be that it cuts across the fundamental principles of the DPA. However, if the privacy safeguards are robust it may result in only minor changes to the existing law. In any case data-sharers would have to consider the draft European Data Protection Regulation which seeks to enhance data subjects' rights. Government should encourage organisations to liaise with the Information Commissioner's Office (ICO) to allow it to audit any data sharing processes as this would demonstrate their commitment to privacy publically and show that the rights of the individual are considered to be a priority."

According to guidance issued by the UK's data protection watchdog last May, organisations must establish whether it is justified to share information in the first place and ensure that only the information required to achieve the objective of the sharing is disclosed.

The ICO's guidance advises organisations to employ 'need to know' principles to restrict access to personal data they hold, and assess whether a data sharing arrangement needs to be ongoing or on a one-off basis. Common rules should be established for how data is shared to make sure it is secure, and reviews of the processes should be made, it said.

"We are aware that the Cabinet Office is developing proposals to enable greater data sharing across government and the public sector," the ICO said in a statement. "We look forward to commenting on these proposals when they are published.

“In the meantime we continue to advise bodies involved in data sharing on how they can comply with the Data Protection Act. This includes explaining the privacy safeguards that must be in place. We have published a statutory code of practice on Data Sharing and will continue to work closely with central government and associated stakeholders to ensure that individuals’ information rights are protected.”

Copyright © 2012, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

Beginner's guide to SSL certificates

More from The Register

next story
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.