ICO Publishes Data Sharing Code Of Practice

The Information Commissioner’s Office has published a new statutory code of practice on data sharing, setting out guidelines on when data can be shared and how it should be protected.

The code covers both routine and one-off instances of data sharing, and is designed to help organisations reap the benefits of sharing data while complying with UK data law. The ICO says that following the code will help organisations build trust with their customers and reduce the risk of leaking data to inappropriate parties.

“People now have an expectation that, where appropriate and necessary, their personal details may be shared,” said the Information Commissioner, Christopher Graham. “However, this does not mean that companies or public bodies can do this just as they see fit. The public rightly want to remain in control of who is using their information and why, and they need to feel confident that it is being kept safe.”

Adopting best practice

The code includes information on data sharing laws, advice on remaining transparent and avoiding common mistakes, and a summary checklist that can be used as a quick reference guide to sharing information. The ICO advises any data controller who is involved in the sharing of personal data to use the code to help them to understand how to adopt good practice.

“Organisations that don’t understand what can and cannot be done legally are as likely to disadvantage their clients through excessive caution as they are by carelessness,” said Graham (pictured) in a foreword to the report. “We want citizens and consumers to be able to benefit from the responsible sharing of information, confident that their personal data is being handled responsibly and securely.”

The publication of the code follows a public consultation, which was launched in October 2010. Graham said the final document reflects the constructive comments that the ICO received during that period, ensuring that the code not only makes sense on paper but also in the real world.

ICO issues fifth fine

Last year, the ICO was given the power to issue fines of up to £500,000 for any serious data breaches, but has recently been criticised for failing to act on the majority of breaches. A Freedom of Information request by hardware encryption specialist ViaSat UK revealed that while 2,565 incidents had been reported, the ICO had only disclosed actions in 36 cases and issued just four fines.

Since then, the ICO has issued its fifth fine against Andrew Crossley, owner of controversial law firm ACS:Law. The £1,000 fine was issued after the website of ACS:Law was hit with a distributed denial-of-service (DDoS) attack last September. The attack exposed the unencrypted details of 6,000 broadband users, who reportedly signed up to BSkyB services and were thought to be illegally sharing pornography.

“As Mr Crossley was a sole trader it falls on the individual to pay the fine,” explained the Information Commissioner. “Were it not for the fact that ACS:Law has ceased trading so that Mr Crossley now has limited means, a monetary penalty of £200,000 would have been imposed, given the severity of the breach.”

The ICO is also currently investigating the effects of the well-publicised Sony Playstation data breach and a possible leak of data relating to sex offenders at the Child Exploitation and Online Protection Centre.