Data Sharing Code of Practice Consultation

Last week the UK Information Commissioner's Office (ICO) announced a draft Data Sharing Code of Practice beginning a 12-week consultation process.

The new code aims to provide clear guidance to protect the rights of employees, citizens and consumers under the Data Protection Act when organisations undertake systematic/routine and exceptional ad-hoc data sharing. By improving data sharing arrangements, the ICO hope that both organisations and people can benefit from increased confidence in the processes and reduce the risks to personal data such as from data theft, loss (i.e. data breaches) and unauthorised alteration or destruction. The Data Sharing Code of Practice Consultation Paper explains what data sharing is, the difference between legal requirements and best practice, provides information on security, governance and, for public sector organisations, free of information.

The draft document has been produced in a clear easy-to-read style which will be familiar to those who have seen other recent ICO guidance documents. Where necessary, explanations are included within the text rather than as references external sources (e.g. the eight data protection principles, individuals' rights, ICO powers and penalties).

The document also includes nine short case studies which illustrate data sharing issues, but perhaps further private sector examples, and those related to more common day-to-day activities are required. These might negate the need for an additional Data Sharing FAQs document. Section 14 provides a template for a suggested data sharing protocol between organisations and will be a helpful start for most organisations.

It is worth reading now and responding to the ICO with any suggestions for changes or additions. If it raises questions in your own mind, send those too. An improved document will help you, your suppliers and your customers improve data protection standards and increase awareness. The ICO has produced a list of consultation questions—responses to the consultation can be sent by email or post. The consultation closes on 5th January 2011.

Update 20th October 2010: See follow-up post about companies' powers to share data.