THE DATA PROTECTION ACT 1998 A QUESTION OF PRINCIPLES Sheelagh F M Keddie Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com THE ROLE OF IT AND THE IT PROFESSIONAL IN DATA PROTECTION 1987 Data Protection manager • IT security manager/administrator 1980’s onwards shift in management of system development • Business area orientated responsibilities • User role in Project management • Service Level Agreements 2005 Data Processor Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com British Computer Society Code of Conduct [Extracts] The Public Interest 1. You shall carry out work with due care and diligence in accordance with the relevant authority’s requirements, and the interests of system users. If your professional judgement is overruled, you shall indicate the likely risks and consequences. 3. You shall have regard to the legitimate rights of third parties … includes..members of the ‘public’ who might be affected by an IS project without their being directly aware of its existence. 4. You shall ensure that within your professional field/s you have knowledge and understanding of relevant legislation, regulations and standards and that you comply with such requirements. Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com MANAGING DATA PROTECTION POLICY ORGANISATION EDUCATION AND TRAINING GUIDELINES PROCESSES INVENTORY Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com WHAT DOES GOOD DP PRACTICE LOOK LIKE? • A clear, complete and relevant policy • An inventory of personal data • Controls to ensure that data are collected legally • Only relevant data and sufficient data are collected • Controls to ensure that data are only used in accordance with how they were collected Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com WHAT DOES GOOD DP PRACTICE LOOK LIKE? • A clear, complete and relevant policy • An inventory of personal data • Controls to ensure that data are collected legally • Only relevant data and sufficient data are collected • Controls to ensure that data are only used in accordance with how they were collected • Procedures to correct inaccurate data • Procedures to delete data when the purpose is completed • Procedures to meet requests from individuals to see their data within the legal time limit • Staff understand their responsibilities and meet them Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com DATA PROTECTION POLICY • Access rules reflect lawful use • chinese walls within data controller reflecting different purposes • compartmentalised access v. hierarchical • more than one logical id for some users • clear policy on monitoring usage • users rights to private use of e-mails, Internet , IT facilities, telephones • monitoring usage v content • automated monitoring v human surveillance • authorisation of specific investigations Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com INVENTORY OF PERSONAL DATA • Broader base for inventory • all automated personal data not just ‘processed by reference’ • includes back-ups • includes e-mails • includes word-processing documents • reflects logical business purposes not necessarily technical data relationships - logical map underpinned by technical map • reflects business ownership of personal data • is not limited to automated data Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com CONTROLS - BUILDING COMPLIANT SYSTEMS • Project initiation and specification • Fair collection - Principle 1 • specify which condition[s] in schedules 2 and 3 are being met • eg the exact wording if consent is being sought • in document • in telephone script • on web-site • the legal obligation which necessitates collection • the public function which necessitates the collection Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com CONTROLS - BUILDING COMPLIANT SYSTEMS • Project initiation and specification • Lawful use - Principle 2 • ensure internal use reflects the information given to the data subject • ensure any intended disclosures to any other legal entity also reflect this information Principle 2 - only obtained for specified and lawful purposes and not further processed in an incompatible manner [ including by an employee or a third-party recipient] Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com CONTROLS - BUILDING COMPLIANT SYSTEMS USE COLLECT STORE legal entity purposes Property of Common Sense Privacy - all rights reserved consent/objections 01875340890 csprivacy@aol.com CONTROLS - BUILDING COMPLIANT SYSTEMS Systems design • CRM or discrete data sets • controls to • reflect multiple purposes and multiple legal entities • maintain accuracy • record dissent • support retention policies Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com CONTROLS - BUILDING COMPLIANT SYSTEMS Systems specification and design • include reports to produce accessible copies of an individual’s data • per legal entity • per person • explain codes • omit clearly exempt material • includes - e-mails, archives, back-up, possibly telephone calls don’t give me - screen prints, multiple copies of call logs and emails, coded actions Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com CONTROLS - BUILDING SECURE SYSTEMS • Establish necessary, effective security controls • Carry out and document impact assessments - likely harm to an individual of a security breach • add control assessments - risk reduction • establish joint ownership with business users of control strategy Principle 7 - secured against unauthorised or unlawful processing, accidental loss or destruction, damage Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com CONTROLS - MANAGING THE DATA PROCESSOR RELATIONSHIP • Data Processor • Written statement regarding security controls • policy • staff training • physical, procedural and technical controls •Data Controller • Part of the procurement process • part of the management and audit processes • clear documented instructions on processing of personal data Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com COLLECTION AND DISCLOSURE VIA WEB-SITES • No covert collection mechanisms • place collection information before collection action eg above the submit button in online forms • get positive consent eg tick that you have read and accept the privacy information • don’t bundle consent to various purposes • enable choices to be made on-line • opt -in via opt-out • shun the passive opt-in - boxes already ticked • remember placing personal data on the Internet is world-wide disclosure/ transfer Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com Questions? Property of Common Sense Privacy - all rights reserved 01875340890 csprivacy@aol.com