The Data Protection Act (DPA) hit the news recently, when ministers suggested that supermarkets and internet firms could be forced to release sensitive personal data they hold about customers. The act already allows individuals and organisations to request information companies hold electronically, but people are either unaware of this or the data is supplied in a very unfriendly format. So, how would your business react if it was forced to release data and could you handle it?
The Data Protection Act
The Data Protection Act 1998 is a United Kingdom Act of Parliament which defines UK law on the processing of data on identifiable living people. It is the main piece of legislation that governs the protection of personal data in the UK. Although the Act itself does not mention privacy, it was enacted to bring UK law into line with the European Directive of 1995 which required Member States to protect peoples fundamental rights and freedoms and in particular their right to privacy with respect to the processing of personal data. In practice it provides a way for individuals to control information about themselves. Most of the Act does not apply to domestic use, for example keeping a personal address book. Anyone holding personal data for other purposes is legally obliged to comply with this Act, subject to some exemptions. The Act defines eight data protection principles. It also requires companies and individuals to keep personal information to themselves.
source http://en.wikipedia.org/wiki/Data_Protection_Act_1998
Proposed changes
You currently have the legal right to request personal information via the act, but the details are rarely in electronic form, and the process can be difficult. The proposed rules would make access far quicker and easier for individuals and organisations to request information, in much the same way the Freedom of Information Act allows people access to information held by public authorities and was (in part) the trigger for the MPs Expenses scandal in 2009.
Ministers are consulting on whether to make it a legal requirement to supply individuals with the data whenever they request it.
John Hayes (a minister in the Business Department) told BBC Radio 4: This is about empowerment. Its about giving consumers the information which companies already collect to allow them to make more informed choices. If that kind of analysis ” about marketing, transaction patterns ” is of value to companies, its likely to be of value to individuals.
Nick Pickles (director of civil liberties group Big Brother Watch) said the move was positive but had dangers: Giving consumers better access to data held about them is clearly a good thing, but this shouldn’t be a trade-off that sees us surrender control of what happens with that information. Theres also the inevitable risk that this information will be accessed for increasingly spurious purposes, from divorce cases to public authority snoopers. The best way to protect peoples privacy is for information to not be collected in the first place and midata must not undermine long-overdue improvements in consumer privacy protection.
Impact on businesses
Most businesses these day collect information about individuals and organisations they interact with. This can be anything from recording any transactions to more detailed information held within Client Relationship Management (CRM) or Enterprise Resource Planning (ERP) systems.
To some degree, most people are unaware of just how much data is collected, especially by B2C companies like the supermarkets, banks, etc. Businesses can paint a fairly accurate picture of your behaviour, in fact John Twelve Hawks wrote a trilogy five years ago that, although a fiction based book, was an updated 1984 take on the modern world influenced by the philosopher Jeremy Benthams idea of the Panopticon.
As individuals and organisations become more aware of their current rights and proposed extension to these, businesses might suddenly find themselves inundated with requests for information. Businesses should consider the impact on processing requests and consider the implications on resources and potential threats to what many would consider commercially sensitive information.
Conclusion
Obviously, at this stage little is known about the details of the proposal, but businesses should at least consider the potential cost of supplying data. Larger businesses, no doubt, will be impacted first and I can see the mobile phone companies, supermarkets, banks and insurance companies having to act first, but sooner or later smaller businesses will have to put something in place.
Although B2B businesses are less likely to see a significant impact (don’t discount it though) I can see smaller B2C businesses and websites having to supply data.
As with most legislation, it is a case of wait and see, but it doesn?t hurt to be aware of the fact that this is being considered. It is worth noting that you should consider the information you store electronically and we have often highlighted to client that personal comments (and other potentially negative / defamatory information) should be avoided.
Resources
Freedom of Information Act 2000