Government requires new consent exemption in order to implement new sensitive personal data sharing initiative, expert says

However, data protection law specialist Kathryn Wynn of Pinsent Masons, the law firm behind Out-Law.com, said that even with such an exemption the bodies may still be find it difficult to justify sharing individuals' sensitive personal details amongst each other without having to inform those individuals about the activity.

Earlier this week the Guardian reported that Cabinet Office Minister Francis Maude will next month unveil plans for a new law that would provide Government departments and public sector organisations with a "fast-track mechanism" to use personal data collected by other departments or public bodies for purposes different to originally intended.

The scheme could involve sensitive personal data collected by doctors or the police being made available for use by other bodies without individuals' "consent or knowledge", the paper's report said.

Under existing data protection legislation special rules are set out to govern the processing of sensitive personal data, such as information relating to medical records or information about suspected or convicted criminals.

Wynn said that the Government risks "cutting across" the existing rules unless the new law is carefully drafted and contains "robust" privacy safeguards.

Under the Data Protection Act (DPA), personal data must be processed fairly and lawfully. Organisations are required to satisfy one of six lawful processing conditions - obtaining an individual's consent is one condition that meets that requirement.

However, consent is not required if "the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject," according to the 'legitimate interests' condition - one of the other lawful conditions set out in the DPA.

"At the moment, if an organisation wishes to share sensitive personal data, it must satisfy the first data protection principle," Wynn said. "The data sharers would be required to ensure processing is fair and lawful and that individuals have been issued with a fair processing notice."

"The data sharing bodies may also be able to rely on the 'legitimate interests' justification for processing data without consent provided that they have made an assessment to ensure that the data sharing will not be prejudicial to the individuals," she said.

"The bodies would also have to ensure that one of the grounds for processing sensitive personal data has been satisfied – this is fairly narrow so the only condition that an organisation would be able to rely on for general data sharing is obtaining the individual’s explicit consent. As the requirements to obtain explicit consent can be tricky from an administrative / logistical perspective, an exemption or derogation from having to obtain explicit consent in order to process sensitive personal data would facilitate data sharing," Wynn said.

"However, it would be hard for the Government to justify an exemption from the fair processing notice requirements – i.e requiring the data sharing bodies to tell individuals about the nature and extent of the data sharing – unless to do so would be prejudicial to the purposes of obtaining that data sharing," she said. "Such an example may be where tax officers are investigating individuals for benefit fraud and are perhaps looking to obtain data about those people from other Government departments, although the DPA already an contains exemption that deals with such a scenario."

"There should be no reason why participating bodies should not tell individuals about data sharing unless such an exemption applies," she said.

The DPA contains an exemption which states that personal data can be processed for the purposes of the prevention or detection of crime without having to inform individuals if informing the individuals would jeopardise the ability to prevent or detect crime.

Wynn said organisations involved in any new data sharing initiative should conduct a privacy impact assessment (PIA) prior to entering such a scheme as one means of safeguarding individuals' right to privacy.

"A thorough PIA would identify only the data that was necessary for the specific purposes of the scheme was processed," she said. "While it is one thing to make it more convenient to share personal information it should not be at the cost of privacy so the PIA would allow the bodies to balance those interest and allow them to identify the least intrusive way of sharing data."

Where practical , organisations involved in any new personal data sharing scheme should anonymise the personal data (so that individuals are no longer identifiable) prior to the information being made available through the scheme, Wynn said. Alternatively Government departments and public bodies could anonymise or pseudonymise data they obtain from other organisations involved in the initiative, she said.

"In terms of any new legislation the devil will be in the detail, but it could be that it cuts across the fundamental principles of the DPA. However, if the privacy safeguards are robust it may result in only minor changes to the existing law. In any case data sharers would have to consider the draft European Data Protection Regulation which seeks to enhance data subjects' rights. Government should encourage organisations to liaise with the Information Commissioner's Office (ICO) to allow it to audit any data sharing processes as this would demonstrate their commitment to privacy publically and show that the rights of the individual are considered to be a priority."

According to guidance issued by the UK's data protection watchdog last May, organisations must establish whether it is justified to share information in the first place and ensure that only the information required to achieve the objective of the sharing is disclosed.

The ICO's guidance advises organisations to employ 'need to know' principles to restrict access to personal data they hold, and assess whether a data sharing arrangement needs to be ongoing or on a one-off basis. Common rules should be established for how data is shared to make sure it is secure, and reviews of the processes should be made, it said.

"We are aware that the Cabinet Office is developing proposals to enable greater data sharing across government and the public sector," the ICO said in a statement. "We look forward to commenting on these proposals when they are published."

“In the meantime we continue to advise bodies involved in data sharing on how they can comply with the Data Protection Act. This includes explaining the privacy safeguards that must be in place. We have published a statutory code of practice on Data Sharing and will continue to work closely with central government and associated stakeholders to ensure that individuals’ information rights are protected.”