The Information Commissioner's Office (ICO) has published
guidelines on what privacy policies should look like and is
engaging in a consultation on its draft code of practice.
"The ICO believes that some existing privacy notices contain too
much legal jargon and are written to protect organisations, rather
than to inform the public about how their information will be
used," said an ICO statement about the consultation.
Privacy policies are the explanations that companies use when
they gather people's personal information such as names, addresses
and telephone numbers. They are often published side by side with
fair collection statements. The gathering and use of this
information is governed by the Data Protection Act (DPA).
The ICO has published its code of practice in order to encourage
companies to be clear and fair about how they will use data, it
said.
"Collecting information about people in the proper way lies at
the heart of good data protection practice," said Iain Bourne, head
of data protection projects at the ICO. "As more and more of our
personal details are collected, we want to ensure that privacy
notices provide clear, user friendly information to the public
about how their personal details will be used and what the
consequences of this are likely to be."
Privacy notices should be used when information will be used in
an unusual way said Commissioner Richard Thomas in the consultation
document.
"The duty to actively communicate a privacy notice is strongest
where the intended use of the information will be unexpected,
objectionable or controversial, or where the information is
confidential or particularly sensitive," he said.
Thomas said that good privacy policies will "make sure
individuals know how information about them will be used, and what
the consequences of this are likely to be. It will also allow them
to build up a picture of the sheer scale and sophistication of the
systems that collect so much information about all of us".
The DPA allows the ICO to prepare codes of practice, but a
breach of the code will not in itself be a breach of the law, and
the ICO could not take direction action on code breaches.
The ICO said that it will take account of a company's compliance
with the code's principles when a complaint has been made to it
about a company's privacy practices.
The DPA demands that companies process personal information
fairly. The ICO said in its guidance that this can mean either that
it is processed as people would expect it to be, or that it is
processed differently but a privacy notice informs them of
this.
The draft code of practice contains examples of good and bad
privacy notices. The consultation on the draft is open until 3
April.
Pinsent Masons and Amberhawk Training are holding an Update
session on 26th January in London where up to date data protection
topics are the agenda. If you are interested in this event, please
email chris.pounder@amberhawk.com
for a brochure.
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
