The UK Information Commissioner Office ("ICO", the UK data privacy agency) has recently issued an informative code of practice to assist companies collecting personal data so that they can better draft clear privacy notices to data subjects about how the company intends to use personal data, and especially when such data is considered to be of a confidential or sensitive nature. The published guidelines are subject to a consultation period and will be finalized after the consultation period ends, on April 3, 2009.
In issuing the guidelines, the ICO made clear that privacy polices were essential to reassure companies’ potential and existing customers that that the privacy of their data is taken seriously.
The principal purpose of the guidelines is to remind companies that they must inform all data subjects about:
- the transfer of data to other companies and overseas;
- the duration of storage;
- the measures taken to ensure the security of the personal data;
- the possibility to object to direct marketing;
- who to contact if there is a complaint.
In promulgating the guidelines, the ICO reminded the companies of their obligations under the EU Data Protection Directive of 1995, which provides that all personal data must be processed "fairly and lawfully."
At a time when data breaches and online marketing have become increasingly common, it is essential that UK companies issue transparent policies about the collection, use, sharing, and security of personal data.
Jeremy Mittman in Proskauer’s Los Angeles office contributed to this post.