Data Sharing Code of Practice Laid Before Parliament

Data Sharing Code of Practice Laid Before Parliament

The Information Commissioners Office (ICO) has published a new Data Sharing Code of Practice, which was first published in December 2020. The code is designed to provide advice to businesses and organisations on how to share data responsibly. The code of practice was laid before Parliament for 40 sitting days before it went into effect. The UK government laid the Data Sharing Code of Practice before Parliament on 18 May 2021 and it came into force on 14 September 2021. This code provides practical guidance on how to share data fairly and lawfully, and how to meet your accountability obligations.

Introduction

The Information Commissioners Office (ICO) has published a new Data Sharing Code of Practice, which provides practical advice to businesses and organisations on how to carry out responsible data sharing. This code was laid before Parliament on 18 May 2021 and came into force on 14 September 2021. It is a statutory code of practice prepared under section 121 of the Data Protection Act 2018 (DPA 2018) and is intended to be a practical guide for organisations about how to share personal data in a way that complies with data protection law. It aims to give you confidence to share data fairly and proportionately.

Key Provisions of the Code

The Data Sharing Code of Practice sets out key principles for responsible data sharing. These include the need to have a lawful basis for sharing data, ensuring transparency with individuals about how their data is being used, and minimizing the amount of data shared. The Code also emphasizes the importance of accountability, requiring organisations to demonstrate that they are meeting their obligations under the UK GDPR and DPA 2018 when sharing data.

Data Sharing for Law Enforcement

The Code acknowledges the unique requirements for data sharing between law enforcement agencies and other organisations. It highlights the importance of complying with specific legal provisions for law enforcement processing (Part 3 DPA 2018) and provides guidance on ensuring fairness, transparency, and accountability in these contexts. The Code also emphasizes the need for appropriate safeguards to protect individuals’ rights when their data is shared for law enforcement purposes.

Impact on Organizations

The Data Sharing Code of Practice has a significant impact on organisations that share personal data. It requires them to review and, where necessary, update their existing data sharing arrangements to ensure compliance with the new Code. Organisations must demonstrate a clear understanding of the legal basis for sharing data, the purposes for which it is shared, and the safeguards in place to protect individuals’ privacy. Failure to comply with the Code could result in enforcement action by the ICO.

Enforcement and Compliance

The ICO is responsible for enforcing the Data Sharing Code of Practice. Organisations that fail to comply with the Code could face a range of enforcement actions, including assessment notices, warnings, reprimands, enforcement notices, and penalty notices. For serious breaches of the data protection principles, the ICO has the power to issue fines of up to £17.5 million or 4% of your annual worldwide turnover, whichever is higher. The ICO will take the Code into account when considering whether you have complied with your data protection obligations when sharing data.

The table below outlines the key provisions of the Data Sharing Code of Practice, along with the associated legal basis and potential impacts for organizations.

Provision	Legal Basis	Impact on Organizations
Lawful Basis for Data Sharing	UK GDPR, Article 6; DPA 2018, Section 33	Organizations must demonstrate a lawful basis for sharing personal data, such as consent, contractual necessity, or legitimate interests.
Transparency and Individual Rights	UK GDPR, Articles 13-14; DPA 2018, Sections 12-13	Organizations must be transparent with individuals about how their data is shared, including the purposes, recipients, and their rights.
Data Minimization	UK GDPR, Article 5(1)(c); DPA 2018, Section 34(1)(c)	Organizations should only share the minimum amount of data necessary for the intended purpose.
Accountability	UK GDPR, Article 5(2); DPA 2018, Section 34(2)	Organizations must demonstrate that they are meeting their obligations under the UK GDPR and DPA 2018 when sharing data.
Security and Confidentiality	UK GDPR, Article 32; DPA 2018, Section 35	Organizations must take appropriate technical and organizational measures to protect personal data against unauthorized access, processing, or disclosure.

This table highlights the key differences between the 2011 Data Sharing Code of Practice and the new code published in 2020.

Provision	2011 Code	2020 Code
Legal Framework	Data Protection Act 1998	UK GDPR, DPA 2018
Emphasis on Accountability	Less explicit	Stronger focus on demonstrating compliance
Transparency and Individual Rights	More general guidance	Detailed requirements for informing individuals
Data Minimization	General principle	Specific guidance on minimizing data shared
Security and Confidentiality	Broader guidance	More detailed requirements for technical and organizational measures
Enforcement	Less stringent	Increased enforcement powers for the ICO

This table provides a summary of key steps organizations should take to ensure compliance with the Data Sharing Code of Practice.

Step	Description
Review Data Sharing Arrangements	Assess existing data sharing practices and identify any areas requiring updating to align with the Code.
Identify Legal Basis for Data Sharing	Establish a lawful basis for each data sharing activity, such as consent, contractual necessity, or legitimate interests.
Ensure Transparency and Individual Rights	Provide clear and concise information to individuals about how their data is being shared, including purposes, recipients, and their rights.
Minimize Data Shared	Only share the minimum amount of data necessary for the intended purpose.
Implement Data Protection Measures	Take appropriate technical and organizational measures to protect personal data against unauthorized access, processing, or disclosure.
Document Data Sharing Practices	Maintain clear and comprehensive records of data sharing activities, including the legal basis, purposes, and safeguards implemented.
Monitor and Review Compliance	Regularly review data sharing practices to ensure ongoing compliance with the Code.

Relevant Solutions and Services from GDPR.Associates

GDPR.Associates offers a range of solutions and services to help organizations comply with the Data Sharing Code of Practice and other data protection regulations. These include⁚

• Data Protection Audits⁚ We conduct comprehensive audits to assess your organization’s data protection practices and identify areas for improvement.
• Data Sharing Policy Development⁚ We help you develop robust data sharing policies that align with the Code and your specific business needs.
• Data Mapping and Documentation⁚ We assist you in mapping your data flows and documenting your data sharing practices to demonstrate compliance.
• Data Protection Training⁚ We provide training to your staff on data protection principles, legal obligations, and practical guidance on data sharing.
• Data Breach Response⁚ We offer expert support in responding to data breaches, including incident management, notification, and remediation.
• Data Protection Consulting⁚ We provide ongoing consulting services to help you navigate complex data protection issues and maintain compliance.

Contact us today to learn more about how GDPR.Associates can help your organization achieve data protection compliance and manage data sharing responsibly.

FAQ

Here are some frequently asked questions about the Data Sharing Code of Practice⁚

• What is the Data Sharing Code of Practice?

  The Data Sharing Code of Practice is a statutory code of practice published by the ICO, providing guidance to organizations on how to share personal data lawfully and responsibly in compliance with the UK GDPR and DPA 2018.

• Who does the Code apply to?

  The Code applies to all organizations that share personal data, including businesses, charities, public sector bodies, and others.

• Is the Code legally binding?

  While the Code is not legally binding in itself, the ICO will take its provisions into account when assessing compliance with data protection laws. Failure to comply with the Code could result in enforcement action.

• What are the key provisions of the Code?

  The Code outlines key principles for data sharing, such as having a lawful basis for sharing data, ensuring transparency with individuals, minimizing data shared, and demonstrating accountability.

• How can organizations comply with the Code?

  Organizations need to review their existing data sharing practices, identify any areas requiring updating, and implement robust policies and procedures to ensure compliance with the Code.

If you have any further questions about the Data Sharing Code of Practice, please visit the ICO website or contact GDPR.Associates for expert guidance.

The Information Commissioners Office (ICO) has published a new Data Sharing Code of Practice that provides practical advice to businesses and organisations on how to carry out responsible data sharing. This code is a statutory code of practice prepared under section 121 of the Data Protection Act 2018 (DPA 2018) and is intended to be a practical guide for organisations about how to share personal data in a way that complies with data protection law. It aims to give you confidence to share data fairly and proportionately. The code was laid before Parliament on 18 May 2021 and came into force on 14 September 2021. The code provides guidance on a number of important issues related to data sharing, including the need to have a lawful basis for sharing data, ensuring transparency with individuals about how their data is being used, and minimizing the amount of data shared. The code also emphasizes the importance of accountability, requiring organisations to demonstrate that they are meeting their obligations under the UK GDPR and DPA 2018 when sharing data.

The code is designed to help organisations to understand their obligations under the UK GDPR and DPA 2018 and to provide them with practical guidance on how to comply with those obligations. The code does not impose any additional barriers to data sharing, but it will help organisations to comply with their legal obligations. It is essential for all organisations that share personal data to be aware of the provisions of this code and to take steps to comply with them. Failure to comply with the code could result in enforcement action by the ICO.

In addition to the information provided in the code, organisations should also consult with the ICO’s website and other resources for further guidance on data sharing.