Our CEO Dyann Heward-Mills, recently presented on data sharing at the Westminster eForum Policy Conference on “Next Steps for UK Data Protection”. She said that “the UK setting high standards on data sharing is to be championed. Among other things, it helps embed trust among consumers and must be matched by an active regulator effectively enforcing these rights.”
With this in mind, data controllers should be aware of the ICO’s Data Sharing Code of Practice (the “Code”), which “gives businesses and organisations the confidence to share data in a fair, safe and transparent way” according to the ICO. The Code was laid before Parliament on 19 May 2021, comes into force after 40 sitting days and applies to data sharing between controllers (not with processors or within organisations).
The Code recommends organisations carry out Data Protection Impact Assessments (DPIAs) for initiatives involving data sharing, although this is not mandatory except in high-risk cases. The Code also recommends that Data Sharing Agreements are put in place, setting out the roles and responsibilities of the respective parties. Guidance is given on data sharing in the context of mergers and acquisitions.
Far from attempting to stymie data sharing, the Code makes clear that in some cases it may be necessary to share data for example, for public health reasons or where there is a serious threat to life.
In her Westminster eForum presentation, Dyann explained the importance of data sharing arrangements being accompanied by a robust infrastructure including ensuring that DPIAs have a mechanism for ongoing review. She commented: “Given the amount of data sharing that has gone on during the pandemic, the private sector needs to look to the public sector for ways of solving data sharing problems.
“Data Protection Officers [DPOs] must be sufficiently independent and protected from interference, they must be cognisant of the Code and ready to ensure that controllers are meeting compliance with it. DPOs should also have the dignity of data subjects in mind, which is particularly important where public-private relationships are concerned.”
