Any business intending to share data should first consider ICO’s Data Sharing Code of Practice (the Code).
Familiarity with the Code will enable you to start to understand your obligations and restraints with regard to sharing data within the course of your business.
The guidance also provides a checklist which will assist you in the process of deciding whether or not to share data with a third party.
This blog post looks at some of the factors you may wish to consider in deciding to share information.
Systematic Data Sharing
When dealing with systematic data sharing (where you share data on an on-going basis) the checklist states that you should consider the following questions:
1. Is the sharing justified?
In doing this you should look at; the potential utility of the sharing of the data, the proportionality of the sharing, the benefits/risks to individuals/society for sharing/not sharing, and whether the objective could be achieved without sharing the data?
2. Do you have the power to share?
Think about the type of organisation that you work for, any relevant functions or powers that organisation possesses and the nature of the information you have been asked to share. Are there any legal obligations to share this information?
Should you decide to share, you should ensure that a meticulous data sharing agreement is in place which embodies the above considerations along with provision for factors such as; the data to be shared, the data retention periods, the measures to ensure security and the organisations involved. Please note, this is not an exhaustive list.
One-off Requests
1.Is the sharing justified?
You should consider whether you should share the information at all; what are the benefits/risks of doing so and would it cause harm to the individual whose information you are sharing? You should also consider whether there is an exemption in the Data Protection Act which militates against sharing
2. Do you have the power to share?
You should consider this question in the same way as systematic data sharing.
Should you decide to share, it is imperative that you only share what is necessary and that this should be passed on securely, to the right person. You should also consider whether it is appropriate to inform the individual that you have shared their information.
It is also important that you document the above considerations and provide evidence and reasoning for each decision.
However, if you find yourself in such an arrangement, you should seek the advice of a competent business solicitor. This aspect of business practice is set to become very important in the coming years. The price is high for failing to comply.
Our practice headed by Shubha Nath has extensive expertise on Data Sharing Agreements as well as advising on one-off matters. For further information, please get in contact with us.