ICO's DRAFT Data Sharing: Code of Practice

This post is relevant to any artist or art organisation that is collecting and sharing any personal data relating to any individual in the UK - irrespective of whether artist or art organisation or art society is based in the UK.

The Information Commissioner' Office for the UK has produced

• a new DRAFT CODE FOR CONSULTATION re. Data Sharing Code of Practice - Draft code for consultation
• this is the covering explanation about the ICO consultation on the draft data sharing code of practice

You can also view a summary of the responses to initial consultation and some of the individual responses on our website.

The updated draft code is

• now out for public consultation and
• will remain open until Monday 9 September 2019.

This is a statutory code of practice made under section 121 of the Data Protection Act 2018. It is a practical guide for organisations about how to share personal data in compliance with data protection legislation.

It explains the law and provides good practice recommendations.
​Following it along with other ICO guidance will help you to:
* manage risks;
* meet high standards;
* clarify any misconceptions your organisation may have about data sharing; and
​* give you confidence to share data appropriately and correctly. 
​
Introduction to the Code (my bold and bullet points)

Cover of the Consultation Document of a Data sharing code of practice - published by ICO 15 July 2019

What happens if we don’t comply with the code?

If you don’t comply with the guidance in this code, you may find it more difficult to demonstrate that your data sharing is fair, lawful and accountable and complies with the GDPR or the DPA.

If you process personal data in breach of this code and this results in a breach of the GDPR or the DPA, we can take action against you.

Tools at our disposal include assessment notices, warnings, reprimands, enforcement notices and penalty notices (administrative fines). For serious breaches of the data protection principles, we have the power to issue fines of up to €20 million or 4% of your annual worldwide turnover, whichever is higher.

There is no penalty if you fail to adopt good practice recommendations, as long as you find another way to comply with the law.

About this code (page 7) My red highlighting re, penalties which can be imposed

Below you can see the contents of the Code of Practice.

The transfer of databases or lists of individuals is a form of data sharing. This may include sharing by data brokers, marketing agencies, credit reference agencies, clubs and societies, and political parties. You are responsible for compliance with the law for the data you receive, and for data that is shared on your behalf. You must make appropriate enquiries and checks in respect of the data, including its source and any consent given. 

​Introduction to the Code

Subscribe to Art Business Info. for Artists - NEWS by Email
and receive every post via email. 
​(Your subscription is only activated after you verify the link in the email you will receive

HIGHLY RECOMMENDED:
If you want to be confident...

• you are doing all the right things in terms of knowing what you should do and then how you share personal data - in letters, databases, lists etc - then read this document
• your voice is heard, if you have any concerns, - respond to this document.

You can respond to the consultation via the online survey, or you can download the document and email [email protected].

The consultation closes on 09 September 2019;

---

NOTE: The Information Commissioner's Office is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.