I have come across Andrew Charlesworth's message of 30 May in the archive, and am having difficulty understanding why it
states that consent is not required for publishing non-sensitive staff personal data on the Web if it is for the purposes of
normal organisational functioning. I don't see anything in the DPA or the DPC's Introduction to the Act which suggests that
this is the case. Surely publishing data on the Web is a transfer to countries outside the EEA and thus a breach of the 8th
Principle. I know there are circumstances where the 8th Principle does not apply, but the fact that the data is being
processed for the purposes of normal organisational functioning isn't one of them, surely, whereas consent by the data
subject is.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|