--------------------------------------------------------------This story was printed from ZDNet UK,
located at http://news.zdnet.co.uk/
--------------------------------------------------------------

Location: http://news.zdnet.co.uk/story/0,,t269-s2104882,00.html

Data protection code lays down law for IT staff
Data protection code lays down law for IT staff

Matt Loney

IT staff have new responsibilities for ensuring compliance with the Data
Protection Act 1998, which came into full force last autumn, according to
a code of practice to be published next week.

The code, which details best practices for compliance with the law when
recruiting staff, says IT managers are should consider themselves equally
responsible with HR managers for ensuring that out-of-date personnel
records are deleted from computers.

The code is the first of four parts of the Employment Practices Data
Protection Code that is being drawn up by the Information Commission. The
Data Protection Act, which the codes address, was drawn up mainly to
protect personal data held on computers, but also relates to data stored
on paper or microfiche and held in any "relevant filing system", which
means, according to the commission, any set of information about workers
in which it is easy to find a piece of information about a particular
worker. In addition, information collected with the intention that it be
put in a relevant filing system is covered.

"It is important to remember that data protection compliance is a
multi-disciplinary matter," says a draft copy of the code. "For example,
a company's IT staff may be primarily responsible for keeping
computerised personal information secure, whilst a human resources
department may be responsible for ensuring that the information requested
on a job application form is not excessive, irrelevant or inadequate."

All workers, including line managers, have a part to play in securing
compliance, "even if only to ensure that waste paper bearing personal
information is properly disposed of."

The code also addresses selection processes by automated means, and warns
that job applicants may have a right to see the logic involved in making
decisions based on automated procedures.

An example of a decision that is covered is where an individual is
shortlisted purely on the basis of answers provided through a touch-tone
telephone in response to psychometric questions posed by a computer. Any
applicant who is rejected or treated in a way that is significantly
different from other applicants solely as a result of the use of an
automated process will have the right to see how the decision was made.

The code will be published next week on the Information Commission's Web
site. Later this year, the Commission expects to publish codes of
practice for keeping employment records, monitoring employees at work,
and medical testing.

************************************************************************************
Distributed through Cyber-Society-Live [CSL]: CSL is a moderated discussion
list made up of people who are interested in the interdisciplinary academic
study of Cyber Society in all its manifestations.To join the list please visit:
http://www.jiscmail.ac.uk/lists/cyber-society-live.html
*************************************************************************************