Which was what I said, except that you chose consent as your Sch.2
condition, and I didn't... My brain's fine, thanks, as is my sense of tact
:-)
Andrew
> ...I would have thought that the questions would be:
>
> - Purpose - is there a clear and lawful purpose (or purposes) for the
> data sharing? I would have thought we could consider accepting research
> as a clear and lawful purpose, **even without invoking the exemption in
> s.33**
>
> - Fairness - in the circumstances, is the nature and extent of the data
> sharing a proportionate means of achieving that purpose when weighed
> against the interests of the Data Subject?
>
> - Transparency - has a degree of notice proportionate to the
> circumstances been provided in advance to Data Subjects about possible
> data sharing of their personal data?
>
> Thus:
>
> If the University believes the organisation will use the data in a
> legitimate fashion, then can condition 6 in Schedule 2 DPA 1998 be used
> "processing is necessary in order to pursue the legitimate interests of
> the data controller or third parties and is not unfair to the
> individual"?
>
> If the goal of the data sharing is to contact the students for a research
> project, then is this method of obtaining the information
> proportionate/fair? (see Samantha's e-mail for an alternative).
>
> In terms of analysing the fairness, the transparency of the process is
> important - have students been adequately informed of the likelihood of
> their information being shared for this purpose?
>
> I would also recommend a clear mechanism allowing students to opt-out of
> this type of data sharing.
>
> In short - I don't think s.33 is necessarily the starting point for
> consideration here.
--On 29 February 2008 16:23 +0000 POUNDER Chris
<[log in to unmask]> wrote:
> Come on guys - I know it's Friday!!
>
> Unless my brain is missing, I think the request for details about
> students is not the research purpose here - the researcher is asking for
> a list of students so their attitudes etc can be assessed!
>
> The research could be into things like "what students eat for breakfast
> when they get up in the afternoon"; the researcher is asking "can I have
> a list of students please".
>
> Section 33 is irrelevant here. It applies when a data controller is
> doing the actual research into about STUDENTS.
>
> So normal fair processing notice + Sched 2 condition please (most likely
> consent) if there is a disclosure of personal data.
>
>
> C
Andrew Charlesworth
Senior Research Fellow in IT and Law
Director, Centre for IT and Law
School of Law/Department of Computer Science
University of Bristol
Wills Memorial Building
Queens Road, Bristol BS8 1RJ
Tel: 0117 954 5633 (CompSci)
Fax: 0117 954 5208 (CompSci)
E-mail: [log in to unmask]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|