Ultimately it is really down to each organisation to satisfy themselves that they have the correct advice from their organisations' legal advisors before embarking on these kinds of projects that involve any kind of personal data. We all remember the damage to HM government from the missing CD's a few years back, I wouldn't wish that kind of adverse publicity to affect the museum sector.
Tony
-----Original Message-----
From: Museums Computer Group [mailto:[log in to unmask]] On Behalf Of Tony Crockford
Sent: 06 May 2011 14:19
To: [log in to unmask]
Subject: Re: Newsletter software
On 6 May 2011, at 13:59, HARRIS TONY wrote:
> However, we have been advised legally that using these two services would breach data protection law as you are exporting personal data outside of the UK and EU if you move your existing contacts list to these new services.
To answer my own question. For the list of names and email addresses to qualify as Personal Data under the terms of the DPA the list would need to include an expression of opinion.
A simple list of names and email addresses would not, in my understanding of the act, be classed as personal data and therefore unaffected by the physical location that the list is stored, or processed.
from the key definitions section here:
http://www.ico.gov.uk/for_organisations/data_protection/the_guide/key_definitions.aspx
Personal data means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
I think this example from the same site, also allows the use of a mailing list company in the USA
Example
Company A in the UK sends its customer list to company B outside the EEA so that company B, acting as a processor, can send a mailing to company A's customers. It is likely that adequate protection exists if:
* the information transferred is only names and addresses;
* there is nothing particularly sensitive about company A's line of business;
* the names and addresses are for one-time use and must be returned or destroyed within a short timescale;
* company A knows company B is reliable; and
* there is a contract between them governing how the information will be used.
I also refer you to this:
http://www.campaignmonitor.com/files/campaign-monitor-eu-data-transfer-clauses.pdf
On that basis I think it's okay to use Campaign Monitor for lists of names and email addresses gathered in the UK.
****************************************************************
website: http://museumscomputergroup.org.uk/
Twitter: http://www.twitter.com/ukmcg
Facebook: http://www.facebook.com/museumscomputergroup
[un]subscribe: http://museumscomputergroup.org.uk/email-list/
****************************************************************
This email was received from the INTERNET and scanned by the Government Secure Intranet anti-virus service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) In case of problems, please call your organisation's IT Helpdesk.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
****************************************************************************
This email and its contents are the property of the Department for Culture, Media and Sport.
If you are not the intended recipient of this message, please delete it.
All DCMS e-mail is recorded and stored for a minimum of 6 months
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
****************************************************************
website: http://museumscomputergroup.org.uk/
Twitter: http://www.twitter.com/ukmcg
Facebook: http://www.facebook.com/museumscomputergroup
[un]subscribe: http://museumscomputergroup.org.uk/email-list/
****************************************************************
|