Here's what I sent to Richard yesterday ... I went through this in my old company and did seek advice from the DPC who were very helpful. We suggested to the DPC that collecting NOK details or what we preferred to call 'emergency contact details' (fairly neutral) without the consent of the EMC, could be achieved because: 1: it was in the interests of the employee ( say they had an accident and we/the hospital needed to be aware of any particular reactions to medicines / defibrillators etc and needed EMC details for confirmation of these requirements/notification of serious injury etc 2: we would advise the employee via the form that they should notify the EMC of the disclosure to us of the EMC's details 3: it would involve disproportionate effort - this was looked on favourably (bearing in mind that we had 8500 employees in Europe and 65000 worldwide) - see the DPC's intro to the Act for advice on disproportionate effort ( Sch1) 4: written assurances to the employee that EMC data would only be used only for emergency purposes I hope this is of some use. best regards Pat Walshe %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%