 |
 |
I have come across Andrew Charlesworth's message of 30 May in the archive, and am having difficulty understanding why it states that consent is not required for publishing non-sensitive staff personal data on the Web if it is for the purposes of normal organisational functioning. I don't see anything in the DPA or the DPC's Introduction to the Act which suggests that this is the case. Surely publishing data on the Web is a transfer to countries outside the EEA and thus a breach of the 8th Principle. I know there are circumstances where the 8th Principle does not apply, but the fact that the data is being processed for the purposes of normal organisational functioning isn't one of them, surely, whereas consent by the data subject is. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%