I've got Andrew Charlesworth's draft guidelines (for JISC) with me here so
I'll give you his interpretation. This guidelines will be checked over by
the DPC although the final interpretation probably lies ahead in case law. (See
- I'm learning about law 'n' everything!)
Personal data such as staff names, pictures, contact details etc that goes
on the www is, by definition, released outside the EU and therefore contravenes
the Eighth DP principal unless one has the consent of the data subject. Data
subjects should be able to assert their normal rights. Institutions should
consider their reasons for displaying the data.
Data that is supplied for the purposes of the normal organisational
functioning and management of the institution (i.e calenders and prospectuses)
should not require the consent of data subjects to be displayed BUT the data
subjects must be informed and they still retain the right to object to the use
of their data where it would cause them significant damage or distress.
Data on the web contravenes the eighth prinicipal, by definition.
If data on the web is not displayed already in printed form then you need
the data subjects explicit consent.
If data on the web is already displayed in printed form, you do not need
explicit consent BUT the data subjects must be informed of this use of their
data and they have rights to object (that seems like a kind of half-way
house)
I will try to draw this to the attention of Phil Boyd when he reads through
the guidelines. I'll let you all know what happens. (Should be this
month).
Amber.
>>> Jane Howard <
[log in to unmask]> 07/20/00 03:15pm
>>>
According to the guidance published by the DPC on transborder
dataflows and the 8th principle, the data controller should
also inform the
data subject that consent to publishing their personal details on the Web means
that their information may
be accessed in countries where their rights are
not protected by law, otherwise the consent is not valid (para 8.2 of
'International Transfers Summary' document). I don't see how this
requirement can be met by merely saying that you can
publish personal data
on the Web because it already exists in printed form.
It would be very
helpful if the ODPC would give some clear guidance on this, rather than issuing
contradictory statements,
so that institutions know exactly where they stand
and what they have to do.
Jane Howard
Administrator
Coventry
University
On Thu, 20 Jul 2000 14:29:18 +0100 Mike Taylor
wrote:
> From: Mike Taylor <
[log in to unmask]>
> Date:
Thu, 20 Jul 2000 14:29:18 +0100
> Subject: RE: Staff Contact
Details
> To:
[log in to unmask],
>
"
[log in to unmask] Ac. Uk"
<
[log in to unmask]>
>
> I disagree. The view
here is that individuals need to explicitly *opt in*.
>
>
Regards,
> Mike
>
>
--------------------------------------------
> Mike Taylor
> INTRA
Project Manager
> Room LG26, John Owens Building
> The University of
Manchester
> Manchester M13 9PL
>
> t: 0161 275 7330
>
f: 0161 275 7122
> e:
[log in to unmask]>
--------------------------------------------
>
>
>
> > -----Original Message-----
> > From:
[log in to unmask]> > [
mailto:[log in to unmask]]On
Behalf Of
> >
[log in to unmask]> > Sent: 20 July 2000
14:11
> > To:
[log in to unmask]> > Cc:
[log in to unmask]> > Subject: RE: Staff Contact
Details
> >
> >
> > I have received advice that
individuals should be informed and at least
> > given the chance to opt
out.
> > Gail Waters
> >
> > > -----Original
Message-----
> > > From: Martin Jones
[SMTP:
[log in to unmask]]
> > > Sent: 20 July
2000 13:04
> > > To:
[log in to unmask]> > > Subject:
Staff Contact Details
> > >
> > > Hi,
> > >
> > > we have a research and commercial dept. who wish to place
Staff
> > > Contact Details (in particular by Speciality/Research
Area) on the
> > > Web. This info currently exists in a book
published by ourselves,
> > > but would we need to get explicit
permission from the100 or so
> > > individuals before we could
publish this electonically ???
> > >
> > >
Thanks,
> > > Martin
