Iain Harrison
Information Governance Advisor
T: 01926 883040
Hello,
I would appreciate any thoughts that the list may have on the following scenario.
The scenario is as follows:
Public authority has been approached by a third party in relation to a product they offer. Public authority is interested in the product and would like a demonstration. Third party state that in order to provide a demonstration they will
need access to a large amount of historical personal data held by the authority to run through their system. Third party has offered a ‘Mutual Confidentiality Agreement’ but this does not mention DPA obligations.
Public authority, as far as I understand, remains data controller for the data as in these circumstances they have determined the purpose for which the data is to be processed and the third party is merely offering a product that will achieve
that purpose, thereby third party is a data processor.
My view is that even for the purposes of a demonstration, if personal data is going to be passed to the third party a contractual arrangement must be in place that satisfies the requirements of Principle 7 although am happy to receive any
views to the contrary if I am mistaken.
Many thanks in advance.
Kind regards,
Amy Jaines
Note: We are a Microsoft Office site. Our base version is 2010. Please make sure that files you send can be read in this format. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this e-mail is strictly prohibited save unless expressly authorised by the sender. The information contained in this message is intended for the named recipients only. It may contain privileged and confidential information and if you are not the addressee or the person responsible for delivering this to the addressee, you may not copy, distribute or take action in reliance on it. If you have received this message in error, please notify the sender(s) immediately by telephone. Please also destroy and delete as soon as possible the message from your computer. ********************************************************************************* *********************************************************************************
All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html
Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):
All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm and are sent in the body of an otherwise blank email to [log in to unmask]
Any queries about sending or receiving messages please send to the list owner [log in to unmask]
(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)
All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html
Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):
All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm and are sent in the body of an otherwise blank email to [log in to unmask]
Any queries about sending or receiving messages please send to the list owner [log in to unmask]
(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)