 |
 |
This is fascinating stuff. I can quite understand permission to publish photos and other personal details being denied, but I'm amazed that email addresses are going to be treated as personal data - I've always regarded email addresses like telephone numbers - they are the property of the organisation which allocates them, not the individual to whom they are allocated. After all, the individuals cannot take them with them when they change jobs. Furthermore, the email addresses and telephone numbers are, as I understand it, not allocated for personal use but for business-only use by the individual employee. If these are regarded as personal then institutions, starting with ours, would charge their employees for the service! As 'institutional information' it should be up to the institution whether or not it chooses to publish such a list. If what you're saying is true, I'm appalled. A few years ago we asked our LIS staff to permit/deny permission in writing for the web publication of their photos. One third, understandably, refused permission. Can we expect this scale of refusal for publication of email addresses and telephone numbers? I think we shall have to consider a carefully worded re-registration as Colin has just described. Rob. (LIS DPO) Dr Robert C. Symberlist Network Multimedia Consultant, Library and Information Services, University of Wales Swansea Singleton Park Swansea SA2 8PP Tel: 01792 295619 Fax: 01792 295851 http://www.swan.ac.uk/lis/ -----Original Message----- From: [log in to unmask] [mailto:[log in to unmask]] Sent: 07 May 1999 14:13 To: [log in to unmask] Subject: Re: Data Protection Act issues ** Reply to note from Adrian Tribe <[log in to unmask]> Fri, 07 May 1999 10:12:14 +0100 Hi, I happen to be the DPO for the University of Dundee and also happen to be the person who for the time being has done an "internal" email directory. Nice to receive a detailed email! > 1. 'Consent' > ============ You are correct in what you say about consent. It has to be explicit. That is, explicitly given that someone wants to be included in any such directory. Transfer of data inside/outside the EU does not really come into it if you are putting data on the web, because automatically transfer is worldwide. > An opt OUT system should still be OK at the point at which data is > gathered (i.e. at the point at which staff/students enter the Uni and > e-mail or telephone accounts are set up). Correct but then your student records should be modified to hold the extra field(s), and ideally your directory ought to have access to the information, and there is the danger that for ever you will be shuffling paper. There is a further issue with disclosing student details (sexual harrasment comes to mind) where even if the student has opted in there is at least some "moral liability" if the student comes to any harm. > Phil Boyd suggested having departmental > staff meetings and explaining the intentions of having a public > directory etc and asking staff then to tell you if they want to opt > OUT. That way, you know that the staff concerned got your message > and understood it, so by choosing not to opt OUT they are indeed > giving their consent. Good idea. In a fair size institution though you have a constant turnover of staff, how do you handle the new staff? Are you likely to get Human Resources (Personnel) to put another form out to staff asking them to opt in/out of an email directory? The punchline is that by Oct2001 all Email addresses on the web will have to be given an opt in by their holders :-) else we are breaking the law. Further since you do not mention it anywhere, some of the supplementary guidelines for the 1984 act said [my paraphrasing] that publicly available email addresses should have adequate protection. I take that to mean that you should display them one at a time and in a way that a robot could not go and extract all of them (well a specifically written robot could but keep it in proportion). The difficulties I find are the following: - You will end up with a very small number of inclusions if you send out a form. People are busy and most could not care less about an EMail directory. You need to retain the paper (yuk) and also have it in an electronic database. (Electronic forms could be used but then you will get even less response). - You are talking in terms of creating the database of EMail addresses from scratch. In our case I extract the info from the NDS tree, process it, and place it where it used by the search scripts. There are alternatives for those with the right technology to access the nds tree directly or x500 directories and so on. The problem with all these solutions is that you need other people to do their bit in terms of feeding in the correct data (for staff opting in/out etc). That will be the day ;-) In my view the key is to find a way of getting: (a) most of your staff to opt in (b) automatically or with little work create a list of those who are "in" (c) ditto for students. The rest would be a case of writting programs. >2. Students as Data Controllers? >================================ The conference people seem to have suggested that students should notify the Registrar's dept themselves. Ehmmmm, we are also being told to minimise the numbers of registrations we do (ideally down to 1) as the charges will be penalising the bigger organisations and those with more as opposed to fewer registrations. Thus this contradicts the advide the DPR's office has been giving in different occasions. Then you may have (we do) students, particularly medics, who use real personal data as part of their studying, coursework etc. They definatelly do not have to register with the DPR. My view is that the educational institution will ultimately be responsible but I cannot really see a student infringing DP legislation. If there is some dispute there will be a sligtly different issue, eg. defamation with DP thrown in as a good measure. >Apologies for the length of this e-mail! ditto. At least you know someone read it :-) Regards Charles ============================================== Charles Christacopoulos, Secretary's Office, University of Dundee, Dundee DD1 4HN, (Scotland) United Kingdom. Tel: +44+(0)1382-344891. Fax: +44+(0)1382-201604. WebDad of http://somis.ais.dundee.ac.uk/ Home of the Scottish Search Maestro http://somis2.ais.dundee.ac.uk/ Happily using OS2 Warp. ============================================== %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%