In a message dated 22/09/2000 12:37:46 GMT Daylight Time,
[log in to unmask] writes:
<< Have any of you been asked by the South African High Commission in
London for the names of all African Economics graduates between 1980
and 1990? Apparently they are investigating a fraud case where the
suspect is using multiple identities.
By not doing so we would be inhibiting the progress of a criminal
investigation, and we do wish to cooperate as far as DPA legislation
permits. We would definitely confirm such details about a named
individual (since graduation is a public event), but we have
reservations about providing a list of Economics graduates just to
facilitate a 'fishing expedition'.
I am minded to ask them to provide the specific names they wish to
investigate, and then we can confirm whether the person holds a degree
from us, rather than just provide a list of *everybody* graduating in
Economics over a 10-year period.
Any advice? >>
-------------------------------
Disclosures for the purposes of crime detection are allowed under section
29(3) of the DPA only where the data controller (i.e. the university in this
case) is convinced that failure to disclose would prejudice the purpose (i.e
the detection of the crime where that detection is undertaken by a recognised
authority - please check whether the SA High Commission have jurisdiction).
This exemption can only be used on a case-by-case basis - in other words they
would have to provide an exemption certificate for each of the persons of
whom they require details - and not for "fishing trips".
Transfer overseas (assuming the SA High Comission is not UK territory) of
this information would require the individuals' informed consent except where
an international agreement existed for crime purposes (but even then it would
be our police making the transfer, not a university).
According to the law of this country, alleged offences over 6 years old would
generally be outside the limitations period for bringing action anyway. If
you do still have the details going back 10 years have you already kept them
for longer than necessary in breach of DPA??
These are just a few things to consider before you refuse to give the details
unless a UK court order is produced.
Ian Buckland
MD
Keep IT Legal Ltd
Please Note: The information contained in this document does not replace or
negate the need for proper legal advice and/or representation. It is
essential that you do not rely upon any advice given without contacting your
solicitor. If you need further explanation of any points raised please
contact Keep I.T. Legal Ltd at the address below:
55 Curbar Curve
Inkersall, Chesterfield
Derbyshire S43 3HP
(Reg 3822335)
Tel: 01246 473999
Fax: 01246 470742
E-mail: [log in to unmask]
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|