The Information Commissioner, responsible for enforcement of the
Data Protection Act, has commissioned a study to ascertain the
extent of compliance by UK web sites, to be carried out during
January and February 2002. All UK-based web sites should have been
fully compliant with the Act of 1998 since 24th October 2001.
The study will review the compliance of a wide range of web sites operated by both large and small organisations. The results of the study will be used to raise awareness of data protection requirements as well as to direct future guidance and enforcement action.
Organisations operating web sites that collect personal data – which can be information as basic as e-mail addresses - should ask themselves:
- Does our website have data protection notices and a privacy policy?
- Have we notified the Information Commissioner of our processing activities?
- Does our notification reflect what we do in practice?
- Have we considered the direct marketing requirements?
- Is our web site secure?
In addition to these questions, how long personal data are kept for, to whom the data are disclosed, the use of cookies and many other factors will all influence compliance with the Act.
Non-compliance can lead to enforcement action by the Commissioner. This can include prosecution, resulting in fines and being prevented from using the personal data until the data have been properly re-collected. Company directors also face personal liability where offences are attributable to their neglect.
Organisations that have not done so should carry out a review of their on-line activities as well as their underlying data handling procedures to ensure compliance with the Act.
The specialist information law team of Masons, the law firm behind OUT-LAW.COM, is offering a web site review service to assist organisations in achieving compliance. This will provide an organisation with a report and recommendations for web site compliance. A range of follow-up services can also be provided to ensure that an organisation achieves and maintains compliance.
