The ICO is working on updating its data sharing code of practice, which was first published in 2011. This work is required by the Data Protection Act 2018.
The updated draft code of practice will explain and advise on changes to data protection legislation where these changes are relevant to data sharing. It will address many aspects of the 2018 legislation including transparency, lawful bases for processing, the accountability principle and the requirement to record processing activities.
The code of practice is a statutory code of practice under section 121 of the Data Protection Act 2018. It explains the law and provides good practice recommendations. The aim is that following it along with other ICO guidance will help organisations to manage risks; meet high standards; clarify any misconceptions an organisation may have about data sharing; and give organisations confidence to share data appropriately and correctly.
The code does not impose any additional barriers to data sharing, but aims to help organisations comply with their legal obligations under the GDPR and the DPA 2018. It also contains some optional good practice recommendations, which do not have the status of legal requirements but aim to help organisations adopt an effective approach to data protection compliance. It also covers some special cases, such as databases and lists, sharing information about children, data sharing in an emergency, and the ethics of data sharing.
Under section 127 of the DPA 2018, the ICO must take the code into account when considering whether you have complied with your data protection obligations in relation to data sharing. In particular, the ICO will take the code into account when considering questions of fairness, lawfulness, transparency and accountability under the GDPR or the DPA 2018.
The code can also be used in evidence in court proceedings, and the courts must take its provisions into account wherever relevant.
The consultation, which follows a call for evidence in 2018 as the first part of the process, ends on 9 September 2019.
