Brodies TechBlog

The Information Commissioner’s Office has just launched a new code of practice on privacy notices – broadly, any form of wording which an organisation uses to tell people what it will do with their personal information.

Although not legally binding, the code is likely to be the regulator’s benchmark from now on when investigating complaints related to privacy notices.

The headline message is to be realistic about how interested people are in reading privacy notices and as to their ability to understand legal language. With that in mind

·         keep the wording clear, succinct and accessible;

·         concentrate on anything which you intend to do with an individual’s information which is not obvious in light of the circumstances in which he or she has provided his or her information;

·         where appropriate, layer a short form privacy notice, highlighting key points, over a fuller notice which can be accessed by anyone who is interested; and

·         remember that the main purpose of a privacy notice is to protect the individual by making sure that he or she understands, in key respects, what you will be doing with his or her information, not to protect your organisation by hiding potentially difficult issues in long and complex legal drafting.

Whilst, arguably, none of this is new (in that it is what, on one interpretation of the law, organisations ought to have been doing anyway), I think we can probably expect to see privacy notices becoming more user friendly, with the code pushing data controllers towards a more pragmatic approach.

All organisations should certainly be reviewing their privacy notices in light of the code. The examples of good and bad practice on the last pages are particularly useful for establishing if you are on the right lines with existing documentation.

Eleanor

Originally Posted 22/06/2009