DPA – Complying in the digital transition Dawn Monaghan, Group Manager, Strategic Liaison ICO UK

Contextual questions The digital age? DPA – Obligations Key pitfalls What happens if I get it wrong? Help to get it right

The digital age What do you mean by digital? More flexibility, quicker, easier, global Is it easier to loose information in a non digital or digital format? Can you find information easier on a non digital or digital format? What are the differences in the obligations?

Same 8 Principles Data Sharing protocols Who is the Data Controller/s When is a data processor not a data processor? Privacy, confidentiality, governance, assurance, quality Organisational responsibilities DPA - obligations

Key Pitfalls Thinking that 'digital' automatically simplifies Believing Digital = Technology = IT Lack of clarity about who has responsibility Not thinking 'Privacy by design' Failing to manage 'customer' expectations Monitor

Nature of the data Amount of people affected Distress/harm Track record Enforcement action Civil Monetary Penalties What happens if you get it wrong

Help to get it rights Guidance on the website Data Sharing Code of Practice Privacy Notice Code of Practice Annoymisation Code of Practice Helpline/e newsletter/ webinars/blogs etc.

In summary Obligations the same whatever the format Can become more complex try to simplify at each stage Build in privacy at the beginning Understand who does what when and where the responsibility lies Tell people what you are doing manage their expectations Use the ICO website and other tools