Code For Handling Personal Data Is Muddled, Says Lawyer

"The Code's high-level guidance on the data life-span, stewardship and accountability is helpful but very much echoes existing guidance from the Information Commissioner's Office and Government," he said. "It's an alternative approach but it's certainly not a new approach."

Malcolm added that some references to the need for consent were wrong.

"The guidance on consent seems inconsistent and therefore muddled," he said. "The initial 'Principles' section [of the Code] suggests consent should be obtained where appropriate, which is the correct position. But the other sections seem to suggest that consent should be collected as a matter of course in a variety of situations."

The 'Principles' section of the Code states: "Individuals should be given as much control as is possible over how their personal information is used and disclosed. This means giving them clear information about this when they provide their personal data and seeking their consent where this is appropriate."

Malcolm says this is consistent with the Data Protection Act and with existing guidance from the ICO.

Another section, though, implies that consent is always required when collecting data. Under the heading 'Responsibilities of the data handler' the Code states: "Data handlers tasked with the collection of personal data should verify that the consent of the data subject has been obtained for the personal data collected."

Malcolm said that notification will suffice in many cases.