Subscribe

Data protection or customer protection?

By Basheera Khan
Johannesburg, 15 Jul 2002

When it comes to the small print of any agreement which consumers enter into with service providers, chances are that in the UK, the wording of the clause relating to the sharing of the consumers` personal information with third-parties will be such that the consumer will have to opt out, rather than choosing to opt in.

I`d have unwittingly joined the ever-growing list of people who have to use a forklift to clear every morning`s junk mail.

Basheera Khan, UK correspondent, ITWeb

Personally, I think it is more honourable for businesses to allow their customers the liberty of choosing to opt in. It`s been my experience that having to check the opt out box in numerous forms makes me feel hounded; it`s similar to the experience of trying to fend off an unsolicited telesales phone call.

To add insult to injury, the last time I chose to thwart a service provider`s data sharing machinations, the personnel member facilitating the process seemed mildly affronted that after she`d asked me to "sign here please", I not only took the time to read the small print, but also chose to remain untouched by that business` partner information and offerings.

If I`d complied with her request, thinking that of course, the business only had my best interests as a consumer at heart, I`d have unwittingly joined the ever-growing list of people who have to use a forklift to clear every morning`s junk mail.

It`s clear from that and similar experiences that many businesses simply don`t understand their obligations under the Data Protection Act, and that their staff have received little or no training in this regard either.

And this is despite the fact that the number of complaints made against companies under the Act have increased significantly, according to the annual report released by the Office of the Information Commissioner, the independent supervisory authority which enforces and oversees the Data Protection Act 1998 and the Freedom of Information Act 2000.

Research this year by the commissioner, Elizabeth France, has found that 42% of people with their details stored electronically were aware of the Data Protection Act, compared with 27% last year.

In 1999-2000, the UK public filed 4 300 data protection-related complaints. In 2002-2003, it filed 12 500 complaints.

This indicates that businesses are not necessarily getting worse at data protection, but that the public is increasingly aware of the facts that its information is being processed, that things can go horribly wrong and that it has rights to call upon when they do.

And this could lead to some nasty surprises for small businesses which don`t comply with their data protection obligations. Only 56% of small businesses claim to understand their data protection obligations compared with 83% of large firms.

There is light at the end of the tunnel, however. The commissioner is working with the Department of Trade and Industry`s Small Business Service to develop data protection guidelines for small businesses that will explain their obligations under the Act more clearly.

In addition, France had expressed concern over the wide availability of the electoral register, particularly as used by direct marketing and "information database" companies.

The commissioner has since welcomed the establishment of a framework for two versions of the register provided by the Representation of the People Act 2000 - a full version, with restricted uses, and an edited version which could be sold for any purpose.

A test case found that the use of the electoral register for commercial purposes without an individual right of objection was a breach not only of the Data Protection Act, but also of the Human Rights Act.

The fly in the ointment? The framework relies on voters opting out.