Privacy code gains support of Registrar

Computer Weekly / 1 July 1999 / David Bicknell

The Data Protection Registrar's Office is backing a global plan to develop a privacy code of conduct.

The initiative is led by the International Commerce Exchange (ICX), whose members include the Post Office and Shell, and it hopes to have a first draft of the code in place by the end of the year.

The plan is to give pragmatic advice to firms worried about transferring employees' personal data across international boundaries.

The move follows concern about the potential effect on businesses of a "data war" between the US and the European Union (EU) if they fail to reach an agreement.

The two sides have been in discussions for months over the implications of their differing approaches to data protection.

While the EU is strict on data protection and has a privacy policy, the US approach is more lax and based on self-regulation, which has to date been ineffective, and not widely supported by US businesses.

Clive Gringras, a solicitor for law firm Olswang, speaking last week at a Computer Weekly conference, Business and the Internet, suggested that while the EU/US situation might eventually be resolved, there were still concerns about data transfer with other non-EU countries.

Deputy Registrar Francis Aldhouse met ICX officials and suggested they take into account existing privacy guidelines from the Organisation for Economic Co-operation & Development and the British Standards Institution.

The latter already offers some advice to businesses on data privacy issues through The Disc Guide to the Practical Implementation of the Data Protection Act 1998.

The ICX might also consider using work done for a recent Canadian standard.

ICX officials accept that the code will have to go further than simply repeating Data Protection Registrar guidelines to companies.

"We should be looking to provide sensible, pragmatic advice," said one senior ICX official.

Clare Wardle, a legal expert at the Post Office, said lawyers working on the code at this week's annual conference on worldwide privacy issues in Cambridge would have to consider the implications for staff, customers, third parties and suppliers.