The risks involved in data sharing
Data controllers must comply with the data protection principles set out in Schedule 1 of the DPA (section 4(4)). The main risks for data controllers in any data sharing arrangement include:
Failing to notify individuals about how their data will be processed.
Collecting personal data for one purpose and later sharing or using it for another incompatible purpose without the data subject’s knowledge or consent.
- Failing to maintain the integrity and security of the data.
- The ICO has the power to take enforcement action against data controllers and can levy fines of up to £500,000 on a data controller for a serious breach of the data protection principles (or for serious breaches of the Privacy Regulations) (section 55A, DPA).
- Non-compliance with the DPA could, therefore, be costly, cause significant loss of reputation to an organisationand harm to data subjects.