There's an interesting post over on Mike Rouse's blog which wonders whether the recent post by Guido about being emailed from the Hansard Society at the LSE because he registered his email address on the Mili-Blog constitutes a breach of the Data Protection regulations.Even if it doesn't, as Mike points out, it does breach the privacy policy on Miliband's blog which states that, "Defra respects your email privacy and your address will not be stored, displayed or shared for any purpose."
The question about Data Protection depends essentially on what information it stores and has disclosed to the Hansard Society and the LSE. If it is just email addresses with no personal information that can cross reference them to real people it may be outside the DPA scope, however, there is another piece of legislative scope it may fall into, the anti-spam regulations. The implication, if it has breached the laws, is a £5000 fine for every email that has been sent.
According to anti-spam regulations, if an organisation mass emails individuals it must satisfy three conditions to qualify for "soft opt-in". The Mili-blog and Hansard Society together achieve the first two I think, but not the third requirement which states that,
"The individual is given a simple opportunity to refuse the marketing when their details are collected and is given another simple way to do so in every future message."This does not, at any point, happen on the Mili-blog. So we have three cock-ups in total. First they may have breached the DPA by disclosing personal data to third parties; second they have actually done the exact opposite of their own privacy policy which states email addresses will not be stored; and third they offer no ability to opt-out of marketing and contact options, which is a requirement of the Government's own regulations.
Whoops!
3 comments:
If your email "address will not be stored", especially given the expansive meaning of processing within DPA98 and the ubiquity of computer "storage" (i.e. the backup tapes of the sent folder of the auto-reply account on the email server), what is the point of registering?
I apologise for the length of that sentence.
S-E
The sentence after the one you quote from the T&Cs is ‘We will only contact you in direct relation to the comment you submitted or to request feedback on this site.’ Wonder how they planned to do that when they’re not storing the email for any purpose? Poorly drafted T&Cs or a late addition, methinks.
I would like to make clear that users have been contacted for a specific purpose and will only be contacted once, that the contact information will not be held, that all survey responses were anonymised, and apologise to anyone who feels their privacy has been infringed.
More information about us can be found at www.hansardsociety.org.uk. In a nutshell, the Hansard Society is an independent, non-partisan charity which promotes citizen awareness and participation in the political process. Our eDemocracy Programme was set up to carry out research and development around how information and communication technologies impact on democratic engagement.
We were commissioned by the Department of Constitutional Affairs to carry out an independent investigation of central government's use of ICT for public engagement purposes. The blog of David Miliband, Secretary of State for the Environment, is one of the case studies. More information about the overall research and an earlier, interim case study evaluation can be found at www.digitaldialogues.org.uk.
It is explained on the 'about this blog' section of David Miliband's blog that we were carrying out this research and would be contacting people who had visited and submitted comments to the blog (see www.davidmiliband.defra.gov.uk/blogs/ministerial_blog/about_blog.aspx). It is also stated that no one is obliged to respond to the survey; however, we hope people do take the opportunity to provide feedback on the blog and help inform the evaluation, which will be published in May 2007.
Post a Comment