Make privacy integral
Make sure citizens’ rights are protected by integrating privacy as an essential part of your system.
To meet point 7 of the Technology Code of Practice (TCoP) your plans must show how you are using privacy by design.
If you’re going through the spend control process you must explain how you’re meeting point 7.
About the EU General Data Protection Regulation
The Information Commissioner’s Office (ICO) provides information about the GDPR. The Technology Code of Practice summarises the key points.
The GDPR came into force on 25 May 2018. It’s about protecting citizens’ personal data when it is being processed or moved.
You must comply with this new regulation and consider the ethical and appropriate use of data and technology.
GDPR is adopting privacy by design as part of the regulation. There is a legal requirement in the GDPR for the protection of citizens’ data to be included from the start of the design process. GDPR includes upfront penalties for not complying.
Maintaining the privacy of citizens’ personal data includes security. Privacy also includes how citizens:
- consent to the use of their personal data
- have the right to have personal data erased
- have the right to restrict the processing of personal data
- have the right to data portability so they can access and move their personal data
How privacy by design will help your programme
Your technology project or programme will benefit from:
- being proactive about privacy and reducing the risks of data theft
- identifying potential privacy issues earlier when they are easier and cheaper to solve
- better awareness of privacy issues across the organisation
- adherence to GDPR when it comes into law
How to embed privacy by design
The Data Protection Act 2018 contains details about how the EU General Data Protection Regulation (GDPR) applies in the UK.
The ICO has a guide on GDPR and suggest using impact assessments in the section on accountability and governance as part of your project or programmes risk management process. The following questions from the Data protection impact assessments are useful to consider:
- Will the project or programme involve the collection of new information about individuals?
- Will individuals have to provide information about themselves to the project or programme?
- Will information about individuals be disclosed to organisations or people who have not previously had routine access to the information?
- Are you using information about individuals for a purpose it is not currently used for, or in a way it is not currently used?
- Does the project or programme involve you using new technology that might be perceived as being privacy intrusive? For example, the use of biometrics or facial recognition.
- Will the project or programme result in you making decisions or taking action against individuals in ways that can have a significant impact on them?
- Is the information about individuals of a kind particularly likely to raise privacy concerns or expectations? For example, health records, criminal records or other information that people would consider to be private.
- Will the project or programme require you to contact individuals in ways that they may find intrusive?
Next: Technology Code of Practice point 8 - Share, reuse and collaborate
Related guides
Updates to this page
Last updated 31 March 2021 + show all updates
-
Addition of a temporary research survey to get user feedback on the Technology Code of Practice.
-
Inclusion of a link to the new Data Protection Act 2018 and associated information from the Information Commissioner's Office
-
First published.