Any Datonomy readers who are responsible for their organisations’ annual DP notifications may wish to respond to the consultation published by the ICO today. The deadline is 30 November and it poses the following three questions about possible refinements to the UK system:
- should the notification and payment process go fully online (Datonomy knows what a pain the manual nature of the current process is);
- whether data controllers should have the option of providing a more narrative description of the data processing they carry out, with the opportunity to link to the organisation’s more detailed privacy policies.
The ICO would continue to provide template forms for specific types of data controllers, but Datonomy suspects that many of its readers’ organisations would favour a more nuanced approach.
The current consultation is confined to improving the status quo to make data controllers’ lives easier and, the ICO hopes, encouraging better levels of notification.
It does not allude to the proposals now being debated in Brussels that could ultimately make the exercise of notification a thing of the past. As Datonomy readers will be aware, Recital 70 of the new draft Data Protection Regulation would put an end to the “indiscriminate general notification obligation“. That, however, is on the assumption that it would be replaced by a raft of other (more onerous) compliance obligations, such as the appointment of DPOs, documentation of processing activities, privacy by design and in some cases privacy impact assessments – and that those measures would provide more effective protection for individuals’ privacy than filling in a form once a year.
Just how many of those proposed changes will become law remains to be seen. So for now (and probably until 2016, when the EU reforms would be likely to take effect in Member States) annual notification is with us…any improvements to the UK system are likely to be welcomed. The ICO consultation is here and Datonomy would be interested in readers’ reactions to the idea of narrative notification.