By Eduardo Ustaran

The Information Commissioner’s Office (ICO) has launched a new Privacy Notices Code of Practice that will help organisations provide more user-friendly privacy and marketing notices. The ICO wants to see an end to the confusing privacy notices that are written to protect organisations rather than to inform the public.

Earlier this year, the ICO called for an overhaul of privacy notices after consumer research revealed that half of consumers do not understand what they are signing up for when they complete online and paper forms. The ICO realized that too many companies baffle customers with lengthy and unnecessary legalese.

The ICO hopes the new Code of Practice will bring an end to impenetrable privacy notices.

Privacy protection as an investment
The ICO wants to establish a sound economic case that will help organisations provide those who make expenditure decisions with a clear rationale for investing in proactive privacy protection. With this objective in mind, the ICO has invited interested parties to bid to undertake a three-month research project aimed at developing a business case for investing in privacy.

The completed research project, “The business case for investing in proactive privacy protection,” will help organisations put a figure on not having proper data protection and privacy safeguards in place. The report produced by the successful bidder will enable organisations to: place a monetary value on information as an asset, quantify the risks of holding information, and pinpoint the financial and reputational costs should problems occur.

Companies urged to follow revised PIA guidelines
The ICO wants companies to follow rules similar to those that apply to Government departments to ensure privacy protection when developing new IT systems or changing the way they handle personal information.

The ICO launched its latest Privacy Impact Assessment (PIA) handbook, which lets organisations assess privacy risk before implementing new technologies and procedures.

PIAs became mandatory for all central government departments following the HM Revenue and Customs’ data breach in November 2007, where personal data relating to approximately 25 million people were lost.

Eduardo Ustaran is the head of Privacy and Information Law Group at Field Fisher Waterhouse LLP, based in London. He is a member of the IAPP Education Advisory Board, co-chair of Knowledge-Net London, editor of Data Protection Law & Policy and co-author of E-Privacy and Online Data Protection. He may be reached at eduardo.ustaran@ffw.com.