Personal Information Online: new Code of Practice published by the ICO

The Information Commissioner's Office (ICO) released a new Code of Practice on 8 July 2010 entitled "Personal Information Online".

The Code, presented as an 'ebook', is intended to help organisations ensure that they comply with their obligations as a data controller under the Data Protection Act 1998 when processing information submitted or gathered via the internet.

The ICO has also produced a guide aimed at data subjects, highlighting potential risks in making personal information available online and steps that individuals can take to protect their privacy.

In true ICO style, the Code is designed to be easily readable and give organisations a steer on what it considers to be best practice in today's ever-changing technological landscape.

There is nothing significantly new that would require a major change in the way that well-run organisations' systems are set up or practices that are traditionally followed. However, there are some useful expansions of advice that the ICO had already suggested in previous guidance, as well as some new takes on the issues.

In particular, the Code looks at:

• When IP addresses are and are not personal data
• Best practice when collecting information from children
• How organisations should treat personal data that is publically available online (increasingly relevant as some organisations offer facilities to gather personal information from any sources they can find online and package this to other organisations to enhance their marketing efforts)
• Behavioural advertising, use of information gathered by cookies and targeted marketing online
• Privacy choices, encouraging organisations to inform users of the options available to them
• International data transfers and cloud computing, suggesting key issues for customers and suppliers to consider

The Code is now available online.