The Scottish Government has launched a new consultation on Identity Management and Privacy Principles. The consultation is part of a move to regulate the collection and use of personal data by public organisations, and includes a focus on risk management and accountability.
The consultation stems from draft principles intended to produce better management and use of personal identifiers. These principles were the result of an expert group, which met from October 2008 to March 2009, and included the Assistant Information Commissioner for Scotland, Ken Macdonald, and Professor Charles Raab of the University of Edinburgh.
One of the key recommendations from the expert group is that organisations should avoid collecting large amounts of personal data which is held centrally – since such databases leave individuals badly exposed to security breaches, whether intentional or accidental.
While the Data Protection Act 1998 (policed by the Information Commissioner) is intended to ensure the security of personal data, it appears that large organisations require clearer guidance on the standards to be met, and the very practical steps they can take to ensure this.
The consultation closes on 23 November 2009, and next steps will be awaited with interest. The one question which remains is: does the private sector require a similar set of recommendations?