New guidance from ICO limits use of fully automated data processing

The document from the Information Commissioner’s Office says such data processing will be legal under the General Data Protection Regulation only in certain circumstances

Charities should not use fully automated processing of personal data unless they can show they have explicit consent or that it is necessary for fulfilling a contract, according to new guidance on profiling under the General Data Protection Regulation from the Information Commissioner’s Office.

The EU’s GDPR will come into force on 25 May and will introduce stricter requirements for organisations that process data than are currently required under the Data Protection Act 1998.

The new guidance from the ICO on profiling defines it as “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person”.

The guidance does not allow for fully automated individual decision-making except in certain cases.

The data controller cannot get around this by fabricating human involvement, according to the guidance, and the human’s oversight of a decision must be “meaningful”, rather than token, and have the authority and competence to change the algorithm’s decision if necessary.

There are exceptions to this, the guidance says: when it is necessary for the performance of or entering into a contract; when authorised by the EU or the member state the data controller is a member of; or when it is based on the data subject’s explicit consent.

Profiling must be shown to be necessary in the performance of a contract to meet the first exception, according to the guidance, including consideration of whether any less intrusive methods can be adopted.

Targeted online advertising is also covered by the guidance, which says that it could have a “significant effect” on individuals depending on certain characteristics of each case, such as the intrusiveness of the profiling process involved, the expectations or wishes of the individuals concerned, how the advert is delivered and the “particular vulnerabilities of the data subjects targeted”.

Data controllers should also be aware of their transparency obligations, the guidance says, including ensuring that information about the profiling is both easily accessible for the data subject and brought to their attention.

The guidance says that profiling can involve the use of personal data that was originally collected for another reason, but will depend on a number of factors, including the context in which the data was collected, the expectations of the data subjects regarding its future use, any safeguards applied and the impact of further processing on the data subject.

Data has to be kept accurate and up to date, the guidance says, explaining that keeping personal data for too long increases the risk of inaccuracies.

Source link

Most charities unaware of forthcoming changes to cheque processing

According to research by the Cheque and Credit Clearing Company, 70 per cent of charities are unaware of plans to introduce cheque imaging next year to speed up clearing

Seventy per cent of charities are not aware that fundamental changes to speed up the way cheques are processed are due to be rolled out by the end of next year, a survey has shown.

Beginning on 30 October this year, banks will begin moving to image-based cheque processing: a photograph of a cheque is passed between banks and branches, which means the cheque itself does not have to be sent around the country. Rather than taking six working days to clear, cheques will clear by the end of the day after they are deposited.

Research by the Cheque and Credit Clearing Company found that only 30 per cent of charities were aware that the change was coming although it said this was an improvement on last year, when only 23 per cent of charities were aware of the forthcoming change.

The survey of 1,000 charity financial representatives was carried out between 3 and 28 April this year through telephone interviews.

In the short term, people will still write, send and pay in cheques in the traditional way, but in the future some banks and building societies might offer their customers the option of paying in by sending an image of the check taken on a smart phone, rather than having to physically deposit the cheque in the bank.

Cheque usage has been in decline. In 2009, the payment trade body Payments UK announced that cheques would be phased out over the next nine years. The plans were abandoned after a public outcry.

According to the Cheque and Credit Clearing Company, 477 million cheques were written in 2016. Its survey found that 29 per cent of charities said they received more than half their income from donations by cheque.

Andrew O’Brien, head of policy and engagement at the Charity Finance Group, said more education was needed, particularly for smaller charities, to raise awareness of cheque imaging. But he said the move would have benefits for the charity sector.

“It’s a positive move in that it is one of the ways to keep banks in the game with cheque issuing,” he said. “If they had stopped using cheques, that would have affected a lot of charities.

“Many charities use cheques to collect donations from older donors, many of whom prefer to use them. It is also important for financial controls, particularly in smaller charities, where having to have the signatures of certain people on cheques can provide quite a lot of security.”

A spokeswoman for the Institute of Fundraising welcomed the move to cheque imaging.

She said: “We are pleased to hear that the new cheque-imaging process will significantly reduce cheque clearing time. This will make a difference for those charities that are able to benefit and is a very welcome initiative.”

Source link