Top tips for compliant data sharing

11 April 2023

“Data sharing” means passing personal data from one organisation to another.  Each organisation is a data controller and uses the data for its own purposes.  So, each controller is responsible for its own data protection compliance.  Here is a checklist of issues to bear in mind when data sharing.

• Make sure you have a lawful basis for processing such as the transfer is necessary in the legitimate interests of the parties or that the transfer is necessary to fulfil a contract with the data subject. Consent is also a lawful basis but it is one that is considered as a last resort (we explain this below).

• Check that the data subjects are aware that personal data will be shared in the current circumstances.  It should be explained in your organisation’s Privacy Notice.
• Ensure the actual transfer of data can be made securely.
• Review the data that is to be shared and ensure that it is the minimum necessary to achieve the purpose of the data sharing.

Consent to data sharing

Data processing is based on the authority of the privacy notice.  The privacy notice explains how personal data will be processed by your organisation and so long as the processing meets a condition for lawful processing, consent is not required.

Consent is one of the conditions for lawful processing but it can be problematic.  It must be a freely given indication of agreement, it cannot be inferred from silence or inaction.  It must be informed agreement, specific to the proposed data sharing or specific to data transfers to a specific category of controllers. 

Further, consent can be withdrawn which removes the authority for future data sharing.  And some circumstances can be interpreted as duress such as requiring employees to consent to data sharing with third parties which will render the consent invalid. 

In most situations there will be a more appropriate condition for lawful processing other than consent.  If you need help using the lawful processing conditions give us a call..etc or for help with the other aspects of data sharing.

Mandy P Webster

11 April 2023