Shared Data

Shared data is data made available to more than one service, organisation or purpose. It can include location-based data, transactional data, cookies and data exchanged between services. Organisations collect, use and store huge amounts of data, so they must manage how it is used, who it is shared with and how it is eventually disposed of.

Benefits of sharing data

Sharing lets services give you more relevant information, adverts, updates and recommendations. An organisation can also use shared data to improve what it offers: spotting popular services or options, common customer issues, busiest times and where a new service or location is needed.

For example, a sports centre shares its booking data with its café, equipment-hire desk and coaching team. The bookings show that badminton courts are busiest on weekday evenings and that junior coaching fills up quickly, so the centre runs more junior sessions. The same data lets the café staff up before busy evenings and lets the centre email a member a reminder about a booked session and suggest a quieter time to use the pool.

Risks

Sharing data increases privacy and security risks because personal data may be exposed or misused. Once data has been passed on, the organisation that collected it has less control over it. Users can be tracked across the internet, and their location can be revealed if they do not control their privacy settings. A free puzzle game that shares your device's location with advertisers, for instance, could let those advertisers work out which shops and venues you visit.

Managing shared data

Responsible use means weighing the benefits against the risks and looking after data throughout its life. That includes disposal: when staff replace old laptops or phones, the devices must be wiped or destroyed before they leave the organisation, because they can still hold customer records. Sharing data is only responsible when there is a clear purpose, people's information is protected and the organisation can justify why it is needed.

Location-based data is data about where a user or device is. Mobile devices can use GPS to work out their position and share it with apps. You can also share your location yourself by typing your postcode into a delivery app, giving an app permission to use it, or posting it on social media.

Real-time location data shows where you are at that moment. It can be used to track where a user is and share that information with others. This can be useful: a maps app can find a nearby pharmacy, a weather app can send a warning about heavy rain approaching your area, a travel app can send updates about delays on your route, and an event app can show what events are happening nearby. Organisations can use location data to send relevant information, adverts and local offers for nearby services and events, so the message is more useful to the person receiving it.

Location data can also support fraud protection. A payment system can compare where a card is being used with where the user's phone is. If the card is used in Edinburgh while the phone is in Cardiff, the mismatch may suggest the card has been used without permission.

There are risks too. Location data can reveal where you live, work or spend time, so you should think carefully before letting technology reveal your location. If a game asks for your location but does not need it to work, you can deny that permission in the app's settings, and you should switch off location sharing when it is not needed. Responsible use means using location data for a clear purpose and giving users control over whether their location is shared.

Transactional data is data recorded from a transaction: a sale, a booking, or a customer using a loyalty card. It is not simply any data an organisation happens to hold — it is the record of a transaction taking place. It can be collected by the business the customer bought from, or by a card company that handles the payment.

Each record can hold what was bought, when and where it was bought, how often that customer buys, how much was spent, and customer details. Loyalty card data is transactional data too, and because the card is linked to a named customer it can also reveal customer demographics and shopping habits.

Finding trends, patterns and demographics

Transactional data is analysed to find trends and patterns — general changes or repeated behaviour found by looking at data over time — and customer demographics, the characteristics of customers that help an organisation understand who they are.

For example, a garden centre records every till transaction. Looking back over one spring, the manager finds that Saturday mornings are busiest and need extra staff, that the lavender range sells least, that takings are highest in May, that the town-centre shop sells far more bedding plants than the out-of-town one, and that most customers come from two nearby villages. Those are patterns and demographics in action. The centre can reorder stock, cut back on the poor seller, discount quiet weekday afternoons, advertise in a village it is not yet reaching, and run a planting workshop on a quiet weekday. Displaying the figures in graphs makes these patterns easier to spot than reading a long list of records.

# Plant sales recorded at a garden centre across one Sunday
sales = ["shrub", "lavender", "shrub", "bird feeder", "shrub", "bird feeder", "shrub"]

print("Transactions recorded:", len(sales))

for item in ["shrub", "bird feeder", "lavender"]:
    print(item, "sold", sales.count(item), "times")

Output:

Transactions recorded: 7
shrub sold 4 times
bird feeder sold 2 times
lavender sold 1 times

Drawbacks to weigh up

Analysis is not free: staff may need to be employed to extract and analyse the data, which adds cost. The data must also be accurate — errors in transactional data lead to bad decisions, such as ordering 500 extra umbrellas because a mistyped quantity made them look popular.

A discount or special offer helps the customer rather than the business, so it is not a benefit of transactional data to the organisation.

A cookie is a small text file that a website creates and stores on your device so the site can keep data about you. It is not a program, virus or malware; it is only a text file.

What cookies do

Cookies let a website recognise your device when you return. They can keep you signed in so you do not have to type your details again, keep items in a shopping basket until your next visit, and store preferences such as a larger text size or dark mode. They also allow personalised content and adverts based on what you did before.

Most cookies hold named-value pairs and a unique ID. A nature club's wildlife-recording site might store patch=woodland, month=May and an ID such as t6wn. The club keeps your list of sightings on its server. When you return, your browser sends the cookie back and the site uses the ID to find your sightings.

First-party and third-party cookies

A first-party cookie is created and used by the same website you are visiting, usually for signing in, baskets and settings. Its scope is limited to that one site, so it is generally low risk.

A third-party cookie comes from a different organisation, such as an advertiser or analytics service, whose code is built into the page. These cookies follow users from site to site so adverts can be matched to them, or count how many visitors view each page.

You can manage or delete cookies in your browser settings. The difference matters because first-party cookies only relate to the one site that set them, while third-party cookies can follow your activity across many sites.

Cookies are small text files that websites save on your device. For the person using the device, cookies have several drawbacks.

Storage space

Every cookie takes up a little storage space on your phone, tablet or computer. One cookie is tiny, but a browser that collects them from many sites over months can build up a large number. If the cookies are never deleted, that stored data can slow the device down over time and take up room you need for other files.

Less privacy

Tracking cookies record what you do online: the pages you open, the searches you make and the things you click. That activity can be used to build a picture of your habits and interests, and the picture can be used to target adverts at you. For example, an advertising company can place cookies on both a revision site and a gaming site. Together the cookies show that you have been reading about volcanoes and looking up cheat codes, so a profile of your interests can be built even though you did not choose to share that. Your privacy is reduced because your behaviour is being watched and recorded.

Security risk

Cookies are stored as text files on your hard drive, and other people may be able to access them. If you lend your laptop to someone, or someone else gets into your files, they may be able to read the information a cookie holds. That is the security risk: the file can be read by the wrong person. Cookies are not programs, viruses or malware, so a virus is not the security risk here; the risk is that a stored text file is read by someone it should not be.

Not every problem caused by cookies is a drawback for the user. If visitors keep rejecting cookies and a shop loses the chance to show them adverts, that is a problem for the shop, not a drawback for the user.

Data exchange between services happens when one system sends information to another. The receiving service may not be able to use it straight away because it expects a different format (how each value is written) or configuration (how the data is arranged). Data transformation is the conversion carried out so the destination system can read and process the shared data.

What transformation can involve

A destination system may have a different data structure from the source system, so the data cannot simply be copied across. It must be converted to match the destination's structure. Common changes include:

• Changing the order of fields so they follow the destination's layout.
• Splitting or combining fields, such as separating a delivery address into street and town, or joining a room number and building name into one location field.
• Changing date or number formats, such as turning 07-11-2026 into 2026-11-07, or writing 1200 as 1,200.
• Replacing codes with full values, such as changing membership code S to Student, because a code alone may mean nothing to the receiving service.

For example, a sports centre's booking system sends a member's details to a payment service. The booking system stores the address as one field, but the payment service needs a street field and a town field. It also stores the membership type as S, while the payment service needs Student. Without these changes, the payment service cannot match the record to the right customer and price.

Why poor transformation causes problems

If data is poorly transformed, it may be unusable or cause errors in the destination system. A date in the wrong format might be rejected, an unreplaced code might be meaningless, and split fields might not match the destination's structure. This can stop a booking, payment or record update from working.

Responsible use means planning and checking the transformation, so the destination system can understand and process the data it receives. Shared data is only useful when the receiving system can use it correctly.

Personal data is any data that can identify a living person. The person it relates to is the data subject. Before an organisation shares someone's personal data with another organisation, it normally needs that person's consent. Passing it on without consent is both unlawful and unethical.

Responsible use of shared data means meeting legal, privacy and ethical requirements. It applies to both individuals and organisations. The organiser of a community choir should not pass members' email addresses to a music shop for advertising without asking the members first, even if the list is easy to copy.

Legal and privacy requirements

Personal information is protected by law. The Data Protection Act 2018 and UK GDPR set the legal requirements for protecting personal data in the UK. There is also a duty of confidentiality, which reinforces the right to privacy: information given in confidence should not be passed on without permission. Privacy means personal data should be kept secure and seen only by the people who need it. Staff should only access records they are authorised to view, so a leisure centre receptionist should only open a customer's booking record to change a swimming lesson, not to look up a friend's home address.

Ethical use

Ethical use means not using data simply because it is available, especially if it was collected for a different purpose. An organisation should seek the data subject's permission before sharing their information. Ask whether sharing is necessary, fair and lawful, not just whether it is technically possible.