Responsible use of shared data

Personal data is any data that can identify a living person. The person it relates to is the data subject. Before an organisation shares someone's personal data with another organisation, it normally needs that person's consent. Passing it on without consent is both unlawful and unethical.

Responsible use of shared data means meeting legal, privacy and ethical requirements. It applies to both individuals and organisations. The organiser of a community choir should not pass members' email addresses to a music shop for advertising without asking the members first, even if the list is easy to copy.

Legal and privacy requirements

Personal information is protected by law. The Data Protection Act 2018 and UK GDPR set the legal requirements for protecting personal data in the UK. There is also a duty of confidentiality, which reinforces the right to privacy: information given in confidence should not be passed on without permission. Privacy means personal data should be kept secure and seen only by the people who need it. Staff should only access records they are authorised to view, so a leisure centre receptionist should only open a customer's booking record to change a swimming lesson, not to look up a friend's home address.

Ethical use

Ethical use means not using data simply because it is available, especially if it was collected for a different purpose. An organisation should seek the data subject's permission before sharing their information. Ask whether sharing is necessary, fair and lawful, not just whether it is technically possible.