Checklist
The privacy law poses a compliance challenge. To start with you need to:
- Decide whether there is any approved privacy code you could subscribe to as an alternative to the NPPs. If there isn't, consider whether you should work with your industry body to develop one.
- Assess whether your systems can flag data collected before and after 22 December 2001. If you can't, you'll be forced to treat all information as governed by the new regime.
- Develop systems to isolate and then destroy or make anonymous personal information that is no longer needed. Given the cost involved you will need to determine what are reasonable steps in this regard.
- Determine which third parties (if any) you collect information from and what you will need to do about that information.
- Review your current arrangements for sharing information with related companies.
- Ensure customers are given appropriate information, and their consent to use and disclose information is obtained, where necessary. This means amending:
- forms and contracts collecting personal information;
- signage, brochures and notification at collection points (for example, your website); and
- telephone procedures used by employees and agents.
- Review your arrangements with agents and intermediaries - such as call centres - to ensure that they comply with the new regime.
- Structure into your first contact with customers:
- an express consent to any use or disclosure for a secondary purpose where consent cannot be implied; and
- an express opportunity for them to convey a wish not to receive direct marketing communications.
- Consider the position of staff as well as customers and ensure appropriate procedures are implemented.
- Ensure your policies preventing unauthorised access, modification or disclosure are adequate.
- Consider your current procedures for access and correction requests and modify them to the extent necessary.
- Consider what is an appropriate fee to cover the reasonable costs of providing a customer with copies of the information held about them or extracts from that information.
- Determine what are reasonable steps to ensure that personal information is accurate at each of the stages of collection, use and disclosure to someone else.
- Identify transactions requiring international data flows and ensure safeguards are in place which conform with the legislation.
- Develop and revise training and compliance reporting programmes.
- Review your complaints handling procedure.
- Don't forget the corporate or institutional parts of your organisation.
You need to ensure that you comply in full with the new legislation in respect
of personal information held about individuals, such as directors and shareholders
of corporate customers.
