Personal Data Privacy and the Internet - A Guide for Data Users

Displaying personal data on the Internet

DPP3 provides that personal data may be used only for the purpose of collection or a directly related purpose unless express consent is obtained from the data subject given voluntarily to use the data for a different purpose. "Use" in relation to personal data includes disclosure or transfer of the data. Organisations which engage in business practices that may involve disclosing personal data on the Internet should pay special attention to this requirement.

=>State that personal data will be displayed at the time of collection. If personal details are collected and are later to be displayed on the Internet or elsewhere, this intention must be made clear to the individual at the time of collecting the data. An example would be an Internet recruitment service which makes personal data on job seekers available through the Internet. At the time of collecting the data from the applicant, a statement that this will be done should be made. Otherwise, before displaying the data in this way, the organisation should obtain express permission from the applicant.

=>Anonymise the personal data when displaying. Anonymous data from which it is not practicable to ascertain the identity of the individual is not personal data. Before displaying personal data on the Internet, organisations should consider anonymising the data as an additional precautionary step to avoid presenting detailed information that might be excessive or abused. For example, such consideration should be given when displaying personal details of the winners of lucky draws and competitions on a web page. In particular, names and ID card numbers should not be published together. Publishing the ID Card number alone would generally be acceptable, as it would provide the necessary and reliable information with a high degree of anonymity.