The ICO embraces AI as it launches its own privacy notice generator for use by small businesses
It may come as welcome news to small businesses that the ICO has just launched its very own privacy notice generator. It is hoped that this will assist small businesses in meeting their data privacy obligations under the UK GDPR, most notably the requirement to provide transparent information to data subjects about how their data is being processed.
In addition to better compliance (and therefore lower risk of being fined by the ICO or suffering reputational damage), better transparency amongst businesses should encourage customer confidence in the business’s goods and services by building trust in the organisation, so there is double the incentive for businesses to ensure that they have adequate privacy notices in place.
Under the UK GDPR all organisations acting as controllers are required to provide information to individuals at the time their data is collected, or if it is collected from other sources, then no later than 1 month after collecting it. The information provided to individuals (data subjects) should be concise, transparent, intelligible, easily accessible, and it must be in clear and plain language. Privacy notices should also be regularly reviewed and updated to ensure that they are accurate, and any new uses of a data subject’s data should be notified to them before it is processed.
A good privacy notice should include details about:
- who the controller entity is
- the type of data collected and how it is collected
- why it is collected and used
- the “lawful basis” the business relies on to process the data
- where the data is stored
- whether it is transferred to any third countries or other internal organisations
- how long it is held for
- the data subject’s rights in relation to the data.
The notice should also explain the data subject’s right to complain, and how to make a complaint.
The ICO’s tool itself can be used for both customer and supplier information (i.e. for an outward facing privacy policy to be posted on an organisation’s website), and for staff and volunteer/job candidate information (i.e. for an inward facing privacy notice). The tool is a great starting point for businesses wanting to improve on their data privacy compliance as it is user friendly and encourages businesses to think about how they process data. Where data flows are more complex, where a business is particularly ‘data heavy’, or where special category data is being processed then it is always advisable to seek legal advice to ensure that adequate steps are being taken.
Compliance with the UK GDPR’s transparency requirement will also lead onto broader compliance with other aspects of the GDPR, such as fairness, purpose limitation, consent and legitimate interests.
The tool is now available on the ICO’s website, here.
If you have any queries regarding the points in this article, or need help understanding your business’ processing activities and compliance obligations generally, then feel free to get in touch.
