On October 31, UK the Information Commissioner (ICO) launched a public consultation on proposed changes to the notification (registration) process, which will be open for comment until November 30.
Through this public consultation, the ICO seeks the views of the public and businesses on three proposed changes: (1) an online payment service; (2) a possibility for data controllers to provide contact details which would be publicly available and (3) a narrative based approach to the way information is collected from data controllers which would be made publicly available. This changes are aimed at making the notification process easier and the information on the public register more helpful for the general public.
The most interesting of these proposals is the change to the information format which will allow data controllers to describe in their own words the processing operations they carry out when they notify, instead of having to list each purpose, the type of personal data collected, who the data subjects are, and recipients involved in each processing operation.
The ICO has provided examples of a narrative approach notification and of the information that would be available in the public register. One example includes a reference to the controllers nature of work which is divided in to several paragraphs - description of processing, reasons for processing information, types or classes of information processed, what information is processed about, who the information will be shared with and transferring information overseas.
Although provided in a more fluid manner, this narrative approach may make the information available considerably denser, especially regarding the public register entries of larger data controllers. Also, the use of expressions such as information and who information is processed about may reduce even further the already low awareness of specific data protection expressions, such as 'personal data' and 'data subject'.
Overall, the proposed changes seem to take into consideration the principles defended by the EU Draft General Data Protection Regulation, especially the accountability and transparency principles.
However, the Draft Regulation, expected to become effective by 2014, is also proposing to abolish the notification obligation. As such, could the changes now proposed by the ICO be an indication of its intention to maintain the public register of data controllers, perhaps in a voluntary format, or is there an expectation that the Draft Regulation will be changed and not abolish the now existing mandatory obligation for data controllers to register with Data Protection Authorities?
Following this public consultation, the ICO expects these changes to be implemented by January 2013.