'I
recently had an email from an agency (with whom I've never registered) telling
me they had my details, and would send my details to clients where they thought
I might be interested - unless I tell them otherwise. I don't actually want to use this agency,
since they are a member of an organisation which has declared itself in support
of IR35.'
From
what I hear, you are far from being the only Contractor to have received a mail
like this - or to feel this way about it.
Your
'details' - which I can only take to mean some variant of your CV - are
'personal data', within the meaning of the Data Protection Act 1998. That Act extended the provisions of the
earlier Act, and now governs the handling of personal data, not only on
computer, but also in the form of a structured manual system. So long as one can get out of the system
information relating to a specific named individual, the system is likely to be
covered by the Act.
The
Act requires that to hold or process personal data, one must be
registered. And, once registered, all
personal data must be:
These
are the Data Protection Principles as defined in the Act.
Given
that you have never registered with this agency, it seems to me that for them
to process your personal data (even simply by incorporating it in their system,
and by sending you this unsolicited email) may well be in breach of the First
Principle - unless they can show that they obtained it lawfully in the first
place (ie from someone authorised to disclose it). More serious is the suggestion that unless you respond and
expressly tell them not to, they may forward your data to clients.
For
personal data to be processed lawfully, the processing must comply with at
least one of the conditions set out in Schedule 2 of the Act. In the circumstances we have here, Schedule
2 provides that before processing your data, they must either have your
consent, or they must be using the data to take steps at your request with
a view to entering into a contract.
In
the first case I think this can only mean your express consent; and in the second, it can only mean an express
request (thereby giving implied consent).
But I find it very difficult to see that sending you an email which
implies 'if you don’t say no then we shall consider you to have consented' could amount to the kind of express consent
or express request clearly envisaged by the Act as required in order to
lawfully process data.
Apart
from the fact that most of us choose to keep our personal data to ourselves,
and to only disclose it to those who we feel have some particular reason to
know or record it, two ways in which the disclosure of such data to their
clients might cause you serious concern spring immediately to mind:
1
Your
details, if sent to the Client for whom you are working now, might convey the
false impression that you are thinking about moving on and looking for another
contract; this might cause that Client
to feel that you were being less than frank with them, and might well influence
decisions not only on extensions, but even on premature termination.
2
Your
details, if sent to a Client for whom you are interested in working by an
agency you do not want to do business with, may arrive there before similar
details sent by another agency of your choice - which may result in the Client
declining to deal with the agency of your choice, because they heard about you
from another source first. Result - you
lose that opportunity.
So
I would suggest that you certainly reply to this email straightaway, and tell
the agency that they do not have your consent to hold or process your data - or
to disclose it to anyone. And also tell
them why.
You
might also consider inviting the Data Protection Commissioner (http://www.dataprotection.gov.uk)
to comment on this agency's practice of trying to impose 'consent' by default.
Finally, back to your
reasons for not wanting to deal with this particular agency: I do find it somewhat ironic that almost the
first item in the Code of Conduct of the particular organisation states that 'Staff
of all members will understand and adhere to all current legislation which
affects their business'. It
seems to me that the particular member of staff in question here is neither
understanding, nor adhering to this very current legislation!
26th
January 2001
I'd really appreciate your feedback on this FAQ - so mail me and tell me what you think of it, if it's been useful to you, or let me know of any specific problem you have where I may be able to help.
[Return to Roger Sinclair's 'Welcome' page]
No liability is accepted for any inaccuracy in the information in these pages - see full disclaimer
© Roger Sinclair roger@egos.co.uk 2001 - All rights reserved - see full copyright details
The information on these pages is provided free and for information only, and is provided 'as is'. Whilst believed to be correct, it is in no way comprehensive. It is provided for your interest only and is not intended to be relied on as formal legal advice. The posting of information on these pages is not intended to create a lawyer-client relationship, and you should not act or rely on this information without seeking professional advice. No liability is accepted therefore for any errors, or for any losses that may be incurred if it is relied on.
You may read these pages on-line, and download them to read later, for
your own personal use.
This copyright notice must appear on every page that you print from here.
You must not redistribute these pages or any part of them in any form or medium
without first obtaining my consent.
You are welcome to set up links to this website from others.
[Return to Roger Sinclair's 'Welcome' page]