New guidance from the Information Commissioner’s Office makes clear employees’ use of social networks for commercial purposes is subject to the Data Protection Act 1998 (DPA).
The ‘domestic purposes exemption’ within the DPA, only covers personal data processed by an individual for the purposes of their personal, family or household affairs and not for business purposes.
Key points in the guidance include:
• the domestic purposes exemption does not cover organisational use of online forums. Organisations which use social media are therefore subject to the DPA even if it asks a member of its staff to do the processing through their personal networking page.
• the exemption also doesn’t apply when individuals process personal data for non-domestic purposes. Individuals who use social media for purposes such as running a sole trader business are subject to the DPA.
• when an organisation, or individual acting for non-domestic purposes, posts personal data on a social networking site, message board or blog, they must comply with the DPA. The same applies if they download personal data from a social networking site and use it for non-domestic purposes.
• if an organisation runs a website which allows third parties to add comments or posts about living individuals, and they are a data controller for the website content, the provisions of the DPA apply.
For further advice or information please contact us at firstname.lastname@example.org.