Glass half full

I have been seeing data protection legislation in a new light of late. I recently began running a course for my local Chamber of Commerce called ‘Data Protection, the Important Bits in Just One Morning’. The idea is to give small and medium sized businesses a sense of their rights and obligations under the law without boring the pants off them or terrifying them needlessly. Once I’d overcome initial concerns about delivering a cut down version of such a complex subject, I warmed to my task and managed in the end to gain an increased sense of how very constructive the Data Protection Act of 1998 really is.

You don’t need me to tell you why the Act is there. The protection of individual privacy is indubitably a wonderful thing. But from a business perspective I have always been more conscious of it as a perceived burden of obligation, and a cause of weary resignation and even fear, than of any sort of benefit.

You’ll often hear companies say ‘we can’t do x because of data protection legislation’, frequently inhibiting initiatives that with reasonable care and due transparency could be both legal and enormously beneficial.

The Information Commission clearly still has a lot of work to do to persuade businesses that it is not a ‘data KGB’ waiting to penalise offenders, but a benevolent organisation trying to encourage rather than enforce good practice.

Looked at from a data perspective, the DPA ought perhaps to be seen as a real boon in helping companies to determine and implement a data strategy.

Companies are happy to rave about the critical importance of data in any CRM environment. But at least 65% per cent of them do not think it quite important enough to warrant a corporate data strategy. Putting together a long-term strategy for data is a hell of a job in anyone’s book and there are plenty of understandable human reasons why one might not bother.

Take me. I am far larger than I would like to be. I know what I should do to remedy the situation. I just don’t quite get round to doing it. I think that attitudes to the DPA are rather similar.

With its requirements that you know why you are collecting the data you hold, that you look after it properly, that you only hold it for appropriate timescales, that it is relevant and that you make sure that it is safe, actually takes us a long way down the path of best data practice and the construction of a good, commonsense data strategy.

So let us use the DPA as a guide to best practice. We will not only be upholding the law, but perhaps the virtue of so doing will pay back handsomely.

Sarah Denner Brown, Independent Consultant, SDB Talking Direct