To ask the Secretary of State for Digital, Culture, Media and Sport, what assessment she has made of the impact and cost to businesses, specifically smaller businesses, of the Information Commissioner’s Office’s requirement for (a) data service providers and (b) other companies to inform individuals on every occasion that their electoral roll data is used for non-electoral purposes.
24 November 2021
Current guidance from the Information Commissioner's Office does not require that companies inform individuals on every occasion that their electoral roll data is used for non-electoral purposes. A version of the electoral roll, known as the 'open register' or 'edited register', may be used by businesses for a wide range of purposes, such as for checking name and address details. Businesses using people’s personal information from this register do not have to inform them or seek their consent on every occasion.
A number of safeguards apply to the personal information on this register and its uses, including the opportunity for people to opt-out. Furthermore, processing of this information must comply with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA), and organisations that process personal data to send marketing communications must also comply with the Privacy and Electronic Communications Regulations (PECR).
The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and has published information about use of the electoral register and how people can opt out of the open register, available at: https://ico.org.uk/your-data-matters/electoral-register. Guidance for organisations on compliance with the UK’s data protection laws can be found at: https://ico.org.uk/for-organisations/. The ICO also has a web hub for small businesses and other small organisations, available at: https://ico.org.uk/for-organisations/sme-web-hub/.