On November 22, 2024, the Information Commissioner's Office (ICO) announced that it had published guidance to assist organizations in sharing personal information to prevent, detect, and investigate scams and fraud while ensuring compliance with data protection laws.

Data protection considerations when sharing data

The guidance notes that data protection laws do not prevent organizations from sharing personal information for legitimate purposes, including fraud prevention. However, the guidance states that organizations should take steps to ensure they are meeting their data protection obligations when sharing data, such as:

• conducting Data Protection Impact Assessments (DPIAs);
• establishing clear responsibilities through data sharing agreements; and
• identifying lawful bases for data sharing, such as legitimate interests or consent.

Data protection principles

The guidance outlines the importance of adhering to data protection principles when sharing personal information, including:

• fairness and transparency: ensuring clarity about the purpose of data use and avoiding undue harm to individuals;
• data minimization: sharing only necessary information and leveraging privacy-enhancing technologies;
• security: maintaining robust protections during and after data sharing; and
• accountability: implementing a Protection by Design and Default approach to safeguard rights.

You can read the press release here and the guidance here.