Data Protection

Data Protection is certainly something every Information Systems professional is conceptually aware of. The matter is however wider than just ensuring that one's data are (occasionally?) backed up. It's an oft-stated estimate that data (gathering, processing) constitute around 80% of the cost of GIS projects, so data are the most valuable part of a GIS. Since GIS deals with real world situations then one's spatial data are also important in that they affect people.

Notwithstanding this importance, there are few regulations guiding GIS practioners and protecting the public interest. A search of CARICOMLaw (operated by the CARICOM Office of the General Counsel and the CARICOM Legal Drafting Facility) reveals, as yet, no legislation on this matter.

The only recent reference found to Data Protection is from the Barbados Advocate newspaper, which on Mon Nov 6, 2006, reported on a Data Protection Bill for the island state whereby ... 'the collection and dissemination of sensitive personal information on databases would be regulated under the legislation'. The legislation is meant to 'protect people's privacy', and one can certainly see the good purpose in that.

Though many GISs in the region may not deal directly with personal data, the pace of change in today's world and the subtleties arising when datasets are combined in new and powerful ways mean that GIS professionals should keep a weather eye out for unintended consequences. A cadastral GIS (LIS) that swiftly identifies the owner of a parcel of land is an excellent public service. However, one that allows all parcels of land owned by an individual to be equally easily identified by a member of the public, is facilitating invasion of privacy.

So, Data Protection should be part of the best-practice view of GIS practitioners. The British Data Protection Act (1998) offers one starting point for GIS practitioners who may wish to find out more. One best-practice implication that I make from a principle in that law is that since LISs hold data pertaining to individuals, then LISs are responsible for protecting their data from accidental/ catastrophic damage or loss, so as not adversely affect the lives of individuals listed in the LIS. E.g. Land Title records may be involved in loans, sale of property, inheritance, startup of new businesses/ investment, compensation for damage during a natural disaster, etc. and so their continuous existence is important to individuals and society.

The Barbados Advocate reported that the Barbados legislation includes the following principles, which are similar to those in the British Act:

• Information be processed fairly and lawfully
• Records must be used for the purpose for which they were originally intended
• The data subject can make a request for a copy of the information.

Barbados will also require that 'information should not be transferred outside of Barbados unless that country or territory ensures an adequate level of protection for the rights and freedom of the data subjects in relation to the processing of personal data' (Barbados Advocate). I therefore anticipate that all countries in the CARICOM Single Market & Economy (CSME) will at some point harmonise on similar principles.

This topic could certainly be discussed further and I hope persons will contribute their knowledge of what obtains in their part of the world.