May 17, 2012 09:58
If you are a member of an organisation, say, The Labour Party, and they pass on your email address (and those of 1000s of other people) to private citizens who want to become Labour Candidate for, say, the post of Police & Crime Commissioner, are you breaking the Data Protection Act?
Does it make a difference if the organisation does this on the strict condition that the private citizen delete the email addresses after the campaign?
My gut feeling is they are breaking the law.
Firstly, while selection of candidates is Labour Party business (and thus in the remit for use of the email), the individual candidate's campaigns are not (and thus beyond what the email address was originally supplied for).
Secondly, Organisations can pass on email addresses to 3rd parties under certain situations but this, presumably, comes with a duty of care. Handing them over to anyone who happens to be standing, who have (potentially) no knowledge of the Data Protection Act and no procedures in places to ensure the act is followed, would seem to breach the organisation's obligations.