How are data sharing practices governed by data protection law?

Data sharing is a form of processing personal data and is therefore governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Section 121 of the DPA 2018 specifically mandates the Information Commissioner to prepare a statutory code of practice that provides practical guidance on sharing personal data in compliance with data protection legislation. This "Data sharing: a code of practice" has been issued by the Information Commissioner's Office (ICO) and was laid before the UK Parliament, giving it statutory force. It clarifies how the principles and obligations of the DPA 2018 apply to data sharing scenarios.

B. The Privacy and Electronic Communications Regulations (PECR) govern electronic marketing and cookies, not the general practice of data sharing between organisations.

C. The Freedom of Information Act provides a right of public access to information held by public bodies, which is distinct from the general regulation of data sharing practices.

D. Data sharing is explicitly regulated as a form of 'processing' under the DPA 2018 and UK GDPR; the ICO's guidance is a statutory code, not merely best practice.

1. Data Protection Act 2018, c. 12, Part 5, Chapter 2, Section 121. This section mandates the creation of the code. It states, "(1) The Commissioner must prepare a code of practice which contains—(a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation...". Available at: https://www.legislation.gov.uk/ukpga/2018/12/section/121/enacted

2. Information Commissioner's Office (ICO). (2021). Data sharing: a code of practice. The introduction states: "This data sharing code of practice is a statutory code issued under section 121 of the Data Protection Act 2018 (DPA 2018). It is a practical guide for organisations about how to share personal data in a way that complies with data protection law." (p. 5). Available at: https://ico.org.uk/media/for-organisations/documents/2619451/data-sharing-code-of-practice.pdf

3. UK General Data Protection Regulation (UK GDPR), Article 4(2). This article defines 'processing' to include "disclosure by transmission, dissemination or otherwise making available," which legally categorizes data sharing as a regulated activity. Available at: https://www.legislation.gov.uk/eur/2016/679/article/4 (as retained in UK law).