Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, what his policy is on whether (a) a person's identity as used to authorise or verify an online account and (b) the fact that a person has such an account should be considered personal data for the purposes of data protection.

The use of a person's identity to authorise or verify an online account would constitute personal data if, as defined by the Data Protection Act (DPA), the data relates to a living individual who can be identified from those data, or from those data and other information that is in the possession of, or is likely to come into the possession of, the data controller. The definition of personal data also includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of that individual.

Organisations that use online accounts are responsible for the development and implementation of appropriate procedures and systems so that personal data is processed in accordance with the provisions of the DPA and other relevant legislation and guidance.

The Information Commissioner’s Office, who is the independent regulatory body responsible for enforcing the DPA in the UK, has produced guidance for the general public, private and public sector organisations on such matters. This guidance can be found on its’ website at; www.ico.org.uk