Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking the question, I contacted the company and we came up with a different method).
I'm aware that the data protection act requires the data to be kept safe. But who's job is it to ensure that it gets there safe? Especially that the information is being requested by them, but the onus is on me to send it? Who's at fault if the data is intercepted?
Is the data my responsibility until it arrives at their system (I think so?), or is it their responsibility to make sure that the data is transferred in a secure manner?
Under my understanding, if I were a company sending someone else's details in this manner, I'm liable. But if I were a company taking bank details over HTTP, it's also on me and not the customer, right?
Short version: If someone asks me for my information, do they have to ensure it is sent to them securely, or do I?
(Again, to avoid derailing the question: I'm looking for the interpretation of people with a stronger background in this issue than me. I'm not looking for legal advice. Future-people reading the question shouldn't interpret answers as legal advice).