establish a rigorous code of practice governing the treatment of sensitive personal data by public sector organisations, including:

See this item in context