Feeds

ICO voices concern over creaking data protection law

Data Protection Directive approaching 15th birthday

Internet Security Threat Report 2014

The Data Protection Directive is old-fashioned and out of date, a report published by the UK's privacy regulator the Information Commissioner's Office (ICO) has said. Commissioner Richard Thomas said that the European Union must change its legislation.

The ICO commissioned RAND Europe to investigate whether or not 1995's EU Data Protection Directive was a good basis for Europe-wide data protection law. The research concluded that the law was flawed and needed to be updated.

It found that the law must be clearer about what it seeks to achieve, that it should be better at forcing organisations to protect personal data in their charge, that it should encourage a more strategic approach to enforcement and that it does not deal well enough with the export of personal data outside the EU.

Thomas said that the Directive, on which the UK's Data Protection Act is based, is outmoded. "The Directive is showing its age. Modern approaches to regulation mean that laws must concentrate on the real risks that people face in the modern world, must avoid unnecessary burdens, and must work well in practice," he said. "Organisations must embed privacy by design and data protection must become a top level corporate governance issue."

RAND said that the Directive would be improved by its fundamental approach to ensuring data privacy being changed. It said that the law should focus on the protection of individuals and the security of their data, and not on the processes that lead to that.

"The stronger, results oriented approach described in this report aims to protect data subjects against personal harm resulting from the unlawful processing of any data, rather than making personal data the building block of data protection regulations," said the report. "It would move away from a regulatory framework that measures the adequacy of data processing by measuring compliance with certain formalities, towards a framework that instead requires certain fundamental principles to be respected, and has the ability, legal authority and conviction to impose harsh sanctions when these principles are violated."

The report emphasized that a law alone will not properly protect personal data, that the behaviour of national regulators is crucial.

"The success or failure of privacy and data protection is not governed by the text of legislation, but rather by the actions of those called upon to enforce the law," it said. "It cannot be stressed enough that supervisory authorities must be given an appropriate level of responsibility for this arrangement to work."

Thomas said that the way that regulators operate is changing as people and organisations become more aware of the dangers of poor data security.

"21st century themes for regulating the privacy and integrity of personal information involve greater emphasis on trust, confidence, and transparency," he said. "Safeguarding personal information has become a major reputational issue for businesses and governments. They must be held accountable if things go wrong."

William Malcolm, a data protection law specialist at Pinsent Masons, the law firm behind OUT-LAW.COM, said that the analysis of the nature of the Directive was accurate.

"Both the Directive and the UK legislation deriving from it have always been mechanistic, rules-based and prescriptive; given the changing world in which we live, legislation which takes a more rights-based approach would be of benefit to organisations and individuals alike," he said.

The report made nine recommendations, including that the terms associated with data protection law, such as privacy by design, be clarified, and that enforcement methods be more closely harmonised.

Malcolm said that this is an appropriate time to be thinking about revising the EU law. "In 2010 we're coming upon the 15 year anniversary of the Directive. It would seem a fitting time to reflect on both the strengths and weaknesses and to ensure that the measures are delivering for individuals, businesses and organisations," he said.

The report can be read here (pdf).

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Big Content outs piracy hotbeds: São Paulo, Beijing ... TORONTO?
MPAA calls Canadians a bunch of bootlegging movie thieves
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Lawyers mobilise angry mob against Apple over alleged 2011 Macbook Pro crapness
We suffered 'random bouts of graphical distortion' - fanbois
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.