Feeds

ICO voices concern over creaking data protection law

Data Protection Directive approaching 15th birthday

The essential guide to IT transformation

The Data Protection Directive is old-fashioned and out of date, a report published by the UK's privacy regulator the Information Commissioner's Office (ICO) has said. Commissioner Richard Thomas said that the European Union must change its legislation.

The ICO commissioned RAND Europe to investigate whether or not 1995's EU Data Protection Directive was a good basis for Europe-wide data protection law. The research concluded that the law was flawed and needed to be updated.

It found that the law must be clearer about what it seeks to achieve, that it should be better at forcing organisations to protect personal data in their charge, that it should encourage a more strategic approach to enforcement and that it does not deal well enough with the export of personal data outside the EU.

Thomas said that the Directive, on which the UK's Data Protection Act is based, is outmoded. "The Directive is showing its age. Modern approaches to regulation mean that laws must concentrate on the real risks that people face in the modern world, must avoid unnecessary burdens, and must work well in practice," he said. "Organisations must embed privacy by design and data protection must become a top level corporate governance issue."

RAND said that the Directive would be improved by its fundamental approach to ensuring data privacy being changed. It said that the law should focus on the protection of individuals and the security of their data, and not on the processes that lead to that.

"The stronger, results oriented approach described in this report aims to protect data subjects against personal harm resulting from the unlawful processing of any data, rather than making personal data the building block of data protection regulations," said the report. "It would move away from a regulatory framework that measures the adequacy of data processing by measuring compliance with certain formalities, towards a framework that instead requires certain fundamental principles to be respected, and has the ability, legal authority and conviction to impose harsh sanctions when these principles are violated."

The report emphasized that a law alone will not properly protect personal data, that the behaviour of national regulators is crucial.

"The success or failure of privacy and data protection is not governed by the text of legislation, but rather by the actions of those called upon to enforce the law," it said. "It cannot be stressed enough that supervisory authorities must be given an appropriate level of responsibility for this arrangement to work."

Thomas said that the way that regulators operate is changing as people and organisations become more aware of the dangers of poor data security.

"21st century themes for regulating the privacy and integrity of personal information involve greater emphasis on trust, confidence, and transparency," he said. "Safeguarding personal information has become a major reputational issue for businesses and governments. They must be held accountable if things go wrong."

William Malcolm, a data protection law specialist at Pinsent Masons, the law firm behind OUT-LAW.COM, said that the analysis of the nature of the Directive was accurate.

"Both the Directive and the UK legislation deriving from it have always been mechanistic, rules-based and prescriptive; given the changing world in which we live, legislation which takes a more rights-based approach would be of benefit to organisations and individuals alike," he said.

The report made nine recommendations, including that the terms associated with data protection law, such as privacy by design, be clarified, and that enforcement methods be more closely harmonised.

Malcolm said that this is an appropriate time to be thinking about revising the EU law. "In 2010 we're coming upon the 15 year anniversary of the Directive. It would seem a fitting time to reflect on both the strengths and weaknesses and to ensure that the measures are delivering for individuals, businesses and organisations," he said.

The report can be read here (pdf).

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

5 things you didn’t know about cloud backup

More from The Register

next story
Hello, police, El Reg here. Are we a bunch of terrorists now?
Do Brits risk arrest for watching beheading video nasty? We asked the fuzz
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
NBN Co claims 96 mbps download speeds for FTTN trial
Umina trial also delivers 30 mbps uploads, but exact rig used not revealed
True fact: 1 in 4 Brits are now TERRORISTS
YouGov poll reveals terrible truth about the enemy within
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?