Feeds

Data protection law 'should contain costs recovery for ICO'

Also link to privacy protection, says firm

The Power of One Infographic

The Information Commissioner's Office (ICO) should be able to charge companies for audits he conducts on their privacy processes, according to a data protection consultancy.

Data protection law should also be linked explicitly to the privacy protections contained in the European Convention on Human Rights, said the company. The proposals are contained in a submission by Amberhawk Training to a Government consultation on the Data Protection Act (DPA).

The Government has asked for the views of business and policy groups on the DPA so that it can negotiate with those views in mind when the European Union reviews the Data Protection Directive in the coming months.

Amberhawk's submission outlines the changes that it thinks should be made to the UK legislation, including its proposal that there should be a formal link in the DPA to the right to privacy created by the European Convention on Human Rights. That Convention's Article 8 guarantees the right to a private and family life.

"The [Information] Commissioner should be able to enforce the Act in circumstances when Article 8 is concerned with the processing of personal data," said Amberhawk's submission. "It should be possible for the Commissioner to assess whether or not some processing is lawful in terms of Article 8."

The DPA contains eight data protection principles which govern how organisations define and treat personal data.

Amberhawk said in its submission that the sixth data protection principle should be rewritten to include the right to privacy contained in the Convention.

At present it says: "Personal data shall be processed in accordance with the rights of data subjects under this Act."

Amberhawk suggested that the sixth principle be changed to read: "Personal data shall be processed in accordance with the rights of data subjects under this Act and, in particular, personal data shall not be processed in a way that does not respect the private and family life or correspondence of data subjects".

"The effect of this change would explicitly link the Human Rights and Data Protection regimes and give the UK's Information Commissioner an explicit human rights role but only in the context of the processing of personal data," it said.

The company also suggested that the ICO should be able to recover the costs that it incurs when examines the data protection practices of companies that might have broken the law.

"The Information Commissioner should be able, at his discretion, to recover the costs associated with any Audit undertaken by his office, or any Notice that he issues," said the submission. "If we expect the Commissioner to protect the privacy of individuals, he should not be financially penalised when he does. The possibility of costs recover will also encourage data controllers to co-operate with the Commissioner to avoid him invoking costs by issuing a formal Notice."

Amberhawk also suggested that the ICO, which also enforces freedom of information (FOI) laws, should be able to operate a similar enforcement mechanism in relation to the DPA that it currently does in relation to FOI laws.

"A consistent approach [between the DPA and FOI legal regimes] can be achieved by introducing a 'Data Protection Practice Notice' mechanism in data protection regulatory regime," said the submission. "This is an administrative notice served by the Commissioner requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with any Data Protection Principle."

The consultation process, which has now closed, will give the Government the information it needs to negotiate on any changes to be made at an EU level to data protection laws, the Ministry of Justice said in July.

See: Amberhawk's submission (8-page / 244KB PDF)

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Maximizing your infrastructure through virtualization

More from The Register

next story
Sit back down, Julian Assange™, you're not going anywhere just yet
Swedish court refuses to withdraw arrest warrant
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
Delaware pair nabbed for getting saucy atop Mexican eatery
Burrito meets soft taco in alleged rooftop romp outrage
British cops cuff 660 suspected paedophiles
Arrests people allegedly accessing child abuse images online
LightSquared backer sues FCC over spectrum shindy
Why, we might as well have been buying AIR
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.