Feeds

Data protection law 'should contain costs recovery for ICO'

Also link to privacy protection, says firm

Build a business case: developing custom apps

The Information Commissioner's Office (ICO) should be able to charge companies for audits he conducts on their privacy processes, according to a data protection consultancy.

Data protection law should also be linked explicitly to the privacy protections contained in the European Convention on Human Rights, said the company. The proposals are contained in a submission by Amberhawk Training to a Government consultation on the Data Protection Act (DPA).

The Government has asked for the views of business and policy groups on the DPA so that it can negotiate with those views in mind when the European Union reviews the Data Protection Directive in the coming months.

Amberhawk's submission outlines the changes that it thinks should be made to the UK legislation, including its proposal that there should be a formal link in the DPA to the right to privacy created by the European Convention on Human Rights. That Convention's Article 8 guarantees the right to a private and family life.

"The [Information] Commissioner should be able to enforce the Act in circumstances when Article 8 is concerned with the processing of personal data," said Amberhawk's submission. "It should be possible for the Commissioner to assess whether or not some processing is lawful in terms of Article 8."

The DPA contains eight data protection principles which govern how organisations define and treat personal data.

Amberhawk said in its submission that the sixth data protection principle should be rewritten to include the right to privacy contained in the Convention.

At present it says: "Personal data shall be processed in accordance with the rights of data subjects under this Act."

Amberhawk suggested that the sixth principle be changed to read: "Personal data shall be processed in accordance with the rights of data subjects under this Act and, in particular, personal data shall not be processed in a way that does not respect the private and family life or correspondence of data subjects".

"The effect of this change would explicitly link the Human Rights and Data Protection regimes and give the UK's Information Commissioner an explicit human rights role but only in the context of the processing of personal data," it said.

The company also suggested that the ICO should be able to recover the costs that it incurs when examines the data protection practices of companies that might have broken the law.

"The Information Commissioner should be able, at his discretion, to recover the costs associated with any Audit undertaken by his office, or any Notice that he issues," said the submission. "If we expect the Commissioner to protect the privacy of individuals, he should not be financially penalised when he does. The possibility of costs recover will also encourage data controllers to co-operate with the Commissioner to avoid him invoking costs by issuing a formal Notice."

Amberhawk also suggested that the ICO, which also enforces freedom of information (FOI) laws, should be able to operate a similar enforcement mechanism in relation to the DPA that it currently does in relation to FOI laws.

"A consistent approach [between the DPA and FOI legal regimes] can be achieved by introducing a 'Data Protection Practice Notice' mechanism in data protection regulatory regime," said the submission. "This is an administrative notice served by the Commissioner requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with any Data Protection Principle."

The consultation process, which has now closed, will give the Government the information it needs to negotiate on any changes to be made at an EU level to data protection laws, the Ministry of Justice said in July.

See: Amberhawk's submission (8-page / 244KB PDF)

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Build a business case: developing custom apps

More from The Register

next story
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
Uber, Lyft and cutting corners: The true face of the Sharing Economy
Casual labour and tired ideas = not really web-tastic
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.