Feeds

Data protection law 'should contain costs recovery for ICO'

Also link to privacy protection, says firm

5 things you didn’t know about cloud backup

The Information Commissioner's Office (ICO) should be able to charge companies for audits he conducts on their privacy processes, according to a data protection consultancy.

Data protection law should also be linked explicitly to the privacy protections contained in the European Convention on Human Rights, said the company. The proposals are contained in a submission by Amberhawk Training to a Government consultation on the Data Protection Act (DPA).

The Government has asked for the views of business and policy groups on the DPA so that it can negotiate with those views in mind when the European Union reviews the Data Protection Directive in the coming months.

Amberhawk's submission outlines the changes that it thinks should be made to the UK legislation, including its proposal that there should be a formal link in the DPA to the right to privacy created by the European Convention on Human Rights. That Convention's Article 8 guarantees the right to a private and family life.

"The [Information] Commissioner should be able to enforce the Act in circumstances when Article 8 is concerned with the processing of personal data," said Amberhawk's submission. "It should be possible for the Commissioner to assess whether or not some processing is lawful in terms of Article 8."

The DPA contains eight data protection principles which govern how organisations define and treat personal data.

Amberhawk said in its submission that the sixth data protection principle should be rewritten to include the right to privacy contained in the Convention.

At present it says: "Personal data shall be processed in accordance with the rights of data subjects under this Act."

Amberhawk suggested that the sixth principle be changed to read: "Personal data shall be processed in accordance with the rights of data subjects under this Act and, in particular, personal data shall not be processed in a way that does not respect the private and family life or correspondence of data subjects".

"The effect of this change would explicitly link the Human Rights and Data Protection regimes and give the UK's Information Commissioner an explicit human rights role but only in the context of the processing of personal data," it said.

The company also suggested that the ICO should be able to recover the costs that it incurs when examines the data protection practices of companies that might have broken the law.

"The Information Commissioner should be able, at his discretion, to recover the costs associated with any Audit undertaken by his office, or any Notice that he issues," said the submission. "If we expect the Commissioner to protect the privacy of individuals, he should not be financially penalised when he does. The possibility of costs recover will also encourage data controllers to co-operate with the Commissioner to avoid him invoking costs by issuing a formal Notice."

Amberhawk also suggested that the ICO, which also enforces freedom of information (FOI) laws, should be able to operate a similar enforcement mechanism in relation to the DPA that it currently does in relation to FOI laws.

"A consistent approach [between the DPA and FOI legal regimes] can be achieved by introducing a 'Data Protection Practice Notice' mechanism in data protection regulatory regime," said the submission. "This is an administrative notice served by the Commissioner requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with any Data Protection Principle."

The consultation process, which has now closed, will give the Government the information it needs to negotiate on any changes to be made at an EU level to data protection laws, the Ministry of Justice said in July.

See: Amberhawk's submission (8-page / 244KB PDF)

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

The essential guide to IT transformation

More from The Register

next story
Britain's housing crisis: What are we going to do about it?
Rent control: Better than bombs at destroying housing
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
GCHQ protesters stick it to British spooks ... by drinking urine
Activists told NOT to snap pics of staff at the concrete doughnut
What do you mean, I have to POST a PHYSICAL CHEQUE to get my gun licence?
Stop bitching about firearms fees - we need computerisation
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.