Feeds

Data protection law 'should contain costs recovery for ICO'

Also link to privacy protection, says firm

Secure remote control for conventional and virtual desktops

The Information Commissioner's Office (ICO) should be able to charge companies for audits he conducts on their privacy processes, according to a data protection consultancy.

Data protection law should also be linked explicitly to the privacy protections contained in the European Convention on Human Rights, said the company. The proposals are contained in a submission by Amberhawk Training to a Government consultation on the Data Protection Act (DPA).

The Government has asked for the views of business and policy groups on the DPA so that it can negotiate with those views in mind when the European Union reviews the Data Protection Directive in the coming months.

Amberhawk's submission outlines the changes that it thinks should be made to the UK legislation, including its proposal that there should be a formal link in the DPA to the right to privacy created by the European Convention on Human Rights. That Convention's Article 8 guarantees the right to a private and family life.

"The [Information] Commissioner should be able to enforce the Act in circumstances when Article 8 is concerned with the processing of personal data," said Amberhawk's submission. "It should be possible for the Commissioner to assess whether or not some processing is lawful in terms of Article 8."

The DPA contains eight data protection principles which govern how organisations define and treat personal data.

Amberhawk said in its submission that the sixth data protection principle should be rewritten to include the right to privacy contained in the Convention.

At present it says: "Personal data shall be processed in accordance with the rights of data subjects under this Act."

Amberhawk suggested that the sixth principle be changed to read: "Personal data shall be processed in accordance with the rights of data subjects under this Act and, in particular, personal data shall not be processed in a way that does not respect the private and family life or correspondence of data subjects".

"The effect of this change would explicitly link the Human Rights and Data Protection regimes and give the UK's Information Commissioner an explicit human rights role but only in the context of the processing of personal data," it said.

The company also suggested that the ICO should be able to recover the costs that it incurs when examines the data protection practices of companies that might have broken the law.

"The Information Commissioner should be able, at his discretion, to recover the costs associated with any Audit undertaken by his office, or any Notice that he issues," said the submission. "If we expect the Commissioner to protect the privacy of individuals, he should not be financially penalised when he does. The possibility of costs recover will also encourage data controllers to co-operate with the Commissioner to avoid him invoking costs by issuing a formal Notice."

Amberhawk also suggested that the ICO, which also enforces freedom of information (FOI) laws, should be able to operate a similar enforcement mechanism in relation to the DPA that it currently does in relation to FOI laws.

"A consistent approach [between the DPA and FOI legal regimes] can be achieved by introducing a 'Data Protection Practice Notice' mechanism in data protection regulatory regime," said the submission. "This is an administrative notice served by the Commissioner requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with any Data Protection Principle."

The consultation process, which has now closed, will give the Government the information it needs to negotiate on any changes to be made at an EU level to data protection laws, the Ministry of Justice said in July.

See: Amberhawk's submission (8-page / 244KB PDF)

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Scrapping the Human Rights Act: What about privacy and freedom of expression?
Justice minister's attack to destroy ability to challenge state
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Hey Brit taxpayers. You just spent £4m on Central London ‘innovation playground’
Catapult me a Mojito, I feel an Digital Innovation coming on
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
EU probes Google’s Android omerta again: Talk now, or else
Spill those Android secrets, or we’ll fine you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.