Feeds

Data protection law 'should contain costs recovery for ICO'

Also link to privacy protection, says firm

Top 5 reasons to deploy VMware with Tegile

The Information Commissioner's Office (ICO) should be able to charge companies for audits he conducts on their privacy processes, according to a data protection consultancy.

Data protection law should also be linked explicitly to the privacy protections contained in the European Convention on Human Rights, said the company. The proposals are contained in a submission by Amberhawk Training to a Government consultation on the Data Protection Act (DPA).

The Government has asked for the views of business and policy groups on the DPA so that it can negotiate with those views in mind when the European Union reviews the Data Protection Directive in the coming months.

Amberhawk's submission outlines the changes that it thinks should be made to the UK legislation, including its proposal that there should be a formal link in the DPA to the right to privacy created by the European Convention on Human Rights. That Convention's Article 8 guarantees the right to a private and family life.

"The [Information] Commissioner should be able to enforce the Act in circumstances when Article 8 is concerned with the processing of personal data," said Amberhawk's submission. "It should be possible for the Commissioner to assess whether or not some processing is lawful in terms of Article 8."

The DPA contains eight data protection principles which govern how organisations define and treat personal data.

Amberhawk said in its submission that the sixth data protection principle should be rewritten to include the right to privacy contained in the Convention.

At present it says: "Personal data shall be processed in accordance with the rights of data subjects under this Act."

Amberhawk suggested that the sixth principle be changed to read: "Personal data shall be processed in accordance with the rights of data subjects under this Act and, in particular, personal data shall not be processed in a way that does not respect the private and family life or correspondence of data subjects".

"The effect of this change would explicitly link the Human Rights and Data Protection regimes and give the UK's Information Commissioner an explicit human rights role but only in the context of the processing of personal data," it said.

The company also suggested that the ICO should be able to recover the costs that it incurs when examines the data protection practices of companies that might have broken the law.

"The Information Commissioner should be able, at his discretion, to recover the costs associated with any Audit undertaken by his office, or any Notice that he issues," said the submission. "If we expect the Commissioner to protect the privacy of individuals, he should not be financially penalised when he does. The possibility of costs recover will also encourage data controllers to co-operate with the Commissioner to avoid him invoking costs by issuing a formal Notice."

Amberhawk also suggested that the ICO, which also enforces freedom of information (FOI) laws, should be able to operate a similar enforcement mechanism in relation to the DPA that it currently does in relation to FOI laws.

"A consistent approach [between the DPA and FOI legal regimes] can be achieved by introducing a 'Data Protection Practice Notice' mechanism in data protection regulatory regime," said the submission. "This is an administrative notice served by the Commissioner requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with any Data Protection Principle."

The consultation process, which has now closed, will give the Government the information it needs to negotiate on any changes to be made at an EU level to data protection laws, the Ministry of Justice said in July.

See: Amberhawk's submission (8-page / 244KB PDF)

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Secure remote control for conventional and virtual desktops

More from The Register

next story
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Right to be forgotten should apply to Google.com too: EU
And hey - no need to tell the website you've de-listed. That'll make it easier ...
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.