Feeds

Gah! EU data protection will STIFLE business, moans gov.UK

Yargh, I'm wrapped up in actual red tape here

Internet Security Threat Report 2014

The European Commission has not calculated the full costs to businesses of changes to the EU data protection regime, the Government has said.

The Ministry of Justice (MoJ) said that the Commission's assessment on the impact its draft General Data Protection Regulation would have on businesses does "not properly quantify the costs which would be imposed on business through compliance with the proposals."

It added that the commission had also "potentially" overstated the benefits of creating a single data protection law to govern across the EU.

"The [commission's] Impact Assessment does not assess the cost of many measures that will have an impact on business (including small businesses), such as strengthened subject access rights and the 'right to be forgotten', while also under-estimating the cost of those measures that are quantified, such as the cost of compulsory Data Protection Officers in large corporations and those processing 'risky' data," the MoJ said.

The government department said it would work to "try to better quantify the costs and benefits of the Commission's proposals on the UK economy" as well as seek "to better understand" the benefits of having a single-applicable data protection law in the trading bloc.

"This assessment of the impact will help to inform the UK's negotiations with the EU and ... it is our intention to publish our analysis" before the end of the year, the MoJ said.

The MoJ detailed its intentions in a document containing a summary of responses (84-page/451KB PDF) it had received to its call for evidence on the Commission's proposed data protection reforms. The draft General Data Protection Regulation (119-page/589KB PDF) was published by the Commission in January, although ministers from the EU member states and the Commission have already begun revising its content.

If enforced, a data protection regulation would introduce a single data protection law across all 27 EU member states. The commission's intention is for the new laws to also apply to companies that process personal data of EU citizens from outside the borders of the trading bloc, although the UK data protection watchdog has questioned whether that would be enforceable.

The MoJ said that it would try to negotiate major changes to the commission's draft plans in order to make the proposed regime less burdensome for businesses. It said that it would "resist new bureaucratic and potentially costly burdens on organisations which do not appear to offer greater protection for individuals."

An example of the bureaucratic and costly measures included within the commission's draft is the plan to introduce a mandatory requirement that organisations conduct data protection impact assessments where the personal data processing presents "specific risks" to individuals' rights, the MoJ said.

Regulators swamped with approval requests will view biz pleas as a 'nuisance'

Requiring those organisations to seek prior authorisation from regulators for that processing is also disproportionate, it added. A "large" number of respondents had claimed that it would be "very onerous" for companies to wait for approval of outsourcing contracts and that it could potentially delay outsourcing transactions. Others said that regulators could be swamped with approval requests and that individuals would see it as a "nuisance" when organisations seek their views during the impact assessment process.

The MoJ added that requiring all companies with more than 250 permanent staff to employ data protection officers would also add disproportionate costs to achieve the safeguarding of personal data. Whilst the Commission has estimated that the cost of employing data protection to be €320 million each year across the EU, the MoJ estimated that the cost to businesses in the UK alone could be estimated at £147m.

The summary of responses document outlined concerns expressed with the commission's plans from across different industries, including media, IT and financial services. The telecoms sector said that its assessment of the "implications" of the proposed new framework was that it would "result in significantly increased complexity and cost that will outweigh any potential cost-savings."

Organisations said that ensuring that existing information they hold complies with the new laws "would have a financial impact on them". A respondent from the media industry estimated that it would cost £10-15 million to comply with the "data minimisation principle". Under the Commission's draft proposals organisations processing personal data must make sure that information is "adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed."

New rules around individuals' consent to personal data processing could also result in "considerable" printing and storage cost burdens for businesses, respondents said.

Under the commission's proposals, organisations operating in the EU would have to obtain explicit, freely given, specific and informed consent from individuals to rely on consent as a legitimate ground for processing personal data. Consent would not be able to be gleaned through silence or inactivity on the part of individuals and instead must be obtained through a statement or "clear affirmative action" before it can be said to have been given.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.