Feeds

Gah! EU data protection will STIFLE business, moans gov.UK

Yargh, I'm wrapped up in actual red tape here

Top three mobile application threats

The European Commission has not calculated the full costs to businesses of changes to the EU data protection regime, the Government has said.

The Ministry of Justice (MoJ) said that the Commission's assessment on the impact its draft General Data Protection Regulation would have on businesses does "not properly quantify the costs which would be imposed on business through compliance with the proposals."

It added that the commission had also "potentially" overstated the benefits of creating a single data protection law to govern across the EU.

"The [commission's] Impact Assessment does not assess the cost of many measures that will have an impact on business (including small businesses), such as strengthened subject access rights and the 'right to be forgotten', while also under-estimating the cost of those measures that are quantified, such as the cost of compulsory Data Protection Officers in large corporations and those processing 'risky' data," the MoJ said.

The government department said it would work to "try to better quantify the costs and benefits of the Commission's proposals on the UK economy" as well as seek "to better understand" the benefits of having a single-applicable data protection law in the trading bloc.

"This assessment of the impact will help to inform the UK's negotiations with the EU and ... it is our intention to publish our analysis" before the end of the year, the MoJ said.

The MoJ detailed its intentions in a document containing a summary of responses (84-page/451KB PDF) it had received to its call for evidence on the Commission's proposed data protection reforms. The draft General Data Protection Regulation (119-page/589KB PDF) was published by the Commission in January, although ministers from the EU member states and the Commission have already begun revising its content.

If enforced, a data protection regulation would introduce a single data protection law across all 27 EU member states. The commission's intention is for the new laws to also apply to companies that process personal data of EU citizens from outside the borders of the trading bloc, although the UK data protection watchdog has questioned whether that would be enforceable.

The MoJ said that it would try to negotiate major changes to the commission's draft plans in order to make the proposed regime less burdensome for businesses. It said that it would "resist new bureaucratic and potentially costly burdens on organisations which do not appear to offer greater protection for individuals."

An example of the bureaucratic and costly measures included within the commission's draft is the plan to introduce a mandatory requirement that organisations conduct data protection impact assessments where the personal data processing presents "specific risks" to individuals' rights, the MoJ said.

Regulators swamped with approval requests will view biz pleas as a 'nuisance'

Requiring those organisations to seek prior authorisation from regulators for that processing is also disproportionate, it added. A "large" number of respondents had claimed that it would be "very onerous" for companies to wait for approval of outsourcing contracts and that it could potentially delay outsourcing transactions. Others said that regulators could be swamped with approval requests and that individuals would see it as a "nuisance" when organisations seek their views during the impact assessment process.

The MoJ added that requiring all companies with more than 250 permanent staff to employ data protection officers would also add disproportionate costs to achieve the safeguarding of personal data. Whilst the Commission has estimated that the cost of employing data protection to be €320 million each year across the EU, the MoJ estimated that the cost to businesses in the UK alone could be estimated at £147m.

The summary of responses document outlined concerns expressed with the commission's plans from across different industries, including media, IT and financial services. The telecoms sector said that its assessment of the "implications" of the proposed new framework was that it would "result in significantly increased complexity and cost that will outweigh any potential cost-savings."

Organisations said that ensuring that existing information they hold complies with the new laws "would have a financial impact on them". A respondent from the media industry estimated that it would cost £10-15 million to comply with the "data minimisation principle". Under the Commission's draft proposals organisations processing personal data must make sure that information is "adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed."

New rules around individuals' consent to personal data processing could also result in "considerable" printing and storage cost burdens for businesses, respondents said.

Under the commission's proposals, organisations operating in the EU would have to obtain explicit, freely given, specific and informed consent from individuals to rely on consent as a legitimate ground for processing personal data. Consent would not be able to be gleaned through silence or inactivity on the part of individuals and instead must be obtained through a statement or "clear affirmative action" before it can be said to have been given.

3 Big data security analytics techniques

More from The Register

next story
Sorry London, Europe's top tech city is Munich
New 'Atlas of ICT Activity' finds innovation isn't happening at Silicon Roundabout
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.