Feeds

Gah! EU data protection will STIFLE business, moans gov.UK

Yargh, I'm wrapped up in actual red tape here

Internet Security Threat Report 2014

The European Commission has not calculated the full costs to businesses of changes to the EU data protection regime, the Government has said.

The Ministry of Justice (MoJ) said that the Commission's assessment on the impact its draft General Data Protection Regulation would have on businesses does "not properly quantify the costs which would be imposed on business through compliance with the proposals."

It added that the commission had also "potentially" overstated the benefits of creating a single data protection law to govern across the EU.

"The [commission's] Impact Assessment does not assess the cost of many measures that will have an impact on business (including small businesses), such as strengthened subject access rights and the 'right to be forgotten', while also under-estimating the cost of those measures that are quantified, such as the cost of compulsory Data Protection Officers in large corporations and those processing 'risky' data," the MoJ said.

The government department said it would work to "try to better quantify the costs and benefits of the Commission's proposals on the UK economy" as well as seek "to better understand" the benefits of having a single-applicable data protection law in the trading bloc.

"This assessment of the impact will help to inform the UK's negotiations with the EU and ... it is our intention to publish our analysis" before the end of the year, the MoJ said.

The MoJ detailed its intentions in a document containing a summary of responses (84-page/451KB PDF) it had received to its call for evidence on the Commission's proposed data protection reforms. The draft General Data Protection Regulation (119-page/589KB PDF) was published by the Commission in January, although ministers from the EU member states and the Commission have already begun revising its content.

If enforced, a data protection regulation would introduce a single data protection law across all 27 EU member states. The commission's intention is for the new laws to also apply to companies that process personal data of EU citizens from outside the borders of the trading bloc, although the UK data protection watchdog has questioned whether that would be enforceable.

The MoJ said that it would try to negotiate major changes to the commission's draft plans in order to make the proposed regime less burdensome for businesses. It said that it would "resist new bureaucratic and potentially costly burdens on organisations which do not appear to offer greater protection for individuals."

An example of the bureaucratic and costly measures included within the commission's draft is the plan to introduce a mandatory requirement that organisations conduct data protection impact assessments where the personal data processing presents "specific risks" to individuals' rights, the MoJ said.

Regulators swamped with approval requests will view biz pleas as a 'nuisance'

Requiring those organisations to seek prior authorisation from regulators for that processing is also disproportionate, it added. A "large" number of respondents had claimed that it would be "very onerous" for companies to wait for approval of outsourcing contracts and that it could potentially delay outsourcing transactions. Others said that regulators could be swamped with approval requests and that individuals would see it as a "nuisance" when organisations seek their views during the impact assessment process.

The MoJ added that requiring all companies with more than 250 permanent staff to employ data protection officers would also add disproportionate costs to achieve the safeguarding of personal data. Whilst the Commission has estimated that the cost of employing data protection to be €320 million each year across the EU, the MoJ estimated that the cost to businesses in the UK alone could be estimated at £147m.

The summary of responses document outlined concerns expressed with the commission's plans from across different industries, including media, IT and financial services. The telecoms sector said that its assessment of the "implications" of the proposed new framework was that it would "result in significantly increased complexity and cost that will outweigh any potential cost-savings."

Organisations said that ensuring that existing information they hold complies with the new laws "would have a financial impact on them". A respondent from the media industry estimated that it would cost £10-15 million to comply with the "data minimisation principle". Under the Commission's draft proposals organisations processing personal data must make sure that information is "adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed."

New rules around individuals' consent to personal data processing could also result in "considerable" printing and storage cost burdens for businesses, respondents said.

Under the commission's proposals, organisations operating in the EU would have to obtain explicit, freely given, specific and informed consent from individuals to rely on consent as a legitimate ground for processing personal data. Consent would not be able to be gleaned through silence or inactivity on the part of individuals and instead must be obtained through a statement or "clear affirmative action" before it can be said to have been given.

Choosing a cloud hosting partner with confidence

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
'Internet Freedom Panel' to keep web overlord ICANN out of Russian hands – new proposal
Come back with our internet! cries Republican drawing up bill
What a Mesa: Apple vows to re-use titsup GT sapphire glass plant
Commits to American manufacturing ... of secret tech
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.