EC tightens up data protection

A revised EC data protection act, which is expected to take effect in October, will impose tighter regulations on the processing of personal information.

Glyn Morgan, a partner in law firm Taylor Johnson Garrett, said IT managers must prepare their systems and contracts now. "Under the revised Act, you will not be able transfer personal data to any country outside the European Economic Area (EEA) that is not approved by the EC," he said. The Act is an implementation of the EC Data Protection Directive.

Morgan advised managers to tighten up their contracts by introducing data protection clauses. "International outsourcers and partners sharing a global intranet must pledge to keep the data secure," he said, "they must also promise not to do anything to it without instructions."

The EC is currently drawing up a list of non-European countries that are approved for data transfer. It is also expected to release a model contract for business use.
"The Act has major implications for companies outsourcing Y2K data abroad, or indeed putting up any personal data on the Internet," Morgan continued. "Letting someone read the data on a regular basis amounts to transferring information, even if they don't download it."

The Act, which is due for its final hearing on 2 July, covers any information held and processed by a computer, that could be used to identify somebody. It gives individuals the right to sue any company that uses their information inaccurately, if the mistake leads to financial loss.

"The best way of avoiding a legal suit is to get the active consent of every person on your list," said Morgan. "It is too early to say whether this will put European businesses at a disadvantage." He cited search engines that offer lists of email addresses as one market that will soon become illegal in Europe.