Data protection directive goes live

The 1998 Data Protection Act will come into effect at midnight tonight, when an EU directive reaches its deadline. But governments across Europe have been slow to implement its strict revisions.

The directive gives individuals greater access to their personal data, and prevents businesses from exporting it outside the European Economic Area without guaranteeing its protection. On the Internet, sites will be obliged to state clearly how they intend to use their subscribers' data.

In the UK, companies will not have to register under the new Act until early next year, when secondary legislation is due. Personal data that is already being processed under the 1984 Act will not have to comply with the new rules for another three years. Governments across Europe are in a similar position. Only Greece, Italy and Sweden are ready.

Companies may well welcome the breathing space. The EC has not yet approved model contracts, submitted by the International Chamber of Commerce last month, for businesses to use with their foreign trading partners. Until it does, individual businesses will have to define for themselves what the law means by "adequate protection of personal data".

Even when the new Act is implemented, compliance will not be fully enforced until case law is established and guidance rules are published, according to the UK Data Protection Registrar.

Silicon.com will publish a full interview with UK data protection registrar, Elizabeth France, next week, to explain how talks for an international standard of data protection are progressing.