Offshore data security fears dismissed by UK

The UK's data protection watchdog has dismissed concerns raised by the Amicus trade union and British politicians about the security of UK customer data handled in offshore locations such as India and South Africa.

The Amicus group of Labour MEPs is calling for the European Commission to extend the data protection directive to cover customer data handled overseas because of fears that security is more lax.

The MEPs also want companies to be forced to allow overseas call centre staff to disclose their real names and their location when customers call up. Currently many Indian staff are given English names and are not allowed to say where they are based if a customer asks.

But the Information Commission, which enforces the Data Protection Act (DPA) in the UK, said it has no concerns and is happy that the law currently says companies should treat data handled overseas in the same way it is handled in the UK.

A spokeswoman for the IC said: "We've never had a cause to take action against anyone under the DPA over their call centre in India. We've never seen a breach and it's not due to a lack of powers – it hasn't happened. If it had happened you would know about it."

Just last month the IC's senior policy development and quality manager told silicon.com the only complaints received from consumers were political with some people asking the IC to force companies to stop sending data abroad in protest at the loss of UK jobs.

A spokesman for Amicus said it has not received any complaints about a specific security incident and is not aware of any but argued that tighter regulation is needed to prevent one happening in the future. "There are genuine fears held by the offshore industry and financial consultants," he said.

He also dismissed the notion that the MEPs are suggesting that overseas IT and call centre workers are less trustworthy or more open to bribes from criminal gangs than their UK counterparts. "It should be more regulated and companies should be looked at more regularly. It's the process and practices implemented by the companies we are questioning, not the staff themselves," he said.

The union claims the issue of disclosure is also about ethical business practices. "A customer will call up a call centre in South Africa, India, or wherever and the call centre worker is not allowed to disclose their real name and where they are taking the call from," he said. "The ethical argument is that customers should be able to know who they are talking to and where they are. It's also good for the workers as it adds to the stress of taking calls from irate customers all day by having to pretend you're someone else."

The MEPs have tabled the motion to the Employment and Social Affairs committee of the EC, which will decide whether an extension to European data protection laws needs to be debated in the Parliament.

Mark Kobayashi-Hillary, author of Outsourcing to India, said the Indian government is looking at beefing up its data protection regulations because of concerns from vendors and end users.

"India is lagging with data protection standards and there are concerns among the financial services community. It is what is driving a lot of them to go captive when they offshore," he said. "With IT is is not so bad but if you are outsourcing dealing with client data that is more sensitive they would rather do it themselves."