Data protection law must evolve to reflect 21st century themes: ICO

The RAND research report has concluded that in an increasingly global, networked environment, the EU Data Protection Directive will not suffice in the long term.

The Information Commissioner’s Office (ICO) has published the review of the strengths and weaknesses of the directive after it commissioned RAND Europe, an independent research organisation, to conduct the study amid growing fears that the current European Directive is out-dated and too bureaucratic.

Richard Thomas, Information Commissioner, said: “The Directive is showing its age. Data protection law needs to recognise that society as a whole suffers where the improper use of personal information results in unwarranted intrusion into private lives or excessive governmental or organisational power.”

“Data protection is too important to be left to data protection specialists talking to each other. 21st century themes for regulating the privacy and integrity of personal information involve greater emphasis on trust, confidence, and transparency.”

Concluding that current law does not sufficiently address the risks to individuals’ personal information, RAND study proposes more strategic approach to the directive’s enforcement. It also recommends for a stronger focus on the accountability of all organisations for safeguarding the information they handle and improved arrangements for the export of personal data outside the European area. It, however, acknowledged that the Directive has helped to harmonise data protection rules across the European Union and has provided an international reference model for good practice.

According to Thomas, massive technological advances, global trade and the need for personal information to cross international borders all signal the need for the law to evolve. “Organisations must embed privacy by design and data protection must become a top level corporate governance issue.”

He added that while the study is not meant to be an immediate blueprint for a new directive, its recommendations could stimulate discussions about how the 21st century data protection law should look like.