25 June 2010

EU - UK should strengthen powers of national data protection authority

The European Commission has requested the UK to strengthen the powers of its data protection authority so that it complies with the EU's Data Protection Directive. The case concerns the implementation of the EU’s 1995 Data Protection Directive (95/46/EC) both in UK law (the Data Protection Act of 1998) and its application by UK courts. The Commission has worked with UK authorities to resolve a number of issues, but several remain, notably limitations of the Information Commissioner's Office's powers:
  • it cannot monitor whether third countries' data protection is adequate. These assessments should come before international transfers of personal information;
  • it can neither perform random checks on people using or processing personal data, nor enforce penalties following the checks
  • courts in the UK can refuse the right to have personal data rectified or erased
  • the right to compensation for moral damage when personal information is used inappropriately is also restricted.
These powers and rights are protected under the EU Data Protection Directive and must also apply in the UK.