News

Proposed Data Protection Regulations Update

Data protection should already be a priority for business. Now, the proposed EU Data Protection Regulations are set to raise the stakes even further.

Data protection is a major issue for businesses of all sizes and across all sectors, with lapses in information security (IS) putting them at risk of fines, commercial costs and reputational damage. Many organisations have already suffered IS breaches and concerns are growing.

The coming months are likely to see the introduction of new European regulations ratchet up the stakes further. Specifically, the adoption of a new EU Data Protection Regulation (EUDPR) will set out to strengthen current data protection legislation. It is likely to impose onerous new responsibilities on organisations, putting them at greater risk of falling foul of the law and subject to heavier penalties if they do. The EUDPR as currently proposed, will result in a single regulatory system across the EU, creating one of the world’s most comprehensive and heavily enforced data breach notification regimes.

Under the current Data Protection Act, UK companies have been obliged to protect the personal data they hold on customers, employees, prospects and others – with the risk of penalties for any failure to do so. But, the proposed EUDPR goes much further.  For example, in the UK there is currently no general obligation to report a data breach, while monetary penalties under the Act are limited to a maximum of £500,000, with a higher ‘trigger level’ for a large fine to be imposed. (You can read more about Notification of data security breaches on the Information Commissioner’s Office (ICO) here: https://ico.org.uk/media/for-organisations/documents/1536/breach_reporting.pdf)

The EU Regulation has not yet been finalised because member countries have widely differing views. EU regulation is imposed centrally and should apply uniformly, with no differences between countries, but the feeling is that various countries are trying to opt out of different proposals.

The UK, for example, is resisting the idea of a dedicated Data Protection Officer for all companies with more than 250 employees, with the ICO arguing that this is not suitable for all companies in all sectors. Some observers believe the end result may look more like an EU Directive – whereby individual states exercise discretion over how they translate EU legislation into local laws – as is the case now in the UK, where the original 1984 Data Protection Act was updated and replaced in 1998 in response to a 1995 EU Directive. We are still some way from reform, so businesses don’t need to panic, but they would be well-advised to look ahead and prepare themselves during the proposed two-year transition period.

What it means for Businesses

The onus is on businesses to put in place robust measures to manage and mitigate IS risks to comply with the new law – and also because it is in their best commercial interests. The bottom line for businesses is that under the current law if you hold data you must keep it secure, and the new law will have the same objective,

Protect yourself and make sure your USBs are SafeToGo – www.safetogo.eu

If you have a requirement for SafeToGo, something a little different, or a special project using flash memory please contact our team on  01380 738395 or via email sales@cardwave.com  to discuss the technology solutions we can offer today and we are planning on delivering tomorrow.

Sources: Comm.Business / BSI