Data breach disclosure hits EU businesses

Public and private sector businesses will soon be hit by mandatory-disclosure legislation.

In mid-November, the European Commission will publish the latest Data Protection Directive, the legislation on which the Data Protection Act is based, and among the new measures will be instructions on data processing.

This will install a mandatory data breach disclosure law covering every organisation in the public and private sectors.

Stewart Room, partner at law firm Field Fisher Waterhouse, told SC that while the law will go through a process of consultation over the next 12 months, he expected it to be adopted in the UK by early 2013.

“For security professionals, the biggest story is the significance that everyone will be washing their dirty linen in public and we will have a situation like there is in the US," Room said.

“Effectively, the current regime is mainly for government departments, and this was done because of the HMRC data loss. In May, mandatory data breach disclosure was added for telcos and ISPs, but it is currently optional for the private sector to report data breaches.”

Room confirmed that all sectors will have to report breaches to the Information Commissioner's Office under the new law, which will also require seriously affected individuals to be informed.

“There will be a process of adjustment to go through to get this right, but this will create a lot of re-engineering,” he said.

“There will need to be incident detection, a need to report incidents internally, and a rewrite of policy. Operationally this will be a big job.”

Room also said the Data Protection Directive will include a ‘binding safe processor rule', whereby data owners will not be liable for loss at the hands of a cloud provider.

“If you outsource to a certified business, you will not be liable if they breach your data. I believe that this will be a massive move for the adoption of cloud services by businesses which, until now, have been worried about third-party responsibility and safety in the cloud.”

This article originally appeared at scmagazineuk.com