EU may force businesses to tell customers about data breaches

Mon 24 May 2010

The European Commission is considering revising data protection laws so that firms responsible for data breaches are obliged to tell their customers.

Telecommunications operators and service providers are already required to notify customers if a data breach has occurred, following recent revisions to EU rules.

Under the new proposal, this requirement would be extended to any organisation that puts an individual's personal data at risk.

It is believed that such a move could help to increase consumer trust and help people feel more confident on the internet.

The European Commission warned that if people do not feel safe online, they are unlikely to embrace the technology.

It said reinforcing rules on personal data protection, along with making the response to cyber-crime more coordinated across Europe, is part of the solution.

This comes shortly after Peter Hustinx, the European data protection supervisor, said the relevant authorities must be given the necessary resources in order to implement any new data protection laws.

James Oxley, a solicitor at Winckworth Sherwood, commented: "These suggested revisions of data protection laws come as no surprise since both the private and public sectors are increasingly seeing their information security obligations and transparency obligations being extended, not just from the European Commission, but also more recently in the proposals of the new coalition government.

"It seems we are entering a new dawn of information Glasnost."