Data Protection in the UK?
Graham Moore asks: "I am getting really concerned about where my personal information goes nowadays. In the last two weeks I have read two news articles here in the UK that talk about call centers and other agencies being set up in India that will transparently deal with customers from the UK (see the this article from The Register). On the UK mainland we have the Data Protection Act to fall back on if we believe the data is knowingly being misused or we wish to see what is stored about us. I suspect that once off of the UK mainland our details can be used or abused unhindered. I have contacted my MP, Melanie Johnson, who is also the Minister for Consumer Affairs, and have not yet had a response. Am I worrying about this unnecessarily or should we all start to get very concerned?"
I read this article about the EU stroing arming US companies to comply with EU privacy guidelines. I can't believe this wouldn't be the case for India as well.
A lot of US companies were upset about this, as was the federal government, but I think the US ended up enacting laws that mirror the EU to ease tensions. Anyone has info on this?
A speech...
Over a few weeks The Guardian covered, in a series of supplements, the current state of privacy in the UK: Big Brother, it may answer some of the questions you have.
troodon.net
Its all a sham.
If a company is found to be in breach of the Data Protection Act there is no "comeback". They simply get wrapped on the knuckles and are told to sort the matter out as soon as possible. There is no penalty, and no penalty if they DON'T sort the matter out.
Be afraid. be very afraid.
IIRC, If a company exports data to a country without eqivelent or better data protection laws they are committing an offence under the act. I can look up more information if you are interested.
But first they must leave the mainland, and that is where the breach of the Act would occur.
An analogous situation - I do work in London for a Swiss bank. Some of the processing involves trading counterparty data, but under Swiss law it is illegal to export this data to the UK. As a result, we get obfuscated data that is meaningless to us, but which the Swiss office can decode back into meaningful counterparties. In other words, the UK is complying with Swiss data laws.
Now, admittedly it's unlikely that the police are watching every internal FTP transfer. We could transfer real data. Doing so would be a crime however, so we don't. The same situation apply to India - whilst it's technically possible to transfer the data, doing so would be a breach of the law.
So...do you trust the company you're doing business with? If you do, then I would suggest that you have nothing to worry about. If you don't, well...
Cheers,
Ian
(I don't, by the way...)
The Information Commissioner is the person to raise this with first, rather than your MP, even if she is a minister (or the cynical would say, especially if she is a minister...)