Slashdot Mirror
EU Considers Strict Data Breach Notification Rules
JohnBert writes "The European Commission is examining whether additional rules are needed on personal data breach notification in the European Union. Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure and notify individuals if such sensitive information is lost or stolen. Data breaches must also be reported to the relevant national authority. 'The duty to notify data breaches is an important part of the new E.U. telecoms rules,' said Commissioner Neelie Kroes. 'But we need consistency across the E.U. so businesses don't have to deal with a complicated range of different national schemes. I want to provide a level playing field, with certainty for consumers and practical solutions for businesses.'"
OK, could this please include:
(1) Notification of all data retention and breaches by government as a result of government legislation, since the EU demands all sorts of data retention for "law enforcement";
(2) Equivalent rules for everyone doing business in the EU even if they store data outside the EU;
(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).
I don't hold my breath.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
I think it's worthy remembering two things:
1) the European Commission (EUC) is not a decisional power. Its steatements are considered as mere advices by the Parliament, if considered at all.
2) the same Parliament is not a Sovrane Government (think of the Federal Government). But still member's legislators have ten years (IIRC) to comply or face fines.
Mastering the English language is fucking easy: all you have to do is to put an f* word in every fucking sentence.
Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.
And don't forget that you have to use Web Services to access The Cloud. Nothing is more secure than SOA and Web Services, with the exception of perhaps SaaS. But I think that Cloud Services 2.0 will combine the tiers into an MVC-compliant stack that uses SaaS to increase the security and partitioning of the data.
My main concern isn't with the security of The Cloud, but rather with getting my Indian team to learn all about it so we can deploy some first-generation The Cloud applications and Web Services to provide the ultimate platform upon which we can layer our business intelligence and reporting, because there are still a few verticals that we need to leverage before we can move to The Cloud 2.0.
Please remember when designing these rules that as soon as people have been trained to react to notifications of a privacy breach, scammers will begin sending fake notifications as a phishing hook.
The approach outlined here seems very reasonable to me. Personal data breach legislation was rushed into the reform package for telecommunications services in Europe, because it was better than waiting for the review of the data protection directive, where it properly sits. However, it means that regulation is vertical - affecting only telecoms service provision - rather than horizontal, which would affect all providers. Since directive 95/46/EC - on data protection - is horizontal, it would make sense to insert the provisions into that directive, and remove them from directive 2002/58/EC - the directive of privacy and electronic communications..
For those who care, the measures are contained within directive 2009/136/EC (the relevant measures here are in Art. 2), but are amendments to Art. 4 of ePrivacy directive (above). However, as befits a directive forming part of the telecommunications package, the subject of the regulation are "provider[s] of a publicly available electronic communications service".
"Electronic communications service" is defined in Art. 2 of directive 2002/18/EC, as:
"a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks, including telecommunications services and transmission services in networks used for broadcasting, but exclude services providing, or exercising editorial control over, content transmitted using electronic communications networks and services; it does not include information society services, as defined in Article 1 of Directive 98/34/EC, which do not consist wholly or mainly in the conveyance of signals on electronic communications networks"
I highlighted the reference to information society services, since this represents a substantial carve-out - this means that websites on online services which gather personal data, and which might suffer from data breaches, are not within the scope of the breach notification. When play.com suffered a breach, for example, it was not obliged under the breach notification to make any statement. It strikes me as odd - although understandable, given the context - that website operators, which are likely to generate huge swathes of personal data, should not be within scope. Something which a change from vertical regulation to horizontal regulation would hopefully remedy.
Get out of the states and you'll find that they either give a shit, or get shut down by fines exceeding their revenues.