Slashdot Mirror

← Back to Stories (view on slashdot.org)

EU Considers Strict Data Breach Notification Rules

Posted by Soulskill on from the wrist-slap-doctrine dept.

JohnBert writes "The European Commission is examining whether additional rules are needed on personal data breach notification in the European Union. Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure and notify individuals if such sensitive information is lost or stolen. Data breaches must also be reported to the relevant national authority. 'The duty to notify data breaches is an important part of the new E.U. telecoms rules,' said Commissioner Neelie Kroes. 'But we need consistency across the E.U. so businesses don't have to deal with a complicated range of different national schemes. I want to provide a level playing field, with certainty for consumers and practical solutions for businesses.'"

4 of 33 comments (clear)

  1. breach by Hazel+Bergeron · · Score: 4, Insightful

    OK, could this please include:

    (1) Notification of all data retention and breaches by government as a result of government legislation, since the EU demands all sorts of data retention for "law enforcement";

    (2) Equivalent rules for everyone doing business in the EU even if they store data outside the EU;

    (3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).

    1. Re:breach by jonbryce · · Score: 3, Informative

      Certainly in the UK, the government has had to notify data breaches in the past. The Department of Work and Pensions is one recent example.

      People doing business in the EU have to either store data in the EU, or store it under "safe harbour" provisions which guarantee the same standards as in the EU.

      So boxes 1 and 2 are already ticked.

  2. About who does what by Psicopatico · · Score: 3, Interesting

    I think it's worthy remembering two things:
    1) the European Commission (EUC) is not a decisional power. Its steatements are considered as mere advices by the Parliament, if considered at all.
    2) the same Parliament is not a Sovrane Government (think of the Federal Government). But still member's legislators have ten years (IIRC) to comply or face fines.

    --
    Mastering the English language is fucking easy: all you have to do is to put an f* word in every fucking sentence.
  3. Horizontal v. vertical by Neil_Brown · · Score: 3, Informative

    The approach outlined here seems very reasonable to me. Personal data breach legislation was rushed into the reform package for telecommunications services in Europe, because it was better than waiting for the review of the data protection directive, where it properly sits. However, it means that regulation is vertical - affecting only telecoms service provision - rather than horizontal, which would affect all providers. Since directive 95/46/EC - on data protection - is horizontal, it would make sense to insert the provisions into that directive, and remove them from directive 2002/58/EC - the directive of privacy and electronic communications..

    For those who care, the measures are contained within directive 2009/136/EC (the relevant measures here are in Art. 2), but are amendments to Art. 4 of ePrivacy directive (above). However, as befits a directive forming part of the telecommunications package, the subject of the regulation are "provider[s] of a publicly available electronic communications service".

    "Electronic communications service" is defined in Art. 2 of directive 2002/18/EC, as:

    "a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks, including telecommunications services and transmission services in networks used for broadcasting, but exclude services providing, or exercising editorial control over, content transmitted using electronic communications networks and services; it does not include information society services, as defined in Article 1 of Directive 98/34/EC, which do not consist wholly or mainly in the conveyance of signals on electronic communications networks"

    I highlighted the reference to information society services, since this represents a substantial carve-out - this means that websites on online services which gather personal data, and which might suffer from data breaches, are not within the scope of the breach notification. When play.com suffered a breach, for example, it was not obliged under the breach notification to make any statement. It strikes me as odd - although understandable, given the context - that website operators, which are likely to generate huge swathes of personal data, should not be within scope. Something which a change from vertical regulation to horizontal regulation would hopefully remedy.