Pictured: Robert Williams
A Shropshire lawyer has warned that proposed amendments to data
protection rules which were designed to bring greater legal
certainty and improve efficiency will in fact impose a significant
burden on UK companies who may have to make substantial investments
to ensure they are compliant.
Under the new proposals there would be a single national data
protection authority in the EU country where organisations have
their main base. But Robert Williams, a Partner and head of
Corporate Law at leading Shropshire and North Wales law firm, GHP
Legal, says the new obligations are unprecedented in the UK and
could cause an administrative nightmare for business owners who
face a fine of up to €1 million for non-compliance or, in the
case of an 'enterprise', up to 2% of global annual
turnover.
"Under the new laws," says Mr Williams, "organisations will be
obliged to notify the national supervisory authority of serious
data breaches within as little as 24 hours. Public authorities and
enterprises employing more than 250 people will need to appoint an
independent data protection officer.
"Explicit consent will be required from an individual before
their personal data can be processed. The individual's lack of
response cannot be assumed to be consent. Privacy by design and
privacy default concepts will need to be integrated into business
processes, with privacy safeguards having to be integrated into
products as they are developed. In social networking, default
settings will have to protect the privacy of individuals.
"Perhaps one of the most difficult requirements will be that, if
required by an individual, an organisation will be required to
erase all personal data held on that individual. That includes any
public links to or copies of personal data that can be found on the
internet. Data subjects will also have the right to transfer
personal data from one service provider to another without
hindrance.
"The obligations on companies will be massive - as will be the
penalties if businesses do not comply. I would advise companies to
start planning for compliance strategies now, and seek advice if
they need to."