Lords report calls for data security law

Link: Lords report calls for data security law
Filed under: Legal News, Internet News, Business News

The House of Lords Science and Technology Committee has issued a new report calling for a major review of internet security.

The Personal Internet Security report recommends the urgent introduction of a data security breach law and a central web-based e-crime reporting system on which it would be mandatory for companies and public sector organisations to report the loss of sensitive data.

The reporting system would provide a central resource for the collation of reports, which would help law enforcement agencies identify patterns in computer crime.

The Committee says that the proposed law should define what constitutes a data security breach and there should be clear guidelines on the content of letters notifying of a security breach.

The letters should include advice on the steps an individual needs to take to deal with a possible loss of personal data.

At the moment businesses are not bound by a duty of disclosure to report a security breach. This makes it less likely that customers will identify and report fraud, leading to significant under-reporting.

The report contrasts the UK situation to that in the US, where many states already have a disclosure law.

In the US, companies have strong incentives to prioritise security, in order to avoid stringent penalties and the possible loss of share value if a security breach is disclosed, with the consequent loss of reputation this would involve.

Before the introduction of disclosure laws, there was a tendency for companies to conceal attacks on their systems. However, the legal requirement for individuals to be notified if their personal data is compromised is a strong incentive for companies to give data security the highest priority.

The Lords committee recommends that the UK government should use the lessons learned in the US in order to establish a workable and effective legislative framework in the UK.

It also called for the Information Commissioner’s Office to be given stronger powers of enforcement.