Shropshire lawyer warns businesses to plan ahead of new data protection legislation
A Shropshire lawyer has warned that proposed amendments to data protection rules which were designed to bring greater legal certainty and improve efficiency will in fact impose a significant burden on UK companies who may have to make substantial investments to ensure they are compliant.
Under the new proposals there would be a single national data protection authority in the EU country where organisations have their main base. But Robert Williams, a Partner and head of Corporate Law at leading Shropshire and North Wales law firm, GHP Legal, says the new obligations are unprecedented in the UK and could cause an administrative nightmare for business owners who face a fine of up to €1 million for non-compliance or, in the case of an ‘enterprise’, up to 2% of global annual turnover.
“Under the new laws,” says Mr Williams, “organisations will be obliged to notify the national supervisory authority of serious data breaches within as little as 24 hours. Public authorities and enterprises employing more than 250 people will need to appoint an independent data protection officer.
“Explicit consent will be required from an individual before their personal data can be processed. The individual’s lack of response cannot be assumed to be consent. Privacy by design and privacy default concepts will need to be integrated into business processes, with privacy safeguards having to be integrated into products as they are developed. In social networking, default settings will have to protect the privacy of individuals.
“Perhaps one of the most difficult requirements will be that, if required by an individual, an organisation will be required to erase all personal data held on that individual. That includes any public links to or copies of personal data that can be found on the internet. Data subjects will also have the right to transfer personal data from one service provider to another without hindrance.
“The obligations on companies will be massive – as will be the penalties if businesses do not comply. I would advise companies to start planning for compliance strategies now, and seek advice if they need to.”
