UK's data protection regulator is ineffective, says research

Apr 11, 2013
UK's data protection regulator is ineffective, says research

The regulator charged with overseeing data protection in the UK has been and will continue to be ineffective unless the government takes action, according to research by an academic at the University of East Anglia.

In a paper to be presented today, Dr Karen Mc Cullagh traces the development of the , currently the Information Commissioner's Office (ICO), since its inception almost 30 years ago, when a Conservative government enacted legislation establishing an independent regulator tasked with administering data protection law in the UK.

There has been little research evaluating the effectiveness of the regulator since its inception. Dr Mc Cullagh's study aims to address this by examining its development through four distinct phases, in order to assess the adequacy and effectiveness of the regulator to date, and predict its future potential.

Dr Mc Cullagh, from UEA's Law School, looked at: the period 1984-1998, when the Data Protection Registrar was first created and derived its powers from the Data Protection Act 1984; 1998-2010 when the Data Protection Registrar transformed into the (ICO) and gained enhanced powers under the Data Protection Act 1998; 2010 to the present, since the level of financial penalty the regulator could impose for serious breaches of the legislation was increased through the enactment of the Criminal Justice and Immigration Act 2008; and finally, the changes in proposed EU data protection regulation, which are tentatively scheduled to come into force in 2014.

"My analysis of the regulator's investigative and enforcement powers demonstrates that they have been, and continue to be, lamentably weak and ineffective," said Dr Mc Cullagh. "Despite the much-lauded enhanced powers for regulators in the proposed EU data protection regulation, there is a real risk that the ICO will remain an ineffective regulator in the future if the UK government does not take measures to create an adequately funded and properly staffed regulatory office, with appropriate investigative and enforcement powers."

Dr Mc Cullagh's analysis reveals that socio-economic, technical and political factors influenced the legislative process in each of the four eras of data protection. She shows that these factors influenced the independence of the regulator and the powers conferred on it, resulting in structural and operational weaknesses that impede its effectiveness.

"If the proposed EU regulation is implemented in its current form, the ICO will face a budgetary shortfall of £42.8m – an issue the UK government has yet to address, even though it will seriously impede the effectiveness of the regulator," added Dr Mc Cullagh.

Dr Mc Cullagh will present her research, entitled "Data Protection: regulatory (in)adequacy?", at the 28th annual British and Irish Law, Education and Technology Association (BILETA) conference, taking place at the Liverpool Law School, University of Liverpool, this week.

Explore further: Twitter looks to weave into more mobile apps

More information: www.bileta.ac.uk/Annual%20Conference/

add to favorites email to friend print save as pdf

Related Stories

Sony fined in UK over PlayStation cyberattack (Update)

Jan 24, 2013

British regulators have fined Sony 250,000 pounds ($396,100) for failing to prevent a 2011 cyberattack on its PlayStation Network which put millions of users' personal information—including names, addresses, ...

Data violations unpunished in EU: rights agency

May 07, 2010

Data protection in many European countries suffers from a lack of funds, staff, independence and most importantly, a lack of sanctions for violators, the EU's rights agency reported Friday.

French regulator warns of Google privacy policy

Feb 28, 2012

Google's new privacy policy appears to violate the European Union's data protection rules, France's regulator said Tuesday, just two days before the new guidelines are set to come into force.

Europe to move against Google over privacy rules

Feb 18, 2013

European data protection agencies intend to take action against the US Internet giant Google after it failed to follow their orders to comply with EU privacy laws, a French agency said on Monday.

EU data protection reform to replace national laws

Nov 28, 2011

The European Union wants to replace a mishmash of national laws on data protection with one bloc-wide reform, updating laws put in place long before Facebook and other social networking sites even existed.

Recommended for you

Twitter looks to weave into more mobile apps

7 hours ago

Twitter on Wednesday set out to weave itself into mobile applications with a free "Fabric" platform to help developers build better programs and make more money.

Google unveils app for managing Gmail inboxes

8 hours ago

Google is introducing an application designed to make it easier for its Gmail users to find and manage important information that can often become buried in their inboxes.

Fighting cyber-crime one app at a time

14 hours ago

This summer Victoria University of Wellington will be home to four Singaporean students researching cyber threats. The students have been working with Dr Ian Welch, a lecturer in Victoria's School of Engineering and Computer ...

Is big data heading for its 'horsemeat moment'?

16 hours ago

There have been so many leaks, hacks and scares based on misuse or misappropriation of personal data that any thought that "big data" could provide benefits rather than only opportunities for harm may be ...

User comments : 0