NESTA Crime Online - University of Brighton Repository

most important advances that the UK could make in promoting personal Internet
security". 231
In both Europe and the UK, there have been many proposals over the last five years for
legislative change that would force firms to notify regulators and customers of all
breaches of their data security. Many voices have come out in favour of enacting data
security breach notification laws (UK NGOs 232 and The European Data Protection
Supervisor – EDPS). 233 In the UK, there were encouraging signs when the Information
Commissioner's Office (ICO) suggested that the revisions to the EU's ePrivacy Directive
“could be the "catalyst" needed to get data-breach notification into UK law” in July
2008. 234 However, by November, the UK government announced that it would not be
implementing a data-breach notification law, similar to the existing one in the US. This
stance could put the Government at odds with the European Union, which plans to force
companies to own up to data breaches as part of its new ePrivacy Directive.
By contrast, 44 US states 235 had enacted legislation by December 2008 which requires
notification of any security breaches involving personal information from public and
private organisations. Legislation on data breach notification was first passed in
California in 2003. 236 In general, most state laws follow the basic tenets of California's
original law: companies must immediately disclose a data breach to customers, usually
in writing. Also in California, there is a private right of action, and there are very few
exemptions. 237 Since the adoption of this legislation in a majority of US states, reports of
security breaches have rocketed and breaches from private companies are regularly
reported. In the UK it has been argued that the US experience has not been a
231 House of Lords, 2007, Personal Internet Security Report, p 57.
232 For example silicon.com, who launched a Full Disclosure campaign in 2007.
233 The EDPS is an independent supervisory authority devoted to protecting personal data and privacy and
promoting good data protection practices within the EU, both by monitoring the EU administration’s own data
processing, as well as by commenting on pending legislation.
234 Heath, N. (2008) “ICO:Data breach law moves closer”, www.silcon.com, 3/7/08.
235 Plus the District of Columbia, Puerto Rico and the Virgin Islands.
236 Data breach disclosure law, SB 1386.
237 Law in some other states allow more exemptions or do not allow a private right of action. For instance,
California allows exemptions for encrypted data that's lost and publicly available government data. In
California there is no such thing as an immaterial breach, while other states do have a definition of immaterial
breach.
Page 84