European Commission tells UK to beef up ICO's powers

The European Commission has told the UK to strengthen the powers of the Information Commissioner’s Office or face infringement action.

The Commission said national data rules in the UK were “curtailed in several ways, leaving the standard of protection lower than required under EU rules”.

It has particular issues with the way the UK implemented the 1995 Data Protection Directive in relation to limitations on the ICO’s powers. These include that the ICO:

• Cannot monitor whether third countries’ data protection is adequate. These assessments should come before international transfers of personal information, the Commission said.
• Can neither perform random checks on people using or processing personal data, nor enforce penalties following the checks.

The Commission also pointed to the fact that the courts in the UK can refuse the right to have personal data rectified or erased. “The right to compensation for moral damage when personal information is used inappropriately is also restricted,” it added.

The UK will have two months to inform the Commission of the measures taken to ensure compliance with the EU Data Protection Directive. Failure could see the UK referred to the European Court of Justice.

Vice-President Viviane Reding, Commissioner for Justice, said: “Data protection authorities have the crucial and delicate task of protecting the fundamental right to privacy. EU rules require that the work of data protection authorities must not be unbalanced by the slightest hint of legal ambiguity."

Claiming that she would enforce this “vigorously”, Reding urged the UK government to change its rules swiftly.

A spokesperson for the ICO said: "It is important that we have effective data protection regulation to help protect individuals' personal information. We look forward to discussing the Commission's detailed concerns with the Ministry of Justice and providing input into the UK Government's response"