Breaking new ground in data protection

While the police are not short of high-profile oversight, industry voice Police Market Report believes the new EU General Data Protection Regulation (GDPR) will “ratchet up” compliance for the service.

“There’s the Home Affairs Select Committee, Her Majesty’s Inspectorate of Constabulary and the Independent Police Complaints Commission for starters.

“But none inflict the short, sharp pain of heavy fines, like the £80,000 which Kent Police was told to pay last month,” said John Rowland, editor of the monthly subscriber-only bulletin that specialises in police information and communications technology.

“The penalty was levied by the Information Commissioner’s Office (ICO) for ‘serious contravention of the Data Protection Act’.

“It’s not first time police, health or local authorities have been penalised – there’s two or three cases every month – but compliance pressures will ratchet up with this next round of data protection laws.”

The GDPR will replace the EU directive that the 1998 UK Data Protection Act is based on. It will run parallel with a new directive for police and justice issues that should enable police forces across Europe to work together faster and more efficiently to counter serious crime and terrorism.

Mr Rowland said that in the short term, the GDPR would increase workloads and trigger an overhaul of data handling systems.

“Pressure will be on to see which bits of compliance can be automated, leaving the trickier stuff to ‘data protection staffers’. There’s time yet. GDPR implementation doesn’t kick in until 2018,” he said.

“The longer-term impact is unknown. Parts of GDPR will break new ground for police and justice agencies. It will also wrap up other rights and rulings already in play and potentially give them a much wider clout.

“Take the right to be forgotten (RTBF), the name given to statute that entitles individuals to have, in some cases, embarrassing or misleading information removed from online and elsewhere.

“It’s been around for some time, in various guises and in different EU countries. The 700 names removed from local sex offender registers are a recent example. The action was taken after the UK Supreme Court granted the right to challenge police use of the register in 2010.

“But consider what will happen if police and agencies are challenged with wider RTBF appeals. It could apply various types of intelligence data, culled from social media, perhaps, and held locally or centrally. In short, anything that contains personal details.

“Individuals will also have the right under GDPR to be informed if personal data is hacked or compromised. The impact of this could be seismic.”

Mr Rowland said no public or corporate body wants to admit they’ve been hacked: “The loud hush from banks, justice, intelligence and enforcement agencies on the subject is conspicuous. It’s highly probable much more will be heard about this post-2018.”

But he added there were a few “get-out clauses for police, justice and tax authorities”.

“The specific police and justice directive will, it is hoped, smooth the way for secure data transfers between EU agencies. It will start by harmonising the existing 28 different nation state data standards,” said Mr Rowland.

“This, however, falls a long way short from offering a blanket exemption.”

With maximum fines as high as 20 million euro for breaches of the new EU data protection regulation, the Information Commissioner’s Office (ICO) has warned that organisations “cannot afford to get data protection wrong”.

There will be a two-year transition period before the new EU-wide regulations pass into law, and Information Commissioner Christopher Graham – who is standing down this summer to be replaced by Elizabeth Denham – said the reforms promise to be the “biggest shake-up for consumers’ data protection rights for three decades”.

European Parliament’s lead MEP on the directive for police and justice issues, Estonia’s Marju Lauristin, said the “historic agreement” should facilitate the sharing of information, while at