Cyber Risk Legal update - March 2015
March 2015 Cyber Risk legal update
Information Security and Data Protection for Financial Services
On 2 March, I braved the snow, and crossed a picket line (PCS members working at the Information Commissioners Office chose the conference day to escalating their campaign of strike action for fair pay) to attend the annual ICO Conference in Manchester.
The conference provides an opportunity for data protection practitioners across the UK to raise questions, hear presentations on a range of topical issues, subscribe to relevant seminars and meet others engaged in similar roles across all sectors. The slides are available here for those of you who were not able to make it, herewith the interesting insights I gained from this year's conference:
- Towards a New Regulation: In the eyes of the ICO, the new Data Protection Regulation has become a "when" rather than an "if". The UK government have given up on its campaign for the Regulation to be a Directive (requiring local implementation and therefore a degree of discretion). The prediction for the finalisation of the Regulation text is around March 2016. There will then be a 2 year implementation period;
Harmonised Security Guidance: The Government and the ICO will be working together over the coming months to produce a harmonised guide on IT security, combining the ICO's Practical Guide available here with the Government Cyber Essentials basic technical measures document available here;
Still Life in Safe Harbor: Despite the German offensive against Safe Harbor, David Smith Deputy Information Commissioner does not think the US Safe Harbor Scheme will be suspended any time soon. In fact, even in response to the European Parliament concerns about the failing in the self regulatory regime, David Smith sees no need for UK companies to be doing additional due diligence on safe harbor companies. Exporting companies should ensure due diligence and contractual clauses are in place to ensure adequate security but no additional due diligence is required just because of concerns about the scheme itself;
Name and Shame: The Complaints Resolution Team at the ICO have been renamed Performance Improvement. They are focussing on organisations who receive multiple complaints. Their aim is to start publishing the number of complaints against particular companies on their websites and the plans that companies have agreed to put in place to rectify these issues;
Stats and Breaches: The ICO has approximately 140 breaches notified to it each month, predominantly from the public sector;
Custodial Penalties: Christopher Graham's current bug bear is the length of time it is taking to get custodial penalties for breach of s.55 of the Data Protection Act onto the statute book.
Click the below headings to read more on each of the developments...
EU Data Protection Regulation Developments
Updates from around the World...
Key Dates Calendar
For more information on DAC Beachcroft please contact:
Rhiannon Davies, Associate
+44 (0) 20 7894 6577
You might also like ...
September 2014 update
Cyber security is about risk reduction, not risk prevention. No system can ever be 100% secure, particularly when constrained by financial resources and the exposure to human error or behaviour.
The law governing data security is similarly not absolute. For example, the Data Protection Act 1998 ("DPA") demands that an organisation has "appropriate" technical and organisational security measures.