EC is polishing its data breach hammer

THE EUROPEAN COMMISSION (EC) has promised to come down hard on firms that break or flaunt data protection rules in its member states.

The EC is doing what national governments seem to be failing to do, and is asking for more power to deal with offending businesses. It is looking for fines of up to five per cent of annual turnover for breaches of privacy rules, according to a draft of the Data Protection Directive to be unveiled in the new year.

Documents seen by the Financial Times suggest that the EC's proposals will also impose mandatory notifications for all companies within 24 hours of any data breach, as the institution looks to strength citizens' privacy.

The document contains provisions for any organisation with more than 250 employees to appoint full-time staff dedicated to data protection, a requirement that is not enforced in all EU member states.

Liz Fitzsimons, a senior associate at international law firm Eversheds said that the proposals highlight the EC's intention to make businesses more aware of their obligations to keep data secure.

"Privacy regulators want to drive privacy up the agenda, especially for non-EU-owned organisations, to ensure improved compliance, following the lead of EU competition authorities," she said.

"These new proposals can be seen as an indication that the EU is getting tougher when it comes to privacy compliance."

The draft of the directive is also expected to contain information on a system called Binding Safe Processor Rules that will let cloud computing firms such as Google and Amazon apply to data protection authorities to become legally responsible for information stored on their servers.

This could drive increased use of cloud computing among smaller companies by removing legal concerns that presently place the burden on the owner of the data, rather than the company storing it, if any data losses occur. µ