The EU Data Protection Commissioners grouping called the Article 29 Working Party (the Working Party) has given an opinion on the operation of a mandatory requirement to notify national data protection regulators (such as the Irish Data Protection Commissioner) of breaches in relation to personal data. The current deadline for implementation of this requirement into Irish Law is 25 May 2011.
This mandatory notification obligation requires public communications service providers (this largely refers to telecommunications and internet access service providers) to notify the national data protection regulator of personal data breaches.
The issue of personal data security breaches has previously been considered by the Irish Data Protection Commissioner who adopted a Personal Data Security Breach Code of Practice in 2010. See our article here. That code of practice has applicability to all data controllers.
The Working Party opinion considers how this notification requirement is currently being transposed into national law in EU member states and aims to assist national data protection regulators in achieving increased harmonisation across the EU.
The Working Party makes various recommendations to national data protection regulators including measures to increase data security and to increase coordination in the approach taken to cross-border data breaches. It further recommends that the European Commission swiftly initiates the adoption of technical implementation measures to guide member states to promote consistent implementation.
The Commission’s intention to extend security breach notification obligations beyond public communications service providers to other parties is supported in the opinion.
The insight provided by this opinion should help streamline implementation and compliance in different member states and in this way it is likely to be welcomed, especially by data controllers engaging in cross-border activities. However, while Ireland has taken some steps via its code of practice to broaden the scope of breach notification requirements to all data controllers, the future potential widening of the notification obligation to a legal formalised requirement and to encompass other actors/sectors may receive a mixed response.
Contributed by Leo Moore.
