EU Considers Strict Data Breach Notification Rules 33
JohnBert writes "The European Commission is examining whether additional rules are needed on personal data breach notification in the European Union. Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure and notify individuals if such sensitive information is lost or stolen. Data breaches must also be reported to the relevant national authority. 'The duty to notify data breaches is an important part of the new E.U. telecoms rules,' said Commissioner Neelie Kroes. 'But we need consistency across the E.U. so businesses don't have to deal with a complicated range of different national schemes. I want to provide a level playing field, with certainty for consumers and practical solutions for businesses.'"
Goddamn those interfering Commies (Score:1)
Imagine expecting businesses to give a shit about their customers' personal information.
Re: (Score:3)
Get out of the states and you'll find that they either give a shit, or get shut down by fines exceeding their revenues.
breach (Score:5, Insightful)
OK, could this please include:
(1) Notification of all data retention and breaches by government as a result of government legislation, since the EU demands all sorts of data retention for "law enforcement";
(2) Equivalent rules for everyone doing business in the EU even if they store data outside the EU;
(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).
Re: (Score:2)
(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).
Just make it n=0 and I agree with you.
Re: (Score:2)
(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).
Just make it n=0 and I agree with you.
n=0 might just mean they are unable to notice breaches.
After all that happened lately to Sony they might learn from it and soon be the ones with the most secure network... Maybe not.
Re: (Score:3)
When a EU authority including national authorities want access this is generally recorded and can later be questioned for legality.
Illegally obtained evidence is in most EU nations not admissible.
Where 'generally' and 'most' is written there is place for more EU rulings to level the playing field.
2), read TFA.
3), no, dissolve the business involved but first fine them
Re: (Score:2)
no, dissolve the business involved but first fine them into bankruptcy.
Bankruptcy should not be an excuse to avoid paying fines either. Andrew Crossley of ACS:Law escaped a £200,000+ fine for loss of extremely private by simply claiming to be insolvent. If you are a criminal ordered to pay reparations you don't get off simply by having no money, we wait until you do have money or just start selling off your stuff at auction.
Re: (Score:2)
A good idea except (3), which is awful; they can just invent breaches that don't even exist as an excuse to terminate a contract. Take that one back to the drawing board, and smoke it.
Re: (Score:2)
Re: (Score:2)
Your paranoia is a little far-reaching here...sure a company is welcome to try that tactic but not without tarnishing their image.
Your paranoia is a little short-reaching here... I'm talking about actions by government, not the corporations, although it's true that the two do regularly work together to fuck the populace out of their rights and money.
Security is NOT an issue with The Cloud. (Score:2, Funny)
Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.
An
Re: (Score:2)
It's wrong in so many ways, i can't even being to start.
Re: (Score:2)
It is sarcasm but still believable. The gullibility of IT illiterate decision makers when schmoozed by weasels in an Armani suits is the stuff of legends. The scariest words you'll ever hear in IT are "that will take too long we'll buy a package". Run away screaming the second the words are uttered.
Re: (Score:1)
boss? is that you?
lol anon! I would have modded you up!
Re: (Score:2)
The ONE day I don't have mod points....
Re: (Score:1)
I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
Do you work for a Cloud company? Those will be your famous last words. You seriously need to look at the bigger picture here. How funny will it be when your medical records end up as a bit-torrent? News of the World have been hammered and Murdoch to which I welcome.
Police corruption is rife and Cloud computing is spy-ware. Yes it will be hacked.
My name is Famous Anus
Re:breach (Score:4, Informative)
Certainly in the UK, the government has had to notify data breaches in the past. The Department of Work and Pensions is one recent example.
People doing business in the EU have to either store data in the EU, or store it under "safe harbour" provisions which guarantee the same standards as in the EU.
So boxes 1 and 2 are already ticked.
Re: (Score:2)
Re: (Score:2)
(2) is already covered more harshly, you can't even export that information if you cannot guarantee that it will be protected up to EU standard wherever you bring it.
Does that include 3-letter agencies? (Score:3)
I don't hold my breath.
About who does what (Score:3, Interesting)
I think it's worthy remembering two things:
1) the European Commission (EUC) is not a decisional power. Its steatements are considered as mere advices by the Parliament, if considered at all.
2) the same Parliament is not a Sovrane Government (think of the Federal Government). But still member's legislators have ten years (IIRC) to comply or face fines.
Re: (Score:1)
While you are right on point 2 (The EU is not sovereign), I disagree on point1.
The EU parliament has to vote on some, but not all, laws and is generally there to be seen as democratic rather than actually doing anything terrible important. The EU commission is somewhere between a 'civil service' where the highest ranking officials from each department discuss and decide what should be done (note that each country sends about 1 commissioner depending on their size, and commissioners also represent their home
Central Channel for Notifications (Score:3)
Horizontal v. vertical (Score:4, Informative)
The approach outlined here seems very reasonable to me. Personal data breach legislation was rushed into the reform package for telecommunications services in Europe, because it was better than waiting for the review of the data protection directive, where it properly sits. However, it means that regulation is vertical - affecting only telecoms service provision - rather than horizontal, which would affect all providers. Since directive 95/46/EC [europa.eu] - on data protection - is horizontal, it would make sense to insert the provisions into that directive, and remove them from directive 2002/58/EC [europa.eu] - the directive of privacy and electronic communications..
For those who care, the measures are contained within directive 2009/136/EC [europa.eu] (the relevant measures here are in Art. 2), but are amendments to Art. 4 of ePrivacy directive (above). However, as befits a directive forming part of the telecommunications package, the subject of the regulation are "provider[s] of a publicly available electronic communications service".
"Electronic communications service" is defined in Art. 2 of directive 2002/18/EC [europa.eu], as:
"a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks, including telecommunications services and transmission services in networks used for broadcasting, but exclude services providing, or exercising editorial control over, content transmitted using electronic communications networks and services; it does not include information society services, as defined in Article 1 of Directive 98/34/EC, which do not consist wholly or mainly in the conveyance of signals on electronic communications networks"
I highlighted the reference to information society services, since this represents a substantial carve-out - this means that websites on online services which gather personal data, and which might suffer from data breaches, are not within the scope of the breach notification. When play.com suffered a breach, for example, it was not obliged under the breach notification to make any statement. It strikes me as odd - although understandable, given the context - that website operators, which are likely to generate huge swathes of personal data, should not be within scope. Something which a change from vertical regulation to horizontal regulation would hopefully remedy.
Re: (Score:1)
"vertical? horizontal? understandable, reasonable?? Ya right..
It's a bunch of circular gibberish designed as welfare for lawyers and bureaucrats who don't understand any of it either, but will make millions arguing about it in front of a guy who dresses funny, and might even wear one of those white wigs. I cannot for the life of me understand how we give these people any kind of credibility, much less actual authority.. Ultimately we will devolve into the age of bureaucracy when nothing else is left.
Or mayb