UK govt rules out data breach notification law

The U.K. government has announced that it will not be implementing a data breach notification law.

Following a recommendation by information commissioner Richard Thomas in July, the government announced in a report on Tuesday that it will not introduce a compulsory data breach notification law for private-sector organizations.

"After considering the analysis of the experience of the U.S. in the area of data-breach notification legislation, the government is not intending to implement similar legislation to that in operation in the U.S.," states the Response to the Data Sharing Review Report (PDF).

It is already mandatory for public-sector organizations to report any significant actual or potential losses of data to the Information Commissioner's Office (ICO). Private-sector organizations should report data breaches "as a matter of good practice", states the report, and the ICO should take into account of any lack of reporting by a private-sector organization in its enforcement action.

Fines for companies that are found in breach of data protection laws are to be raised, stated the report. The U.K. Ministry of Justice is working with the ICO to determine the level of the maximum fine.

Merlin, Earl of Erroll, told ZDNet Asia's sister site ZDNet UK on Wednesday that a data breach notification law would have both advantages and disadvantages.

"It's like the curate's egg--good in parts," said Errol. "Notification is inherently a good idea because it allows the government to get a handle on the scale of the problem. The danger is that it opens up opportunities for phishing, as people send out letters saying: 'Your details have been compromised, please confirm your data.'"

Errol said that the government should reconsider mandatory data breach notification, and added that the European Parliament was also considering a data breach law.

"Europe is looking at it hard and, if they bring in a law, then the government will have no choice but to accept," Erroll said.