Data protection risk increased by internet

A lack of understanding of the internet is causing many firms to accidentally breach the data protection laws.

IT law specialist Tarlo Lyons has found that despite the increasing adoption of e-commerce, most companies still use their old data protection policies which don't cover them from legal action under the amendments made to the 1998 Data Protection Law.

The biggest problem comes from using personal data on corporate websites, which has grown rapidly as companies attempt to 'humanise' their sites. If staff details are posted online, the employer can be held liable when that data is accessed from a country not governed by recognised European data security laws.

"It's a breach of Principle 8 of the new Data Protection Act 1998," warned Andrew Rigby, head of e-commerce and digital media at Tarlo Lyons. "Companies face fines and enforcement notices - and there's also the ultimate possibility that a business could be closed down."

And technical issues such as 'cookies' - small information files which collect user information and settings - further cloud the issue, causing Rigby to call for "a coherent, cohesive set of guidelines."

The EC is currently running a working party investigating data security issues on the web.

Gary Cutlack