Readers may be wondering what has happened to the EU Commission’s infraction proceedings against the UK government for failure to implement the Data Protection Directive correctly.
Last Summer as a part of its ongoing review of the implementation of the Directive, the European Commission wrote to the UK government, asking for a response to a number of queries about the way the Data Protection Act has given effect to the Directive. This correspondence from the EC came after the UK Court of Appeal’s decision in, and the UK Information Commissioner’s guidance on, Durant v FSA which, inter alia, provided a restrictive judgment on the types of data that fall within the ambit of the Data Protection Act.
We have been in touch with the Department for Constitutional Affairs (the government department responsible for handling the infraction proceedings), which has advised us that the Commission has taken no further steps in this matter since the UK government response last Autumn and an informal meeting in January. The DCA, however, thinks it unlikely that the Commission has dropped the matter. Rather, it is likely that the current delay is instead due to the relevant EC department moving from the Internal Market Directorate to the Justice and Home Affairs Directorate and the associated administrative delay that this has caused.
We understand that the Commission also raised queries about:
the UK’s approach to transfers of personal data outside the EEA
the lack of a statutory definition of “consent”
whether the powers available to the Information Commissioner are sufficient – in particular whether the Commissioner should have powers to award costs and impose actual penalties
This still leaves organisations operating in the UK in a difficult position. While organisations may bring their policies and procedures into line with the DPA, until this uncertainty has been resolved there is a continuing risk that the UK legal position will be forced to change as a result of legal action by the EC.