UK data laws need 'Californication'

Any UK data breach legislation should use the California law as a blueprint, according to an information security company chief.

Joe Fantuzzi, CEO of content and document protection company Workshare, told silicon.com it would be good to have more stringent protection in the UK and other countries in Europe because stronger regulations change behaviour.

Fantuzzi said: "That's why the California law has teeth - it's because of the requirement to notify and not because of the huge fines."

The law - known as SB 1386 - obliges Californian state agencies or businesses to disclose data security breaches to residents if their unencrypted personal information many have been compromised.

The data breach legislation in The Golden State has since been followed by similar moves from other US states and has forced businesses to take data security seriously - and given consumers the tools to protect themselves against fraud. silicon.com is campaigning for a similar law in the UK.

silicon.com's Full Disclosure campaign - what we are asking for...

silicon.com wants the government to review its data protection legislation and improve the reporting of information security breaches in the public and private sectors.

We are calling for greater public debate and for the government to consider legislation that would require organisations that suffer information security breaches to alert their customers if there is a chance the breach has put individuals' sensitive personal data at risk.

We want to hear your views about this campaign and the issues it raises. Make your voice heard by leaving a Reader Comment below, emailing us at editorial@silicon.com or signing the 10 Downing Street e-petition.

Fantuzzi added: "Japan probably has some of the most severe notification laws and penalties around privacy laws."

The quarterly Workshare Global Security Threat Report said companies tend to fall into two camps when it comes to data protection - those which have a "worryingly archaic approach" and those taking action by writing security policies to protect their data.

The report added: "Essentially, policies are not worth the paper they're printed on unless properly enforced. Organisations need to look at ways to better enforce policy if they want to avoid hefty fines and serious damage to their business reputation."