• silicon.com
• Technology
• Security

By Sally Watson, 2 August 1999 00:25

NEWS UK businesses are putting themselves at risk of prosecution because of ignorance about data protection laws on the Internet, according to IT law specialist, Tarlo Lyons. The company claims that despite the increasing adoption of ecommerce, most companies have failed to update policies and protect themselves from legal action under the 1998 Data Protection Law. According to Andrew Rigby, head of ecommerce and digital media at Tarlo Lyons, the major problem facing companies is the use of personal data on corporate Web sites. He warns that if staff details are posted online, the employer can be held liable when that data is accessed from a country not governed by recognised European data security laws. "It's a breach of Principle 8 of the new Data Protection Act 1998," warned Rigby. "Companies face fines and enforcement notices - and there's also the ultimate possibility that a business could be closed down." The EC has recently set up a working party to specifically investigate data security issues on the Web and Rigby explained that this could have far-reaching consequences for business. "They've recently picked up on cookies and Java applets which collect information from users' PCs without their permission," he said. "Companies will soon be required to let users know." Rigby criticised the UK Data Protection Registrar for a lack of guidance and said what is needed is "a coherent, cohesive set of guidelines". A spokeswoman for the Registrar said a paper will be published next month on the interpretation of Principle 8 for ecommerce, but admitted it will only be a preliminary draft. "There are still discussions and negotiations going on about how online data transfer will be dealt with. Some of the areas aren't finalised," she said.