The European Data Directive is "showing its age" and needs an overhaul to meet modern data protection requirements, according to a report commissioned by the Information Commissioner's Office (ICO).
The 13-year-old directive sets out how private data must be handled in the European Union (EU) and therefore its member states. The report by RAND said the directive has had a largely positive effect on privacy across the EU, but needs to react to changes in how data is used be it by individuals on social networking sites or companies for e-commerce.
"The directive is showing its age," Information Commissioner Richard Thomas said in a statement, explaining that regulation must refocus on the real risks faced by people. "Massive technological advances, global trade and the need for personal information to cross international borders all signal the need for the law to evolve."
The report claimed the directive was outmoded, costly to comply with and inconsistent, but praised the regulation for its neutral approach to technology.
While some interviewed for the report suggested scrapping the directive, the overall conclusion was that it needs to be tweaked. Shifting the "emphasis" of some concepts while better enforcing current rules would bring more value to the existing system.
Thomas warned that any new legislation must consider privacy. "Data protection law also needs to recognise that society as a whole suffers where the improper use of personal information results in unwarranted intrusion into private lives or excessive governmental or organisational power," Thomas said.
Thomas added that data protection is an issue for everyone to consider, especially governments and businesses.
"Data protection is too important to be left to data protection specialists talking to each other," he said, adding: "Safeguarding personal information has become a major reputational issue for businesses and governments. They must be held accountable if things go wrong."
"Organisations must embed privacy by design and data protection must become a top level corporate governance issue," he added.
The Data Protection Act in the UK, which is more than a decade old, has also faced calls for modernisation. Click here to read our top five data protection tips.
