Jon Bright (London, OK): The Commons Justice Committee is recommending today that tough new laws be brought in to strengthen data protection. The banner headline for most of the papers has been potential criminal prosecution for anyone that breaches security recklessly or repeatedly. This is the kind of response that is needed after 'datagate', and I hope the government acts on it (indeed the Ministry of Justice rather tiresomely claimed that it had 'thought of that already'). But there was another more important recommendation, which might have got lost a bit - a legal obligation to report significant data losses to those affected, and to the Information Commissioner.
What we still don't know - and I'm not sure if anyone is following up - is why it took over 6 months for the fact that 3 million learner driver details had gone missing to be revealed, and why it was finally forced out on the 17th of December 2007, as opposed to any other date. Who (from which party) told Kelly that she had to report it then? And how long had they known about it before? If your personal data has been lost to a potentially criminal third party, the most important thing is that you are made aware of it, so you can take appropriate steps to protect yourself. But without this legal requirement to report, we will never be made aware of when our data is mishandled, until whoever knows about it decides the time is right, politically, for it to be revealed.
