Legal sector ahead of the game when it comes to data regulation reform

Legal professionals are more aware and concerned of forthcoming changes in European data protection law than any other sector in the UK.

The EU General Data Protection Regulation, currently being discussed by the European Commission, Parliament, and Council, is predicted to be ratified in the next 12 months and implemented in 2017.

EU reform aims to cut red tape for businesses by bringing in a single set of rules and create a single Data Protection Authority (DPA) responsible for each company. The regulation also aims to protect the rights of European citizens to have control over their personal data.

The regulation will require companies with more than 250 employees to appoint a data protection officer, as will smaller companies which hold more than 5,000 personal data records.

Fines of up to ‚¬100m, or 5 per cent of global turnover, for companies that deliberately or negligently breach the rules are included in the draft regulation.

A Crown Records Management (CRM) survey of 407 IT decision-makers at UK companies with more than 200 employees revealed that over one-fifth were totally unaware of the changes, while half of those who knew about the regulation were not reviewing policies.

However, the legal profession is better prepared, perhaps in part due to the challenges already faced by companies such as Google in the right to be 'forgotten' case. This follows the highly-publicised European Court of Justice (CJEU) ruling on the right of EU citizens to ask for personal information to be removed from internet searches - a principle which could be extended under the new regulation.

Some 70 per cent of those in the legal sector reported being concerned about the new regulation, by far the biggest figure across all sectors.

The survey also revealed vast differences in the way different sectors are preparing for the new regulation. Almost half of IT decision-makers in the legal sector reported their company was set to review policies ahead of the new regulation.

In addition, two-fifths in the legal sector said they were planning staff training, while a quarter were waiting on the fine details of the regulation before taking action.

The biggest concern over the regulation expressed by the legal sector was difficulty in complying with the right to forget principles, following by the cost of implementation.

John Culkin, director of information management at CRM, said: 'It is encouraging to see the legal sector is in some areas an exception; and perhaps this should be expected given the impact of the 'right to erasure' debate which has seen Google, following a court case in Spain, forced to delete out-dated or inaccurate information in its searches when requested to so by European citizens.

'But the important question is not just whether people are worried or not, but whether they are being proactive and taking early action to prepare. In this area the legal sector still has work to do. Our advice is that waiting too long could be a very dangerous game.'