Data protection: will the law be enforced?

Here's an interesting coincidence of pieces about the Data Protection Act. First, as most readers will know, there's the database maintained by a consultancy called (imaginatively) the Consulting Association listing construction industry workers who their subscribers - building companies - might think it better not to employ. Here is a link to the story in The Times legal section. "At last", I thought when I heard the news story on the radio, "the Data Protection Act is being enforced". And enforced in a way that people will see it and understand why it's being done. Maybe this will be a defining moment in its life.

It also appears that the Metropolitan Police are being criticised for maintaining a database. I think it would be hard to criticise them if it contained information about criminals and wrong-doers, but the point is that it contains information about people who have not been convicted of anything, just attended demonstrations and that sort of thing. Well, they have to comply with the DPA as well, although there are exceptions that they can use. This, however, seems to be more of a Human Rights Act story.

At the same time, Andrew Sharpe, partner at London law firm Charles Russell, has told a seminar that "there is effectively no enforcement" of the Data Protection Act. (Are you reading this, Chris?) In fact his thesis is one that I have also presented to training courses on the Data Protection Actover the years:

"In other fields, companies go to lawyers to make sure they are complying with the law," he said. "Nobody comes to me to make sure they're complying with the Data Protection Act, because there's no downside for them if they screw up.

"If somebody loses your data, or leaks it, or gives it to someone you didn't want to have it, don't come to me - don't expect the law to do anything... there is effectively no enforcement."

He suggests - and it must be a reasonable assumption - that the private sector is probably losing just as many laptops and data sticks as government departments. Perhaps, though, these stories do hang together: data protection enforcement in the future is going to be far more effective than it has been in the past, and the law less easily dismissed as irrelevant.