A legal expert has called the figures "unreliable" and also
claims it is "unrealistic" to blame the Act for all compliance
costs in this area.
The Conservative Party's red tape review is titled 'Freeing
Britain to Compete: Equipping the UK for Globalisation.' It is
published as an official submission to the Shadow Cabinet by the
party's Economic Competiveness Policy Group, which is chaired by
John Redwood MP.
Under demands for the Data Protection Act to be reformed, the
policy review quotes figures from the British Chambers of Commerce
"Burdens Barometer", and estimates that the Act imposes a recurring
annual cost of £2.3 billion for both the public and private
sectors. The Burdens Barometer quotes £667 million as the recurring
annual data protection costs for business alone, and the £2.3
billion figure is derived by adding in other costs from a
Regulatory Impact Assessment (RIA), published by the government,
when the Data Protection Bill was before Parliament in 1998.
The policy review states that this is the third-highest impact
of all the new regulations on business legislated in the last 10
years.
However, the policy group report seems to have ignored a much
more recent study published in December 2006 by the former
Department for Constitutional Affairs. This later study measured
the costs to businesses of complying with the Data Protection Act
and associated secondary legislation at a much lower £55.9 million
in recurring annual administrative costs – 12 times less that
the Burdens Barometer figure of £667 million. This latest estimate
did, however, carry an accompanying warning that it should be
regarded as "indicative" and might not be "statistically
robust".
The Conservative's policy review concludes: "The Data Protection
Act implements EU law in the UK, and we are increasingly concerned
about how governments and large organisations use their personal
data.
"Nonetheless, we strongly suspect that it
would be possible to reform the Act in order to reduce its
burden.
"Proper handling of the data given to public
bodies and private sector companies would be governed by the
general law of privacy, and by established codes of conduct."
Louise Townsend, a data protection specialist with Pinsent
Masons, the law firm behind OUT-LAW.COM, said it was questionable
why the Tory policy review group had decided to ignore the most
recent compliance cost estimate.
"It is, at best, dubious how they get to such a high figure for
the annual cost to businesses of the Data Protection Act," she
said. "It seems they may be using an inflated or out of date figure
to justify their demands to reform the legislation. There certainly
seems to be some doubt about the validity of their figures."
Townsend added: "It is also unrealistic to blame the Data
Protection Act for all the compliance costs to businesses in the
data protection area, as most commercial organisations have to take
security and data quality measures to meet their own industry
standards and good commercial practice."
Townsend said there might be scope for amendments to the
existing legislation which would still comply with the European
directive. "It might be possible, but it could prove quite
difficult to achieve," she said. "Other measures suggested by the
report such as cost benefit assessments and consultation with
industry bodies before new guidance is introduced may be more
realistic."
The Conservative Party did not answer OUT-LAW's request to
clarify why it had not based its cost estimates on the most recent
figures available.
Editor's note 22/08/2007: This story has been
updated since it first appeared. Following comments from readers,
we have revised the text to explain the source of the various
costings cited.
