Why new privacy law still needs tightening
Susan Calman

WITH hindsight it seems incredible that mobile phone text messaging was once seen as a toy suitable only for children. Yet until 1998, the networks usually didn’t charge for a service they regarded as a novelty.

However, as the mobile phone has become an essential part of modern life, texting too has increased in popularity - last year more than 16 billion texts were sent.

If you have experienced the annoyance of receiving unwanted SMS messages or e-mail - known as spam - you will understand why the new Privacy and Electronic Communications Regulations (PECR) have been welcomed.

Essentially, the PECR incorporate an EU directive which updates the Telecoms Data Protection Directive in light of new technology. In particular, it ensures that the privacy rules currently applicable to land line telephone and fax services also apply to e-mail and the internet.

The adoption of the directive into UK law will affect a range of organisations and individuals. As well as requiring changes from those operating in the electronic communications sector, it will have an impact on marketers, website and online content businesses, providers of subscriber directories, internet users and anyone who sends or receives commercial communications by e-mail or SMS.

Some provisions will directly affect the way service providers and marketing companies use technology. Firstly, the PECR gives subscribers a right to decide whether or not they want to be listed in subscriber directories. And subscribers must be given clear information about the directories in question, including whether they offer reverse search-type functions, for which additional specific consent is required.

The area gaining the most publicity is the provision that requires prior consent to send unsolicited commercial e-mail and SMS to individual subscribers. The PECR also provides that the sender of e-mails can no longer be disguised. Now a valid address must be provided to allow a user to unsubscribe.

The major problem with the regulations is the manner in which they will be enforced. The PECR envisage that enforcement action will be taken by the Information Commissioner under the existing enforcement powers granted by the Data Protection Act 1998. However, even the Information Commissioner has admitted that his powers are currently not appropriate to address the issues raised by the technology involved.

The current regime of issuing information and enforcement notices does not lend itself well to taking swift action against those who breach the PECR. The powers granted in the 1998 Act were drafted to assist a measured response to difficult questions as to whether or not data processing has occurred. This does not apply itself well to the nature of the PECR: whether or not a fax or SMS is unsolicited is a matter of fact rather than interpretation.

The 1998 Act also allows for an appeals procedure which suspends the effect of any notices issued, allowing the conduct to continue.

The Information Commissioner recommended that Stop Now Orders be used. These would give the commissioner the power to obtain a court order to stop any non-compliant conduct. He further recommended that his office should have the power to prosecute those guilty of an offence under the PECR and that he should be able to bring proceedings against a company director or similar officer who has consented to, or connived at, the infringement.

The PECR come into force on the 11 December without any of those recommendations being in place. However, the Department of Trade and Industry is reviewing the PECR and the commissioner’s recommendations may well be introduced.

Certainly without the ability to take action against blatant or repeat offenders, our phones, faxes and in-boxes will continue to be bombarded by unwanted messages.

• Susan Calman is a solicitor with Shepherd & Wedderburn specialising in intellectual property and IT law.

business.scotsman.com