Call to extend EU rules on data breaches to all online companies

Companies running online businesses should be forced to notify their customers when their personal data has been compromised, said Viviane Reding, European  Commissioner for Justice.

Ms Reding has called for further amendments to the European Union's Electronic Communications Framework following the spate of recent online breaches, such as those at Sony and Play.com.

These attacks compromised people's personal data and Ms Reding has said this showed that the privacy rules under the Privacy and Electronic Communications Regulations (PECR), which currently require internet service providers (ISPs) and telecoms companies to notify customers when this happens should be extended; even if a company is based outside EU jurisdiction.

"Any company operating in the EU market or in any online product that is targeted at EU consumers should comply with EU rules," she said in a statement to the global edition of The New York Times, The International Herald Tribune.

Currently amendments to the UK implementation of PECR, which forms part of this framework of directives come into force on 25 May, will force telecoms companies and ISPs to inform the Information Commissioner's Office, Ofcom and customers of certain personal data breaches immediately.

Reding is reported as saying she will investigate the upcoming review of data protection laws to include companies such as online banking, social networking and gaming sites and online retailers.

She said that even though Sony had eventually informed its customers of the attack on it had suffered, this was "much too long" for a high-profile security breach

In her speech to German privacy experts at a recent discussion in Brussels, she said it was understandable if "the trust of our citizens" in technology had been eroded in light of the recent security breaches.

"I think it is important that users are notified if someone has unlawful access to their data. It is essential for consumer confidence that they know what happens to their data," she said.