Richard Thomas, the outgoing Information Commissioner, can look back at his tenure as the UK’s data watchdog with some satisfaction. During his time in charge, the subject of data protection has garnered hitherto unimaginable levels of attention, and Thomas has sought to take a sensible but firm approach to data protection issues. There has also been the introduction of Freedom of Information rules to add to an already significant workload.

But however well he has set about his task, there has always been the suspicion that his efforts have been somewhat hamstrung. The publication of the Rand review, which Thomas commissioned, confirms those misgivings.

That review is clear in its recommendation that current European data protection legislation needs an overhaul. And so it does.

That Thomas should prepare to leave his post by calling for more business-friendly rules is no surprise. It is a common theme from anyone with an interest in data protection.

The vast majority of business leaders accept and recognise the duty of care they have over the information that they collect and store about their customers and fellow citizens. They are happy to abide by sensible rules governing personal data.

But there is so much in the current European data protection directive ­ – which is the basis for the UK’s Data Protection Act –­ that is not sensible and could cause firms to unintentionally find themselves on the wrong side of the law. That situation needs to be addressed urgently.

The trouble is, calls for more business-friendly data protection rules are nothing new. Indeed, one of Thomas’s first acts as Information Commissioner was to promise such an approach.

There is, however, scant evidence that the regulators within Europe have any appetite for change. For sure, crafting rules that are to govern a technology environment that changes at lightning pace is a thankless task.

If there is to be any prospect of change, it is vital that Christopher Graham,the incoming commissioner, takes up the baton.