Network managers to take the rap

Network managers could face personal prosecution if their company falls foul of the Data Protection Act (DPA) which comes into full force on 23 October.

Many companies were concerned when the DPA was introduced in 1998, but parts of the Act were initially suspended. No prosecutions followed, which bred complacency in many firms.

Eversheds ecommerce lawyer Jonathan Armstrong said: "It created confusion and left a cold trail. There is still a real lack of compliance with the DPA. The Information Commissioner will look at personal convictions to enforce the law, meaning that the network manager will be prosecuted."

Nearly two thirds of network managers are unaware of the October deadline, while half of them believe that senior management gives insufficient support to ensure compliance, according to a survey by law firm Tarlo Lyons and The Opus Group.

"British bosses are not giving proper resources and support, just lip service. It's foolhardy given the potential damage to brand equity in the event of 'naming and shaming'," explained Richard Ryan, head of research at The Opus Group.

Unintentional DPA breaches can happen through the transfer of data outside Europe. International companies using central mainframes in the US to handle core business processes without special agreement will breach the Act.

To stay within the law, UK companies could set up two separate agreements: one for transferring data and one for third-party processing. The agreements can be individual or can follow the European Model Clause.

Alternatively, US mother companies need to enter the 'safe harbour' scheme, by signing up to the regulations of the Federal Trade Commission in the US.

But it is considered to be the toughest regulator in the world, and many companies are concerned that its strict rules would damage their competitive positions.