Shell cracks at EU privacy rulings

Differing US perspectives on data protection and a lack of practical guidance are said to be preventing businesses from complying with European Union (EU) rules on data privacy.

This was the warning from Nick Mansfield, principal consultant at Shell Services International, speaking at the recent Compsec 2000 security conference in London.

Mansfield cited Shell's own experience as a warning to other users. The company was forced to cancel the worldwide roll out of a $36m SAP finance system just seven days before going live. The system ran too great a risk of contravening EU rules.

"We stopped dead because the system, containing personal information, was subject to the EU directive," said Mansfield, who is also chairman of the International Commerce eXchange (ICX) consortium, members of which include BT and Royal Mail subsidiary Viacode.

ICX has drawn up practical guidelines for businesses to comply with the EU directive and the 1998 Data Protection Act.

Dai Davis, head of the IT group at law firm Nabarro Nathanson, said: "What I always say to companies is: 'You are breaching the data protection legislation left, right and centre, so don't make a target of yourself.' What the Data Protection Registrar can do is limited by her budget. It's not in her interest to make waves."

First published in Network News