Oh, behave: EU cracks down on behavioral targeting in the U.K.

The European Commission announced this week that it might sue the United Kingdom if that country fails to limit the tracking and collection of users’ Internet browsing habits and personal information without prior consent. The United Kingdom until now has adopted a self-regulatory approach similar to that followed by the Federal Trade Commission (we reported on the FTC’s revised behavioral marketing principles in this blog post). However, the European Commission has suggested that such an approach is insufficient because user consent is not obtained prior to collection.

According to reports, the Commission appears to be concerned that the U.K.’s failure to require that behavioral marketers obtain user consent before tracking Internet behavior violates the European Union’s strict Data Privacy Directive. The Directive prohibits the "processing" (very broadly defined) of EU residents’ personal information (also very broadly defined) without such residents’ consent.

U.K. ICO May Impose Fines for Data Breaches

A new Act of Parliament gives the United Kingdom’s Information Commissioner’s Office (ICO) the authority to impose monetary penalties for misuse of personal data in violation of section 55 of the Data Protection Act of 1998 (DPA).

For some years, the ICO has had only limited means of securing compliance with section 55 of the DPA, which makes it a criminal offense to knowingly or recklessly obtain or disclose personal data without consent. While the ICO has had the power to take action against individuals who violated section 55, the imposition of a penalty was left to the courts.

All this changed on May 9, 2008 with the enactment of the Criminal Justice and Immigration Act. The Act grants the ICO the power to impose fines directly for violations of section 55 of the DPA. This increase in the ICO’s authority mirrors that of other U.K. regulators like the Financial Services Authority, which in 2001 obtained the power to impose fines on banks and other financial institutions for data security failures.

Proskauer summer associate Noemi Blasutta contributed to this post.