What legislation in the UK or EU requires online services and software companies to care about security of their products?

Question

... And to what extent? E.g. what is the minimum an online service or software vendor are required to do to protect personal data? Let's not talk about PCI-DSS and payments here.

Answer 1

What is the minimum an online service or software vendor are required to do to protect personal data?

In the UK that is covered by the Data Protection Act 1998. The full Act can be downloaded here (pdf)

The Data Protection Act controls how your personal information is used by organisations, businesses or the government.

Everyone responsible for using data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

• used fairly and lawfully
• used for limited, specifically stated purposes
• used in a way that is adequate, relevant and not excessive accurate
• kept for no longer than is absolutely necessary
• handled according to people’s data protection rights
• kept safe and secure
• not transferred outside the European Economic Area without adequate protection

There is stronger legal protection for more sensitive information, such as:

• ethnic background
• political opinions
• religious beliefs
• health
• sexual health
• criminal records

Source Data protection

---

Guide to data protection - Information security (Principle 7)

This part of the guide offers an overview of what the Data Protection Act requires in terms of security, and aims to help you decide how to manage the security of the personal data you hold. We cannot provide a complete guide to all aspects of security in all circumstances and for all organisations, but this part identifies the main points. We also provide details of other sources of advice and information about security.

There is no “one size fits all” solution to information security. The security measures that are appropriate for an organisation will depend on its circumstances, so you should adopt a risk-based approach to deciding what level of security you need. In brief – what does the Data Protection Act say about information security?

The Data Protection Act says that:

"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

This is the seventh data protection principle. In practice, it means you must have appropriate security to prevent the personal data you hold being accidentally or deliberately compromised. In particular, you will need to:

• design and organise your security to fit the nature of the personal data you hold and the harm that may result from a security breach;
• be clear about who in your organisation is responsible for ensuring information security;
• make sure you have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff; and
• be ready to respond to any breach of security swiftly and effectively.

...

What level of security is required?

The Act says you should have security that is appropriate to:

"the nature of the information in question; and the harm that might result from its improper use, or from its accidental loss or destruction."

The Act does not define “appropriate”. But it does say that an assessment of the appropriate security measures in a particular case should consider technological developments and the costs involved. The Act does not require you to have state-of-the-art security technology to protect the personal data you hold, but you should regularly review your security arrangements as technology advances. As we have said, there is no “one size fits all” solution to information security, and the level of security you choose should depend on the risks to your organisation.

...

What level of security is required?

The Act says you should have security that is appropriate to:

"the nature of the information in question; and the harm that might result from its improper use, or from its accidental loss or destruction."

The Act does not define “appropriate”. But it does say that an assessment of the appropriate security measures in a particular case should consider technological developments and the costs involved. The Act does not require you to have state-of-the-art security technology to protect the personal data you hold, but you should regularly review your security arrangements as technology advances. As we have said, there is no “one size fits all” solution to information security, and the level of security you choose should depend on the risks to your organisation.

The following link goes into a lot more detail on this topic.

Source https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/

Further Reading

• Guide to data protection