When the anonymous civil servants who drafted the Data Protection Act (DPA) in 1998 set about their work, they were smart enough to realise that the world of computers was likely to evolve considerably.

Keeping the law up to speed with the pace of technological change was always going to be a challenge, and the principles-based approach that underpins the DPA has worked well. Precedents set through case law have allowed the Act to encompass technical developments ­ although Marks & Spencer’s challenge to the Information Commissioner’s enforcement of laptop encryption represents a new test.

But even such legal foresight was unlikely to have taken into consideration the internet, cheap storage, USB drives, broadband, social networking and all the data-intensive applications upon which modern business life depends.

So it is right to heed the calls for a review of the DPA that will see it through its next decade.

But today, law enforcement is not enough to securely protect data. A new DPA needs to go hand in hand with best practice IT management.

When the DPA came into force in March 2000, the article in Computing concentrated on the specifics of the new law and the challenges it posed for IT departments.

Any similar feature now would cover the legal aspects in just a few lines. The complexity of the IT protecting people’s personal information has increased exponentially. And with it, the awareness of identity theft and the potential for misuse of our data has grown in parallel.

Self-regulation and self-discipline are now just as important as legislation.

Every employee needs to be constantly reminded to protect corporate data as if it were their own. And processes such as information lifecycle management need to sit alongside all the security procedures necessary to treat our information with the care we each wish it to be handled.

A review of the law is timely. The review of your IT management practices should be constant.

The realisation is growing that data protection is not somebody else’s responsibility.

Moves to make individuals liable for the loss or disclosure of personal information held by public sector bodies or by companies are an inevitable response to the data loss scandals we have seen in recent months.

Until now, the Data Protection Act has focused responsibility on senior executives of an organisation, who are held to task for failures of staff under their charge. But the reality is that those workers are rarely motivated by the need to protect their bosses or their employer’s reputation.

When someone else takes the blame, why should you care if you make a mistake?

The most common concern of IT leaders looking to introduce data protection or risk management policies is how to create a culture that supports the rules and regulations put in place. Having a policy is one thing ­ making staff buy into it can be quite another. Ultimately, a culture exists only in the collective hearts and minds of a group of individuals, it cannot be imposed from above or through a set of rules.

From a government perspective then, legislation appears to be the only answer.

But no law will be effective ­ other than in increasing the prison population ­ without education to go alongside it.

Data privacy is perhaps the biggest single challenge facing the technology industry. Information security is not the issue ­ technical controls exist to secure the vast volumes of electronic data being generated ­ but the access to, and authorisation of the use of that data is about people, not technology.

For every government employee who inappropriately accesses citizen records (see www.computing.co.uk/2215705), how many would protest if someone did the same to their personal details?

People need to realise the impact on others of their actions, and to be given training and advice to ensure they are aware of their responsibilities. The best way to do that is to ask the question: What if it were you?

Government has been wholeheartedly – ­ if not always successfully ­ – embracing the potential for technology to improve services to citizens, but the politicians have some way to go.

As local councils across the country go to the polls today, few candidates can claim to have turned to the internet to boost their appeal to voters.

The leaflet pushers have been as active as ever ­ – the tree count for all the paper thrown straight into voters’ rubbish bins in the past month must be huge ­ – but this new-fangled computer stuff seems to have passed our potential representatives by.

In London, where the highest-profile election is taking place, none of the candidates looked at the possibility, for example, of using social networking to engage with voters; nor have they made much mention of IT’s potential in improving the citizens’ lot. Ken Livingstone’s jocular anticipation of chips in our heads may not win him another term as mayor, but his Tory rival Boris Johnson can hardly claim to represent the internet generation either.

How different things are in the US, where the battling Democrat candidates, Hillary Clinton and Barack Obama, have put the web at the centre of their campaigns. The forthcoming presidential elections will be the most internet-enabled we have seen.

Perhaps part of the problem lies in the culture of secrecy surrounding technology in parliament.

Only now, after a series of data protection scandals, has the Information Commissioner been given the go-ahead to spot-check Whitehall departments for compliance. And MPs want to improve transparency by gaining access to departments’ management information systems instead of having to wait for annual paper-based reports.

The internet ethos is built on openness ­ – not a quality often associated with politicians. If our elected representatives could grasp how IT can connect them with citizens, not only would they be closer to our tech-enabled culture, but perhaps more open with us all.