The information commissioner told an international Privacy Laws & Business conference in Cambridge the European data protection legislation needed updating to meet new challenges posed by online information..
"It is showing its age and failing to meet new challenges to privacy such as the transfer of personal details across international borders and the huge growth in personal information online. It is high time the law is reviewed and updated for the modern world," he said.
Richard Thomas has commissioned RAND Europe to complete the study, to be published in April 2009.
"We think the time has come for a new debate about the approach to data protection at European level. We want the the study to to be as objective as possible and analyse the strengths and weaknesses of the current approach. We want to explore avenues for improvement to provide effective protection, while minimising burdens for organisations," Thomas said.
He said RAND Europe would bring new thinking, new analysis, and new approaches.
Reform was expected to be slow and approved changes were not likely within the next five years, but it was important to make a start. Thomas added.
"I hope the UK government will also demonstrate leadership by engaging constructively in these reviews and supporting better regulation and practical approaches to international data protection," he said.
RAND Europe - part of the US-based RAND Corporation - is an independent, not-for-profit research institute. It will identify potential areas of reform and consider how consumers' rights can be enhanced.
The research group, with its partners time.lex, a Brussels-based law firm, and management consultancy GNKS-Consult, beat 19 competitive bids for the ICO's competitive tender announced in April 2008.
A representative of RAND Europe said there would be a small number of interviews as well as workshops, and there would be an open invitation to organisations to take part.