At the start of March, the government announced the reintroduction of the Data Protection and Digital Information (No.2) Bill. First mooted in July 2022, the original Bill was withdrawn “to allow ministers to consider the legislation further.”
Despite the UK GDPR and Data Protection Act being not even five years old, the government says it wants to capitalise on post-Brexit freedoms as some elements of the UK GDPR and DPA create barriers, uncertainty and unnecessary burdens for businesses and consumers.
And for many, the delay from last year was welcomed – especially by the European Commission since, as Euractive.com commented, “London’s planned reform of its data protection regime has attracted considerable attention in Brussels, given its potential implications for the EU-UK data adequacy agreement reached in 2019, which facilitates ongoing data transfers between the two.”
In response, the Department for Culture, Media and Sport has said that the UK had been in “constant contact” with the European Commission in creating the new Bill.
So, what is the government proposing?
In overview, there are several changes. Subject Access Requests – where individuals seek their information – can be refused or charged for if vexatious; there will be new legitimate interests for processing data; there are to be new rules on data security; a ‘senior responsible person’ who is part of an organisation’s senior management must be appointed; record-keeping requirements are to be diluted except for ‘high risk’ activities; the role of artificial intelligence in data processing will be clarified; and the penalties for breaching rules on electronic marketing are to be radically increased.
There is confidence in the revised Bill in that it has been co-designed to create more integrity and transparency
There is confidence in the revised Bill in that it has been co-designed to create more integrity and transparency. Of course, the fact that elements of bureaucratic red tape have been removed or watered down is going to be good for business; they’ll have new-found clarity about when they can process personal data without needing consent without weighing up their own interests against an individual’s rights.
But lawyers such as Jeanette Burgess, head of regulatory and compliance at Walker Morris, are warning that the Bill doesn’t radically change the data protection regime, as “organisations still need to make sure that they only process personal data where they have a lawful basis to do so, and that data protection principles are complied with.”
Beyond that, she says that cost could be a problem for companies with operations in the EU as they will still need to comply with the EU GDPR. Here Burgess says that “they may find it cheaper to continue to follow the current regime in the interests of consistency to the extent that is possible under the new Bill.”
The ‘weaponisation of data’ by employees is a frequent frustration for HR managers. James Potts, legal services director at Peninsula, a business services organisation, notes that the Bill “will assist HR managers in shielding their businesses from vexatious data subject requests and will also give the ICO the power to reject complaints relating to such requests.” But while vexatious or excessive requests can be quickly dealt with, proof of the facts will be needed.
And it’s bound to please organisations, particularly smaller enterprises, that ministers have specifically sought to cut down on the amount of compliance paperwork they need to complete; unless their processing activities could pose high risks to individual’s rights and freedoms, they won’t need to keep processing records.
Ultimately, those already compliant with the UK GDPR will not need to make any significant changes as the main principles and obligations of the current data protection regime will remain. However, it’s hoped that the burdens on organisations are eased, but the results will take time to become apparent.
More detail will filter out on the Bill at gov.uk.