BPE Solicitors explains how data law reform continues to be a focus for the UK government

Sponsored by

Share

The Business Magazine article image for: BPE Solicitors explains how data law reform continues to be a focus for the UK government

The Data Protection and Digital Information Bill was introduced to Parliament last month, with its key goal being to ‘reduce burden whilst maintaining high standards’.

Rocio de la Cruz, data protection expert and Partner and Macaulay James, Paralegal at BPE Solicitors discuss the key proposals of the new Bill which was first initiated by the Department of Culture, Media and Sport (DCMS) in September 2021.

Key Proposals

Governance

The requirement to appoint a Data Protection Officer (DPO) will be replaced with the designation of a Senior Responsible Individual (SRI). In contrast to the current position under UK GDPR, the SRI must be an individual within the Senior Management of an organisation. Additionally, the SRI will not be required to have any previous knowledge of Data Protection Law, a point which may be viewed as weakening the current standards but that, at the same time, will encourage (as it happens in practice with DPOs) the formation of resourced data protection teams in which internal and external individuals will support the SRI.

Article 30 UK GDPR currently requires organisations to create and maintain a record of all processing activities that they undertake where the type of information registered is listed in the article. Under the new proposals, this will be replaced with a requirement to maintain an appropriate record of processing in which the inclusion of the basic elements of the processing activities will still be mandatory (as listed under the Bill), given more discretion to controllers and processors to define what other information feels appropriate, in the circumstances of each case, to be included in these records.

Prior consultation with the Information Commissioner’s Office (ICO) will no longer be mandatory where an organisation has carried out an impact assessment and identified a high-risk that it is unable to mitigate. Instead, prior consultation will become optional, with incentives will be built into any investigative process following a breach.

If the DPDI is passed, the ICO will become the “Information Commission”, which will retain the majority of powers and responsibilities of the ICO, but also gain enhanced powers of enforcement.

Increased Ability to Use Personal Data

A new assessment will be introduced that enables organisations to meet the threshold more easily for anonymisation of Personal Data. The practical benefit of such a change will be organisations increasing their use of data without fear of a UK GDPR breach. This clarification on what fully anonymised data means will result in organisations only needing to consider identifiability at the time of processing rather than in the future, and within a reasonable degree of parties involved or that may reasonably access the data.

Data Subject Access Request Reform

DPDI also seeks to reform Subject Access Requests to clarify when organisations are able to refuse or charge a fee, with the introduction of a term ‘vexatious or excessive’ which has been extensively interpreted by UK Courts and previous ICO’s guidance issued in the context of the Freedom of Information Act 2000. The ‘vexatious or excessive’ requirement will replace the current wording in Article 12 (5) of the UK GDPR of ‘manifestly unfounded’.

Legitimate Interests

The Legitimate Interest legal ground to use personal data legally requires the undertaking of a balancing test to ensure that the legitimate interest of the organisation relying on this legal basis is not overridden by the interests, rights and freedoms of the individuals concerned. These balancing tests must be documented since the ICO may require them in the context of an audit or investigation. The DPDI proposes removing this requirement, and instead set a list of recognised legitimate interests that will apply directly if the requirements for each legitimate interest ground are met.

Cookies

The circumstances in which consent is not required for cookie placement will be broadened to include web analytics, functionality enhancements and for automatic updates. Users will still need to have the ability to opt-out and this will need to be clearly explained to them. The intention of the Government is to move to a general opt-out system in the future – once the technology supports this.

Simplifying the Sharing of Data

The new legislation will simplify and facilitate the sharing of data under Smart Data Schemes. The Secretary of State will have the power to regulate organisations that hold customer data to share this with third parties.

Digital Identity Verification

Alongside the establishment of Smart Data Schemes, the Bill will enhance the framework surrounding Digital Identity Verifications. The proposals will increase confidence that data can be shared to organisations or individuals, secure in the knowledge that identification checks have been completed by a trusted provider.

Does the Bill risk the UK Adequacy Status?

The UK Government assesses that the proposed changes are not divergent enough to risk the UK losing its adequacy status with the EU. However, there is some concern that this is a possibility at the next review. In its own impact assessment, the government has admitted that losing the adequacy status with the EU would outweigh the benefits of any reform the Bill may introduce. It is for this reason that many people believe the proposals will have been drafted within the parameters of maintaining the free flow of data between the UK and EU.

Final Thoughts

As with all legislation, it is highly likely that amendments will be made upon passage through Parliament and as such many of the above proposals will change. It is also possible that a new appointed Prime Minister may have differing views or priorities for Data Reform.

Many commentators describe the proposals as evolutionary rather than revolutionary. There is disagreement over whether the changes streamline UK GDPR enough, or conversely whether the reforms push the boundaries too far. It will be important to track the Bill closely over the coming months to be aware of the changes that are eventually enacted.

If you want further information on data protection and compliance with data regulations, please see our Global Privacy Hub which can help any business with its compliance or contact Rocio de la Cruz [email protected] 01242 248233 or a member of BPE’s Technology team for practical advice.