News

Another new direction: UK reintroduces the Data Protection and Digital Information Bill, but what's changed?

On 8 March 2023, the Department for Science, Innovation and Technology ("DSIT") introduced the Data Protection and Digital Information (No. 2) Bill (the "Bill"), extinguishing the previous Data Protection and Digital Information Bill (the "Previous Bill"). The Bill is set to be "…a simple, clear and business-friendly framework…" that will minimize the bureaucracy associated with "…the barrier-based European GDPR…".

If enacted, the Bill will make changes to the GDPR as it forms part of UK domestic laws post-Brexit (the "UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations ("PECR").

 

What's new in the Bill?

The Bill represents evolution, not revolution, compared to the Previous Bill (see our summary here): the key elements have all been retained. For example, the Information Commissioner's Office ("ICO") would still be replaced by an "Information Commission" (constituting a chief executive and other board members) and the requirements to conduct data protection impact assessments and to appoint data protection officers would still be removed.
The key revisions to the Bill in this latest version include:

• Information relating to an identifiable living individual: The Bill clarifies what falls within the scope of "information [obtained] as a result of…processing" when considering the definition of an identifiable living individual. The Previous Bill took into account Information collected as a result of a controller's or processor's actions in determining whether an individual was identifiable in that person's hands. The Bill adds that information that is obtained due to the inaction of a controller or processor should also be taken into account. For example, if an organisation fails to implement security measures, then information obtained as a result of hacking should be considered in assessing whether individuals were identifiable.
• Research: The Bill expands the definition of scientific research by referring to the way in which research is carried out. It now includes scientific research that is publicly or privately funded and conducted either as a commercial or as a non-commercial activity. The parliamentary committee hearings on the Bill also noted that the broader definition will be welcomed by developers of artificial intelligence systems, as it could facilitate the use of personal data in this context.
• Legitimate interests: Unlike the Previous Bill, the Bill includes a list of examples of when legitimate interests could be a suitable legal ground for processing. The non-exhaustive list includes direct marketing, intra-group sharing of personal data for internal administration and ensuring the security of network and IT systems. A legitimate interests assessment would still be required for such activities.
• Record keeping: The Bill would exempt any controller or processor from the duty to keep records of processing unless they are carrying out high-risk processing activities. The Bill's approach to record keeping is intended to allow businesses to allocate their time and resources to higher-risk activities.
• Direct marketing and PECR: The Bill requires electronic communications network providers to inform the ICO of "any reasonable grounds" they have for suspecting that a person has breached the direct marketing rules.
• Automated decision-making and AI: The Previous Bill stated that limitations on automated decision-making under Article 22 UK GDPR only apply to decisions without meaningful human involvement. The Bill states that profiling will be a relevant factor in the assessment as to whether there has been meaningful human involvement in a decision.

 

Will compliance with the EU GDPR be sufficient?

The UK Government has said that businesses already adhering to the requirements of the EU GDPR should not need to implement changes to their data protection programmes in order to comply with the updates to the UK regime. However, UK-only businesses may wish to take advantage of the greater flexibility that it is likely to provide in comparison to the current UK GDPR (such as the minimised record keeping requirements and the removal of DPIAs), as well as the expected cost savings, estimated at £4.7 billion across the UK economy.

What's happened since the reintroduction of the Bill?

On 17 April 2023, the Bill underwent a second reading in UK Parliament. During the debate, the word "adequacy" was mentioned 36 times, highlighting the importance to Parliamentarians of retaining the UK's adequacy decisions from the EU. The UK Government's position is that adequacy will be maintained.

On 10 May 2023, the Bill entered the committee stage, which involved a clause-by-clause examination of the Bill. During the hearings, one expert witness praised the "…broader and more common-sense…" approach to achieving adequacy based on outcomes rather than equivalent legislative provisions, and another witness concluded that the Bill is "…a step forward [and]…a better [less prescriptive] regime…" compared to the GDPR. However, the Bill was not free from critique, with witnesses stating that they were concerned about the risk-based approach it takes to overseas transfers.

A full report containing an in-depth of scrutiny of the Bill by the UK Parliamentary committee is expected shortly.

 

Article provided by INPLP member: Katie Hewson (Stephenson Harwood LLP, United Kingdom)

 

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)