News
UK Data Reform: Striking the Balance Between Adequacy and Innovation
The UK Government has brought forward a new Bill that proposes several changes to UK data protection law, alongside other provisions intended to broaden use and commercialisation of data for economic and societal benefit. The Bill, introduced into the House of Lords on 23 October 2024, bears similarities to the previous Government's proposed reforms, but includes safeguards that are in part aimed at ensuring the UK will retain its adequacy arrangements with the EU.
The previous UK government's Data Protection and Digital Information ("DPDI") Bill did not become law due to the July 2024 UK general election. That Bill contained provisions – for example, allowing the Government to set strategic priorities for the Information Commissioner's Office ("ICO") – that could have jeopardised the UK's EU adequacy decision, which is up for review in June 2025.
For details on these previous unsuccessful attempts at reform, please see A New Direction for UK Data Protection Law: the Data Protection and Digital Information Bill and Another new direction: UK reintroduces the Data Protection and Digital Information Bill, but what's changed?.
The new Data (Use and Access) Bill bears a close resemblance to the DPDI Bill, but with changes apparently intended to maintain the UK's EU adequacy status. The the new Government has stated that this is a key priority, alongside growing the economy, improving UK public services and "making people's lives easier".
The changes will not signifcantly increase the burden on organisations subject to UK data protection law, which may instead be able to take advantage of certain provisions.
The Bill's proposed key changes to UK data protection law
Complaints. Controllers must facilitate complaints by data subjects and data subjects should complain to controllers before going to the regulator. There is a new 30-day deadline for acknowledging complaints and controllers must give a substantive response "without undue delay". This will likely require amendments to privacy notices and rights request processes.
Enforcement and the regulator. The ICO would gain significant new investigatory powers, including the authority to request documents, to require a wide variety of individuals to attend an interview and to compel a third party report on processing being investigated to be drawn up, at the controller or processor's own expense. The regulator's fining powers under PECR have also been increased to the same level as the UK GDPR – up to 4% of annual turnover or £17.5m, whichever is higher. The ICO would be given a makeover, with a new name - the Information Commission – a new corporate structure and a board, bringing it in line with other UK regulators such as Ofcom.
Legal bases. The Bill provides a new "recognised legitimate interests" basis for processing. No balancing test will be needed to pursue certain listed processing purposes. These include national security, public security and defence, emergencies, detection investigation or prevention of crime, safeguarding vulnerable individuals and disclosure to a person performing a public interest task.
There is also a new list of statutory examples of "ordinary" legitimate interests, including direct marketing – though the usual balancing test will still apply.
Automated decision-making. The prohibition on automated decision-making with significant effects ("ADM") is narrowed, to cover only ADM using special category data. Safeguards to protect the rights and freedoms of data subjects must still be applied to all ADM, irrespective of the data used. These include the provision of information about the decision-making; allowing for representations to be made; and enabling the data subject to obtain human intervention in those decisions and to contest them.
A decision will be automated if there is no "meaningful human involvement", and ministers will have powers to specify types of decision that will automatically have, or not have, "meaningful human involvement".
Purpose limitation. The Bill clarifies that the current controller's original purpose for processing is the relevant one, when considering whether further processing is compatible – not the original controller's purpose when they first collected data from the data subject. Subsequent controllers will therefore not be "tied" to the original controller's purpose, provided their processing is otherwise lawful.
Broad consent for research. The Bill will validate "broad consent" to scientific research processing, even if it does not specify the exact processing purposes (on the basis that it isn't possible to define these at the point of collection). This will cover both publicly- and privately-funded research, by both non-commercial and commercial organisations.
International transfers. When the Secretary of State is considering a third-country adequacy decision, they must apply a "data protection test": namely, whether that country's standards are "not materially lower" than the UK's. This is also the standard that organisations will need to apply when they carry out transfer impact assessments. The Secretary of State can consider the "desirability" of facilitating data transfers between the UK and a third country – opening the door to political and economic considerations.
Special categories of data. Ministers will be able to amend the list of "special categories" of personal data. Ministers can add to the list and can subsequently remove these additions, but cannot remove any existing categories listed in UK GDPR itself. The Government considers this to be an important measure to add flexibility for novel uses of data in new technologies.
Disproportionate effort exemption. This exemption from the need to provide fair processing information to data subjects would apply even when data is collected directly from the data subject. Safeguards should be applied – controllers will be required to take "appropriate measures to protect the data subject's rights, freedoms and legitimate interests", and will need to make the relevant notice available publicly, such as on their website. The Bill also sets out a non-exhaustive list of factors for determining whether "disproportionate effort" would be involved – for example, the number of data subjects involved and the age of the data.
Subject access requests. The Bill codifies the existing case law position that controllers need only carry out a "reasonable and proportionate" search in response to a subject access request ("DSAR"), and that the clock can be stopped while a controller seeks clarification from the data subject on a DSAR.
Cookies and PECR. The Bill will amend PECR to allow cookies to be placed on users' devices without user consent if those cookies are solely for analytics or user experience purposes, or to provide emergency assistance. Users must still be given information about the cookies and the purposes for which they have been placed, as well as an option to opt out.
Other changes
The Bill also contains provisions intended to spur wider use and commercialisation of data for economic growth and societal benefit, such as on smart data schemes and digital IDs. The smart data provisions are comparable to the measures found in the EU Data Act, but are broader in scope as the data sharing measures in the UK Bill are not confined to data from connected devices. Details of such schemes would be contained in future regulations.
What next?
As at December 2024, the Bill is at Committee stage, in which legislators will consider potential amendments. It looks likely that the Bill will ultimately pass into law sometime in the spring or early summer of 2025. Following this, we would expect to see a flurry of secondary legislation from the Government and guidance from the Information Commission, filling in the detail of the overarching frameworks created by the Bill
Article provided by INPLP member: Katie Hewson (Stephenson Harwood LLP, UK)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
News Archiv
- Alle zeigen
- Jänner 2025
- Dezember 2024
- November 2024
- Oktober 2024
- September 2024
- August 2024
- Juli 2024
- Juni 2024
- Mai 2024
- April 2024
- März 2024
- Februar 2024
- Jänner 2024
- Dezember 2023
- November 2023
- Oktober 2023
- September 2023
- August 2023
- Juli 2023
- Juni 2023
- Mai 2023
- April 2023
- März 2023
- Februar 2023
- Jänner 2023
- Dezember 2022
- November 2022
- Oktober 2022
- September 2022
- August 2022
- Juli 2022
- Mai 2022
- April 2022
- März 2022
- Februar 2022
- November 2021
- September 2021
- Juli 2021
- Mai 2021
- April 2021
- Dezember 2020
- November 2020
- Oktober 2020
- Juni 2020
- März 2020
- Dezember 2019
- Oktober 2019
- September 2019
- August 2019
- Juli 2019
- Juni 2019
- Mai 2019
- April 2019
- März 2019
- Februar 2019
- Jänner 2019
- Dezember 2018
- November 2018
- Oktober 2018
- September 2018
- August 2018
- Juli 2018
- Juni 2018
- Mai 2018
- April 2018
- März 2018
- Februar 2018
- Dezember 2017
- November 2017
- Oktober 2017
- September 2017
- August 2017
- Juli 2017
- Juni 2017
- Mai 2017
- April 2017
- März 2017
- Februar 2017
- November 2016
- Oktober 2016
- September 2016
- Juli 2016
- Juni 2016
- Mai 2016
- April 2016
- März 2016
- Februar 2016
- Jänner 2016
- Dezember 2015
- November 2015
- Oktober 2015
- September 2015
- August 2015
- Juli 2015
- Juni 2015
- Mai 2015
- April 2015
- März 2015
- Februar 2015
- Jänner 2015
- Dezember 2014
- November 2014
- Oktober 2014
- September 2014
- August 2014
- Juli 2014
- Juni 2014
- Mai 2014
- April 2014
- März 2014
- Februar 2014
- Jänner 2014
- Dezember 2013
- November 2013
- Oktober 2013
- September 2013
- August 2013
- Juli 2013
- Juni 2013
- Mai 2013
- April 2013
- März 2013
- Februar 2013
- Jänner 2013
- Dezember 2012
- November 2012
- Oktober 2012
- September 2012
- August 2012
- Juli 2012
- Juni 2012
- Mai 2012
- April 2012
- März 2012
- Februar 2012
- Jänner 2012
- Dezember 2011
- November 2011
- Oktober 2011
- September 2011
- Juli 2011
- Juni 2011
- Mai 2011
- April 2011
- März 2011
- Februar 2011
- Jänner 2011
- November 2010
- Oktober 2010
- September 2010
- Juli 2010