UK’s proposed data protection reforms - a step in the wrong direction?
The Consultation
The consultation on proposed reforms to UK data protection laws was launched in September 2021 and revolved around five key objectives:
- Reducing barriers to responsible innovation;
- Reducing burdens on businesses and delivering better outcomes for people;
- Boosting trade and reducing barriers to data flows;
- Delivering better public services; and
- Reforming the Information Commissioner’s Office (ICO), the UK’s regulator for data protection.
In relation to reducing barriers to responsible innovation, the UK government wants to make it easier for organisations to establish legal basis for processing data in areas such as research, AI and machine learning, with the aim to strike a better balance between protecting individuals and encouraging responsible innovation. Its main proposal to achieve this better balance is to create an exhaustive list of legitimate interests, allowing organisations who come within this list to use personal data without applying the current balance test.
To reduce the burden on businesses, the UK government proposes removing the obligation to, amongst others, appoint a data protection officer, prepare records of processing activities and conduct data protection impact assessments. There are also plans to relax the rules on analtyical cookies, where consent would no longer be needed (consent will remain a requirement for marketing and tracking cookiers) or if there is a legitimate purpose for processing the data. Another proposal to reduce redtape on businesses is the voluntary undertakings process. This mirrors a regime in Singapore, affording businesses an opportunity to avoid an ICO enforcement action for breaching UK data protection laws by presenting a remedial plan to the ICO of the actions they intend to take to address those breaches.
The UK government aims to boost trade and reducing barriers to data flow by allowing organisations to create alternative transfer mechanisms in addition to those provided under Article 46 UK GDPR. The UK government has stated its desire to establish data partnerhips with countries like the USA and South Korea, so these new transfer mechanisms could facilitate greater international data transfers. It will be an area of high interest for businesses that currently or wishes to have international transfers of data (albeit noting the potential for a knock on effect to the adequacy decision of the EU with respect to the UK).
A new Commissioner
An interesting backdrop to these porposed reforms is that the UK has a new Information Commissioner, John Edwards, who succeeded Elizabeth Denham on 4 January 2022. Edwards previously worked as New Zealand Privacy Commissioner and has a reputation of being a critic of Big Tech. However, in his new role he will be tasked with the delicate balancing act between respecting the individual’s right to privacy, while enabling actors to reap the benefits of data-driven innovation. His appointment has been welcomed by some, who hope that the ICO will retun to a more consistent and proportionate enforcement regime and focus on issues of concern to individuals while applying the pragmatism and consultative approach that the ICO has long been known for. It will be interesting to observe the types of actions the ICO pursues under Edwards, as they could provide valueable insight as to the path the ICO will take under its new leadership.
EU Adequacy – what now?
However, the “elephant in the room” for all of these proposals is the potential impact on the EU’s adequacy decision, which enables a free flow of data between companies in the UK and EU. If the EU feels that these reforms do not sufficiently protect its citizens’ data, then the EU could be revoke its adequacy decision. Revocation of the the adequacy decision would arguably represent a step backwards, creating uncertainty and complicance risks for organisations, at a time when they have just completed their implementation programmes for the 2018 EU General Data Protection Regulation reforms. The unintended consequences of a revocation would arguably outweigh the benefits offered by the reforms and the UK government seems to be aware of this as the reforms outlined above do not seem to radically diverge from the protections currently offered under the GDPR. There have also been attempts in the accompanying documents to cost the proposed reforms. However, the ultimate decision rests with the EU Commission, which no doubt will scrutinise these proposals closely and take appropriate action should they translate into UK law.
A legislative bill, detailing the proposed data protectection reforms, is expected to be released by June 2022. It will be keenly observed by the EU Commission, businesses and law professionals alike as to which direction the UK governement wants to take the UK’s data protection regime. Watch this space.
Article provided by INPLP member: Jonathan Kirsop (Pinsent Masons, United Kingdom)
Discover more about INPLP, the INPLP-Members and the GDPR-FINE database
Dr. Tobias Höllwarth (Managing Director INPLP)