Public consultation is launched on reforms to the UK’s data protection regime

On the 10th September 2021, the Department for Digital, Culture, Media & Sport launched the public consultation on proposed reforms to the UK data protection regime as part of the government’s National Data Strategy.

The document outlines five key proposals:

• Reducing barriers to responsible innovation - Aiming to provide clearer guidance for the basis upon which data can be processed for research purposes and also to provide a definitive list of “legitimate interests” for which organisations may be permitted to process data.

• Reduce burdens on business and deliver better outcomes for people - Implementation of a more dynamic, risk-based accountability framework inspired by the Canadian approach to privacy management rather than the current, more prescriptive framework of the GDPR. Removal of the need for organisations to appoint Data Protection Officers or to carry out Data Protection Impact Assessments where deemed unnecessary. Possible changes to data breach reporting thresholds.

• Boosting trade and reducing barriers to data flows - UK data adequacy decisions to become more flexible, organisations to be able to design their own transfer mechanisms.

• Delivering better public services - Guidance on more effective collaboration between public and private sectors where it is within the public interest (specifically around health data since the pandemic).

• Reform of the Information Commissioners Office (ICO) - New objectives for the regulator including a new statutory framework, being encouraged to set its own regulatory priorities, the introduction of a new independent board and CEO and new processes introduced to deal with complaints.

The other significant and controversial proposal is a potential change to the way that cookies are used by organisations. Two options have been proposed in order to limit cookies pop-ups: the first is permitting organisations to use cookies without the users consent (treated in the same way as ‘strictly necessary’ cookies are currently) and the second option is permitting organisations to store or collect information from a user’s device without their consent for “other limited purposes” akin to “legitimate interests”.

The proposed overhaul of data protection rules in the UK may pose a significant risk to the current EU adequacy decision in relation to cross-border data transfers. When the adequacy decision was published on the 28th June 2021, the EU made it clear that they can withdraw the decision at any time if the UK regime no longer aligns with the GDPR. The UK’s proposals for a more flexible approach towards data transfers with other countries in order to “boost trade and reduce barriers” have the potential to actually prohibit trade (at least with the EU) should the UK regime fall out of alignment with the GDPR and the adequacy decision be recinded.

Elizabeth Denham Information Commissioner for the UK, released this statement in response to the consultation:

“People’s personal data is used in ever more novel ways; it is right that government looks to ensure a legislative framework that is fit for the future. A framework that continues to be independently regulated to maintain high standards of protection for people while delivering social and economic benefits. My office will provide constructive input and feedback as the work progresses, including through our public response to the consultation, ensuring that the ICO can effectively regulate this legislation. We will be considering the detail of the proposals and intend to publish our response as soon as possible.”

Oliver Dowden MP (who was Secretary of State for Digital Culture, Media and Sport when the consultation was released) believes that these reforms will “keep people’s data safe and secure, while ushering in a new golden age of growth and innovation right across the UK.” Nadine Dorries MP was appointed as the new Secretary of State for Digital Culture, Media and Sport on 15/09/2021. The consultation closes at 11:45pm on the 19th November 2021.

You can read the consultation document here and the government’s full National Data Strategy document here.