Response to government consultation published

In the last edition of the Debrief, we covered the announcement of the Data Reform Bill in the Queen’s speech. On the 17th June, the official response to the government’s consultation on this Bill, was published.

The response outlines areas which are now very likely to be brought before parliament, alt-hough it is not stated exactly when this will be. Some of the key areas that the government in-tend to proceed with are as follows:

• Legitimate interests - an initial restricted list of processing purposes (including preven-tion of crime) may allow processing of data without the need for conducting a “balancing test” to ascertain legitimate interest first.

• Fairness in Artificial Intelligence (AI) and mitigation of bias - a white paper is currently being written to consider issues around fairness of use, in relation to AI. Processing of special category data may also be automatically allowed for the purpose of bias mitiga-tion in developing AI.

• Potential reform of Article 22 - clarification is being sought around what “solely auto-mated” decisions are, and how to reform legislation around automated decision-making, rather than removing Article 22 altogether, as initially proposed.

• Anonymisation of Data - will be standardised, however no precise process for this is de-tailed.

• Smart Data Schemes - will be involved in informing the processes of data intermediaries.

• Removal of Data Protection Officers - these roles will be replaced with the less formal role of a “senior responsible individual.”

• Removal of Data Protection Impact Assessments - requirements for these assessments will be removed and replaced with more flexible risk-based requirements.

• Prior consultation - for high-risk processing of data, this will no longer be mandatory, but voluntary instead.

• Risk-based approach to adequacy decisions - the UK will be able to make risk-based da-ta adequacy decisions, which will no longer be subject to review every 4 years.

• ICO - reforms to ICO governance and reporting processes will be put forward.

“I share and support the ambition of these reforms. I am pleased to see the government has taken our concerns about independence on board. Data protection law needs to give people confidence to share their information to use the products and ser-vices that power our economy and society. The proposed changes will ensure my office can continue to operate as a trusted, fair and impartial regulator, and enable us to be more flexible and target our action in response to the greatest harms.

We look forward to continuing to work constructively with the government as the proposals are progressed and will continue to monitor how these reforms are expressed in the Bill.”

John Edwards, UK Information Commissioner

Some of the more controversial proposals which were outlined in the initial consultation have been abandoned, such as completely removing Article 22, or allowing organisations to create their own data transfer mechanisms; this has resulted in a slightly more conservative Bill, however, the EU will still be interested in the specific details surrounding areas such as personal data, anonymisation, and the ICO process reforms, before any decisions are made regarding the UK’s existing adequacy relationship.

The Advisory Bureau will continue to monitor the situation and will release updates as necessary.

To read the full consultation response, please click here.