{"id":99152,"date":"2023-03-27T16:03:27","date_gmt":"2023-03-27T15:03:27","guid":{"rendered":"https:\/\/www.commercialriskonline.com\/?p=99152"},"modified":"2023-07-27T12:27:32","modified_gmt":"2023-07-27T11:27:32","slug":"uk-data-protection-reform-back-on-track","status":"publish","type":"post","link":"https:\/\/www.commercialriskonline.com\/uk-data-protection-reform-back-on-track\/","title":{"rendered":"UK data protection reform back on track"},"content":{"rendered":"<p>Following a seemingly false start, the reform of UK data protection legislation seems to be back on track with publication of the Data Protection and Digital Information (No. 2) Bill. Organisations will need to take time to consider the new Bill and determine which of the changes to the current regulations will apply.<\/p>\n<p>Assuming the current version of the Bill becomes law, it will be necessary to determine whether processing activities are considered \u2018high risk\u2019 as this is what will determine whether data processing records need to be kept. The government currently gives one example of where processing may be high risk (processing large volumes of sensitive data about people\u2019s health). We expect to receive further guidance on this but anticipate that it will be based on the nature and scope of the processing and those that process special category data.<\/p>\n<p><strong>Back on track<\/strong><\/p>\n<p>Following government consultation post-Brexit, the first iteration of the Data Protection and Digital Protection Bill was introduced to Parliament in July 2022. The government then announced that further amendments were required, and progress stalled. The updated version of the bill, the Data Protection and Digital Information (No. 2) Bill had its first reading in the House of Commons on 8 March 2023.<\/p>\n<p><strong>Reform<\/strong><\/p>\n<p>Much of the July 2022 bill was in keeping with the current status quo, although did introduce:<\/p>\n<ul>\n<li>Changes to the accountability framework, including alternatives to the requirements to undertake data impact assessments and appoint a data protection officer.<\/li>\n<li>Changes to data subject access requests, to bring this into line with the UK\u2019s freedom of information regime.<\/li>\n<li>A data protection test: The requirements for assessing the adequacy of third countries were altered and renamed as a \u201cdata protection test\u201d that focuses on risk-based decision-making and outcomes.<\/li>\n<li>Reform of the Information Commissioner\u2019s Office (ICO), including consistency in the level of fines that can be issued, bringing the Privacy and Electronic Communications Regulations in line with other legislation.<\/li>\n<\/ul>\n<p><strong>What\u2019s new?<\/strong><\/p>\n<p>The reforms are said to take \u201cthe best elements of the GDPR\u201d while providing \u201cbusinesses with more flexibility\u201d. The key changes that have been made to the updated Bill mostly provide clarification on the first draft:<\/p>\n<ul>\n<li>The updated Bill now provides non-exhaustive examples of processing that is necessary for the purposes of a legitimate interest, including processing that is necessary for the purposes of direct marketing.<\/li>\n<li>The definition of scientific research has now been updated to include that which is publicly or privately funded and whether carried out as a commercial or non-commercial activity.<\/li>\n<li>The Bill clarifies rules regarding automated decision making where a significant decision is taken with \u201cno meaningful human involvement\u201d.<\/li>\n<li>The duty to keep data processing records will now only apply to organisations whose processing activities are likely to pose a high risk to an individual\u2019s rights.<\/li>\n<li>The Bill confirms that businesses can continue to use their existing international data transfer mechanisms to share personal data overseas if they are already compliant with current UK data laws.<\/li>\n<\/ul>\n<p><strong>Impact and comments<\/strong><\/p>\n<p>The Bill confirms a new duty on public electronic communication service providers to report any \u201csuspicious activity\u201d to the ICO relating to unlawful direct marketing. Non-compliance could result in a \u00a31,000 penalty. The ICO will be publishing guidance on what may constitute reasonable ground for such suspicion, but this duty is likely to mean that providers of electronic communications services may need to introduce new policies to ensure compliance.<\/p>\n<p>The Bill also confirms an emphasis on safeguarding and sets out specific safeguards for research, archiving or statistical purposes, which are arguably more onerous than the GDPR (General Data Protection Regulation). Organisations will need to ensure that they have the necessary measures in place to ensure compliance.<\/p>\n<p>It is also worth noting a new requirement for data subjects to raise complaints with the relevant data controller, prior to lodging a complaint with the ICO.<\/p>\n<p>The Bill is not substantially different to that published in July last year and does not appear to depart significantly from the essence of the GDPR, so we hope that the adequacy decision by the European Commission, allowing data to follow freely from the EU to the UK, will not be at risk. However, until the Bill becomes law and is reviewed in full by the EC, there are no guarantees.<\/p>\n<p><strong>What\u2019s next?<\/strong><\/p>\n<p>The Bill now moves to a second reading in the House of Commons, although no date has yet been set. The Bill will then make the usual progress through the House of Commons and House of Lords, before becoming law.<\/p>\n<p><em>Contributed by Helen Bourne, partner, Clyde &amp; Co<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Following a seemingly false start, the reform of UK data protection legislation seems to be back on track with publication of the Data Protection and Digital Information (No. 2) Bill. Organisations will need to take time to consider the new Bill and determine which of the changes to the current &hellip;<\/p>\n","protected":false},"author":26,"featured_media":83647,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","footnotes":""},"categories":[552,361,375,354,162,364,160,193,382],"tags":[503,407],"acf":[],"uagb_featured_image_src":{"full":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266.jpg",700,400,false],"thumbnail":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-150x150.jpg",150,150,true],"medium":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-300x171.jpg",300,171,true],"medium_large":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266.jpg",700,400,false],"large":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266.jpg",700,400,false],"1536x1536":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266.jpg",700,400,false],"2048x2048":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266.jpg",700,400,false],"image-publication":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-390x223.jpg",390,223,true],"image-publication-large":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-476x272.jpg",476,272,true],"jannah-image-small":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-220x150.jpg",220,150,true],"jannah-image-large":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-390x220.jpg",390,220,true],"jannah-image-post":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266.jpg",700,400,false],"featured-2":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-530x340.jpg",530,340,true],"editors-pick":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-219x115.jpg",219,115,true],"archive-thumbnail":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-375x375.jpg",375,375,true],"mobile-thumbnail":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-375x300.jpg",375,300,true],"single-feature":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-700x400.jpg",700,400,true],"square-thumbnail-s":["https:\/\/www.commercialriskonline.com\/wp-content\/uploads\/2021\/10\/Data_shutterstock_1062915266-100x100.jpg",100,100,true]},"uagb_author_info":{"display_name":"Helen Bourne, partner, Clyde &amp; Co","author_link":""},"uagb_comment_info":0,"uagb_excerpt":"Following a seemingly false start, the reform of UK data protection legislation seems to be back on track with publication of the Data Protection and Digital Information (No. 2) Bill. Organisations will need to take time to consider the new Bill and determine which of the changes to the current &hellip;","_links":{"self":[{"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/posts\/99152"}],"collection":[{"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/users\/26"}],"replies":[{"embeddable":true,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/comments?post=99152"}],"version-history":[{"count":3,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/posts\/99152\/revisions"}],"predecessor-version":[{"id":99179,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/posts\/99152\/revisions\/99179"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/media\/83647"}],"wp:attachment":[{"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/media?parent=99152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/categories?post=99152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.commercialriskonline.com\/wp-json\/wp\/v2\/tags?post=99152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}