After being introduced in a blaze of glory by the previous Government, heralding the future of data processing within the UK, the Data Protection and Digital Information (No.2) Bill failed to make it into law before last year’s General Election. Therefore, unsurprisingly, the new Government picked up the baton and introduced the Data (Use and Access) Bill (the “Bill”) on 23 October 2024. The Bill was evolution, not revolution, although, with greats fanfare (and providing the foundations for its AI vision), the current Government believes the Bill will ensure that business will be able to innovate, while understanding and implementing data protection legislation easier; make savings; and increase public trust due to the proposed legislative reforms (including the development of ethical guidelines and frameworks).
The Bill is currently at the early stages of its passage through Parliament and is subject to change – mid-2025 is a possible ETA for Royal Assent. Therefore, time will tell whether or not the Bill’s proposals are enacted fully; the suggested economic benefit materialises; the proposed technological advances will be realised and, importantly, how Europe reacts to the final text – for example, will it have an impact upon the EU’s current adequacy decisions in relation to the UK?
With regard to the latter point above, commentators differ in their opinion upon the potential impact upon adequacy, particularly as the Bill provides that the Government will be able to streamline the adequacy finding process. However, regardless of any legal or academic debate it isclear that data reform is on the horizon and your business should be ready.
If the Bill becomes law, it will effectively amend the UK GDPR, the Data Protection At 2018 and the Privacy and Electronic Regulations (“PECR”). However, it is important to note that the plan is that if a business is fully compliant with the current UK GDPR then the Bill will entail subtle changes to your data processing regime. The burning question at this stage being – is your business currently fully compliant with the UK GDPR and related data protection laws? If not, there is no time like the present to rectify.
The Bill has tweaked some of the principles of its predecessors and, as currently drafted, includes changes to the restrictions relating to automated processing (potentially permitting flexibility to utilise automated systems including AI); the provision of an approved list of ‘Legitimate Interests’ (removing legal uncertainty and, in some cases, the requirements for a Legitimate Interests Assessment); ); an expansion of a Controller’s rights in relation to DSARs (including the ability to expand timescales in certain situations); providing for additional categories of ‘sensitive data’; ; a relaxation of consent requirements for the use of cookies and similar technologies in relation to a range of purposes; an increase in potential fines for breaches of the PECR to provide uniformity; and an enhancement of the ICO’s powers.
The UK Government has insisted that the purpose of the Bill includes aiding the UK data and AI and digital economy; encouraging innovation; building public trust; providing clarification; and introducing flexibility (and, many would argue, increasing regulatory compliance burdens) into data processing activities. It is debatable whether or not the Bill will achieve such aims, however it is agreed by most legal analysists that clarification certainly is required in relation to certain aspects of the current data protection regime. However, the balance required is reform which will not adversely impact EU adequacy while encouraging the use of a key asset, data, within the parameters of fair and ethical use.
The key takeaway for businesses at this stage is that data reform IS on its way and will increase the importance of lawful data processing in the future. Ensure that your house is in order now in relation to your future data processing and digital activities.
Author
Sean Crotty, Partner