Anyone banking on the Information Commissioner’s Office providing a pre-Christmas GDPR treat by publishing its final consent guidance for the new regulation is in for yet another disappointment, amid fears the document will not now be available until April – just four weeks before compliance is mandatory.
The ICO had originally said it would publish its consent guidance in June, but this was then delayed until December. The UK regulator claimed it was waiting for the Article 29 Working Party – the group of EU data protection chiefs from each member state – to release its consent guidance. “Once this has happened, our guidance will follow,” it insisted.
However, A29WP has only just launched its own consultation, which does not close until January 27 2018. Its next plenary meeting is due at the beginning of February so it will be hard pushed to have gathered and gone through all the responses to the consultation by then; the next meeting after that is not until April, just weeks before the May 25 2018 GDPR D-Day.
When asked about the new delay an ICO spokeswoman said: “Yes, that is correct. I’d point you to our blog post which says the ICO’s draft guidance on consent is a good place to start right now. It’s unlikely that the guidance will change significantly in its final form.”
One industry insider said: “Surprise, surprise, the shambolic handling of GDPR guidance continues. [Information Commissioner] Elizabeth Denham might talk a good game but at the end of the day, what have we actually got apart from the ‘GDPR 12 steps to take now’ guidance, produced in March?
“We have a hotline for SMEs, that pushes the 12 steps guide and we’ve had the ICO conference roadshow that pushes the 12 steps guide.
“Of course the ICO has insisted we should follow the draft consent guidance as it won’t change much, apparently, although quite how it can say that without the A29WP having its say is beyond me. I guess there’s always the legitimate interests guidance, although that is not so much in the slow lane, it is still in the garage waiting for the mechanic.”
The move comes as UK industry bodies the DMA and the Advertising Association have rifled off a letter to the Government, outlining how the Brexit deal should allow for the ICO to continue to participate fully in the new European Data Protection Board, which will replace A29WP in May.
The missive, which is supported by Facebook, Twitter, Google, Unilever and Sky – as well as every other UK marketing trade body – is calling for the ICO to retain full voting rights, and allow UK consumers to benefit from access to the one-stop shop mechanism under GDPR.
It argues that advertising and marketing are at the heart of the UK economy and play a vital role in driving economic growth. Annual UK exports of advertising services are worth £4.3bn and every £1 spent on advertising returns £6 to the economy, resulting in £120bn to UK GDP. Data is the lifeblood of this industry and 76% of businesses want to retain access to the digital single market post-Brexit, according to a recent study conducted by the DMA.
DMA tells firms: don’t expect all the answers on GDPR
Americans streets ahead of UK firms with GDPR plans
Firms finally wake up to GDPR but despair about future
Brace yourselves for the GDPR data ambulance chasers
ICO set to launch dedicated GDPR hotline for SMEs
ICO stands firm on ‘over strict’ GDPR consent guidance
GDPR fears mount over delay to ICO consent guidance
Third-party data crackdown will wreak havoc says DMA
DPN joins calls for more urgency over GDPR guidance
UK bodies publish GDPR ‘legitimate interests’ guidance
ICO insists GDPR guidance will cover legitimate interest
Industry on alert over third-party data legal crackdown
DMA joins forces in bid to demystify legitimate interests
GDPR consent updates spark chilling warning to brands
GDPR compensation to dwarf £30bn bill for PPI claims