Firms face Herculean task to keep right side of data law

As the House of Lords begins the process of trying to unpick the UK Data Protection Bill, brands and data suppliers have been warned that keeping up with the myriad changes to data protection legislation will make the 12 Labours of Hercules seem like stroll on the park.
While the Greek mythological hero ultimately succeeded in his task – including slaying the nine-headed Lernaean Hydra and the Nemean lion, as well as capturing and bringing back Cerberus – Pinsent Mason data law protection expert Claire Edwards doubts today’s data practitioners will ever be able to come out winners.
In a blog post, she wrote: “To properly get to the bottom of data protection legislation in the UK, a controller or processor would need at the very least to read the lengthy Data Protection Bill, the lengthy GDPR and rules on e-privacy – currently PECR, although a new EU ePrivacy Regulation is on the way.
“That is before taking into account other pieces of national law, which may have some impact, such as the Digital Economy Act for example. Adding a potentially never-ending list of orders statutory instruments etc. made under the Bill’s delegated powers and it has the potential for compliance to be over burdensome for controllers and processors trying to make sense of it all.”
Things only get worse if the UK business offers goods and services in the EU, Edwards warned, as “not only will it have the problem of complying with reams of primary and secondary legislation for its UK customers, it would have a separate set of obligations to comply with for its EU customers”.
While many are under the illusion that Brexit will cut the red tape which it is claimed is choking UK businesses, for data protection laws the Government plans will have the opposite effect. Edwards concludes: “[This process] will defeat the GDPR’s purpose of harmonising data protection legislation.”