Firms 'face higher costs, not savings, under data laws'

Data protection experts and privacy groups have blasted Government claims that the UK’s proposed data laws will benefit businesses, insisting firms will be “sweating” over “costly changes” to the regulatory regime and face a new “patchwork of laws” to comply with.

When the Data Protection & Digital Information Bill – formerly the Data Reform Bill – was published in Parliament earlier this week, the Minister for Media, Data & Digital Infrastructure Matt Warman was keen to point out how business friendly it will all be.

He said: “We are reducing the burdens on businesses that have held the UK back from the benefits of greater personal data use before now. By focusing on outcomes not box-ticking, we will unburden businesses from prescriptive requirements and empower them to protect personal data in the most proportionate and appropriate way. Our changes could create around £1bn in business savings over ten years.”

But Mishcon de Reya senior data protection specialist Jon Baines disagrees. He said: “This is a complicated Bill, covering multiple different areas. Despite best intentions, it would, if enacted, still leave a patchwork of laws for companies to have to negotiate and comply with.”

The Open Rights Group goes even further, with executive director Jim Killock maintaining that if the Bill is passed in its current form, “British businesses will be sweating as they try to get their heads around another costly and expensive change to the regulatory regime”.

He added: “This data oligarchs charter will cheat workers out of their rights, increase regulatory costs for business, and will only benefit global tech companies.

“This Bill will scrap important protections from prejudice and bias afforded to women, workers, patients, migrants, ethnic minorities, and vulnerable people and communities, and everyone else. It will enshrine discrimination, bias and prejudice into UK law.”

Baines, meanwhile, is not convinced that Warman’s claims that the EU data adequacy deal will be safe under the new regime. Signed last year, the pact allows the free flow of data between the UK and EU.

According to the UK Government’s own figures, if the agreement were voided, UK businesses could lose more than £1bn in reduced trading revenue and £420m in compliance costs over five years, wiping out the claimed £1bn in savings businesses could achieve under the new data law.

Baines commented: “With the multiple amendments proposed in the Bill, the UK GDPR is starting to look quite different to its European cousin. And the more the two regimes diverge, the more there is a risk that the EU might question whether it still considers the UK to have an ‘adequate’ regime for the purposes of data transfers.”

The ORG’s legal and policy officer, Mariano delli Santi, added: “The Bill severely restricts data subjects’ rights, substantially abolishes the right to human review of automated decisions, hollows out the principles of purpose limitation and lawfulness, and transforms the ICO into a government-controlled authority.

“Any of these provisions is substantially incompatible with the EU GDPR. Beyond the Government’s wishful thinking on the matter, if this ever becomes law there is absolutely no chance that the UK adequacy decision will stand.”

However, not everyone is concerned. Jo Joyce, senior counsel from law firm Taylor Wessing, told Tech Monitor: “There is a lot of fiddling around here but there is nothing in my view that brings us outside the adequacy.

“There is definitely less autonomy for the ICO, or at least more parliamentary oversight. That is in my view unlikely to create problems from an EU perspective as the extent to which supervisory bodies are fully independent varies, although it is likely changes around ICO autonomy and powers [will] be the most commented on.”