Govt keeps 'best of GDPR' as data reforms are revised

The Government has finally dusted off the Data Protection & Digital Information Bill, claiming the revised proposals “will take the best elements of GDPR” but cut down on “pointless paperwork” and “reduce annoying cookies”.

Ministers say the Bill, which has been on hold since September last year, has been revised following “a co-design process with business leaders and data experts”, including Which?, the DMA, TechUK and the Information Commissioner’s Office.

It is is being introduced today in Parliament by the Department for Science, Innovation & Technology (DSIT).

While the full text of the Bill has yet to be published, most of the original measures affecting the marketing industry remain, including bigger fines for rogue telemarketers, a soft-opt in for charity emails, relaxing the online cookies law and a shake-up of the ICO.

Back in July, ministers claimed the new laws would save firms £1bn over ten years; a claim which was disputed by many data protection experts who insisted the shake-up would cost firms more, not less.

Now ministers claim the revised Bill will unlock £4.7bn in savings for the UK economy over the next ten years but there is little detail on how this will be achieved.

The Government simply says the new version will remove the stipulation, included in GDPR, for all businesses to keep data processing records. This requirement will now only apply to companies deemed to be engaging in “high risk” activities, such working with health data.

It will also detail circumstances where personal data can be processed without the subject’s consent for “certain public interest activities” around law enforcement and protecting vulnerable people.

The legislation also features an updated definition of scientific research, which clarifies that commercial organisations will benefit from the same freedoms as academics to carry out innovative scientific research, such as making it easier to reuse data for research purposes.

Technology Secretary Michelle Donelan insisted the new law would ensure data adequacy with the EU, a far cry from her speech at the Conservative Party conference last summer, which suggested GDPR would be abandoned.

In a statement, the Government said the Bill will:

– Introduce a simple, clear and business-friendly framework that will not be difficult or costly to implement – taking the best elements of GDPR and providing businesses with more flexibility about how they comply with the new data laws.

– Ensure our new regime maintains data adequacy with the EU, and wider international confidence in the UK’s comprehensive data protection standards.

– Further reduce the amount of paperwork organisations need to complete to demonstrate compliance.

– Support even more international trade without creating extra costs for businesses if they’re already compliant with current data regulation.

– Provide organisations with greater confidence about when they can process personal data without consent.

– Increase public and business confidence in AI technologies by clarifying the circumstances when robust safeguards apply to automated decision-making.

The Government cites figures which show data-driven trade generated 85% of the UK’s total service exports and contributed an estimated £259bn for the economy in 2021.

Donelan said: “Co-designed with business from the start, this new Bill ensures that a vitally important data protection regime is tailored to the UK’s own needs and our customs.

“Our system will be easier to understand, easier to comply with, and take advantage of the many opportunities of post-Brexit Britain. No longer will our businesses and citizens have to tangle themselves around the barrier-based GDPR.

“Our new laws release British businesses from unnecessary red tape to unlock new discoveries, drive forward next generation technologies, create jobs and boost our economy.”

The Bill will also establish a framework for the use of trusted and secure digital verification services, which allow people to prove their identity digitally if they choose to do so. The measures will allow customers to create certified digital identities that make it easier and quicker for people to prove things about themselves.

TechUK CEO Julian David said: “TechUK welcomes the new, targeted package of reforms to the UK’s data protection laws, which builds on ambitions to bring organisations clarity and flexibility when using personal data.

“The changes announced today will give companies greater legal confidence to conduct research, deliver basic business services and develop new technologies such as AI, while retaining levels of data protection in line with the highest global standards, including data adequacy with the EU.”

DMA CEO Chris Combemale, who is also chair of the DPDI Business Advisory Group, added: “The DMA has collaborated with the Government throughout the Bill’s development to champion the best interests of both businesses and their customers. We are confident that the Bill should act as a catalyst for innovation and growth, while maintaining robust privacy protections across the UK – an essential balance which will build consumer trust in the digital economy.”

Information Commissioner John Edwards concluded: “I welcome the reintroduction of the Bill and support its ambition to enable organisations to grow and innovate whilst maintaining high standards of data protection rights. Data protection law needs to give people confidence to share their information to use the products and services that power our economy and society.

“The Bill will ensure my office can continue to operate as a trusted, fair and independent regulator. We look forward to continuing to work constructively with the Government to monitor how these reforms are expressed in the Bill as it continues its journey through Parliament.”

Share with friends and colleagues

Related Articles