Where will we be in 2023... with data privacy reform?

Anyone expecting the Government to implement its planned data reforms any time soon could be in for a disappointment as, 18 months after first outlining the biggest shake up of UK data protection legislation for decades, we appear to be back to square one.

The new laws, based on what ministers maintained was “common sense, not box-ticking”, were first unveiled in August 2021 and coincided with confirmation that New Zealand privacy commissioner John Edwards would be the new UK Information Commissioner.

By June this year, the Data Protection & Digital Information Bill 2022-23 had been revealed, and included bigger fines for rogue marketers, a soft-opt in for charity emails, relaxing the online cookies law and a shake-up of the Information Commissioner’s Office.

Ministers reinforced their claims that this was a business-friendly move by insisting UK firms could save up £1bn over ten years; a claim which was disputed by many data protection experts who insisted the shake-up would cost firms more, not less.

Industry body the DMA backed plans, although others were not so sure, with one privacy group branding the Bill “irresponsible”. Meanwhile, privacy chiefs warned the reforms could scupper the UK’s adequacy deal with the EU, estimated by the Government to be worth up to £85bn a year to the UK economy.

These fears were heightened when Culture Secretary Michelle Donelan roused the Conservative Party faithful – and the short-lived Liz Truss administration – by insisting the Bill would replace GDPR with a “business- and consumer-friendly British data protection system… that will focus on growth and common sense, helping to prevent losses from cyber attacks and data breaches, while protecting data privacy”.

In true EU-bashing overdrive, Donelan continued: “This will allow us to reduce the needless regulations and business-stifling elements, while taking the best bits from others around the world to form a truly bespoke, British system of data protection.”

Cue much gnashing of teeth; if ministers were planning to ditch GDPR, the EU adequacy agreement – and that £85bn a year – could be torpedoed too.

Edit and The Salocin Group chief J Cromack summed up the strength of feeling by warning: “Businesses don’t need a different set of regulations, it will just create a greater burden for UK firms. If UK companies want to trade and have customers in the EU they need to comply with GDPR to help them thrive. They just need more pragmatic guidance on implementation.”

And, it seemed, somewhere in Whitehall, someone was listening. Just a few weeks after Truss had fallen on her sword, DCMS deputy director for domestic data protection policy Owen Rowland maintained that data adequacy with the EU was “at the heart of the approach we are taking going forward”.

He also claimed there would be a new public consultation in the coming weeks. He added that ministers “need space to work with all groups to check we go as far as we can to enable growth and innovation while protecting high standards and maintaining our parallel policy objective of looking after EU adequacy and doing so as quickly as possible”.

Funnily enough, this has yet to see the light of day, but, then again, the Government appears to have other priorities, most notably undoing the damage one of its own caused during the summer.

So, when are we likely to see the Data Protection & Digital Information Bill 2022-23 version 2.0?

Your guess is as good as ours; there have even been claims that Rowland had been misquoted. But, in the meantime, the best advice for businesses has got be to “keep calm and carry on”…

Share with friends and colleagues

Related Articles