The Government has responded to its consultation setting out proposals to reform the UK’s data protection laws.
The Consultation, entitled ‘Data: a new direction’, was launched on 10 September 2021, to inform its development of proposals to reform the UK’s data protection laws, as part of the UK’s National Data Strategy. The Consultation presented proposals that build on the UK’s current data protection regime, such as its data processing principles, data rights for citizens, and mechanisms for supervision and enforcement.
The Consultation ran for 10 weeks, and received 2,924 responses, including TIGA’s.
The proposals in the Government response are arranged into 30 headings across five chapters:
- Reducing barriers to responsible innovation. Chapter 1 relates to providing clarity and certainty to businesses on the interpretation of current laws, definitions and requirements relating to personal data processing
- Reducing burdens on businesses and delivering better outcomes for people. Chapter 2 relates to reducing disproportionate burdens on businesses and delivering better outcomes for people in relation to the processing of personal data
- Boosting trade and reducing barriers to data flows. Chapter 3 relates to boosting trade and reducing barriers to personal data flows
- Delivering better public services. Chapter 4 relates to delivering better public services through improved use of and access to personal data.
- Reform of the Information Commissioner’s Office. Chapter 5 relates to the reform of the ICO, the UK’s independent data protection regulator.
Overall, respondents were broadly supportive of the Government’s proposals in the following areas:
- Changes to research provisions, especially the proposal to consolidate and bring together research-specific provisions, to create a statutory definition of ‘scientific research’ and the changes proposed to notification requirements
- Removal of consent requirements in relation to audience measurement cookies
- The principle of proportionality outlined in the reform agenda across adequacy and Alternative Transfer Mechanisms
- Reforming the ICO, and emphasis on the importance of maintaining its regulatory independence
- Standardising the terminology and definitions used across the data processing regimes
- Increasing clarity and transparency of the existing rules on police collection, use and retention of data for biometrics, in order to improve transparency and public safety
- Extending powers under section 35 of the Digital Economy Act 2017, to include businesses, as this could be beneficial in terms of joined-up public services.
Concerns were raised about:
- Introducing a nominal fee for subject access requests
- Whether the government should have a role enabling the activity of responsible data intermediaries
- Removing the need for data controllers to carry out the legitimate interests balancing test for specified activities if children’s data were involved
- Removing the right to human review of automated decisions
- Whether to exclude political parties and charities from rules on direct electronic marketing
- Removing requirements for Data Protection Impact Assessments (DPIAs) and Data Protection Officers (DPOs)
- The potential impact of reforms on the ICO’s independence
A summary of next steps can be found in Annex A of the Government’s response.