UK data protection reforms announcement imminent

News of the expected announcement was set out in an annex to its new UK digital strategy, published on Monday.

“We are publishing our response to the data protection regime consultation (due June 2022)”, the government said.

UK data protection law was last substantially updated in 2018 when the General Data Protection Regulation (GDPR) came into force, though the EU legislation was subsequently converted into UK law with some minor amendments at the point that Brexit took effect.

Despite the relatively recent overhaul and the fact many businesses surveyed recently reported seeing benefits from the GDPR, the UK government is exploring further reform. The Department for Digital, Culture, Media and Sport (DCMS) consulted on possible reforms to data protection law last year, and the government signalled its plans to introduce a Data Reform Bill into parliament over the next year in the Queen’s Speech last month.

At the heart of the proposals consulted on were plans to strip a series of “administrative burdens” from data protection law in a move that would enshrine the concept of more flexible, risk-based ‘privacy management’ into legislation.

Requirements around data protection impact assessments (DPIAs) and consultation over high-risk personal data processing would be removed, according to those plans. The government is also keen to minimise record keeping obligations and increase the threshold for notifying data breaches to regulators.

A raft of measures to “reduce barriers” to responsible data-related innovation were also consulted on, including plans to make it clearer how personal data can be used for scientific research.

Other data-related reforms are being considered too – including amendments to regulations governing the use of cookies.

In a recent speech given in Brussels, UK information commissioner John Edwards said he is “confident” that the forthcoming UK reforms will not lower standards of data protection that apply to European citizens’ data when that data is transferred to the UK – a matter that is expected to be closely scrutinised by EU policymakers when the UK legislation is updated, and which has major implications for smooth trade between the UK and EU.

Edwards said: “You will hear politicians speak of the need to secure a Brexit dividend, and rhetoric describing the benefits of being free of the red tape of European regulation. We are yet to see the proposals in black and white after the consultation period, but I can assure you that I, and my staff, have worked closely with officials and ministers to ensure that all that is good about the GDPR is not traded away for hypothetical gains.”