The Data Protection and Digital Information Bill (No. 2) (Bill) was introduced to Parliament on 8 March 2023.
The Bill is intended to reduce some of the burdens on businesses associated with the General Data Protection Regulation and to promote data-driven innovation.
When will the Bill come into effect?
The Bill is expected to come into effect later this year, subject to the timing of the general election.
What does the Bill mean for your business?
The intention behind the Bill is to boost trade and reduce unnecessary barriers to data flows, whilst maintaining the UK’s adequacy status with the EU.
Some of the key areas which the Bill aims to address include:
- Cookies: The amount of consent pop ups for cookies will likely be reduced. The Bill aims to widen the situations in which tracking technologies may be used without the user’s consent.
- Subject access requests: UK data protection law gives individuals the right to request the data which organisations hold about them. Complying with such requests can be complex, burdensome, and costly for organisations. The Bill allows for broader grounds on which organisations would be able refuse to respond to requests, or charge a fee, where requests are “vexatious or excessive”. The Bill provides actual examples of “vexatious” requests which organisations will find helpful.
- Amended definition of “personal data”: The Bill seeks to clarify and possibly limit the definition of personal data i.e. the information to which data protection law applies.
- International transfers: The Bill establishes a new test for making adequacy decisions. The Secretary of State will be required to take a more outcomes-based approach and consider whether the standard of protection of personal data by the relevant country is "materially lower" than the UK standard. In practice, this means that the Secretary of State will likely be able recognise more countries as providing an adequate level of protection for personal data, which will reduce the barriers to data flows.
These are just some of the ways in which the Bill proposes to amend the current data protection regime. There would also be changes and clarifications around the purpose limitation, legitimate interests and the use of personal data in research. Greater fines are intended be introduced regarding direct marketing and there would also be changes to the accountability framework.
What is the downside of the Bill?
What remains to be seen is whether the changes brought about by the Bill would mean that the UK has diverged too far from EU data protection law. If so, there is a risk that the UK could lose its EU adequacy status, which currently allows for the free transfer of data between the UK and the EU. If the UK were to lose its adequacy status, it would be costly and cumbersome for companies to put in place appropriate safeguards for the transfer of data (e.g. the standard contractual clauses).
