{"id":6419,"date":"2022-08-30T10:00:00","date_gmt":"2022-08-30T09:00:00","guid":{"rendered":"https:\/\/www.infolaw.co.uk\/newsletter\/?p=6419"},"modified":"2022-08-29T18:19:18","modified_gmt":"2022-08-29T17:19:18","slug":"reforming-data-protection","status":"publish","type":"post","link":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/","title":{"rendered":"Reforming data protection"},"content":{"rendered":"\n

Following a consultation<\/a> on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to regulation\u201d post-Brexit \u2013 the government has published the Data Protection and Digital Information Bill<\/a> (previously dubbed<\/a> the \u201cData Reform Bill\u201d).<\/p>\n\n\n\n

The forthcoming legislation follows several years of upheaval to the data protection regime, first as a result of the EU General Data Protection Regulation (GDPR) in 2016 which was transposed into UK law by the Data Protection Act 2018<\/a> (DPA). Although the EU GDPR is no longer enforceable in the UK following the Brexit transition period, its key principles, rights and obligations were retained in UK legislation known as the UK GDPR.<\/p>\n\n\n\n

Changes to the data protection landscape<\/h3>\n\n\n\n

Following are some of the key changes proposed in the new Data Protection and Digital Information Bill.<\/p>\n\n\n\n

Subject Access Requests<\/h4>\n\n\n\n

Subject Access Requests (SARs) \u2013 which can be submitted by individuals in order to gain access to their data \u2013 can currently be refused (or a fee applied) if the request is \u201cmanifestly unfounded or excessive\u201d. Under the Bill, this exemption will apply instead to SARs which are considered \u201cvexatious or excessive\u201d. This change arguably increases the scope for organisations to refuse SARs or charge a fee, although this will depend on the interpretation by the Information Commissioner\u2019s Office (ICO).<\/p>\n\n\n\n

Privacy and Electronic Communications Regulations<\/h4>\n\n\n\n

Under the Privacy and Electronic Communications Regulations (PECR), all websites which are operated by UK organisations must gain consent from users if they wish to track them with the use of cookies. The only cookies which can be used without consent are those which are \u201cstrictly necessary\u201d in order to allow the website to function properly. <\/p>\n\n\n\n

The Bill will expand the types of cookies which are permitted without consent, to include those which are required to obtain statistics (eg Google Analytics) in order to improve the user experience, although the user must still have the ability to opt out.<\/p>\n\n\n\n

An interesting new clause to be added by the Bill to the PECR (section 6B) opens up the possibility of enabling web users to provide universal cookie consent, which could potentially put an end to the barrage of cookie consent pop-ups over multiple websites. There are already tools<\/a> which can prevent many of these pop-ups but they don\u2019t currently allow users to select their preferences.<\/p>\n\n\n\n

The Bill also significantly increases the maximum fines for breaches of the PECR, from the current \u00a3500,000, to the higher of \u00a317.5 million or 4 per cent of a business’s global turnover.<\/p>\n\n\n\n

Data protection flexibility<\/h4>\n\n\n\n

The Bill aims to make the data protection regime more flexible. For example, it limits the scope of personal data, introducing a subjective test of whether individuals are identifiable by the controller or processor by reasonable means at the time of processing.<\/p>\n\n\n\n

The Bill introduces a new list of \u201crecognised legitimate interests\u201d which can be relied upon by organisations for data processing purposes; there will be no need to carry out a legitimate interest assessment if the type of data processing is on this list.<\/p>\n\n\n\n

International transfers of data will become more flexible under the Bill compared to the existing EU GDPR framework, with the introduction of a risk-based approach for purposes of adequacy decisions.<\/p>\n\n\n\n

Data Protection Officers<\/h4>\n\n\n\n

The GDPR introduced a requirement for public authorities and organisations carrying out high risk data processing to appoint Data Protection Officers (DPOs) to independently<\/em> oversee compliance with their data protection obligations. Under the proposed Bill, instead of a DPO, the same organisations will need to appoint a senior responsible individual<\/em> who \u201cmust be part of the organisation\u2019s senior management\u201d. Although their duties will remain the same, their status as part of the management team may potentially lead to conflicts of interest.<\/p>\n\n\n\n

Data Protection Impact Assessments<\/h4>\n\n\n\n

Under the current law, Data Protection Impact Assessments (DPIAs) must be carried out where processing is likely to result in a high risk to individuals. The Bill replaces DPIAs with Assessments of High Risk Processing<\/em>. In practice, this appears to merely be a change of name.<\/p>\n\n\n\n

Data controllers<\/h4>\n\n\n\n

The Bill removes the requirement for non-UK based data controllers to appoint a data protection representative in the UK.<\/p>\n\n\n\n

Information Commissioners Office<\/h4>\n\n\n\n

The name of the ICO will change to the \u201cInformation Commission\u201d and it will have some new reporting obligations to the government, as well as being subject to greater oversight by the Secretary of State.<\/p>\n\n\n\n

Automated decision making<\/h4>\n\n\n\n

There is currently a general prohibition on automated decision making (eg using algorithms and AI) under Article 22 of the UK GDPR. The Bill removes this general prohibition and replaces it with specific safeguards, essentially making it easier for organisations to implement automated decision making processes.<\/p>\n\n\n\n

What do lawyers need to advise their clients?<\/h3>\n\n\n\n

The broad aim of the Data Protection and Digital Information Bill appears to be about making the data protection regime slightly more flexible for businesses. However, most of the general obligations will still remain, so it\u2019s important to ensure that compliance measures continue as normal. And in respect of adhering to the PECR, this is even more crucial in light of the huge increase in maximum fines for breaches.<\/p>\n\n\n\n

Organisations should review their data protection procedures in preparation for the new legislation, and consider if they can take advantage of any benefits, such as saving time by implementing automated decision making systems.<\/p>\n\n\n\n

Any company documentation pertaining to data protection, such as policies and guidance, should be reviewed in light of the changes. References to obsolete terms such as DPO and DPIAs will need to be updated.<\/p>\n\n\n\n

The second reading of the Bill is due to take place on 5 September 2022. It\u2019s worth bearing in mind that a new Prime Minister is due in post around the same time, which could potentially lead to further amendments.<\/p>\n\n\n\n

Further reading<\/h3>\n\n\n\n

UK government formalises data protection reform following consultation<\/a> \u2013 Osborne Clarke<\/p>\n\n\n\n

Changes to UK Data Protection Laws: Key headlines<\/a> \u2013 Dentons<\/p>\n\n\n\n

UK Data Protection and Digital Information Bill: in detail<\/a> \u2013 Pinsent Masons<\/p>\n\n\n\n

Alex Heshmaty is technology editor for the Newsletter. He runs Legal Words<\/a>, a legal copywriting agency based in the Silicon Gorge. Email alex@legalwords.co.uk<\/a>.<\/em><\/p>\n\n\n\n

Photo via Piqsels<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to regulation\u201d post-Brexit \u2013 the government has published the Data Protection and Digital Information Bill (previously dubbed the \u201cData Reform Bill\u201d). The forthcoming legislation follows several years of upheaval to the […]<\/p>\n","protected":false},"author":61,"featured_media":6431,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[],"class_list":["post-6419","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection"],"yoast_head":"\r\nReforming data protection - Internet for Lawyers Newsletter<\/title>\r\n<meta name=\"description\" content=\"Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to\" \/>\r\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\r\n<link rel=\"canonical\" href=\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/\" \/>\r\n<meta property=\"og:locale\" content=\"en_GB\" \/>\r\n<meta property=\"og:type\" content=\"article\" \/>\r\n<meta property=\"og:title\" content=\"Reforming data protection - Internet for Lawyers Newsletter\" \/>\r\n<meta property=\"og:description\" content=\"Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to\" \/>\r\n<meta property=\"og:url\" content=\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/\" \/>\r\n<meta property=\"og:site_name\" content=\"Internet for Lawyers Newsletter\" \/>\r\n<meta property=\"article:published_time\" content=\"2022-08-30T09:00:00+00:00\" \/>\r\n<meta property=\"og:image\" content=\"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg\" \/>\r\n\t<meta property=\"og:image:width\" content=\"900\" \/>\r\n\t<meta property=\"og:image:height\" content=\"500\" \/>\r\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\r\n<meta name=\"author\" content=\"Alex Heshmaty\" \/>\r\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\r\n<meta name=\"twitter:creator\" content=\"@nickholmes\" \/>\r\n<meta name=\"twitter:site\" content=\"@nickholmes\" \/>\r\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alex Heshmaty\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\r\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/\",\"url\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/\",\"name\":\"Reforming data protection - Internet for Lawyers Newsletter\",\"isPartOf\":{\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg\",\"datePublished\":\"2022-08-30T09:00:00+00:00\",\"author\":{\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/#\/schema\/person\/daff2a47987956c44c74c8e136c0ffde\"},\"description\":\"Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to\",\"breadcrumb\":{\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#primaryimage\",\"url\":\"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg\",\"contentUrl\":\"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg\",\"width\":900,\"height\":500},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.infolaw.co.uk\/newsletter\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Reforming data protection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/#website\",\"url\":\"https:\/\/www.infolaw.co.uk\/newsletter\/\",\"name\":\"Internet for Lawyers Newsletter\",\"description\":\"Edited by Nick Holmes\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.infolaw.co.uk\/newsletter\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/#\/schema\/person\/daff2a47987956c44c74c8e136c0ffde\",\"name\":\"Alex Heshmaty\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.infolaw.co.uk\/newsletter\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/dd8296d053e8fde73684687cf6357300702da710fec385800bf0bf74f12a5916?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/dd8296d053e8fde73684687cf6357300702da710fec385800bf0bf74f12a5916?s=96&d=mm&r=g\",\"caption\":\"Alex Heshmaty\"},\"description\":\"Alex Heshmaty is technology editor for the Newsletter. He runs Legal Words, a legal copywriting agency based in the Silicon Gorge. Email alex@legalwords.co.uk.\",\"sameAs\":[\"http:\/\/www.legalwords.co.uk\"],\"url\":\"https:\/\/www.infolaw.co.uk\/newsletter\/author\/alexheshmaty\/\"}]}<\/script>\r\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Reforming data protection - Internet for Lawyers Newsletter","description":"Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/","og_locale":"en_GB","og_type":"article","og_title":"Reforming data protection - Internet for Lawyers Newsletter","og_description":"Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to","og_url":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/","og_site_name":"Internet for Lawyers Newsletter","article_published_time":"2022-08-30T09:00:00+00:00","og_image":[{"width":900,"height":500,"url":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg","type":"image\/jpeg"}],"author":"Alex Heshmaty","twitter_card":"summary_large_image","twitter_creator":"@nickholmes","twitter_site":"@nickholmes","twitter_misc":{"Written by":"Alex Heshmaty","Estimated reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/","url":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/","name":"Reforming data protection - Internet for Lawyers Newsletter","isPartOf":{"@id":"https:\/\/www.infolaw.co.uk\/newsletter\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#primaryimage"},"image":{"@id":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg","datePublished":"2022-08-30T09:00:00+00:00","author":{"@id":"https:\/\/www.infolaw.co.uk\/newsletter\/#\/schema\/person\/daff2a47987956c44c74c8e136c0ffde"},"description":"Following a consultation on reforming the UK\u2019s data protection laws \u2013 partly designed to \u201cprovide an opportunity for the UK to reshape its approach to","breadcrumb":{"@id":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#primaryimage","url":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg","contentUrl":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2022\/08\/piqsels.com-id-jexxx.jpg","width":900,"height":500},{"@type":"BreadcrumbList","@id":"https:\/\/www.infolaw.co.uk\/newsletter\/2022\/08\/reforming-data-protection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infolaw.co.uk\/newsletter\/"},{"@type":"ListItem","position":2,"name":"Reforming data protection"}]},{"@type":"WebSite","@id":"https:\/\/www.infolaw.co.uk\/newsletter\/#website","url":"https:\/\/www.infolaw.co.uk\/newsletter\/","name":"Internet for Lawyers Newsletter","description":"Edited by Nick Holmes","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infolaw.co.uk\/newsletter\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.infolaw.co.uk\/newsletter\/#\/schema\/person\/daff2a47987956c44c74c8e136c0ffde","name":"Alex Heshmaty","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.infolaw.co.uk\/newsletter\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/dd8296d053e8fde73684687cf6357300702da710fec385800bf0bf74f12a5916?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dd8296d053e8fde73684687cf6357300702da710fec385800bf0bf74f12a5916?s=96&d=mm&r=g","caption":"Alex Heshmaty"},"description":"Alex Heshmaty is technology editor for the Newsletter. He runs Legal Words, a legal copywriting agency based in the Silicon Gorge. Email alex@legalwords.co.uk.","sameAs":["http:\/\/www.legalwords.co.uk"],"url":"https:\/\/www.infolaw.co.uk\/newsletter\/author\/alexheshmaty\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/posts\/6419","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/comments?post=6419"}],"version-history":[{"count":3,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/posts\/6419\/revisions"}],"predecessor-version":[{"id":6434,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/posts\/6419\/revisions\/6434"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/media\/6431"}],"wp:attachment":[{"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/media?parent=6419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/categories?post=6419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infolaw.co.uk\/newsletter\/wp-json\/wp\/v2\/tags?post=6419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}