DCMS Reveals Detail of Data Reform Bill

From September 2021 the UK Government consulted individuals and organisations about proposed changes to the UK data protection framework.

on 16 June 2022 the Department of Culture Media and Sport (DCMS), which is responsible for data protection legislation, announced the outcome and its response, setting out proposals to legislate for changes to the Data Protection Act.

What’s Changing?

Key elements of the proposals include:

• Moving away from the current requirements to appoint data protection officers (DPO), maintain a record of processing activity, and data privacy impact assessments. Instead the proposal is to replace these with a Privacy Management Programme overseen by a suitable individual (with enhanced responsibilities for training and audit), with more flexible record keeping requirements and a greater focus on risk management. The DCMS noted that organisations may choose to retain a DPO, particularly if they process high volumes of data, or sensitive data.
• Removing the “balancing test” when relying on legitimate interests as a lawful basis, whereby data processors must weigh up the impact of the proposed data processing against the impact on individuals’ privacy. Instead the DCM proposes to retain the test for instances when children’s data are used, but also to define a list of activities for which the legitimate interests lawful basis may automatically be used.
• Changing the statutory footing of the Information Commissioner’s Office (ICO) so that alongside the data protection and accountability powers, the ICO would also be required to pay due regard to public safety, and economic growth and innovation.
• Moving to an ‘opt out’ consent model for cookies, that in practice would mean consent is not required for cookies to be placed – but people must still be made aware of how to opt out and control their data.
• Aligning penalties for breaching the Privacy and Electronic Communications Regulations with those for breaching the GDPR – raising the penalty ceiling from £500,000 to £17.5 million or 4% of global turnover, whichever is the greater.

There were fears the Government would seek to water down people’s rights and, for example, reintroduce a fee for making subject access requests. The Government has said they do not intend to do this, but is considering changing the threshold for when a subject access request can be refused.

John Edwards, UK Information Commissioner, said:

“I share and support the ambition of these reforms.

“I am pleased to see the government has taken our concerns about independence on board. Data protection law needs to give people confidence to share their information to use the products and services that power our economy and society. The proposed changes will ensure my office can continue to operate as a trusted, fair and impartial regulator, and enable us to be more flexible and target our action in response to the greatest harms.

“We look forward to continuing to work constructively with the government as the proposals are progressed and will continue to monitor how these reforms are expressed in the Bill.”

You can read the full consultation response here