The UK Government has reintroduced a bill (The Data (Use and Access) Bill) to amend the UK GDPR. This Bill is based on the previous government’s proposals, but omits some key changes.
The Data (Use and Access) Bill introduces several amendments to the UK’s data protection framework. These amend the UK General Data Protection Regulation and the Data Protection Act 2018.
Key Changes
Recognised Legitimate Interests: The Bill amends Article 6 of the UK GDPR to permit data controllers to process personal data based on “recognised legitimate interests” without the need for a detailed legitimate interest assessment. These interests are specified in Schedule 4 of the Bill. They include activities such as ensuring network and information security, preventing fraud, and safeguarding the rights of individuals.
The Bill also sets out explicitly that direct marketing can be undertaken on the basis of legitimate interests, although the legitimate interests assessment would still need to be done in that case.
Automated Decision-Making: The Bill expands the lawful basis for solely automated decision-making processes. It outlines specific conditions under which such processing is permissible, aiming to provide clearer guidelines for organisations leveraging automated systems.
Information Commissioner’s Office Restructuring: The governance structure of the ICO is revised to enhance its regulatory capabilities. The Bill proposes changes to its oversight mechanisms, aiming to improve accountability and efficiency in enforcing data protection laws.
Data Breach Reporting Alignment: The Bill brings improvements to the personal data breach reporting regime under the Privacy and Electronic Communications Regulations, aligning it more closely with the UK GDPR. This aims to streamline reporting processes and ensure consistency across regulatory frameworks.
Health and Care Data Protection: Specific provisions are introduced to strengthen data security and protection within the health and care sectors. The Bill seeks to enable the safe and lawful use of personal data in these sectors, balancing the need for data accessibility with effective privacy controls.
These amendments reflect an evolutionary approach to data protection reform. The aim is to modernise existing laws while maintaining robust safeguards for individual privacy rights. However, other proposals such as removing the need for a data protection officer have not been taken forward.
Sign Up Here:
The Data (Use and Access) Bill is currently making its way through Parliament. Be sure to come back to check for further updates. Gain the practical skills you need to identify and manage data protection and GDPR with this five-star rated training course. Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.What’s Next?
Listen to This Article Here
