The Data Reform Bill: Uncertainty and Missed Opportunities
The Minister of State’s written answer given on 19 October was only the last in a series of statements from the previous government promising (or threatening) to change the UK GDPR. It indicated that the draft Data Protection and Digital Information Bill will be retained but amended. This statement contrasted markedly with the recent statement from the Secretary of State (under the previous administration, but now reappointed) to the Conservative Party Conference, in which she undertook to “replacing [the UK] GDPR with our own business- and consumer-friendly British data protection system” suggesting a more fundamental change than that contained in the existing draft Bill.
The fact that the UK now enters its third administration in as many months only adds to the lack of clarity about whether the Bill will ultimately be brought forward, substantially amended, or replaced with more comprehensive draft legislation that would replace both the UK GDPR and Data Protection Act 2018. It seems that significant reform of the UK GDPR remains likely, assuming the new administration can find the time and political capital to implement it. Prime Minister Sunak has indicated an intention to ‘replace’ the GDPR. But real uncertainty and confusion seem likely to overshadow the UK’s data protection regime for months if not years.
On the basis that (i) ideas for reform have a tendency to be used, even if the legislative vehicle changes, and (ii) there is little else to go on in divining the government’s plans, we were commissioned by Reset to analyse the Data Protection and Digital Information Bill’s implications. This series of six briefing papers looks at the Bill’s impact on data rights, research, and EU data adequacy. We also highlight some important missed opportunities for reform, which we urge the new government to consider as it prepares the next chapter in the story of privacy regulation in the UK.
In short, our view is that the Bill would make significant changes to the data protection regime that threaten to undermine data rights, leave a question mark over the UK’s data adequacy decision from the EU, and burden businesses with the need to consider compliance with two accountability regimes, whilst doing little to improve the availability of data to genuine researchers.
We hope you find the briefing papers (updated to take account of the version of the Bill published in March 2023) useful and welcome your feedback. Contact alex.lawrencearcher@awo.legal