On 16 June 2022, the UK government’s Department for Digital, Culture, Media and Sport (“the DCMS”) published its response to its Data Reform consultation. The response sets out the UK government’s key data protection reform proposals which will be incorporated into the UK’s new Data Reform Bill.
Here are the key takeaways of the Data Reform proposals:
Reducing Barriers to Responsible Innovation
One of the focus areas of the proposed reform is to facilitate the innovative use of data by removing several barriers which are said to hinder innovation in organisations.
-
Use of Personal Data for Research Purposes
The DCMS recognises that the current laws around the use of personal data for research purposes are complicated. All too often, organisations find it difficult to establish legal certainty for when using data for vital and pioneering research. The proposed reforms focus on removing unnecessary hurdles to better enable researchers to unlock more personal data for responsible research uses. Some of the proposals are:
- Clarifying and creating more certainty around what "research purposes" means in practice;
- Incorporating definitions of “scientific research”, “historical research” and “statistical purposes” into the legislation; and
- Creating an exemption to the requirement to provide transparency information to data subjects when information is not obtained directly from the individual.
-
Re-use of Personal Data
The DCMS believes that the re-use of personal data (often referred to as “further processing”) can provide innovative benefits. As such, it plans to widen and clarify the circumstances in which data may be re-used and provide clarity on how organisations can better differentiate between new and further processing.
-
Legitimate Interests
Often businesses and organisations seek to rely on their legitimate business interests as the required legal basis for processing personal data. In order to do so, under the UK GDPR, a balancing exercise must be undertaken weighing the business' legitimate interests against the rights of the relevant data subjects. The DCMS has recognised many organisations’ concerns about the time and effort these legitimate interests impact assessments can take.
In answer to these concerns, the DCMS proposes to introduce a limited, exhaustive list of legitimate interests for which organisations could use personal data without applying the legitimate interests balancing test. The list is likely to include processing activities undertaken to prevent crime or report safeguarding concerns, or which are necessary for other important reasons of public interest.
-
Data Minimisation and Anonymisation
The DCMS also proposes to clarify when personal data can likely be regarded as anonymous and issue guidance as to how organisations can establish whether an individual is identifiable or not.
Reducing Burdens on Businesses
Accountability
The DCMS has recognised that data protection legislation can place a disproportionate burden on some organisations. It therefore plans to reform the accountability framework by introducing a more flexible system underpinned by risk based “privacy management programmes”.
In doing so, the DCMS proposes to remove the existing requirements for:
- Data Protection Officers;
- Data Protection Impact Assessments; and
- Records Of Processing Activities
These can be replaced with risk assessment tools which are appropriate to the organisation. This is intended to transition the position under UK law from a “one size fits all” model towards a more flexible approach which reflects the volume and sensitivity of personal data processed by the specific organisation.
Cookies
- The DCMS will remove the consent requirement for the use of analytics cookies and treat these as “strictly necessary” cookies.
- It intends to remove the need to display cookie banners to UK residents and replace with an opt-out model for consent whereby users are given sufficient information to allow them to opt-out via their online preferences.
Breach Reporting
Article 33 of UK GDPR requires that an organisation must inform the ICO of a personal data breach “unless it is unlikely to result in a risk to the rights and freedoms of natural persons". The DCMS has recognised that this threshold has led to the reporting of relatively minor breaches. Whilst the UK government sought opinions as to whether a higher reporting threshold would reduce the number of notifications, the ICO highlighted that an indirect reduction of the number of reportable incidents would impact the amount of “valuable intelligence data” received. Ultimately, the DCMS decided not to pursue a higher threshold for breach reporting.
Subject Access Requests
The DCMS outlined that the right of access is “one of the key rights of the data protection framework”, however, it did acknowledge that dealing with such requests can be time-consuming and resource intensive. Whilst the regime is not expected to change substantively, a critical change is anticipated in respect of the threshold for refusing to respond to a Subject Access Request. The consultation identified that the “manifestly unfounded” threshold was too vague and created a significant barrier for organisations to refuse unreasonable requests which had the intention of disrupting an organisation.
The DCMS confirmed that the government intends to bring the Subject Access Requests threshold in line with the Freedom of Information Act regime where a request can be refused for being “vexatious or excessive”. The DCMS refused to permit a recommended cost ceiling for Subject Access Requests. However, the DMCS has noted that it is considering the impact of Subject Access Requests on SMEs.
Alignment of PECR and UK GDPR / DPA 2018
The DCMS requested views on the effectiveness of the Privacy and Electronic Communications Regulations 2003 (PECR) which sets out privacy rights in respect of electronic communications. PECR provides supplementary rules to the UK GDPR in respect of cookies, direct marketing communications and communications security.
As PECR’s enforcement provisions were born out of the Data Protection Act 1998, they are currently much weaker than the UK GDPR and DPA 2018. The consultation asked for views as to whether PECR should be ‘upgraded’ to allow the ICO to levy fines in line with the UK GDPR and DPA 2018 of up to £17.5m or 4% of global turnover. The majority of respondents supported the proposal and it is hoped that aligning the two regimes will bring greater clarity for organisations in respect of those enforcement provisions.
Summary
The reforms appear to be focused on providing organisations with greater flexibility over their use of personal data while still committing to a high level of data protection. Organisations should be reassured that if they already comply with the UK’s current data protection regime, they will still comply with the new regime. If anything, the proposed Data Reform is designed to make the lives of businesses and organisations a little easier.
