Reforms to UK Data Protection on the Horizon
We are all now well aware of the UK General Data Protection Regulations and the Data Protection Act 2018 and the overhaul to the outdated data protection regime that this legislation brought into place. However, a new bill is making its way through Parliament with the aim of further modernising the UK’s data protection regime and making the most of our post-Brexit freedoms with a focus on boosting the economy.
The aptly named Data Protection and Digital Information Bill was referred to in the King’s Speech which opened the new Parliamentary session in November 2023. The aim of the Bill is to build on the UK’s already high standard of data protection while at the same time reducing some of the impact the burden of the current legislation has on businesses.
As currently drafted, the Bill will amend provisions relating to data subject access requests under the UK GDPR. The Bill will permit a data controller to charge a reasonable fee for complying with a data subject access request, if such a request is “vexatious or excessive” rather than the current narrow drafting of “manifestly unfounded or excessive”. Examples of a ‘vexatious’ request could include ones that are made as an abuse of process, not in good faith or are intended to cause distress.
The express time limit to respond to a request “in any event within one month of receipt” is proposed to be replaced by “before the end of the applicable time period” at present the applicable time period is unknown but this appears to provide more flexibility in the time limits a data controller has to respond to such requests.
The Bill also proposes to make changes to the current grounds for lawful processing of personal data, along with introducing a new category of “recognised legitimate interests” for the processing of personal data for the purposes of crime investigation or prevention and safeguarding vulnerable individuals.
The Bill also aims to allow businesses to protect personal data in a more efficient and proportionate way than is currently required under the UK GDPR, cutting unnecessary red tape whilst still maintaining high levels of protection.
The powers of the Information Commissioner’s Office, the regulatory body for data protection in the UK will also be strengthened under the Bill to enable it to deal effectively with organisations that breach data protection rules and also to extend its powers to take action in relation to nuisance calls.
The Government’s mission is to achieve better data access and use, to grow our economy. This cannot be achieved without considering the impacts of Artificial Intelligence (AI). In the King’s speech, it was confirmed that the UK would “continue to lead international discussions to ensure that AI is developed safely”.
The Prime Minister, Rishi Sunak, also confirmed as part of the King’s Speech that AI is going to provide the opportunity to solve problems that we once thought were beyond our remit and whilst AI can be harnessed in a way that can provide untold benefits to the working world as we know it, we do need to acknowledge that this may also bring risks and dangers if AI is not utilised properly. AI remains a focus of the current Government and we are awaiting a regulatory roadmap to be published to set out how the Government plans to tackle AI in legislation going forwards.
The implementation date of the Bill is not currently known, and it is likely that the next general election could have an impact on the current drafting and any implementation date. It is important to note that we are in a general election year and the current draft Bill and points in the King’s Speech regarding AI reflect the current Government’s position on these matters, which may all be subject to change towards the end of the year.
We will continue to monitor progress of the Bill and any progress on the AI regulatory roadmap and share updates when these are available.
If you require any assistance in relation to any data protection matters in your business or would like to discuss what you need to be considering now in terms of AI in your organisation, or for any other employment law related queries, please get in touch with one of our Employment Law Team below who would be happy to assist.
Amy Hallam
Head of Employment
t: 0114 3496989
e: amy.hallam@brmlaw.co.uk
Ellie Leatherday
Associate
t: 01246 564002
e: ellie.leatherday@brmlaw.co.uk
Jade Taylor
Trainee Solicitor
t: 01246 560587
e: jade.taylor@brmlaw.co.uk
