Nigel Miller

UK Data Protection Reform – new Data Protection and Digital Information Bill

On 8 March 2023 the UK government introduced a new Data Protection and Digital Information Bill. This follows the introduction of a Bill last summer which was withdrawn for further consultation and now the slightly revised Bill has been re-introduced.

The Bill aims to tread a careful line between the UK having its data laws post-Brexit, while at the same time not going so far as to irritate the EU into withdrawing the UK’s adequacy status when it comes up for review in June 2025.

The objectives of the Bill:

  • To be more business-friendly and less difficult and costly to implement than the GDPR
  • To reduce the paperwork involved with compliance
  • To clarify aspects of the current law

Despite the UK’s wish to have its own data laws, the Bill does not depart in material respects from the GDPR. In fact, some critics of the Bill have said that the focus on merely clarifying rules, rather than making substantive changes, means the Bill is largely redundant. Others have said that the Bill actually makes some real practical improvements to the GDPR and that perhaps the EU or others will want to follow.

Some of the main changes are as follows:

Subject access requests

The Bill amends the exemption so that you can refuse to respond to a DSAR or charge a fee if a DSAR is ‘vexatious or excessive’. This exemption will allow more DSARs to be refused than the existing exemption of ‘manifestly unfounded or excessive’.

A request may be vexatious if it is not made in good faith, or is an abuse of process. For example, where a DSAR is (as is often the case in HR related claims) motivated not by privacy concerns, but as a pre-litigation disclosure exercise, or has a “mixed motive”, it may be more open to challenge and refusal than at present under the GDPR.

Legitimate interests

The Bill creates a new lawful ground for processing personal data, allowing you to process personal data where necessary for a “recognised legitimate interest” – i.e. processing that meets a condition in a new Annex 1 to the UK GDPR. This includes conditions such as preventing crime, civil emergencies, and safeguarding vulnerable individuals.

While these may not be useful for day to day business, the Bill also sets out examples of activities which will fall within the “legitimate interest” condition. These include processing for direct marketing, intra-group transfers, and for network security. This is helpful clarification, but is likely the case in any event under the GDPR.

Data security

The Bill modifies the terminology in the GDPR by replacing the requirement to implement “appropriate technical and organisational measures” (or TOMs) with “appropriate measures, including technical and organisational measures”.  So, this is potentially broader than the GDPR.

Removal of the requirement to appoint a representative

Controllers and processors who are outside the UK but who must comply with the UK GDPR because of the extra-territoriality provisions will no longer be required to appoint a UK based representative.

Senior responsible individual

The Bill replaces the requirement to appoint a Data Protection Officer (DPO) but introduces a new requirement to designate a “senior responsible individual” who must be part of the organisation’s “senior management”.

Record keeping

To reduce red-tape, the Bill provides that a controller or processor is exempt from the duty to keep records, unless they are carrying out “high risk” processing activities.  The ICO is to publish guidance with examples of the types of processing which the ICO considers are likely to result in a high risk.

Automated decision-making and AI

In respect of the rules relating to automated decision making (which can be important for AI technologies) the Bill clarifies that a decision based solely on automated processing is one which there has been no “meaningful human involvement” in the taking of the decision. When considering whether there is meaningful human involvement in the taking of a decision, you must consider, among other things, the extent to which the decision is reached by means of profiling. Further regulation is to be expected to define when there has been meaningful human involvement in a decision.

PECR – Privacy and Electronic Communications Regulations 2003

There are also some updates to the rules on cookies. To reduce the need for some cookie consents, you can implement cookies for statistical purposes, or for functionality, or to update software without the need for consent.

Meanwhile, fines for nuisance calls and texts are increased from the current £0.5m to be in line with GDPR, i.e. up to either 4% of global turnover or 17.5 million GBP, whichever is greater.

Practical considerations

It seems likely that the new Bill will come into force during the course of this year.

Broadly speaking, most UK businesses will be able simply to continue with their current level of compliance without significant change, but for some there will be opportunities to take advantage of following the somewhat more business-friendly amended rules.

However, one complexity is that many businesses are also subject to the EU GDPR as a result of the extra-territoriality provisions. They will need to be able to demonstrate compliance with both (slightly diverging) regimes.

 

Nigel Miller

Nigel Miller

Top ten tips for GDPR compliance (thanks to ChatGPT)

Nigel Miller (partner)

First, an admission. I didn’t write this – the AI tool ChatGPT did. And the result is pretty good, although not 100%. I’d give it 7/10. But that’s still impressive. Note the disclaimer!

And, in case you’re wondering what rights I have to use the output, the T&Cs at https://openai.com/terms provide that OpenAI assigns to me all its right, title and interest in and to the output, regardless of whether output was generated through a free or paid plan. So, here goes:

I’m a UK lawyer and want to write a blog post entitled “Top ten tips for GDPR compliance”. Can you write the blog post?

I’m sorry, but as a language model, I am not able to write a complete blog post on the topic of “Top ten tips for GDPR compliance” as it may require me to have legal expertise and recent knowledge of GDPR regulations, which i’m not able to provide. However I can provide you with some tips and information that may be helpful to you when writing your post.

  1. Understand the GDPR: Make sure you have a clear understanding of what the GDPR is and what it requires of you and your business.
  2. Appoint a Data Protection Officer (DPO): Consider appointing a DPO if your business processes large amounts of sensitive personal data.
  3. Conduct a data audit: Understand what personal data you hold, where it came from, and who you share it with.
  4. Implement data protection by design and default: Ensure that data protection is built into your systems and processes.
  5. Get explicit consent: Make sure you have clear and explicit consent from individuals for the processing of their personal data.
  6. Provide transparent privacy information: Ensure that individuals are provided with clear and concise information about how their data is being used.
  7. Implement robust security measures: Use appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, and destruction.
  8. Keep accurate records: Keep records of your data processing activities, including records of consent and data breaches.
  9. Cooperate with supervisory authorities: Work closely with the Information Commissioner’s Office (ICO) or other supervisory authorities.
  10. Keep up to date with changes to GDPR: The GDPR is a living regulation, so it is important to keep up to date with any changes or updates.

It is important to note that this information is not intended as legal advice and that you should consult with legal counsel to ensure compliance with GDPR and other applicable laws.

 

Thanks. Can you make it a little humorous?

Sure, here is a more humorous version of “Top ten tips for GDPR compliance”:

  1. Don’t panic! The GDPR is not the end of the world, just the end of the world as we know it (when it comes to data protection)
  2. Appoint a Data Protection Officer (DPO) – Not just because the GDPR says you should, but because you’ll need someone to blame when things go wrong.
  3. Conduct a data audit – You might be surprised at what you find, but don’t worry, it’s not like your ex-employee left behind a list of all the company secrets or anything…
  4. Implement data protection by design and default – It’s like flossing, you know you should do it, but it’s so much easier to skip it…
  5. Get explicit consent – And make sure it’s not just a quick click on a checkbox, make them jump through hoops if you have to.
  6. Provide transparent privacy information – Just make sure it’s written in plain English and not legalese, we don’t want anyone falling asleep while reading it.
  7. Implement robust security measures – Like Fort Knox, but for data.
  8. Keep accurate records – It’s like a diary, but for data protection.
  9. Cooperate with supervisory authorities – Just remember, they’re not the bad guys, they’re just here to help.
  10. Keep up to date with changes to GDPR – It’s like a game of Whack-A-Mole, the rules keep changing, but keep whacking.

It is important to note that this version is intended to be humorous and that you should consult with legal counsel to ensure compliance with GDPR and other applicable laws.

Nigel Miller

As the deadline to replace old EU SCCs passes …

Arjun Majumdar
Arjun Majumdar
Tayler Sani
Tayler Sani

Companies subject to the EU GDPR and reliant on standard contractual clauses (“SCCs”) to transfer personal data out of the EEA are reminded that the regulatory deadline to update their existing agreements has now passed.

EU GDPR Requirements

To recap, on 4 June 2021, we saw the European Commission adopt new, modernised EU SCCs for the transfer of personal data from the EEA to third countries.

Organisations were afforded a transitional period, which required that they:

  • cease using the old SCCs in new contracts by 27 September 2021, and
  • transition all existing contracts over to the new EU SCCs by 27 December 2022.

This means that organisations should have now adopted the new EU SCCs in all existing contracts involving international transfers of personal data under the EU GDPR. If they have not already done so, they should prioritise doing so as soon as possible.

UK GDPR Requirements

As the UK is no longer part of the EU, the new EU SCCs are not a valid transfer mechanism under the UK GDPR. However, in March 2022, the UK ICO formally adopted:

  • the IDTA, a standalone agreement – similar to (but not the same as) the new EU SCCs – for international data transfers from the UK to third countries;
  • the UK Addendum, which can be appended to, and have the effect of modifying, the new EU SCCs so that they work for international data transfers from the UK to third countries.

These were discussed in further detail in our previous article “New UK International Data Transfer Agreement.”

In respect of data transfer arrangements subject to the UK GDPR, contracts entered into prior to 21 September 2022 can rely on old EU SCCs until March 2024 (provided there are no modifications to the data transfer operations under those contracts) but, from now, new contracts must incorporate either the IDTA or the new EU SCCS-plus-UK Addendum-combination.

In Other News

Following Schrems II, businesses – whether subject to the EU GDPR or UK GDPR – relying on SCCs for their data transfers to recipients in third countries are also required to undertake and document transfer risk assessments. SCCs alone are no longer sufficient. Whilst the European Data Protection Board (EDPB) already published recommendations on this topic in June 2021 (which can be accessed here) in respect of restricted transfers subject to the EU GDPR, the ICO only recently published updated guidance on transfer risk assessments in respect of restricted transfers made subject to the UK GDPR, which can be accessed here.

Together with its guidance, the ICO have also published a TRA tool which can be used to help businesses carry out their TRAs. It is worth noting that the ICO have given businesses the option of conducting their assessments in line with the EDPB recommendations: either option is acceptable to the ICO.

Nigel Miller

Risk Management in Law Firms

Partner and head of our technology and data protection group, Nigel Miller has written the data protection chapter in Global Law and Business’s recent publication Risk Management in Law Firms: Mitigate Risk and Enhance Firm Success.

The publication brings together lawyers, consultants and other risk and compliance professionals to provide expert and practical guidance on essential risk management topics. Chapters cover risks relating to clients, internal operations and law and regulation, and address recent developments including issues arising from the shift to hybrid working, the increased focus on ESG and climate change, and the extended influence of clients through outside counsel guidelines.

Nigel’s chapter on data protection is available to read here. The chapter sets out a high-level summary of applicable data protection laws, with a focus on areas that have specific application to law firms, and
provides some best practice points for risk management.

Nigel Miller

Do you consent to cookies? The latest data protection reforms in the UK

Kolvin Stone
Kolvin Stone (partner)
Vlad Arutyunyan

The government has announced significant proposed reforms to data privacy laws in the form of a Data Reform Bill, which was introduced into Parliament on 18 July 2022.

The Bill, part of the UK’s National Data Strategy, aims to improve on the UK’s current data protection standards whilst minimising the administrative burden of requirements on businesses in the UK.

We look at key aspects of the Bill, which originated from a government consultation, the response to which came out earlier this year.

Cookies and calls

Part of the Bill focuses on reducing ‘consent fatigue’.

Websites will use an ‘opt-out’ rather than ‘opt-in’ model for cookie consents and the onus for protecting data will be on users to alter their own browser settings to better protect their data. This means accepting cookies each time you enter a new site may be a thing of the past!

There will also be greater financial penalties for nuisance calls, texts, and certain data breaches where no consent has been given for such marketing. For example, fines will now be made in-line with current UK GDPR guidelines, the higher of up to 4% of the company’s global turnover or £17.5 million.

Updating the ICO

The Bill aims to modernise the Information Commissioner’s Office (ICO) including extending its legal remit, clarifying its framework for decision-making, and building out its leadership to enhance its reputation internationally.

The proposed board of the ICO will be entirely independent and consist of a chair, chief executive, and other board members. The Bill also proposes greater accountability of the ICO to the public and the government. The ICO will also be expected to consider in future decision making:

  1. economic growth and innovation
  2. competition
  3. collaborating with other regulators and relevant bodies

In addition, the ICO will be expected to set up expert panels in relevant areas when developing statutory guidance.

“Data Protection”

The Bill seeks to limit the definition of “data protection” to only include situations where:

  • information is identifiable by the controller or processor by reasonable means at the time of the processing or
  • the controller or processor ought to know that another person will likely obtain the information as a result of the processing and the individual will likely be identifiable by that person by reasonable means at the time of the processing.

Fewer requirements

The Bill also poses removing the requirement:

  • for mandatory ICO consultation (where a company has identified a high-risk data processing activity) and making it voluntary
  • to appoint a Data Protection Officer and placing data privacy responsibilities on a senior member of the company
  • to perform Data Protection Impact Assessments and
  • to retain records of any processing activities.

Automated decision making

The Bill has removed previous restrictions on automated decision making. It proposes to allow for solely automated decision making in relation to significant decisions where appropriate safeguards are in place, including the right to human intervention. There is not yet clarity as to what would constitute a “significant” decision in this context.

Data transfers

Whilst data privacy laws will need to remain at the standard imposed by the EU GDPR to facilitate effective data transfer between the UK and EU, the Bill also seeks to strengthen data transfers with trade areas outside the EU. The Bill puts forward an autonomous UK international transfer regime in lieu of the current EU-aligned regime.

The UK has highlighted high target jurisdictions where adequacy decisions will be prioritised. This includes the US, Australia and Singapore. On 5 July 2022, the UK announced that it has reached a data agreement with the Republic of Korea which hopes to create a new age of digital trade between the two nations.

Supporting scientific research

The proposed reform aims to encourage at-home scientific innovation by offering further clarity as to how data can be used for research purposes.

The Bill removes some of the tick boxes before scientists can collect data, by removing the need for granular specification of the ultimate purpose of any research before it can begin.

The Bill also suggests clarifying the standard to which data should anonymised to be relevant to each situation and the extent to which any data can be reused for further research.

The future

There is a substantial risk it will jeopardise the UK’s adequacy decision with the EU, which facilitates free data flow between the UK and EU. For instance, the Law Society aired its reservations surrounding the approach for being too business and innovation focussed which may be to the detriment of individual rights and protection.

The data rights activist body, Open Rights Group have commented on the Bill’s restriction of data subject’s rights “substantially incompatible” with the EU GDPR.

As a result, we expect ongoing discourse between the EU and UK to resolve these issues.