New law: Government proposes significant changes to UK data protection laws

Proposals, still subject to confirmation, include:

• Changing the rules to enable better digital innovation in Artificial Intelligence, science research and other key areas.
• Reducing compliance requirements – for example, current record-keeping obligations, the need to carry out Data Protection Impact Assessments, and the obtaining of consents to use of cookies. The proposals also include changes to the scheme under which individuals can request copies of data held on them – the ‘data subject access request’ scheme.
• Making it easier to send individuals’ personal data abroad, and vice versa.
• Allowing government departments to share personal data if it is to improve delivery of their services.
• Changing the role and powers of the Information Commissioner’s Office.

If the changes are sufficiently different from EU obligations, the current recognition by the EU of the UK rules as ‘adequate’, which allows data to flow freely between the UK and EEA member states may end. UK businesses which operate in both will need to comply with both regimes.

Operative date

• To be announced

Recommendations

• Organisations should monitor the government proposals, and start planning and costing changes needed as the new rules become clearer.
• Organisations can find out more about the government’s recent data protection consultation on the GOV.UK website.