Search PillsburyLaw.com
  • All
  • Lawyers
  • Capabilities
  • Insights

Alert

UK Announces Post-Brexit Data Reform Bill

Does this signal the beginning of the end of the GDPR in the UK or simply a reframing of approach?

By Mark Booth

Alert

By Mark Booth

Takeaways

The UK Government has announced a new Data Reform Bill, part of a series of legislative changes aimed at obtaining a “Brexit dividend.”
The new Bill builds on proposals made by the Department for Digital, Culture, Media and Sport in its 2021 consultation: “Data: a new direction.”
The draft of the proposed Bill has not yet been published, but any deviation from current practices will need to be carefully considered to mitigate any risks to the UK’s data laws adequacy status with the EU.

05.20.22

Businesses have invested significant time, money and effort into creating and administering comprehensive GDPR compliance frameworks. The announcement from the UK this past week may therefore leave some feeling nervous. However, the proposed Data Reform Bill can be seen as another helpful prompt for businesses to review and update their policies and procedures (particularly if a comprehensive review has not been undertaken since last year).

The UK Government hopes that the Data Reform Bill will reduce the burdens faced by businesses operating in the UK or targeting UK individuals, moving to an approach that is outcome-focused rather than “box-ticking,” thereby increasing the competitiveness and efficiency of UK businesses.

In particular, the Bill seeks to:

  1. Modernize the UK’s privacy regulator, the Information Commissioner’s Office, and empower it to take stronger actions against organizations;
  2. Give citizens and small businesses more control of their data through Smart Data Schemes; and
  3. Enable data to be shared more efficiently between public bodies.

The Government has emphasized that the changes should not diminish the protection of personal data in the UK, for which it seeks to retain a “gold standard.” Any significant deviation from current practices would, however, alarm businesses that have had to put in significant effort to comply with GDPR and also risk the UK losing its “adequate” status, which currently allows for personal data to flow uninhibited between the UK and the EU.

More details will no doubt become clear as the results of the DCMS consultation and the text of the Data Reform Bill are published.

UK proposals to “reboot” data laws and the enforcer’s powers will cause both excitement and concern for businesses. A reduction of “red tape” will be welcomed, but any need for different policies, processes and compliance steps will pose a potential burden for international businesses, as would the loss of UK adequacy status.

The Data Reform Bill must still proceed through the UK legislative process. Businesses are advised to monitor the latest developments and consider now how this will impact their current business activities, data protection policies and procedures.

Tags
Cybersecurity, Data Protection & Privacy
These and any accompanying materials are not legal advice, are not a complete summary of the subject matter, and are subject to the terms of use found at: https://www.pillsburylaw.com/en/terms-of-use.html. We recommend that you obtain separate legal advice.