What would reformed data law mean for the UK?

The government is considering reforming the UK data protection regime, with the aim of becoming more “innovation-friendly”. A consultation on changes will be launched in the coming weeks, according to the Department for Digital, Culture, Media and Sport (DCMS).

The consultation will look at changes to “break down barriers to innovative and responsible uses of data” and is expected to include the role of the Information Commissioner’s Office (ICO) as well as fewer cookie notifications on websites.

The announcement coincided with the naming of John Edwards, currently New Zealand’s privacy commissioner, as the government’s preferred candidate to take over from Elizabeth Denham as UK information commissioner later this year.

The government is also hoping to strike data adequacy deals with the US, Australia, South Korea, India, Brazil, Kenya and Indonesia, following a similar agreement with the European Union earlier this year. 

What do industry bodies think of the potential for changes to the UK General data protection regulation (gDPR)?

Camilla Ravazzolo, data and privacy counsel, Market Research Society
The DCMS initiatives very well fit the post-Brexit agenda, in the wake of driving growth and unlocking innovation intents, and they don't come as a surprise. It is time, though, that the focus switches from an analysis carried out against an EU background – and variable diversion from its data protection framework – or we’ll never stop dwelling on the past and dreaming what could have been.

Principles, ethics and protection of privacy and personal data as fundamental rights are not up for debate; what can be discussed are the new instruments and tools and frameworks to be adopted. Innovative thinking is welcome if fundamentals are respected. In this sense the nomination of John Edwards as commissioner is reassuring.

In actual day-to-day terms, what is left to be seen is how these new approaches will be translated and what it will mean for small- and micro- businesses, which have already undergone gargantuan work on GDPR compliance. May this not be in vain in the wake of a new framework.

John Mitchison, director of policy and compliance, Data & Marketing Association
The DMA, and many of the data privacy experts we work with, believe that it is interpretations of the GDPR that are restricting growth in the digital economy – not the GDPR itself. There is an opportunity for industry associations like the DMA, in partnership with the ICO, to establish industry codes of conduct across every sector of the economy.

Industry codes of conduct can help to apply current data protection legislation to achieve the government’s growth and innovation objectives set out in the National Data Strategy. This will help businesses to innovate while maintaining a high level of privacy protection, the degree necessary to build trust and consumer confidence in the modern digital economy.

The UK government should not risk the EU revoking our adequacy status when it provides so many benefits to businesses across Europe. If the UK government does plan to amend data protection laws then it must remain in consultation with the EU to ensure all parties are happy.

On the other hand, the EU must respect that there are other non-EU adequacy agreements in existence and so must be willing to negotiate its current position. This doesn’t necessarily mean going back to the drawing board, but there may need to be revisions at some point.

Konrad Shek, director of policy research, Advertising Association
Data underpins the digital economy and it is core to digital advertising. From that perspective, we welcome the UK government’s role in championing international data flows and striving to making the UK a centre for global trade and innovation. But we recognise achieving this aim and maintaining the UK’s high standard of data protection rights will be an extremely difficult balancing act.

Firstly, we must ensure that data protection rights are not unnecessarily eroded as maintaining public trust in a digital economy is paramount. Secondly, we hope that in pursuing this aim it does not put our data adequacy decision from the EU, that was only recently granted by the European Commission, at risk.

The EU is still by far the largest market for UK advertising. While divergence from the EU’s GDPR may lead to marginal gains elsewhere in the world, it could come at a great cost of additional compliance to do business with the EU.

Richard Lindsay, director of legal and public affairs, Institute of Practitioners in Advertising
The government’s recent announcement on its proposals for changes to the UK’s personal data regime should be encouraging for UK businesses. After the very real worries over whether the EU would grant adequacy to the UK for data transfers, the proposals will come as welcome news.

The government says that it wants to improve the UK’s data protection regime to make it even more ambitious and innovation-friendly while still being underpinned by secure and trustworthy privacy standards. That balance is crucial: UK businesses must be allowed to use data in innovative ways to help them grow and thrive, but within the confines of a sensible legal framework that protects individuals and does not stray too far from the existing high standards of the GDPR.