What does the Data Protection and Digital Information Bill mean for UK industry?

The Data Protection and Digital Information (DPDI) Bill is the first major piece of data protection legislation since the UK left the European Union (EU) four years ago.  Instead of completely replacing existing legislation, the DPDI bill revises the UK’s existing data protection regime.

For many years, the UK’s data protection regime was aligned with that of the European Union. In 2016, the General Data Protection Regulation (GDPR) was published, which was a major change in data protection policy for the European Union, which had not been updated for nearly two decades. GDPR was enacted into UK law as a raft of data protection policies, most notably the Data Protection Act 2018. The GDPR has gone on to become the de-facto standard for data protection around the world.

Leaving the EU meant that the UK was no longer part of the EU’s data protection regime. However, as the UK’s data protection legislation aligned with the EU’s, it was straightforward for the UK to gain a data adequacy agreement, which is essential for EU-based organisations to freely share data with those outside the EU.

It has been two years since the DPDI bill was first laid before Parliament in 2022, and it is currently at the committee stage in the House of Lords.

Any changes to the UK’s data protection policies will be scrutinised by the European Commission to confirm whether the data adequacy agreement remains valid. The EU has already questioned the UK regarding the intrusive nature of the Investigatory Powers Act 2016.

The DPDI bill introduces a regulatory framework for online identification, called digital verification services, but without any legal requirement for the enforcement of online IDs. While the UK’s core data protection policies remain roughly in line with the EU’s, the DPDI loosens some of the regulatory elements. However, this is only applicable to those organisations that are not operating within the EU.

“If you have a business that also has operations in the EU, then you’ve effectively got two regimes now, which were the same, but are now starting to start to diverge in certain areas,” says Daniel Tozer, a partner specialising in a technology and data law for Keystone Law.

One of the proposed changes is the removal of the requirement for data protection impact assessments. Instead, organisations will be expected to carry out assessments for high-risk processing.

“You will still need to do assessments, where there’s high-risk processing of data involved, but there will be more flexibility as to how to do them. You won’t need to follow specific templates or requirements,” says Anthony Lee, a partner specialising in information technology for Gunnercooke. “Many businesses are going to see that as a good thing as it will reduce the compliance burden.”

One of the core changes is that the DPDI bill removes the need for a data protection officer (DPO). Instead, the duties of the DPO can be assigned to that of a senior responsible individual, such as a chief information officer (CIO) or chief marketing officer (CMO).

The potential to remove the DPO has both positive and negative impacts. Currently, the DPO is an independent figure within the executive team who is responsible for ensuring the appropriate data protection policies are followed. However, in most cases, data protection authorities will want to speak to the people responsible for processing data, such as the aforementioned chief information officer, so combining the roles makes sense.

“The whole purpose of the senior responsible individual is that it should be somebody who’s making the decisions, for example, about how to use a marketing list or what datasets to use for analytics,” says Tozer. “These are the people who say yes or no to those things, so you can understand why, from that position, they are the person that the ICO wants to be able to talk to.”

However, there is also the argument that combining the roles of a DPO with that of a CIO or CMO could lead to conflicts of interest. Even if the duties of the senior responsible individual were delegated, there would be a conflict between wanting to maximise usability of data and ensuring full adherence to data protection policies.

The DPDI has loosened some of the data protection policies regarding automated data processing without the data subject’s consent, provided it has no meaningful impact upon the subject themselves.

The DPDI bill would also replace the Information Commissioner’s Office (ICO) with the Information Commission. While the public body would lose some of its independence and neutrality, due to the chief commissioner being assigned by the secretary of state, it would also have increased powers and be able to assign greater fines for data breaches and failures to follow data protection regulations.

In the current draft of the DPDI bill, much of the wording regarding the changes is not as clear as it could have been. The use of subjective terminology leaves some ambiguity in a number of areas around what would and would not be permissible regarding data processing within the UK.

“We can expect test cases to appear quickly in the UK courts. The ICO will likely be particularly hot on automated decision-making, because many businesses use some form of automated decision-making in their practices,” says Tozer.