The UK Government recently published its long-awaited response to its data reform consultation, ‘Data: A new direction’ (see our post on the consultation, here).
As many readers are aware, following Brexit, the UK Government has to walk a fine line between trying to reduce the compliance burden on organizations and retaining the ‘adequacy’ status that the European Commission granted in 2021 (see our post on the decision, here).
While we’ll have to wait to review the detail of the final legislation, we outline below some of the more eye-catching proposals for reform.
1. Scrapping certain cookie consent requirements but increasing fines
The most obvious headline-grabber is the decision to scrap the requirement under the UK Privacy and Electronic Communications Regulations (“PECR”) for organizations to obtain the consent of UK residents when placing non-essential cookies on their devices.
The consultation response indicates that in the short term, the consent requirement will be removed for cookies used for a small number of “non-intrusive purposes” (including web analytics cookies). In the (indefinite) long-term, the Government indicates that it intends to remove the opt-in consent requirement entirely, and move to an opt-out model, but the impact of this may be limited. The Government has clarified that it will only happen when alternative solutions—such as browser-based solutions—are available, and the opt-out model will not apply to sites subject to the Age-Appropriate Design Code. The ongoing deprecation of third-party cookies for targeted advertising may also mean that the move to an opt-out model has a more limited practical impact.
Although the Government plans to relax some of the current cookie consent requirements, it will amend the powers of the ICO to grant it the same enforcement powers for infringements of PECR (which regulates cookies and direct marketing) as the GDPR. This includes allowing the ICO to serve assessment notices and increase the maximum fines available under PECR to the higher of £17.5m or 4% of an organization’s global turnover.
2. Granting controllers more scope to reject data subjects’ rights requests
The Government rowed back on its proposal to re-introduce fees for providing responses to data subjects’ rights requests in all cases. That said, it will proceed with proposals to amend Article 12(5) GDPR, which only permits controllers to refuse to act on a data subject access request or charge a reasonable fee where the request is “manifestly unfounded or excessive”. Going forward, controllers will be able to reject requests or charge fees where they are “vexatious or excessive”—this will bring the regime in line with that set out in the Freedom of Information Act (FOIA). This is a lower standard than is set out in the GDPR, but does not mean that controllers will be able to reject data subjects’ requests out of hand—it requires a case-by-case assessment of whether the request would create an unjustified or disproportionate level of disruption, irritation or distress. Importantly, though, it may allow controllers to take account of all the circumstances, including the motivation for the request.
3. Establishing use cases where companies do not need to conduct a balancing test when relying on legitimate interests
Organizations have expressed concerns that conducting a balancing test when relying on legitimate interests to process personal data (i.e., determining whether their legitimate interests outweigh the rights of data subjects) takes significant time and effort. In response, the Government has announced that it will create a limited list of processing activities for which organizations can rely on the legitimate interests legal basis under Article 6(1)(f) GDPR without conducting a detailed balancing test (provided that they can comply with the other obligations set out in the GDPR). The full list remains to be seen, but the consultation response indicates it is likely to include processing activities carried out to prevent crime, or that are necessary for other important reasons of public interest.
4. Expanding the scope to use personal data for scientific research
The Government aims to ensure that UK data protection legislation permits and even encourages companies and research institutions to use personal data for scientific research. It will make a number of changes to try to clarify the rules, including introducing a statutory definition of “scientific research”, and making clearer the circumstances in which data can be used (and re-used) for scientific research purposes. The Government will not, however, introduce a new legal basis explicitly covering scientific research, as it proposed in the original consultation.
5. Removing specific accountability requirements
Whilst the Government recognizes the importance of accountability as a fundamental principle under the GDPR, it is of the view that the ‘one size fits all’ approach places a disproportionate burden on SMEs.
Therefore, the Government intends to remove specific requirements to:
- appoint a data protection officer (Articles 37-39 GDPR);
- carry out data protection impact assessments (“DPIA”) (Article 35 GDPR); and
- maintain records of processing activities (“ROPs”) (Article 30 GDPR).
In its place, the Government will introduce a requirement for companies to have a ‘privacy management programme’. The aim is to allow companies to tailor their accountability programs more specifically to the processing they carry out. Among other things, the consultation response indicates such a programme might include the appointment of a suitable “senior individual” with responsibility for the programme, and implementing or leveraging existing risk management tools to help assess, identify, and mitigate privacy risks. In practice, the impact for many companies may be limited as the consultation response clarifies that existing ROPs and DPIAs can be leveraged as part of the programme.
6. Permitting use of sensitive data for monitoring and correcting bias in AI systems
The Government published its National AI Strategy (available here) in September 2021, where it outlined its intention to make the UK an AI superpower. As part of this, the Government will permit organizations to process sensitive personal data to monitor and correct bias in AI technologies, subject to specific safeguards (e.g., limitations on re-use of this data).
7. Lowering the threshold for data to be “anonymized”
The Government proposes changes to what constitutes “anonymized” data. The GDPR sets a particularly high bar, requiring companies to process data in a way that means the data subject is no longer identifiable using any means reasonably available, and arguably requiring them to revisit anonymized datasets over time to confirm that the anonymization measures still meet this standard. The Government intends to lower this bar, and will require organizations to take account of whether an individual is identifiable through “reasonable means” available to them at the time of the anonymization, or whether the controller or processor knows, or ought reasonably to know that passing personal data on to another controller or processor is likely to result in re-identification. The Government response does not mention the ICO’s open consultation on anonymization in this section, so it appears that these changes will supersede the forthcoming ICO guidance.
8. Changes to the ICO
In addition to these substantive changes, the Government plans to restructure the ICO to bring it in line with other regulators. The ICO is currently a “corporation sole”—an incorporated entity represented by a single individual: the Information Commissioner. Under the Government’s proposals, the ICO would be renamed and have a Chair, a CEO, and a Board of Directors, and be subject to a Statutory Statement of Purposes set by Parliament. The Government will also require the ICO to take account of competition, economic growth, and innovation when carrying out its duties.
These proposals were controversial during the consultation process, and many campaigners argued that this would undermine the independence of the ICO. Such independence is a key requirement for receiving an adequacy decision from the EU.
The Government is expected to introduce legislation to enact these reforms during the current parliamentary session which ends in April 2023.
* * *
Covington’s Data Privacy and Cybersecurity team has extensive experience in advising on UK data privacy laws and is well positioned to provide advice or answer any questions you may have on the impact of the UK Government’s data reforms on your organization.