Earlier this month during the United Kingdom’s annual Queen’s Speech, the British government announced its plans to overhaul GDPR to “establish a new pro-growth and trusted data protection framework” designed to shift the emphasis of the UK’s data regime to become more ‘outcomes-focused’ and reduce burdens on UK businesses, allowing them to become more efficient and competitive”, among other goals.
The Bill follows the government's consultation on reforms to the UK data protection regime, conducted last year, the results of which are yet to be published. A key theme of the consultation was reducing the perceived burdens that businesses face under the existing data protection framework. This theme is continued in the government's announcement of the Bill. Its briefing states that the three main elements are:
- ensuring that UK citizens' personal data is protected to a gold standard, while enabling public bodies to share data to improve the delivery of services;
- using data and reforming regulations to improve the everyday lives of people in the UK, for example, by enabling data to be shared more efficiently between public bodies; and
- designing a more flexible, outcomes-focused approach to data protection which helps create a culture of data protection, rather than 'tick box' exercises
What this means in essence is that it shows the beginnings of a divergence between regulation in the UK and the EU, which until now was exactly aligned via GDPR. The perception in the EU is that despite promising a ‘gold standard’ when it comes to data privacy, the implications of removing bureaucratic and administrative burdens from businesses is in effect a divergence which cannot be ignored.
Currently, the European Commission has made an adequacy decision in respect of the UK which allows data to flow freely between the UK and EU member states, however, this may be revoked if the Commission determines that the UK's level of protection of personal data falls below that offered to EU citizens. The EU is due to review the adequacy decision in 2024, but has indicated that this review may come sooner if the UK's data protection regime starts to differ significantly from that in the EU.
Perhaps ironically, after years of playing catchup with data regulations, businesses may still find that they incur cost as a result of this change in approach.
While the speech was light on detail on what to expect, the briefing did not refer to changes to the rules around artificial intelligence or the use of cookies on websites, both of which have previously been expected to be key areas for reform.
In any case, a draft Data Reform Bill is expected to be published later this summer, so make sure to up to our newsletter now in order to keep up to date with this story.