Technology minister Michelle Donelan defends data reforms

Reactions to the bill

Although the full effects of the bill in practice are yet to be understood, as the full text was only published 8 March, reactions so far have been mixed.

Alistair Dent, chief strategy officer at data science consultancy Profusion, said there was a lot to like in the announcement of the bill, particularly around the certainty it will provide for British businesses.

However, he noted that a key issue is whether the bill will live up to its goal of ensuring businesses can continue sending personal data overseas via existing international transfer mechanisms.

“This is very important to UK businesses, as failure to make it compatible with, for example, GDPR, will mean that companies which deal with EU citizen’s data will have to comply with both sets of legislation – which will significantly increase costs,” he said.

“This bill is obviously at a very early stage and there’s a lot of areas that still need clarification – not least how it will be adequately enforced. We must remember that, despite its flaws, GDPR has really helped to improve online privacy and increase accountability for businesses. The government is very keen to be seen to be cutting red tape and using ‘common sense’ in its rule making, but this must not come at the expense of protecting people online.”

Georgina Graham, a data and technology lawyer at law firm Osborne Clark, said: “Businesses will be pleased to see the new measures designed to reduce paperwork and increase flexibility around compliance – for example, records of processing have turned into an administrative burden for many businesses, so this proposed change might genuinely save businesses time and costs. Conversely, consumers will likely be pleased to see the increase in fines for nuisance calls and texts.”

She added that, with the EU-UK data adequacy decision scheduled for review in 2024, “the UK government will need to be mindful of the risks involved in diverging too far from the EU GDPR” if it wants businesses to continue sending data to Europe.

Commenting on the bill at the same IAPP event but on a different panel, former information commissioner Elizabeth Denham said: “The UK is walking that very fine line to make sure that we retain adequacy, and that’s what businesses in the UK want.”

She added, however, that she does not think the changes to the UK data protection regime are substantive, and would rather see the UK join other countries outside the EU with “full throated support for a new way” for regulating data protection.

During the same panel, Max Schrems, an Austrian lawyer who has been challenging the legality of various international data transfer mechanisms since the early 2010s, said the UK’s data reforms mean the country is no longer relevant from a European perspective when challenging poor data protection practices.

“If we go after a company, we’ll go after a UK company in Europe, we will go directly to Europe, it just is not relevant anymore from a litigation perspective,” he said.

Michael Queenan, co-founder and CEO of UK data company Nephos Technologies, said the UK government has “decided to sell-out personal data privacy for business benefit and innovation” with the bill.

“When you remove regulations, compliance becomes cheaper, but at what expense? This needs to be collectively addressed to genuinely encourage business growth, drive innovation and protect our data,” he said.

“The new DSIT in principle is a good step, but it has its work cut out. Currently, promises are being made without adequate funding or tools to deliver. Besides, anyone who trades with other countries, including EU countries, will still have to comply with their data laws to be able to use the data of citizens from that country so I don’t really know how they can claim it makes international trade easier.”