The UK government introduced the Data Protection & Digital Information (No.2) Bill (the Bill) on 8 March 2023, withdrawing the Data Protection & Digital Information Bill that was introduced in June 2022, but paused. This client alert summarises the key issues and practical points for data controllers and data processors.

Will the Bill require compliance with both EU and UK regimes?

Post-Brexit, the Bill is intended to make the EU General Data Protection Regulation (GDPR) more practicable and less burdensome in lower-risk situations, while maintaining high data protection standards. It contains many clarifications and brings several GDPR recitals into the operative text. All being well, the legislative process will culminate in a new Act sometime in the next 12 months.

Multinationals with operations in both the UK and the EU/EEA will have to comply with the GDPR and are, in any event, likely to want to do so in most cases in order to simplify compliance and operational efficiency. At a conference on 8 March 2023, representatives from the UK government and data protection regulator, the Information Commissioner's Office (ICO), indicated that, generally, compliance with GDPR would be considered sufficient under UK privacy and data protection laws, even after the introduction of the Act. However, those doing business only in the UK and who do not plan to expand to the EU/EEA may find it easier to comply only with UK laws under the Bill when finalised, given the less onerous requirements that the new UK law will introduce in relation to certain matters. Multinationals may also choose to do the same in relation to their UK-only data processing activities.

What changes did the Bill make to the 2022 version?

The final Act could well be different again, as changes are possible during its legislative passage. With that in mind, the key areas which the Bill intends to address are likely to remain the same and are as follows ("added" means added by the March 2023 Bill):

• "Personal data" definition – various clarifications. Added: information may be "personal data" if it is not sufficiently protected via appropriate measures that mitigate the risk of unauthorised persons obtaining such information.
• Legitimate interests – reflecting Rec. 47, 48 and 49 GDPR by explicitly stating in the operative legislation that processing necessary for legitimate interests may include processing that is necessary for direct marketing (defined as the communication (by whatever means) of advertising or marketing material which is directed to particular individuals); intragroup transmissions necessary for internal administration; or processing necessary for the security of network and info systems. Also, there will be a new "recognised legitimate interests" legal basis for certain important public interests (like safeguarding vulnerable individuals), where no balancing test against individuals' rights will be necessary (i.e. certain processing is deemed to be in the controller's legitimate interests). The Secretary of State may update these by regulations, having regard to individuals' interests, rights and freedoms.
• Transfers of personal data (i.e. data exports) – a risk-based approach to adequacy decisions made by the UK, to be termed "approved" transfers, under a "data protection test" whereby the standard of protection in the receiving country is "not materially lower". Added: "grandfathering" (i.e. transfers valid under "old" laws to remain valid).
• Data Subject Access Requests (DSARs) – controllers may refuse a request or charge reasonable fees if the request is "vexatious or excessive" (cf. the GDPR's "manifestly unfounded or excessive").
• Purpose limitation – clarification on further processing for compatible purposes, including on determining what are compatible purposes (e.g. scientific research), and listing certain types of processing (mainly certain important public interests) deemed to be compatible. The Secretary of State may update the list by regulations where necessary to safeguard important public interests.
• Research – clarifications to facilitate research (e.g. that research can be "scientific" however funded and (added) whether conducted as a commercial or non-commercial activity, so far as it can "reasonably be described as scientific"). "Scientific" is not defined.
• Automated decision-making (ADM) – clarifications in relation to provisions that are notoriously difficult to interpret: prohibiting ADM (added: with no "meaningful human involvement") except under certain conditions, including safeguards enabling data subjects to obtain human intervention and to contest decisions. Clarified by the Bill: profiling alone is not ADM, but the extent to which the decision was reached by profiling must be considered in determining whether there was meaningful human involvement.
• Data Protection Officers (DPOs) – no DPO requirement, but a "senior responsible individual" (SRI), part of senior management, must be appointed for likely "high-risk" processing. No set criteria for what is high-risk here (cf. GDPR), but (added by the Bill) the ICO must publish examples of processing types it considers to be likely high-risk for this purpose. No sharing of an SRI between different public or private organisations/bodies (cf. GDPR), but an SRI can involve a job-share, and SRIs can secure other persons to perform SRI tasks.
• Data Protection Impact Assessments (DPIAs) – only required for likely high-risk processing. Again, there is no set criteria for what is high-risk here (cf. GDPR), but (added by the Bill) the ICO must publish examples of processing types it considers to be likely high-risk for this purpose. No explicit requirement to consult the SRI, but this seems implicit in the list of SRI tasks.
• Records of Processing Activities (ROPAs) – (changed by the Bill) only required for likely high-risk processing, regardless of organisational size (cf. GDPR's exemption, with exceptions, for small organisations). Again, (added) the ICO must publish examples of processing types it considers to be likely high-risk for this purpose.
• ePrivacy and "cookie law" – main changes (no further changes under the recent Bill):
  • Enforcement – fines to increase to GDPR levels and ICO powers to include assessment notices.
  • "Cookie law" including mobile apps – storage of/access to information to be permitted, with notice and opt-out rights, for service improvement analytics (although it is unclear to what extent third party analytics will be allowed), user preferences, security patching and emergency assistance. Certain matters are deemed "strictly necessary" (e.g. authenticating identity, preventing/detecting fraud or technical faults). Preference-management technology, to enable consent to be given or objection made automatically, may be recognised and permitted in the future under Secretary of State regulations.
  • Direct marketing – "soft opt-in" to be extended to political parties and non-commercial organisations such as NGOs/charities.
  • Automated telephone marketing – telcos must report to the ICO within 28 days (£1,000 fixed penalty for breach) any reasonable grounds for any person's suspected contraventions of direct marketing regulations when using their service. The ICO will be able to enforce against callers based on the number of calls generated (cf. only the number connected, currently).
• ICO – additional duties (e.g. having regard to the desirability of promoting innovation and competition); structural changes (Information Commission body); Secretary of State powers (e.g. to designate strategic priorities to which the ICO must have regard generally); and new ICO powers to require documents, reports (e.g. technical reports) and interviews, and to reject complaints under certain conditions (including no complaint to the controller first – new provisions specifically address complaints to controllers and their responses, and the Secretary of State could require reporting of complaints to the ICO).

Will the Bill prejudice UK adequacy under the GDPR?

The EU Commission could terminate, suspend or amend its adequacy decision allowing free transfers of personal data from the EEA to the UK, if it considers the UK no longer ensures an "adequate level of protection" for GDPR purposes, or allow this decision to expire in June 2025 without renewal. Many of the Bill's changes are meant to clarify ambiguities in the GDPR or simplify compliance in lower-risk situations, as opposed to changing the fundamental concepts and rights under the GDPR or lowering the level of protection. Furthermore, preserving adequacy is one of the UK government's stated priorities. Therefore, one would like to assume that the Commission will not revoke adequacy but, of course, it is for the Commission to decide on its actions when the Bill becomes law.

It should be noted that, if the EU Commission revokes its UK adequacy finding, this will not mean that organisations will no longer be able to transfer personal data from the EEA to the UK. They would rely on the EU Standard Contractual Clauses or the other mechanisms that organisations currently use to transfer their data to countries that are not "adequate" which, it should also be noted, is the vast majority of countries around the world. Nevertheless, if the Commission revokes UK adequacy, this will certainly introduce a degree of friction and additional work that exporting companies will need to carry out in order to transfer EU or UK personal data to the US.

What is the timing/deadlines?

The timing is difficult to predict, but it may be perhaps a year before the Bill becomes an Act (i.e. around March 2024). Then, most provisions will take effect only on the dates designated in Secretary of State regulations, to be made under the Act.

What are the key practical action points?

Organisations with UK operations should monitor the Bill's progress and consider what, if any, changes they wish to make when it becomes law. Given that such organisations are currently subject to GDPR, they will need to decide whether to change their practices when the Bill becomes an Act, or simply continue as before (i.e. complying with GDPR rather than UK standards). There are a few additional requirements under the Bill beyond GDPR, but they are not major (e.g. including, in privacy notices, information about the right to complain to controllers).

Assuming that the Act will maintain the key positions in the new Bill, it is reasonable to expect that many organisations will see the benefits for their UK-only data processing activities and that the more pragmatic approach that the Bill introduces should be welcome news for many organisations. Clarifications around legitimate interests, scientific research and automated decision-making are bound to make it easier for companies to explore the potential of new technologies and AI without worrying about the risk of technical non-compliance with rules that lack clarity. This provides more agility within the regulatory framework and can only be positive.

The reduction of formalities and paperwork is bound to improve efficiency and reduce compliance costs, while maintaining substantive levels of data protection. Businesses will still need to be clear about what data they process, data governance and how they comply with their obligations, but some of the bureaucratic burden is lessened. And surely, the ability to perform two of the most basic digital business functions (i.e. operating a website or an app, and sharing data with group companies in other regions), with legal certainty and without having to conduct expensive detailed legal analyses of complex legal areas (such as public authority access to data), where the real-world risk is limited to a small handful of circumstances, must be welcome news for everyone.

On the substantive data protection side, removing uncertainty around these basic business functions will enable organisations and the ICO to focus on areas that create real risk of harm to individuals, such as fraud, cybersecurity, inappropriate use of sensitive or children's data, or attempts to frustrate data subject rights. In that sense, it can be argued that the new UK Bill aims for at least as high a level of protection of personal data as the GDPR.

Please feel free to get in touch with Dentons' experts if you would like specific advice on the Bill. We will be publishing an update when it becomes law.