Government announces more details of data protection bill


Posted on 8th August 2017
On 7 August the government published a ‘Statement of Intent’ in relation to the new Data Protection Bill.  The announcement attracted widespread positive media coverage, concentrating on new rights for individuals, such as a “right to be forgotten”, and new penalties for organisations that get it wrong.  But hang on, isn’t this all very familiar stuff from the General Data Protection Regulation?

To understand the context, you may remember that hidden away between the various Brexit bills in the Queen’s speech earlier this summer, a new Data Protection Bill was announced. For data protection practitioners, this was very welcome news.  Although we’ve all been working hard preparing for the GDPR, which will apply from 25 May 2018, the GDPR is only one (albeit very important) piece of the data protection jigsaw.  Reflecting the differences between the 28 EU member states, spread throughout the GDPR there are ‘derogations’, or areas where national law may depart from the GDPR text. This includes some pretty significant areas, such as criminal offences and exemptions. There is also the matter of the Law Enforcement Directive, which needs to be implemented into UK law by next May.

The new announcement fills in some, but not all, of these gaps.  For instance, we now know that many of the exemptions under the Data Protection Act will be retained under the new regime, including those for journalism and for research purposes. Most practitioners had been working on this assumption, but the confirmation is welcome. As well as retaining and expanding the existing ‘section 55’ criminal offence (for unlawfully obtaining or disclosing personal data), the government proposes new criminal offences for intentionally or recklessly re-identifying anonymised data, and for altering records to prevent disclosure under subject access rules.  The government has also confirmed that the age at which children may consent to information society services will be set, as expected, at 13.

But this is a statement of intent, not a draft bill, and so we will have to wait until next month before the full bill is published. Although the government does not command a parliamentary majority, it is likely that these measures will have cross-party support.

Perhaps more significant than the specifics is the tone of the announcement. The government is talking about data protection reform as a positive change to empower individuals, rather than as a damaging cost to organisations, and there is a strong emphasis on maintaining cross-border data flows. In the uncertain world of impending Brexit, that is something to be welcomed.

Enjoy That? You Might Like These:


4 July
Leading law firm Blake Morgan has announced 11 promotions in Wales, recognising the talent, hard work, and dedication of its people across both legal and business support roles. This news... Read More
1 July
Leading law firm Blake Morgan has announced a raft of new summer promotions, recognising the excellent work of its employees over the past year, and the exceptional service they provide... Read More
19 June
Blake Morgan’s family lawyers have been recognised for their excellence in the latest Doyle’s Guide. Read More