Following Liz Truss winning the Conservative Party’s internal contest to become the U.K.’s new Prime Minister much debate surrounds the policies the new right-wing leader will seek to implement.
One such key policy is data privacy, with the Data Reform Bill set to replace the European Union’s General Data Protection Regulation (GDPR) regulations in the U.K. This is being considered so that the U.K. can distance itself from European regulations, as part of its variable post-Brexit strategy, and to partly create a more business-centric environment.
While the law is drafted, under the Johnson administration, it may be subject to change. Under Truss’ new cabinet, how will the proposed Bill be amended by the time it makes it through parliament? How will the cabinet decide on consumer rights compared with business priorities?
Camilla Winlo, Head of Data Privacy at professional services firm Gemserv, explains how the Bill could be changed and why the government should be focusing on promoting data-driven innovation.
Winlo explains to Digital Journal: “On 18th July 2022, the Data Protection and Digital Information Bill – designed by Boris Johnson’s government to replace General Data Protection Regulation (GDPR) in the UK – received its first reading in the Commons.”
As to what the objectives are, Winlo clarifies: “From its inception, the Bill has been designed by the Department of Culture, Media and Sport’s (DCMS) to “remove inappropriate barriers to the flow of UK personal data overseas”, in order to differentiate the UK’s Data Privacy environment from that of Europe.”
This is likely to present problems to more liberal minded politicians and this could lead to changes. Winlo says: “However, with a long road ahead through parliament, under what looks likely to be a drastically changed cabinet, it is possible that the Bill may be amended before it is passed.”
Which aspects might be subject to change? According to Winlo: “One key focus of the Bill is on data-driven innovation, and this is unlikely to change. By giving companies more flexibility around how they address the compliance objectives, the government hopes to encourage start-ups and innovation incubators to set up in the U.K.”
This means a drift from a common framework to individual policies being enacted by different companies.
She adds: “Where GDPR specifies documentation requirements, for example, the Bill gives companies the opportunity to design their own compliance management system. That is more work – not less – but it allows organisations to build something more tailored to their requirements as opposed to working within GDPR’s specifications. Saying this, businesses still need to be mindful that GDPR will still apply in Europe.”
As to what this means in practice, Winlo’s opinion is: “Whilst there has been some criticism that the U.K. will be viewed as ‘soft’ on data privacy, the government has clearly recognised that robust data protection requirements are essential to the Bill’s success. It is vital that the data regulation included in the Bill is strong enough to create a secure environment for innovation to take place.”
