Britain's digital minister says the General Data Protection Regulation (GDPR) is "limiting the potential of our businesses," and is vowing to cut data protection "red tape," for the "newly independent nation free of EU bureaucracy."

The recently appointed Michelle Donelan said the UK planned to "seize this post-Brexit opportunity fully, and unleash the full growth potential of British business," claiming: "We can be the bridge across the Atlantic and operate as the world's data hub."

It's a clear statement of intent about the direction of data protection policy with new political leadership in government, although the country's proposed replacement for the EU's GDPR – the Data Protection and Digital Information Bill (DPDIB) – is still progressing through [1]Parliament .

[2]

The bill is being looked at by lawmakers, but UK tech companies are going to have to do legwork whichever changes are made, despite protestations by the government that the tweaks will amount to a simplification or removal of laws.

[3]

[4]

As for what it means for multinationals, things get trickier for them too. Those with a presence in the UK and Europe who perhaps deal with the territories using a single policy, as they were covered by a similar approach, will have to make some changes when the UK goes it alone.

UK GDPR

The UK, despite Brexit, still has the GDPR implemented via the Data Protection Act (DPA) of 2018. It first incorporated the law when the UK was a member state, and went on to amend it on January 1, 2021, to be read together with the new "UK-GDPR" rather than the EU GDPR.

The UK GDPR is almost word for word the same text, and that is purposeful, because any significant divergence from the EU GDPR could affect data sharing adequacy rulings post-Brexit.

The Secretary of State for Digital, Culture, Media and Sport was [5]speaking at the Conservative Party Conference conference this week.

Replacing the GDPR with national legislation has been trailed by the Conservative Party since before the so-called TIGRR report. This was a kind of post-Brexit wish-list that included killing off metric measures in favor of imperial, because that went so well for [6]NASA . The parts of it that alluded to the new data protection bill spoke of an "overemphasis on consent," which it said "led to people being bombarded with complex consent requests."

It's also important, however, that the law achieves data adequacy, something the ruling party appears to believe is within reach, citing the examples of Japan, South Korea, Canada, and New Zealand.

Tech pros warn EU 'data adequacy' at risk if Brexit Britain goes its own way [7]READ MORE

Adequacy means a state's legislation is considered compliant with the EU data protection text, meaning organizations in those countries can still trade with the EU and handle EU citizens' data.

DPDIB and your rights

There are also concerns around the watering down of data subjects' rights, with some critics of the new bill saying it relaxes the definition of "consent" in the context of scientific research (clause 3).

Legal eagle Chris Pounder at HawkTalk Training, for example, believes this might [8]encourage unethical research . He says a proposed change in the DPDIB where people's data is collected for research, archives and statistics (RAS) purposes is likely to lead to a decrease of subject consent in "importance as the legitimate interests lawful basis becomes more attractive for private sector RAS."

Netskope's EMEA CISO, Neil Thacker, spoke of a coming burden for data processors: "Having to process data differently for any region adds to the costs of businesses, so for any organization working internationally, adding yet another international regulation will bring cost and further resource burden.

[9]

"In addition, gaining adequacy confirmation with the GDPR is a process that takes time, which risks causing yet more uncertainty for British businesses and those looking to trade with the UK. "Lawyers will get work from this, infosecurity and data professionals will get headaches from this, and data subjects can only be more confused." ®

Get our [10]Tech Resources



[1] https://bills.parliament.uk/bills/3322

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yz6nPYPNGaJg4BOdUIu98wAAAIU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yz6nPYPNGaJg4BOdUIu98wAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yz6nPYPNGaJg4BOdUIu98wAAAIU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.ukpol.co.uk/michelle-donelan-2022-speech-to-conservative-party-conference/

[6] https://www.jpl.nasa.gov/missions/mars-climate-orbiter

[7] https://www.theregister.com/2022/05/17/uk_eu_data/

[8] https://amberhawk.typepad.com/amberhawk/2022/09/expansive-ras-exemption-in-dpdi-bill-encourages-unethical-research.html

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yz6nPYPNGaJg4BOdUIu98wAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://whitepapers.theregister.com/