The UK Digital Information Bill: Brexit dividend or data disaster?
- Reference: 1711364407
- News link: https://www.theregister.co.uk/2024/03/25/uk_digital_information_bill_feature/
- Source link:
Currently, UK and EU businesses can freely share personal data across international borders. However, if the UK departs from European levels of protection, international data transfers could be restricted, presenting EU and UK businesses with a bureaucratic challenge.
The Data Protection and Digital Information (No.2) Bill was [1]published on 8th March 2023, hailed by the government as a "Brexit dividend" that would create a more business-friendly data protection regime that promotes growth and innovation, while upholding individuals' rights.
[2]
The government claims the Bill "would seize the post-Brexit opportunity to boost the economy by £4.7 billion over the next decade." Despite these bold claims (which mercifully have not been written on the side of a bus) the bill has not had an easy passage through Parliament. This is the government's second attempt to reform the UK data protection regime, the first Data Protection and Digital Information Bill having [3]stalled in 2022.
[4]
[5]
The (No.2) Bill has passed through the House of Commons and its first and second readings in the House of Lords (track its passage [6]here ). Next will be the Committee Stage, during which the Bill will undergo a line-by-line examination.
If adopted, the Bill would make a number of changes to the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC) Regulations, 2003, rather than introduce new legislation. Many of the changes appear to be largely cosmetic; for instance, various UK GDPR definitions would be amended, though changes to the definition of personal data potentially narrow the scope of individuals' protection.
Brexit dividend? 'Newly independent' UK will be world's 'data hub', claims digital minister [7]READ MORE
Cookies and shakeup at the Commissioners' Office
The Information Commissioner's Office (which enforces data protection law in the UK) would be replaced with a new Information Commission, and granted a number of new powers. The Bill would also simplify the rules on website cookie banners, which for many members of the public is likely to be their most frequent interaction with data protection law. This particular change will be broadly welcomed.
Perhaps the most significant change is that the Bill would streamline the rules on data transfers, which prohibit the transfer of data outside Europe. Currently, the GDPR prohibits the transfer of personal data from Europe to third countries that do not guarantee an "adequate level of protection." Some "third countries" have sufficiently robust data protection laws to be granted an " [8]adequacy finding," which enables the free-flow of personal data to continue.
[9]
Since leaving the EU, the UK benefits from an [10]adequacy decision made by the European Commission, which rests on the fact that the UK data protection regime is closely aligned with that of Europe. However, the European Commission has indicated that if the UK [11]diverges from European data protection standards, it can and will revoke its decision.
In the absence of an adequacy decision, transfers of personal data from the EU to a "third country" require data-sharing businesses to implement one of a number of safeguards which ensure that the exported data is protected to the standards of the GDPR. These safeguards are mandatory in order for businesses to share information about their customers, suppliers and workers across international borders (even where the transfer is to members of the same corporate group).
The most widely used of these safeguards is the standard contractual clauses, which contractually bind the recipient to protect data to GDPR standards. However, implementing the standard clauses to enable the many data-flow permutations of a multinational business can be resource consuming. The EU-US data protection framework (and the UK extension) is an alternative mechanism, that permits the flow of data to US businesses that have certified to the scheme. However, the scheme is the successor to the EU-US Privacy Shield and its predecessor the US Safe Harbor, both of which were declared invalid by the CJEU, following a legal challenge by privacy activist Maximillian Schrems and there is every chance the data protection framework could go the same way.
[12]
Data transfers present a complex challenge to international businesses, that may require significant resources to resolve.
[13]Outgoing UK Information Commissioner issues warning about the independence of her office
[14]UK's GDPR replacement could wipe out oversight of live facial recognition
[15]Meta's data-hungry Threads skips over EU but lands in Britain
[16]Get your staff's consent before you monitor them, tech inquiry warns
[17]UK promises big data law shake-up... while also keeping the EU happy, of course. What could go wrong?
The Data Protection and Digital Information Bill's proposed amendments to the data transfer rules potentially weaken the protection of individuals' personal data when transferred outside Europe.
If the European Commission were to withdraw the UK's adequacy finding, this would present UK businesses with a bureaucratic hurdle that could well outweigh any of the benefits of the Bill, and raises the question: if it's not broken, why fix it?
However, such concerns may be rendered academic by Parliament's announcement of an extension until 12th December 2024: If the General Election takes place before then and results in a new government, the Bill may never be adopted at all. ®
Get our [18]Tech Resources
[1] https://commonslibrary.parliament.uk/research-briefings/cbp-9746/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZgGtqj-o-GdHigG8pV59nQAAAEI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/10/06/new_dcms_head_newly_independent/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZgGtqj-o-GdHigG8pV59nQAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZgGtqj-o-GdHigG8pV59nQAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://bills.parliament.uk/bills/3430
[7] https://www.theregister.com/2022/10/06/new_dcms_head_newly_independent/
[8] https://www.theregister.com/2023/10/11/uk_us_data_bridge/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZgGtqj-o-GdHigG8pV59nQAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2021/06/22/uk_eu_data_sharing_adequacy/
[11] https://www.theregister.com/2022/05/17/uk_eu_data/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZgGtqj-o-GdHigG8pV59nQAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2021/10/07/outgoing_ico_warns_independence_of_role/
[14] https://www.theregister.com/2023/05/19/dpib_2_surveillance_oversight/
[15] https://www.theregister.com/2023/07/05/threads_comes_to_uk/
[16] https://www.theregister.com/2023/08/10/workplace_monitoring_select_committee/
[17] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[18] https://whitepapers.theregister.com/
Re: Growth & innovation
This is one of BoJo's gifts and something everyone in the IG sector has seen coming.
It won't cut 'red tape' it will increase it and costs along with it.
Another benefit of Brexit that is nothing more than shuffling the deckchairs on the Titanic
Re: Growth & innovation
Surely sensible leader would have tossed this in the bin. Blame goes on whomever decides to progress this...
Re: Growth & innovation
A lot of the bill is about government enabling more surveillance of citizens. The "growth" agenda is merely a fig leaf. If government cared about economic growth they'd have delivered some in the past 14 years, when in real terms it has flatlined.
As far as I can tell, global companies may implement specific privacy logic that is required in the EU, but they would not bother implementing anything privacy-wise that would only be applicable to UK. At best, they have two or three tiers of privacy in the whole world, and one of these is "EEA+", including EU, GB, Norway and Switzerland. Life is too short.
So essentially, it's the same thing as having different industrial standards in the UK from in the EU: That mostly means the EU standard is used everywhere.
Your argument that international companies aren't interested in markets with localised standards is wrong, and even the most cursory consideration will show that - varying international standards for (eg) power sockets, units, which side of the road to drive on, pharmaceuticals, food, etc etc. Consider Ireland - requires EU standard cars, but drives on the left, yet has the instruments market in metric, so standard for neither the rest of Europe, or for Britain. Doesn't stop companies happily supplying cars. Fridge freezers for the GB market have different standards to the EU, in relation to the flammability of some materials - but have you noticed a shortage of fridge freezers?
Using internationally recognised standards clearly encourages trade and is beneficial for business, and often for consumers. But the idea that business can't and won't adapt to varied standards is nonsense.
Although that doesn't take away that the this bill is crap legislation, moving in the wrong direction and the wrong reason.
conflation
There is a distinction to be made between different standards and less strict ones.
Power sockets: different and incompatible. Either comply or don't do business in that market.
Which side of the road to drive on: different and incompatible. You may sell LHD cars in Britain, but hardly anyone wants to buy one.
What's being discussed here is a loosening of standards. So there is one-way compatibility. EU standards are just fine in the putative UK regime, but the reverse is not true. Who's going to bother?
-A.
A gift?
Well, it's a gift to some people, but not to us, nor probably anyone else in the UK
Re: A gift?
For the brexiteers, brexit was always about making us the 51st State, making us subservient to America, ideally an America run by Trump and his kind.
Our race to the bottom is intended to facilitate that. Brexiteers don't care how damaging that is to Britain or her people.
The nonsense about Sovereignty and Taking Back Control were just lies to get what they ideologically wanted.
Re: A gift?
For the brexiteers, brexit was always about making us the 51st State, making us subservient to America, ideally an America run by Trump and his kind.
That's really about as nonsensical a statement as claiming that remainers want to stay in the EU to make us subservient to Macron & Sholz.
Re: A gift?
Oh Brexit has been an utter waste of time resources and money, but it is not about making us the 51st state.
Yes, it was ideologically driven (you know that when the trade unions and Institute of Directors agree, it is not about business) but it was driven by those somehow imagining that it is sill the 1940s and the UK is a big player in the world that others will adapt to fit us. The reality is the only ones who actually matter to forming economic policies and exceptions are the EU, USA, and China.
Edit: Yes, the UK is 6th ranking by country GDP at $3T, but compare it to USA at $25T, EU block at $20T, and China at $18T.
Re: A gift?
@Paul Crawford
"Yes, it was ideologically driven"
I am surprised this is still used as reasoning against brexit when it remain was about being 'more European'. The ideology that we must all conform or be labelled racist and xenophobic somehow.
"it was driven by those somehow imagining that it is sill the 1940s and the UK is a big player in the world"
We are (as you partially point out in your edit) but also why is it leave voters thinking its the old world when the EU was designed on the old world of trade blocs? Noting the world moved on, absolute poverty fell drastically globally as trade opened up outside of closed blocs.
I note you compare the USA, China and the EU. The USA and China are countries and the EU is an organisation made up of multiple countries which is why the UK is 6th in GDP compared with countries, not organisations.
Re: A gift?
Remaining was about continuity, and close links and influence with what is still the UK's main trading partners. We threw much of that away, and got nothing useful in return leading most people to ask, what was the point?
Compliance has already been made harder by Brexit, if this went ahead, it would only worsen the situation.
As aside, clearly the EU isn't a country, but it negotiates as one, which gives it leverage. The UK lacks the same leverage.
Re: A gift?
"Oh Brexit has been an utter waste of time resources and money"
^ I agree and I am still waiting to see these most wondrous tangible benefits that we were promised. Indeed, I am still waiting for my free live baby unicorn and for the free crock of gold at the end of the rainbow for every household in the United Kingdom.
Re: A gift?
@TVU
"^ I agree and I am still waiting to see these most wondrous tangible benefits that we were promised."
As soon as we left the UK was reaping the benefits of covid jabs, amusingly made in countries in the EU who unfortunately had to wait at the back of the queue due to the EU commission not ordering them in time. Wasnt forced to participate in the covid(Euro) bailout fund. The UK acted much swifter in support of Ukraine.
"Indeed, I am still waiting for my free live baby unicorn and for the free crock of gold at the end of the rainbow for every household in the United Kingdom."
Remainer claims not delivered at not attributable to leavers.
Re: A gift?
How many time do we have to tell you. The vaccine arrangements were made while the UK was still subject to all EU regulations. Brexit made absolutely no difference, we or any EU country could have done exactly what we did.
Re: A gift?
@DJO
"How many time do we have to tell you. The vaccine arrangements were made while the UK was still subject to all EU regulations. Brexit made absolutely no difference, we or any EU country could have done exactly what we did."
And yet at no point has a remainer managed to explain how the situation would have worked. The highly theoretical 'we or any EU country' ordering it themselves doesnt work very well but even worse is the reaction of the EU when they screwed up and would have stolen. Hence you can keep telling because you are wrong.
Brexit did make the difference for no reason other than making it politically difficult for the gov to order through the EU. Thankfully.
Re: A gift?
"As soon as we left the UK was reaping the benefits of covid jabs"
^ That is overt fake news not least because interpretations of existing agreements would have already allowed for this to happen.
it is safe to say that the Adam Smith Institute is neither a revolutionary Marxist institution nor a bastion of committed Remainers but even they came out in favour of a sane EEA/EFTA-type Brexit that would not have inflicted so much economic damage on the British economy.
Re: A gift?
@TVU
"^ That is overt fake news not least because interpretations of existing agreements would have already allowed for this to happen."
Unfortunately that doesnt pass the reality test (see response to DJO) but I am guessing you at least recognise the others I mention as benefits?
Re: A gift?
Oh it certainly is a gift to some in the UK. Rich people don't care whether we are part of the EU or not Brexit makes zero difference. These are same rich people that make money on profits. These profits can be driven by the reduction of regulations the EU have imposed. It also devalues the UK economy which again if you have your money outside the the UK (who would leave it in the UK when Brexit was happening?) means your money is now worth more. Brexit as we have seen has been amazing for business as it's the perfect excuse to generate profits. Sure we have the import/export issues but we don't import eggs, milk and butter which have shot through the roof (I am aware we do import some of these so don't need a correction however the vast majority is not imported) amongst other things, record profits everywhere. Politicians are also loving it because they can now take back control and pass laws they otherwise would never be able to pass. It's a shitshow.
Re: A gift?
Politicians are also loving it because they can now take back control and pass laws they otherwise would never be able to pass. It's a shitshow.
Prime example are IR35 changes in private sector. They had to delay them until our full withdrawal, as they are incompatible with many EU directives we were bound to, but told the public it was because Covid...
Re: A gift?
For those uninformed, breaches are in 3 areas - the changes introduce zero rights employment, effective state aid for large corporations and in proportionality (excessive red tape for small business and zero red tape for large corporations operating the same business model - as they are exempt from the regulation).
When referring to government actions
It would be a good idea to use the appropriate punctuation with their "reforms" as they are not any such thing.
Dictionary.com top 3 definitions of the word are
1. the improvement or amendment of what is wrong, corrupt, unsatisfactory, etc.:
2. to change to a better state, form, etc.; improve by alteration, substitution, abolition, etc.
3. to cause (a person) to abandon wrong or evil ways of life or conduct.
I have yet to see a "reform" from Westminister that does any of those things. It seems to mean more "weaken" or enfeeble. Consider the actions over the last decade+ upon the economy, employment law and so on when they "reformed" those. This is just more of the same.
Re: When referring to government actions
I think they are using it in the same way one does with "reformed ham"
Who knew?
"The Information Commissioner's Office (which enforces data protection law in the UK)"
[Citation needed.]
-A.
Re: Who knew?
And now the Information Commission and it'll have exactly the same problem as it's predecessor along with almost every regulatory body under a Tory government.
The government know that abolishing or cutting the powers of such bodies would be incredibly unpopular with most voters so they endow the bodies with nebulous and wide reaching powers then strip them of almost all funding until they are completely unable to fulfil their remit.
would create a more business-friendly data protection regime, while upholding individuals' rights
This is nonsensical, you can either let personal data be more easily sold ("more business friendly"), or have it protected as it is now ("upholding individuals' rights"). You cannot do both, as an increase in one is by definition a decrease in the other.
Easy answer
> if it's not broken, why fix it?
Because it's not broken yet.
Plus ça change?
" If adopted, the Bill would make a number of changes to the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC) Regulations, 2003, rather than introduce new legislation. "
This is one of the worst possible outcomes. The separate existence of these three pieces of legislation has been a source of confusion from day one. What's needed by ordinary business folks is a single consolidated piece of legislation that brings all the obligations together in one place, and this is an ideal opportunity to deliver it.
But there are some serious problems with the bill before Parliament that have not been mentioned in this article, none of which are 'cosmetic' (quite the opposite).
[1] The requirement for a qualified Data Protection Officer with statutory independent standing has been eliminated in favour of a "senior responsible individual" with no explicit requirement for either expertise in data protection law or independence (they're only implied by the duties, so expectations of standard are highly subjective). The result is an almost certain massive rise in both errors and conflicts of interests. This is not just a re-naming exercise -- it's the removal of a safeguard for both businesses and data subjects.
[2] It is intended to replace data protection impact assessments (DPIA) by ‘assessments of high risk processing’, which obviously begs the question, as until an assessment has been conducted how do we know there's a high risk. The inevitable outcome will of course be that pretty much all processing will be considered 'low risk', obviating the need for assessment.
[3] It is intended to remove the Article 27 requirement for UK-based representatives of controllers outside the UK. This will (again obviously) hinder access to remedy. Data subjects must not only face the existing massive discrepancy of power between themselves and data controllers, but will have to do this across jurisdictions and geographical (and even possibly linguistic) boundaries.
Finally, it must be emphasised yet again that 'cookie' consent and cookie banners are entirely separate issues. Elimination of intrusive and often misleading banners is a welcome departure. Eliminating the right to reject tracking is not . The current legislation is silent on 'banners' -- they are the invention of a commercial culture that seeks to bypass the legislation for its own advantage by playing on our distaste -- inviting click through. So we have a piece of current legislation that requires our consent to be obtained lawfully for tracking, that is being subverted by organisations obtaining acceptance unlawfully. The proposed solution is not to enforce the seeking of consent by lawful means, but to eliminate the need for lawfully obtained consent .
As well as increasing uncertainty for organisations that are trying to comply with the law, all these changes weaken the protection of data subjects. Qui bono? I think it's pretty obvious.
LOL.
Still polishing the Brexit turd all the way to the bitter end.
They should be busy working on their CVs for their post election job hunts.
"The government claims the Bill "would seize the post-Brexit opportunity to boost the economy by £4.7 billion over the next decade."
"Vote for me for class president. I'll make sure:
- There are free coke and chocolate vending machines in every classroom.
- Homework will be banned.
- Fridays will be a half-day.
- Becky stops picking her nose and rubbing it under her desk.
- Mrs. Smith uses deodorant.
create a more business-friendly regime
UK's got the most business-friendly regime already, particularly on painless incorporation of scam companies that flock to our shore from around the globe. O come, all ye faithful, joyful and triumphant.
...or is it that brexit dividend born around 8 yrs ago hasn't matured yet? Still waiting.
Growth & innovation
Or cutting corners and spending less money on data security and compliance?
These yachts won't buy themselves.
Just another hot air brain dead happy clappy idea from "reverse Midas" Sunak's government.