The government has published a statement of intent on the new Data Protection Bill which will replace the current Data Protection Act and bring the EU’s General Data Protection Regulation (GDPR) into UK law. The statement explains that the new law will replace the existing UK data protection laws, but offers reassurance that the new regime will be implemented in a way that as far as possible preserves the existing data protection concepts we are used to in the UK.
The statement of intent sets out the government’s objectives which include maintaining public trust and confidence in the processing of personal data and the ability to transfer data across international borders. The new law aims to provide continuity of data protection standards following Brexit.
The new Bill will create two new criminal offences, of intentionally or recklessly re-identifying individuals from anonymised data and of altering records with the intention of preventing disclosure of that information following a subject access request. These offences will incur unlimited fines and may be ‘reportable’ offences, ie they may be included on a criminal record check.
The new law will provide for some UK national laws which are permitted under the GDPR. Existing UK exemptions and derogations (which are essentially what businesses use to enable them to process personal data) will be retained, the statement explains, with necessary adjustments to match up with the GDPR. The statement of intent outlines certain ‘notable’ derogations that will be retained from the current law, including:
- preserving the current approach to the treatment of criminal offence data, so that organisations can process criminal convictions and offences data
- allowing the use of automated decision making provided that individuals can request that processing is reviewed by a person rather than a machine.
However, there is more detail that businesses are waiting for – the statement does not provide significantly new or different information to that in the GDPR. The government has not yet announced when the new Bill will be published, but it may be as early as September 2017.