What does the future of data regulation look like for marketers?

The UK has had four years to get used to the sweep­ing changes that the EU Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) brought with it when its pro­vi­sions were imple­ment­ed in the Data Pro­tec­tion Act 2018. That year, busi­ness­es were forced to rewrite data-han­dling pro­ce­dures and imple­ment strin­gent new ways of inter­act­ing with their cus­tomers. 

Hav­ing been marched up to the top of the GDPR hill, it looks increas­ing­ly like­ly that mar­keters and their clients will be marched back down again some time soon. In the Queen’s Speech on 10 May, the gov­ern­ment revealed that it was plan­ning sig­nif­i­cant reforms to data pro­tec­tion law. 

Details were thin on the ground, but the gov­ern­ment did say that it intend­ed to replace the “high­ly com­plex” leg­is­la­tion that it had inher­it­ed from the EU with some­thing offer­ing a lighter touch. The main goal: to make the whole process more straight­for­ward and save organ­i­sa­tions from hav­ing to do “exces­sive paper­work”. 

But there are caus­es for con­cern for busi­ness­es, many of which have only just man­aged to wrap their heads around all the com­plex­i­ties cre­at­ed by the GDPR. For instance, firms that have one foot in the UK and the oth­er in Europe are wor­ried that the extra bureau­crat­ic bur­den of hav­ing to com­ply with two sets of reg­u­la­tions could cause them huge prob­lems. 

West­min­ster has said that it will open its pro­pos­als to con­sul­ta­tion, which means that the indus­try – and con­sumers – have the pow­er to shape the law. So what should the future of data pro­tec­tion reg­u­la­tion look like?

Preparing for change

There tends to be a lot of anx­i­ety sur­round­ing big leg­isla­tive changes, but this often proves unfound­ed when the real­i­ties of com­pli­ance don’t prove as dif­fi­cult as feared. This is why some mar­keters sug­gest that wor­ry­ing too much in this respect is a stress­ful waste of time and ener­gy. 

“Data pro­tec­tion reg­u­la­tion is quite sim­ply beyond the capac­i­ty of us mere mor­tals,” admits Andrew Armitage, founder and MD of A Dig­i­tal, an agency based in Kendal, Cum­bria. “Peo­ple run­ning small busi­ness­es can’t afford the ser­vices of a com­pli­ance depart­ment, a chief data offi­cer or an infor­ma­tion secu­ri­ty offi­cer. The real­i­ty is that most small firms – and prob­a­bly larg­er ones too – will choose their providers care­ful­ly and do the best they can.”

But Armitage believes that no com­pa­ny can cat­e­gor­i­cal­ly say that it’s always 100% com­pli­ant with all the rules. “It’s too com­pli­cat­ed to know what mate­r­i­al gets sent where and when. This becomes a prob­lem only in the event of a secu­ri­ty breach or a scan­dal,” he says.

The main aim of the pro­posed reforms is to save firms from “exces­sive paper­work”, which should, at least in the­o­ry, reduce the risks of non-com­pli­ance. But the key ques­tion is whether some of the more bureau­crat­ic ele­ments of the GDPR will have to remain in UK law.

A data privacy update 

There is a good rea­son for retain­ing cer­tain ele­ments of the GDPR, accord­ing to Natal­ie Cramp, CEO of data sci­ence com­pa­ny Pro­fu­sion.

“I don’t think any­one can argue that it’s a flaw­less piece of leg­is­la­tion,” she says. “But, if you con­sid­er how weak and out­dat­ed our data pri­va­cy laws were before its enact­ment, it has sub­stan­tial­ly improved the sit­u­a­tion over­all.” 

For instance, the GDPR drove a sig­nif­i­cant change in con­sumer rights by putting the indi­vid­ual at the cen­tre of data pro­tec­tion leg­is­la­tion. The con­cern is that the good work it prompt­ed the mar­ket­ing indus­try to do to smarten up its act – and build pub­lic trust in the process – will be undone. 

“The fear is that the gov­ern­ment will favour weak and/or vague reg­u­la­tions in the name of sim­plic­i­ty,” says Cramp, who fore­sees a poten­tial dou­ble wham­my. “The UK could end up in a sit­u­a­tion where busi­ness­es are strug­gling to nav­i­gate a new set of rules, there­by dam­ag­ing their abil­i­ty to oper­ate inter­na­tion­al­ly, while peo­ple are left with lit­tle pro­tec­tion.”

The prospect of a two-track sys­tem is wor­ry­ing plen­ty of British busi­ness­es with inter­ests in the EU, observes Dr Janet Ward, senior lec­tur­er in mar­ket­ing at the Uni­ver­si­ty of Brighton. 

Although firms that rely on for­eign mar­kets fur­ther afield “may wel­come some eas­ing of the GDPR, com­pa­nies that depend on Euro­pean trade may raise con­cerns”, she pre­dicts, not­ing that UK exports to the EU in 2021 were £20bn down on the total for 2018, the lat­est com­pa­ra­ble year of sta­ble trad­ing. 

Ward points out that hav­ing dif­fer­ent reg­u­la­tions from those of our near­est for­eign mar­ket may seem like a night­mare, par­tic­u­lar­ly for small­er firms that have had to deal with prob­lems caused by the North­ern Ire­land pro­to­col. She adds that “those more focused on con­sumer behav­iour will be con­cerned about a dilu­tion of pro­tec­tions, par­tic­u­lar­ly for chil­dren and oth­er vul­ner­a­ble peo­ple”.

Marketers hope for clarity 

What­ev­er reforms are even­tu­al­ly enact­ed, there is one thing for cer­tain: the whole mar­ket­ing pro­fes­sion would like these to be the last ones for a while. 

“Every­one in our indus­try is keen to avoid con­stant changes to the rules,” says Aman­da Walls, founder and direc­tor of Man­ches­ter-based agency Cedar­wood Dig­i­tal. “Each time the rules change, we go through our own con­sul­ta­tion process with experts to then roll out the required changes across our web­sites and those of our clients. This process is not only cost­ly; it’s also incred­i­bly time-con­sum­ing. Any move to ‘sim­pli­fy’ data reg­u­la­tion has to be a final one for at least the fore­see­able future.”

Such sim­pli­fi­ca­tion needs to work for all con­cerned. British con­sumers and their rep­re­sen­ta­tives aren’t like­ly to favour much in the way of dereg­u­la­tion, because they gained a set of sig­nif­i­cant legal pro­tec­tions in 2018. An inter­na­tion­al sur­vey of 2,600 con­sumers pub­lished by Cis­co Sys­tems last year found that 18% of UK respon­dents had approached an organ­i­sa­tion to enquire about hav­ing the per­son­al data it had obtained on them amend­ed or erased – one of the impor­tant rights grant­ed to them by the GDPR. 

Tech firms, for their part, will gen­er­al­ly lob­by for dereg­u­la­tion. For instance, they’re like­ly to be con­cerned about how the long-planned Dig­i­tal Mar­kets Unit with­in the Com­pe­ti­tion and Mar­kets Author­i­ty is being beefed up with greater pow­ers to clamp down on bad actors, although noth­ing sub­stan­tial is like­ly to hap­pen in this depart­ment before the end of the 2022–23 par­lia­men­tary ses­sion.

It all leads to plen­ty of uncer­tain­ty for mar­ket­ing chiefs as they try to for­mu­late their medi­um-term busi­ness plans. This is a headache that doesn’t have an easy rem­e­dy at present. 

If there’s one thing that the entire indus­try would like to obtain from the forth­com­ing leg­is­la­tion, it’s clar­i­ty. 

“There would need to be a clear dis­tinc­tion and under­stand­ing here of how our own data pro­tec­tion guide­lines would work with this, with­out cre­at­ing the com­plex­i­ty of hav­ing to oper­ate with­in dif­fer­ent data rules depend­ing on which organisation’s prod­ucts we’re work­ing with,” says Walls, who fears that such an out­come “would not only be incred­i­bly time-con­sum­ing; it could also increase the risk of error”.