The jury’s out: Westminster’s case for modernising data law

The pru­dent stew­ard­ship of per­son­al data can be a del­i­cate and oner­ous task for British busi­ness­es, but less red tape and greater flex­i­bil­i­ty in man­ag­ing this mate­r­i­al could soon be with­in their sight. 

Freed from the EU’s shack­les, the Depart­ment for Dig­i­tal, Cul­ture, Media and Sport (DCMS) is seek­ing to mod­ernise the UK’s bureau­crat­ic data pro­tec­tion regime by cre­at­ing a “bold” new sys­tem, all in the name of aid­ing eco­nom­ic growth. And, at first glance, the wide-rang­ing pro­pos­als pub­lished in its Sep­tem­ber 2021 con­sul­ta­tion doc­u­ment, Data: a new direc­tion, seem dis­tinct­ly pro-busi­ness, sig­nalling a shift from hide­bound process­es to greater account­abil­i­ty. 

It’s hard to imag­ine how the government’s com­mit­ment towards “unleash­ing data’s pow­er… for the ben­e­fit of British busi­ness­es” could simul­ta­ne­ous­ly enhance con­sumers’ rights. It is often said that pri­va­cy is a right, not a priv­i­lege, but there is a bal­ance to be struck. 

The DCMS is propos­ing to move from the cur­rent pre­scrip­tive approach to what it calls an “out­comes-focused” sys­tem. If that sounds vague, it’s because it is. 

“It’s dif­fi­cult to say whether this rep­re­sents a gen­uine change in favour of busi­ness or not, since the dev­il will be in the detail,” says James Cas­tro-Edwards, data pro­tec­tion spe­cial­ist at Arnold & Porter. He adds that Westminster’s inten­tion to cre­ate a pro-growth and pro-inno­va­tion data regime is “hard to inter­pret as any­thing oth­er than a relax­ation of the rules”.

It’s been almost four years since the intro­duc­tion of the Data Pro­tec­tion Act 2018, which is a very long time in tech­nol­o­gy. Whether this leg­is­la­tion remains fit for pur­pose is debat­able. But it is clear that, if busi­ness­es are to have enough flex­i­bil­i­ty to use big data effec­tive­ly, reg­u­la­to­ry changes are need­ed. 

The DCMS pro­pos­als are under­pinned by both the online safe­ty bill and the dig­i­tal reg­u­la­tion plan, pub­lished in July 2021, which has inno­va­tion at its heart. The gov­ern­ment wants to reduce bar­ri­ers to “respon­si­ble inno­va­tion” by busi­ness­es and light­en their com­pli­ance bur­den. Most notably, the so-called legit­i­mate-inter­est bal­anc­ing test for cer­tain activ­i­ties (such as using per­son­al data for inter­nal R&D) will be dis­ap­plied; a new legal basis for research will be intro­duced (with safe­guards); and the legal bases and con­di­tions for pro­cess­ing per­son­al data will be clar­i­fied.

“This is about chang­ing the empha­sis from restrict­ing data uses to mak­ing firms sub­ject to greater account­abil­i­ty, but in a prag­mat­ic and sen­si­ble way,” says Eduar­do Ustaran, co-head of the glob­al pri­va­cy and cyber­se­cu­ri­ty prac­tice at Hogan Lovells.

Will business see the benefits?

It looks good for busi­ness­es at first blush, par­tic­u­lar­ly firms seek­ing to con­duct sci­en­tif­ic research but hes­i­tat­ing to do so because of a lack of clar­i­ty. 

But a shift to an out­comes-focused regime may not be the sig­nif­i­cant change that some peo­ple might be expect­ing. Jonathan Kir­sop, part­ner in the data pro­tec­tion team at Pin­sent Masons, points out that the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) is “large­ly prin­ci­ples-based any­way… The pro­posed reforms look to remove some of the pre­scrip­tive ele­ments of the leg­is­la­tion – for instance, its require­ments for data pro­tec­tion offi­cers and pri­va­cy impact assess­ments – but they don’t oth­er­wise depart sig­nif­i­cant­ly from this prin­ci­ples-based approach.”

Some lawyers believe that small and medi­um-sized enter­pris­es would be the main ben­e­fi­cia­ries of the planned reforms, giv­en the like­ly reduc­tion of red tape in cer­tain cir­cum­stances. As for big multi­na­tion­al busi­ness­es, Kirsop’s view is that any sig­nif­i­cant eas­ing of the process­es they must fol­low would be less like­ly, giv­en the scale and geo­graph­i­cal spread of their oper­a­tions. 

Con­sid­er sub­ject-access requests (SARs) – the bane of many busi­ness­es. Organ­i­sa­tions can’t refuse an SAR on the grounds that it’s oner­ous to deal with, but the gov­ern­ment has pro­posed to dis­card some record-keep­ing require­ments imposed by the GDPR, which would enable firms to respond to SARs more effec­tive­ly.  

But this leaves com­plex ques­tions unad­dressed, accord­ing to Katie Hew­son, a part­ner in Stephen­son Harwood’s data pro­tec­tion prac­tice. “For exam­ple, the extent of the duty to be trans­par­ent about, and to give access to, data that is inferred about a sub­ject is like­ly to become increas­ing­ly rel­e­vant as com­pa­nies use auto­mat­ed process­es to make assump­tions about indi­vid­u­als’ pref­er­ences.”

The Infor­ma­tion Commissioner’s Office, which receives more com­plaints from the pub­lic about SARs than any­thing else, also has con­cerns about this and wants to see appro­pri­ate safe­guards.

Protecting consumer privacy

A sig­nif­i­cant wor­ry is that con­sumers’ pri­va­cy rights will be com­pro­mised if the DCMS pro­pos­als are enact­ed. The Law Soci­ety has warned that any per­cep­tion of the scales tip­ping in favour of busi­ness­es using per­son­al data for wider rea­sons at the expense of people’s pri­va­cy would jeop­ar­dise the UK’s rep­u­ta­tion as a glob­al leader in data pro­tec­tion.

Such con­cerns are valid, but they have been exag­ger­at­ed, accord­ing to Kir­sop. His view is that the reforms per se would not push things that far. He believes that the biggest risk con­cerns EU ade­qua­cy – the Euro­pean Commission’s rat­ing of the effec­tive­ness of a non-member’s data pro­tec­tion mea­sures. 

“There is spec­u­la­tion that, if the UK diverges too far from the GDPR norm, that could threat­en the UK’s ade­qua­cy deci­sion from the Euro­pean Com­mis­sion,” Kir­sop says. 

So it could turn out that the government’s pro­posed shift to a pro-growth, pro-inno­va­tion data regime, while intend­ed as a busi­ness-friend­ly move, “would have the oppo­site effect if the result were to be a loss of trust in UK busi­ness­es”, warns Cas­tro-Edwards.

But, all in all, there is much to be said for sim­pli­fy­ing the law and mak­ing it eas­i­er for busi­ness­es to under­stand what com­pli­ance looks like, accord­ing to Ustaran. This will ben­e­fit both com­pa­nies and con­sumers – and it should in turn reduce the risk of lit­i­ga­tion for unlaw­ful uses of data, he says.

Ustaran, who is broad­ly opti­mistic about the prob­a­ble effects of the DCMS plan, adds: “Reforms con­sis­tent with the direc­tion of trav­el the UK has main­tained in this area – mak­ing the law eas­i­er for busi­ness­es to com­ply with and for cit­i­zens to under­stand – are com­pat­i­ble with the nation’s sta­tus as a glob­al leader in data pro­tec­tion.”