Thank you for contacting me about data protection.
Now that the UK has left the EU, there is opportunity to simplify the clunky parts of our data protection laws and create a world class data rights framework that will allow us to realise the benefits of data use while maintaining high data protection standards.
Data is fundamental to fuelling economic growth in all areas of society from unlocking medical breakthroughs to helping people travel, manage their finances and shop online. It is vital to the development and use of innovative technologies such as artificial intelligence.
The Government consulted on an ambitious package of reforms to create a new regime that is pro-growth and trusted for UK citizens and businesses. The Data Protection and Digital Information Bill was first introduced in 2022 but paused so Ministers could engage in a co-design process with business leaders and data experts – ensuring that the new regime built on the UK’s high standards for data protection and privacy, and seeks to ensure data adequacy while moving away from the ‘one-size-fits-all’ approach of European Union’s GDPR.
The Bill has since been improved to introduce a simple, clear and business-friendly framework that will not be difficult or costly to implement – taking the best elements of GDPR and providing businesses with more flexibility about how they comply with the new data laws. Furthermore, it will ensure the UK's new regime maintains data adequacy with the EU, and wider international confidence in the UK’s comprehensive data protection standards. By reducing the amount of paperwork and supporting international trade without additional costs if they're already compliant, the changes will give organisations greater confidence about when they can process personal data without consent.
I appreciate concerns about certain aspects of the Data Protection and Digital Information Bill. While I note you would like Schedule 1 to be amended, the Bill gives more confidence to organisations to rely on the legitimate interests lawful basis and to further process data. As well as specifying circumstances in which existing legitimate interests lawful basis for processing can apply, Schedule 1 sets out ‘recognised legitimate interests’ where no balancing test is required, for example in situations such as crime prevention and safeguarding, where nervousness about sharing data can cause real harm.
I recognise that many of you are also concerned about the use of statutory instruments and powers provided to the Secretary of State. Regarding the powers given to the Secretary of State to amend the recognised legitimate interest activities in Annex 1, before laying regulations, the Secretary of State would need to consider the effects of any changes on the interests and fundamental rights and freedoms of data subjects, particularly children. The regulations would be subject to the affirmative procedure. Also subject to affirmative procedure is the Secretary of State's power to adjust the fixed monetary penalty amount by laying a statutory instrument in Parliament.
Clause 104 of the Bill seeks to amend Section 20 of the 2012 Act to abolish the office of the Biometrics Commissioner and transfer its casework functions to the Investigatory Powers Commissioner. I understand that this will reduce duplication and simplify oversight of the police use of biometrics. The Information Commissioner will continue to provide independent oversight of the use of biometrics by all bodies, including the police.
Finally, concerning CCTV, Clause 105 (1) seeks to abolish the office of Surveillance Camera Commissioner. Clause 105 (2) would repeal Part 2 Chapter 1 of the 2012 Act to remove the requirement for a Surveillance Camera Code. The Information Commissioner would continue to provide independent oversight and regulation of this area, without duplication by the Surveillance Camera Code and Commissioner.
You may be interested to read the Bill's impact assessment which provides further information on this important piece of legislation:
https://bills.parliament.uk/bills/3430/publications
Thank you again for taking the time to contact me.
Kind regards,
Graham