The new Digital Information and Smart Data Bill suggests granting increased powers to the ICO and modernising its regulatory structure by appointing a CEO, board, and chair. The DPDI Bill suggested a similar shift in the ICO’s powers and model and proposed additional powers to the Secretary of State in regulating the ICO’s board and setting priorities and enforcement objectives.
Overall, the proposals within the DISD Bill are not entirely new and are similar to some of those proposed in the DPDI Bill. For example, the proposals to relax restrictions on processing personal data for scientific research purposes and to modernise and strengthen the ICO. However, the DPDI Bill proposed a whole raft of other changes that do not seem to have been picked up in the DISD Bill: the most notable being reduced reporting requirements, changes to the definition of personal data, expanding the use of legitimate interest and scrapping the role of Data Protection Officers. It remains to be seen whether such provisions will be picked up in the future but for now, organisations processing personal data should continue to plan compliance plans in line with current legislation.
Given the extent of changes proposed by the DPDI Bill, it attracted criticism for threatening too much of a departure from EU data protection standards, which our current regime largely mirrors. Should the DPDI Bill have passed, it would have been interesting to have seen its influence on the EU-UK adequacy decision, which is due for renewal in June 2025. The EU-UK adequacy decision enables the free flow of data sharing between the EU to the UK on the basis the UK is deemed to have safeguards in place appropriate to the EU GDPR standard. Having an adequacy decision makes the sharing of data between the EU and the UK pretty straightforward, without which the transfer of data between the UK/EU would become far more complex. Naturally, this could impact the willingness of EU organisations to work with UK organisations and shrink economic growth rather than drive it forward. Many may view the DISD Bill as less threatening to the forthcoming renewal of the EU/UK adequacy decision and see this as a positive step for the UK economy.
The Bill also plans to reform data laws where there is a lack of clarity around safely developing new technologies. This may refer to additional regulation surrounding rapidly emerging AI technologies, which are currently not subject to any AI-specific legislation in the UK. Interestingly, while AI was briefly mentioned, there was no specific commitment to introduce specific AI legislation in the King’s speech, which was predicted to be a focus for the new Labour government, but perhaps this is to come later. Please see our blog on AI regulation under a Labour government for more information.
