Government unveils plans to overhaul UK data laws

In a published response to its consultation, 'Data: a new direction', the government has set out how the Data Reform Bill will modernise the Information Commissioner's Office, strengthen the UK's data protection standards, and reduce business burdens.

Background to the consultation

The current UK data protection regime consists of the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR) and the Data Protection Act 2018 (DPA). 

The consultation presented proposals that build on the UK's current regime, such as its data processing principles, data rights for citizens, and mechanisms for supervision and enforcement.

The government claims that the EU's General Data Protection Regulation (GDPR), implemented in the UK four years ago, has led to uncertainty and an over-reliance on 'box-ticking' to seek consent from individuals to process their data to avoid non-compliance. 

In what is likely to be welcome news for many small businesses, one of the proposed changes is removing the need for specific organisations to have a Data Protection Officer (DPO) and undertake lengthy impact assessments.

It means a small business won't have to recruit an independent DPO to fulfil the requirements of UK GDPR, provided they can manage risks effectively themselves, and they will not have to fill out unnecessary forms where the risk is low.

Companies and organisations will still be required to have a privacy management programme to ensure they are accountable for processing personal data.

Protection from nuisance calls and increased fines

The Data Reform Bill will increase fines for nuisance calls, text messages, and other serious data breaches under the UK's existing Privacy and Electronic Communications Regulations (PECR), which aim to prevent companies from contacting people for marketing purposes without their consent.

The fines will increase from the current maximum of £500,000 and be in line with current UK GDPR penalties of up to four per cent global turnover or £17.5 million, whichever is greater.

Reduction in cookie consent pop-ups

PECR rules will also be updated to significantly cut down on 'user consent' pop-ups and banners - the irritating boxes people see on every website they visit.

Currently, users have to consent for cookies (the data points which allow sites to remember information about an individual's visit) to be collected. 

The proposal for a new 'opt-out' model for cookies will heavily reduce the need for users to click through consent banners on every website they visit - meaning that people will see far fewer frustrating boxes online.

Under the new rules, users will be better enabled to set an overall approach to how their data is collected and used online - for example, via their internet browser settings.

However, it is currently unclear how the government will implement some of these changes practically on a technical level. 

Before the legislative changes are commenced, they will need to work with the tech industry and the regulator to ensure technology is effective and readily available so people can set their online cookie preferences to opt-out via automated means. 

Read more about the government's data strategy here.

Looking for legal advice for your business? 

Every business needs good data management to operate successfully. Our solicitors advise companies of all sizes on data protection, intellectual property and privacy issues, including SMEs and tech start-ups.

Our team can help guide you through your rights and obligations if you have any questions about data-related issues or planned reforms.

We have solicitors in Eastbourne, Hastings, Brighton, London, Uckfield, and Ulverston, and we work with businesses across the UK.