Page 26 - PWM2023_November EBook

BETTER BUSINESS

Data

protection

The UK’s data protection regime that came about
following the introduction of the General Data
Protection Regulation (GDPR), and the subsequent
new Data Protection Act (DPA), is around five years
old now, by Adam Bernstein
H and consumers.”
unnecessary burdens for businesses
owever, the govern-
ment is introducing
She continues: “In its announce-
legislation, via the Data
ment of the new bill, the government
Protection and Digital
Information Bill
described it as a ‘common-sense-led’
(DPDI), to reform it.
UK version of the EU’s GDPR. The
The bill is the culmination of a reform intention is to update and simplify
programme which began with a pub- the UK’s data protection framework,
lic consultation back in autumn 2021; reducing burdens on organisations
a bill was first introduced in July 2022 while maintaining high data protec-
but it never got off the ground. tion standards.”
And Modiri thinks the same and
A rethink comments that “the bill seeks to
Kevin Modiri, a partner and solici- bring in a less burdensome and more
tor at Nelsons, an East Midlands law flexible regime which will become
firm, notes that the earlier version of easier and inexpensive to imple-
the bill was put on hold after Liz ment”. He thinks that the bill offers a
Truss was appointed as prime minis- particular benefit to smaller and
ter. He says that at the Conservative medium-sized enterprises and there Then there are changes to the ‘legitimate interests’ definitions in the
Party conference in October 2022, will also be a financial advantage as GDPR used as the legal basis for data processing. Here Modiri points out
science, innovation and technology “the new laws are expected to save that “there is a proposal to include some examples of processing that may
secretary Michelle Donelan the UK economy £4.7 billion and be considered as necessary for the purposes of a legitimate interest such as
announced that “the UK would be boost data protection standards so for direct marketing, intra-group transmissions of data and processing to
replacing the GDPR. Ministers took that businesses can continue trading ensure security of network and information systems”.
time to reflect and came up with a freely with global partners, which Beyond that is a proposed new legal basis for processing which is for a
No.2 bill in which they have made includes the EU”. ‘recognised legitimate interest’. The key difference between this and the
some targeted reforms”.
Importantly, he adds that the bill “is Proposed changes current legitimate interests basis is that businesses relying on one of the
not a replacement of the GDPR but a So, what are the changes that the recognised legitimate interests will only need to ensure that their process-
refinement to allow greater certainty bill proposes? ing falls within one of the listed activities.
for individuals along with a clarifica- To begin with, Modiri explains And there is to be, as Modiri puts it, “a clearer and more stable frame-
tion of certain aspects of the existing that “the new DPDI bill has been work for international transfers with a risk-based approach to data trans-
framework”. described as largely the same as its fers and changing the adequacy rules”. He says that “this will allow
And for Jeanette Burgess, head of predecessor, but contains a number businesses to have a simpler and clearer set of rules for international trans-
regulatory & compliance at Leeds- of provisions which are to be fers”.
based Walker Morris, it appears that expected to simplify UK data laws”. Overall, though, Burgess thinks that the bill doesn’t radically change the
the government is seeking to capital- One of the key changes that he data protection regime. She says that this means that “organisations will
ise on post-Brexit freedoms to make picks out is an update to the defini-
changes to the current data protec- tion of personal data “to specify what still need to make sure that they only process personal data where they
tion regime. She says: “According to is meant by the identification of an have a lawful basis to do so and that data protection principles are complied
the new bill’s explanatory notes, individual ‘directly or indirectly’ and with”.
some elements of the GDPR and information relating to an identifia- That said, she lists changes introduced by the bill that could help busi-
DPA create barriers, uncertainty and ble living individual”. nesses reduce costs. In particular, she says that “under the proposed new

24 PrintWeek MENA November 2023 www.printweekmena.com