On March 8, 2023, the UK government published the Data Protection and Digital Information (No. 2) Bill (the “Bill”) which proposes to update the current UK data protection regime.
The Bill and its Explanatory Notes can be found here and here (respectively).
The Bill is the culmination of a process that started with the UK government’s National Data Strategy, announced at the end of 2020. In September 2021, the UK government launched a consultation setting out its proposed reforms of the UK’s data protection regime following Brexit, in particular, the General Data Protection Regulation (EU) 2016/679 as it forms part of retained EU law in the UK (“UK GDPR”), with an aim to create “a more pro-growth and pro-innovation data regime whilst maintaining the UK’s world-leading data protection standards”.
In response to the consultation, the UK government introduced its first draft of a reform bill on July 18, 2022 (the “first Bill”). However, in October 2022, after a change of leadership, the government announced an intention to introduce additional changes and to replace the UK GDPR “with [a] business and consumer-friendly, British data protection system.”
The Bill reflects those objectives, which the government hopes will reduce administrative and financial burdens on organisations and provide them with greater flexibility on how to comply with certain aspects of the UK data protection law.
Please click here to continue reading on the Cleary Cybersecurity and Privacy Watch blog.