On 17 June 2022 the Department for Digital, Culture, Media and Sport published its response to its consultation on data reform, Data: a new direction.
In the response, the Government set out its intention to reform the UK’s data protection regime, building on, and ultimately diverging from, the General Data Protection Regulation (GDPR).
The consultation, and response, explore a number of ways in which the UK could liberalise its data protection regime to make it more innovation-friendly as the Government looks for new ways to reduce burdens on businesses.
The response confirms the Governments ambitions to press ahead
with changes including the removal of cookie banner requirements and for
reforms to be made to the Information Commissioner’s Office (ICO).
The Government has said that it is reasonable to expect the UK to maintain adequacy with the EU with proposals in the consultation compatible with maintaining personal data flows from the EU - but this is not guaranteed following the introduction of any changes.
The Government is now expected to introduce a Data Reform Bill to Parliament shortly, which will likely become an Act of Parliament next year.
Ukie will continue to engage with the Government to make the case for the maintenance of adequacy along with our partners across the creative industries and the wider tech sector. We will also highlight the potential benefits that liberalisation of data protection could bring to the games industry.
Key areas of focus and proposals
The Government’s consultation had five priority outcomes:
- Boosting competition and innovation;
- Maintaining high data protection standards;
- Creating a system that could keep pace with technological change;
- Letting all businesses use data innovatively; and
- Equipping the Information Commissioner’s Office (ICO) to regulate.
To achieve these outcomes, the consultation focussed on five areas for data reform (with some example areas of interest):
Reducing barriers to responsible innovation
● Clarifying legitimate interests
● Creating a simpler gateway for research
● Giving permissions for AI systems
● Clarifying the fairness principle
●
Providing clearer standards for data
minimisation
Reducing burdens on businesses and delivering better outcomes for people
● Reforming breach reporting requirements
● Ensuring privacy and rights in relation to electronic communications
●
Amending bulk subject access requests
Boosting trade and reducing barriers to data flows
● Focussing on human rights and citizen safety
● Reforming adequacy assessments
●
Allowing alternate transfer mechanisms for
international transfers
Delivering better public services
● Learning lessons from personal data use during Covid-19 pandemic
●
Building trust in government and increasing
transparency
Reform of the Information Commissioner’s Office
● Creating a duty to have regard to growth, innovation and competition
● Reforming governance model and leadership
● Requiring the DCMS Secretary of State to publish a statement of strategic priorities
● Ensuring ICO follows best practice
● Creating a more proportionate regulatory approach to complaints
The Government's plan for action
The Government will be moving forward with the majority of its proposals. A full table of the Government’s intentions in relation to individual proposals can be found at the bottom of this page. There are some notable exceptions to this where the Government will not be proceeding with its proposals:
- The Government will not proceed with creating a new lawful ground for processing personal data for research purposes;
- The Government will not proceed with the removal of Article 22 of the UK GDPR (a ban on solely automated decision making);
- The Government will not introduce a cost ceiling for complying with subject access requests nor introduce a nominal fee for making subject access requests;
- The Government will not introduce the power for the DCMS Secretary of State to appoint a CEO of the ICO.
What it means for games companies and next steps
The Government will now finalise its Data Reform Bill and it is expected that the Bill will be introduced to Parliament shortly and that the Bill will receive Royal Assent next year. It is likely that there will then be an implementation period for organisations to comply with any new requirements.
There are no provisions or proposals that are focussed on the games industry specifically. This is “whole economy” reform and will affect businesses and organisations everywhere. Once the new regime is clearer, members should engage with data protection experts to ensure that they remain compliant.
If you or your organisation would like to discuss your views on the Government’s proposed reform of data protection law, please get in touch with Dominic Murphy, Head of Policy and Public Affairs, Ukie (dominic@ukie.org.uk).