Latest Updates on the Data Protection and Digital Information Bill in the UK
7th May 2024
Updated 03/06/2024
What is the difference between DPDI Bill 1 and 2?
The first version of the Bill (Bill No.1) was introduced in the UK Parliament in July 2022 but was paused following the election of Elizabeth Truss as Conservative Party leader to ‘allow Ministers to consider the Bill further’ (read more).
Bill No.1 was officially withdrawn on 8 March 2023 when the new Data Protection and Digital Information (No. 2) Bill was introduced in the House of Commons on the same day. This is the second version of a set of proposals to reform the UK GDPR.
The Data Protection and Digital Information No 2 Bill (DPDI Bill) marks a further significant milestone in the growth of the UK’s data protection framework. The DPDI signifies a commitment to enhancing data protection measures and addressing contemporary privacy concerns. The Bill, introduced as a response to the changing landscape of digital data management, has been undergoing scrutiny and refinement to meet the changing needs of society. Since its inception, the bill has garnered attention from stakeholders across various sectors, with debates focusing on key provisions, enforcement mechanisms, and the balance between privacy rights and innovation.
Here’s a snapshot of the latest updates and discussions surrounding the Data Protection and Digital Information Bill (DPDI):
Consultation and Feedback
Throughout the legislative process, policymakers have actively sought input from stakeholders, including industry representatives, privacy advocates, legal experts, and consumer groups. Public consultations and parliamentary hearings have provided opportunities for feedback and constructive dialogue, shaping the bill’s trajectory and refining its provisions.
Amendments and Revisions
In response to feedback and emerging challenges, amendments to the bill have been proposed to address specific concerns and improve clarity. These amendments may encompass areas such as data retention periods, cross-border data transfers, consent mechanisms, and the scope of regulatory oversight.
Impact Assessments
As part of the legislative process, comprehensive impact assessments are conducted to evaluate the potential economic, social, and regulatory implications of the proposed bill. These assessments help policymakers understand the practical effects of the legislation on businesses, consumers, and regulatory agencies, informing decision-making and resource allocation.
Public Awareness Campaigns
Concurrent with legislative efforts, public awareness campaigns have been launched to educate citizens about their rights and responsibilities concerning data privacy. These campaigns aim to empower individuals to exercise greater control over their personal data, make informed choices about data sharing, and recognise the importance of data protection in the digital age.
Cross-Sector Collaboration
Collaboration between government agencies, industry stakeholders, academia, and civil society organisations is essential for the effective implementation and enforcement of the Data Protection and Digital Information Bill. By fostering partnerships and sharing best practices, stakeholders can collectively address challenges, promote innovation, and uphold privacy rights.
Criticism of the DPDI Bill
Some have also criticised the DPDI bill because it is thought to reduce individuals’ right to access their data. The Open Rights Group states that the bill would weaken legal restrictions around internet monitoring and profiling will face limitations, making it simpler to utilise personal data for political purposes without voters’ consent or legitimate expectations. Read more from the ORG here. There is particular concern that the reintroduction of the disproportionate effort test in relation to subject access requests (SAR) will have a negative effect on data subjects, but the proposal is welcome from Controllers who see greater use of data subjects using information access requests as a weapon.
The Public Law Project has also expressed concerns that the bill, if passed, would water down accountability rules, making it harder for journalists, public society, and authorities to monitor political parties’ personal data use. Read more from the PLP here.
TechUK, however, points out that the GDPR has limitations too, especially for smaller businesses who may struggle to comply with some of the stricter GDPR rules. Their article addresses the potential misconceptions about the DPDI bill including limiting regulatory independence, weakened oversight of biometric data and surveillance camera footage, automated decision making and more. They assert that the DPDI Bill will continue to protect the rights of individuals and will not undermine the protections provided by the GDPR and other data protection laws. See the full article here.
As the Data Protection and Digital Information Bill progresses through the legislative process, it is essential to remain vigilant and engaged in ongoing discussions surrounding data protection and digital privacy. By staying informed, providing feedback, and advocating for strong privacy safeguards, individuals and organisations can contribute to the development of a robust and responsive regulatory framework that protects personal data while fostering innovation and economic growth.
The Data Protection and Digital Information Bill underscores the UK government’s commitment to modernising data protection laws, enhancing privacy rights, and addressing the challenges of the digital era. The bill has passed the 2nd reading and is currently at the Report stage in the House of Lords, where it will be further examined and amended prior to the third reading.
Footnote: DPDI Bill Suspended
Due to the upcoming UK election on 4th July, the DPDI Bill has been suspended and could be abandoned entirely, although tech and media industry leaders are pressing the government to push the bill through before the election. This could have far-reaching effects on the landscape of data legislation in the UK. We will share updates with you on this situation as it unfolds.
Author: Paul Adams LLB (HONS)
Paul is an information governance specialist and one of the founder Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.
