Cybersecurity Policy Report, UK’s ICO Releases Latest Views on Data Protection Bill, (Mar 15, 2024)
By Tony Foley
The United Kingdom’s Information Commissioner’s Office (ICO) has published its updated view on the status of the Data Protection and Digital Information (DPDI) Bill, which would, if enacted, update and streamline the U.K.'s version of the General Data Protection Regulation (UK GDPR).
The latest offering from the ICO follows a similar release in January that recognized changes made to the legislation since Information Commissioner John Edwards offered an initial endorsement of the legislation in May 2023 and provided additional guidance (CPR, Jan. 2). As the bill returns to Parliament’s House of Lords for further scrutiny, the ICO’s updated view weighs in on new clauses added by the government since ICO’s last statement.
In general, the ICO welcomed the government’s amendments, saying that they made important technical clarifications to the proposal. In addition, however, the ICO expressed updated positions on a number of the DPDI’s provisions, including the following:
(1) Definition of “personal data”: The ICO cited its previous comments that the draft bill would lead to an expansive view of what constitutes personal data, and although it conceded an intervening statement from the government that this was unintentional, the ICO expressed a desire to see the issue formally addressed in the text, explanatory notes, or parliamentary debate.
(2) High-risk processing: The ICO maintains that the DPDI should contain additional detail and provisions to clarify high-risk processing, setting out activities that meet this definition on the face of the bill, and ensuring that the definition remains “future-proof” by specifying that the ICO has the ability to further designate activities that fall within the category.
(3) Social benefits information: Acknowledging the scale of the U.K.’s benefit fraud and error problem, the ICO emphasized that, for a measure requiring the release of information for social benefits purposes to be deemed as necessary and proportionate, the legislative language must be drafted sufficiently tightly to expressly minimize the level of data collected and to clarify what information will be processed and for what purpose.
“Overall, the Bill remains one which I support as improving the effectiveness of the data protection regime in the UK, upholding people’s rights, providing regulatory certainty and clarity for organisations, and improving the way the ICO regulates,” Commissioner Edwards concluded. “I will continue to engage with government and Parliamentarians to provide my independent advice on further changes during the remaining phases of the parliamentary process.”
News: InternationalLegislation DataPrivacy DataSecurity GDPR