{"id":36783,"date":"2022-06-23T10:00:00","date_gmt":"2022-06-23T10:00:00","guid":{"rendered":"https:\/\/cloudnewshub.com\/archives\/36783"},"modified":"2022-06-23T10:00:00","modified_gmt":"2022-06-23T10:00:00","slug":"what-will-the-data-reform-bill-mean-for-uk-businesses-operating-in-the-eu","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=36783","title":{"rendered":"What will the Data Reform Bill mean for UK businesses operating in the EU?"},"content":{"rendered":"
<\/div>\n

At the state opening of parliament on 10 May<\/a>, the Prince of Wales announced the government\u2019s intention to reform the UK\u2019s data protection regime. Since Brexit, this has comprised two complementary laws \u2013 the UK GDPR<\/a> (General Data Protection Regulation) and the DPA (Data Protection Act) 2018.<\/p>\n

The UK GDPR applies both to UK organisations that collect, store or otherwise process the personal data of individuals residing in the UK, and to non-UK organisations that offer goods or services to, or monitor the behaviour of, UK residents. As its name suggests, the UK GDPR is based on, and is substantially similar to, the EU GDPR, which applied in the UK before Brexit.<\/p>\n

The DPA 2018 supports the UK GDPR and applies to certain types of processing that are outside the Regulation\u2019s scope, including processing by public authorities. The DPA 2018 also sets out data processing regimes for law enforcement processing and intelligence processes.<\/p>\n

The GDPR originated in the EU \u2013 albeit with significant input from UK experts and the UK\u2019s data protection authority, the Information Commissioner\u2019s Office (ICO) \u2013 so Boris Johnson\u2019s government, elected on a promise of getting Brexit done and cutting EU red tape, has long earmarked it for reform.<\/p>\n

According to the official briefing notes for the Queen\u2019s Speech, reforming the UK GDPR and DPA 2018 should \u201ccreate over \u00a31bn in business savings over 10 years by reducing burdens on businesses of all sizes\u201d, such as \u201cexcessive paperwork\u201d and other obligations that have \u201clittle benefit to citizens\u201d.<\/p>\n

The outcome of the Department for Digital, Culture, Media and Sport consultation on data protection reform has now been published<\/a> and the principal recommendations that will be carried through to legislation are now known.<\/p>\n

In essence, these proposals seek to lessen the administrative burden on organisations (reducing \u201cred tape\u201d), while maintaining an adequate level of protection for individuals\u2019 rights.<\/p>\n

The key requirements are as follows.<\/p>\n

\n

<\/i>Organisations must implement privacy management programmes<\/h3>\n

Maintaining the principle of accountability is key, and this is intended to be maintained by implementing a privacy management programme, which needs to be proportional to the risk created by the organisation\u2019s data protection processing activities. The government believes that such programmes \u201cwill place greater emphasis on the principles at the core of accountability, such as organisational responsibility; risk management; transparency; training and awareness of staff; and continuous monitoring, evaluation and improvement of data protection management within an organisation\u201d.<\/p>\n

In practice, this is often the approach already taken by larger or more complex organisations. This broader approach is to be welcomed, as it will encourage the many smaller organisations that perhaps currently do not do enough to review and modify their practice in order to introduce a more appropriate data protection programme.<\/p>\n<\/section>\n

\n

<\/i>Removal of the requirement to designate a DPO<\/h3>\n

Article 37 of the UK GDPR requires a data protection officer<\/a> (DPO) to be appointed in certain specific circumstances. Currently, it is not mandatory for the vast majority of UK organisations to appoint a DPO.<\/p>\n

A data protection officer is responsible for:<\/p>\n