The UK Government introduced the Data Protection and Digital Information Act (No. 2) ("Act") in Parliament on 8 March 23. The law reduces compliance requirements and gives organizations flexibility in using personal information. Businesses that are not yet compliant will benefit from the changes.
The main points of the strategy are:
- Reducing barriers: The bill introduces definitions of "statistical surveys," "scientific research," "historical research," and “consent” for processing personal data. It intends to reduce the legal requirements for using personal data in various forms of research.
In addition, if the data owner's processing purpose is "legitimate interest," that is, if the processing is necessary for the investigation, investigation, or prevention of terrorism, the organization should not equate legal interest with rights and the likes of the curriculum. The law also empowers the Secretary of State to create, modify, and/or revoke recognized legitimate interests in the future.
The law also regulates a non-exhaustive list of other legitimate interests, including direct marketing, group transfers of personal data, and the processing security of networks and information systems. However, organizations need to assess this type of work satisfactorily. - Reducing the burden on businesses and increasing benefits for people: Organizations should only keep records of activities when they carry out activities that may pose a "high risk" to individuals' rights and freedoms. Such risks should be identified using the "nature, scope, content and purpose of the business." Some examples of high risk are organizations working on particularly large data (e.g., health insurance companies) or using new technologies to process large amounts of personal data (e.g., public face cameras).
The Senior Data Protection Officer ("SRI") replaced the Data Protection Officer role. Organizations should appoint an SRI only if the controller/processor is a government agency (a court or tribunal acting in its jurisdiction) or is a controller/processor that would pose a high risk to people. SRIs will be responsible for protecting information risks in their organisations unless they can assign this role to people with the necessary skills. The SRI must be part of the organization's senior management but may take on other roles besides the SRI roles.
Data controllers and processors not established in the UK will also not be required to appoint a representative pursuant to Article 27 of the UK GDPR. - Reducing Barriers to the Flow of Information: This Act establishes new tests (also known as "information bridges") for the Secretary of State to comply with necessary regulations. The foreign minister will be asked to make a joint effort to test, be more efficient, and set the protection standards for the third country/entity. In practice, this means that the Secretary of State can verify that many countries have adequate data protection.
This law will increase penalties for direct marketing violations (such as wiretapping and wiretapping) under the Privacy and Electronic Communications Regulations ("PECR"). The maximum fine will be increased from £500,000 to £17,500,000 or, in the case of a business, 4% of the business's global annual turnover, whichever is higher. Finally, the proposal has amended the PECR Law to expand the list of exceptions where it is necessary to allow cookies to be placed on the end user. These exemptions include, for example:- 1. Collecting statistical information on community service information for improvement;
- 2. Adapting the appearance or functionality of the website to the user's preferences;
- 3. Install necessary software updates to secure the End Device and
- 4. Locate a person in an emergency.
In addition to the exception for defining the area in an emergency, users should be provided with clear, detailed information about the storage (and access) of information stored on their edge devices, with the option to turn it off.