The history of the Data Protection and Digital Information Bill (DPDI Bill)
The DPDI Bill (No 1) was presented to Parliament on 18 July 2022. Since then, Since then, it has passes from the Department for Digital, Culture, Media and Sport (DCMS) to the newly formed Department for Science, Innovation and Technology (DSIT). DPDI Bill (No 1) had not made any progress through Parliament, owing, at least in part, to the fractious political goings on of 2022.
In September 2022, the second reading of DPDI Bill (No 1) was pulled to ‘allow ministers to further consider this legislation’. There were rumblings of taking inspiration from other countries such as Israel, Japan, Canada and New Zealand, where data adequacy is achieved without GDPR.
As many assumed, on 8 March 2023, the Government confirmed that DPDI Bill (No 1) had been withdrawn and New Technology Secretary Donelan introduced the Data Protection and Digital Information Bill (No 2) (DPDI Bill (No 2)).
How much has changed and will it make compliance easier?
DPDI Bill (No 2) is a revised version of DPDI Bill (No 1), rather than a rewrite that some expected as the as the Government tries to balance the adequacy decision with the EU, whilst trying to reduce the regulatory burden on businesses.
Whilst the DPDI Bill (No 2) will see the UK data protection regime moving further away from the EU data protection regime, it is not a radical change. The main thrust of the UK data protection regime will stay the same but some of the proposed changes in DPDI Bill (No 2) will reduce the compliance burden on businesses.
As with DPDI Bill (No 1), we consider the most significant question is whether the changes proposed will, in the eyes of the EU, mean personal data is not considered to be adequately protected in the UK and put the UK’s adequacy decision with the EU at risk. The adequacy decision allows for the free flow of data from the EU to the UK without organisations having to put any additional measures in place.
The next stage for DPDI Bill (No 2) is for it to receive its second reading in the House of Commons. The date for the second reading is still to be scheduled.
What will DPDI Bill (No 2) mean for businesses?
In terms of whether it meets the demands of businesses, the Government press release states that The Data Protection and Digital Information Bill was “co-designed with business from the start” and that DPDI Bill (No 2) was developed in consultation with business leaders and data experts. Businesses expecting that they will no longer need to worry about data protection matters will be disappointed. DPDI Bill (No 2) still maintains high standards of data protection rights.
DPDI Bill (No 2) introduces more flexibility for businesses in terms of how they manage their record keeping and compliance with data protection legislation. In addition, the proposed changes to the cookies regime give more flexibility, for example the changes may allow the use of certain analytical cookies without consent where the data is being used to improve services/websites. Businesses will need to consider the proposed requirements of DPDI Bill (No 2) carefully and understand how it will change UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) 2003. Businesses will need to check that their current standards and internal processes meet the proposed new requirements established by DPDI Bill (No 2). In the majority of cases where businesses are compliant with the current data protection regime, they will be compliant with the new regime.
Womble Bond Dickinson (WBD) is a full-service international law firm sitting amongst the Top 20 UK law firms and ranking 109th globally.
