Contractors, do you welcome or worry over the UK’s Data Protection and Digital Information Bill?

On April 17th 2023, the UK’s minister for data Julia Lopez outlined modern laws for a data-driven era as the Data Protection and Digital Information Bill got debated in parliament.

You're being updated to the latest version...

This new piece of legislation is an updated version of the Data Bill passed in July 2022, and hopes to help address problems faced by the public, such as cookie pop-ups, tacking nuisance calls with bigger fines, and improving trust in the way data is handled.

It seems like this is welcome news for consumers, including contractors in their role as digital citizens, who are often frustrated by incessant pop-ups and nuisance calls while they browse online – but it might add to your workload if you’re contractually expected to be across your client’s data obligations, writes Mel Hzeg of Gerrish Legal.

What are the objectives of the Data Protection & Digital Information Bill?

Minister Lopez claimed that this bill will provide greater flexibility for organisations to protect personal data while maintaining high data protection standards.

But corporate bottom lines beware, because the bill will also increase fines for nuisance calls and texts from £500,000 to either £17.5 million or up to 4% of global turnover, whichever is greater.

This 3500% increase in sanctions stand to heavily impact data officer contractors, as they will have to be more vigilant in ensuring that their client’s data practices comply with the new regulations.

Pros and cons of the bill for data contractors

So you’ll need to ensure that your client’s online systems are secure and that data is being handled in accordance with the new legislation. The new framework also means keeping-up-to date with guidelines from the Information Commissioner’s Office (ICO), with whom the government is closely working with to implement the bill and create of a statutory board (with a chair and chief executive), to make sure it remains a world-leading, independent data regulator.

But positively, the bill could significantly alleviate some pressures tech sector contractors face today. For example, the anticipated reduction in consent-related pop-ups on websites would make it easier for web site admins and other contractors to collect data without having to constantly ask for permission, which could streamline work processes while reducing friction in the user experience.

The UK-EU 'clear water' concern

Nonetheless, some are skeptical of the bill’s benefits, and others go further -- warning that the proposed framework will damage the privacy of UK residents and UK businesses alike.

One of the main concerns is that the bill seeks to distance itself from the GDPR rules of the European Union, which have been considered some of the most stringent data protection laws in the world.

Marijus Briedis, chief technology officer at NordVPN, sums up the concerns nicely: “By seeking to put clear water between itself and Europe over GDPR rules, the [UK] government is putting the personal privacy of UK residents at risk”.

There is particularly concern, given that many UK residents rely on European companies to process their data, and that the EU has strict requirements when it comes to the transfer of data outside of the single market.

Our stance, as a data law firm? Well, we would welcome any clarity on data protection laws but would be wary of any legislation that diverges from the EU GDPR standards.

Do you send/receive data from the continent?

The UK-EU corridor represents a considerable and safe data-transfer corridor, but that’s only because their data protection policy was seen as being held to the same standards as one another, prior to the introduction of this new UK data bill. Any changes made to these standards from the UK-side could force the EU to review the necessary safeguards required to transfer data to and from the UK. If that happens, the risk is that harm or at least disruption for IT contractors could follow, as a review could result in requirements to implement more paperwork on EU data transfer mechanisms, where they wish to send/receive data from the continent.

It has also been argued that while the relaxing of data restrictions might benefit smaller companies (even contractors’ own companies perhaps), it could also contribute to a consolidation of power among tech giants who already have significant influence over our lives.

At NordVPN, Briedis worries that the bill would reduce the need for transparency and accountability, making it harder for people to understand how their data is being used. The natural consequence of this is that companies could end up being more negligent and leave individuals vulnerable to cyber attacks and data breaches. After all, Briedis says “it is often their [large companies’] own poor safety practices that leave them [individuals] vulnerable.”

Final thought

While the Data Protection and Digital Information Bill has the potential to improve data protection and reduce irritating cookie pop-ups, it’s important to consider the potential risks associated with the bill, even if a bit of streamlining and fewer permissions does sound good. The government should take steps to address these concerns and ensure that the bill ultimately serves the best interests of UK citizens and their data privacy because currently, the question marks seem too numerous to just ignore.