• news-banner

    Expert Insights

Review of the Department for Digital, Culture, Media & Sport consultation

On 10 September 2021 the Department of Digital, Cultural, Media and Sport (DCMS) published a consultation titled ‘Data: a new direction’ (Consultation).  The Consultation is part of the UK governments wider national data strategy to unlock the power of data across the UK economy and secure a ‘pro-growth and trusted data regime’.  The Consultation closes on 19 November 2021 and recommends a number of fundamental changes to the current data protection regime in the UK.  We have considered 5 key proposals that will have a direct impact on how businesses can use data going forward if the changes are adopted.  

Key proposed reforms

The underlying intention of the Consultation is to: i) reduce barriers to innovation (particularly in spaces such as AI and machine learning development); ii) decrease the burden on businesses and a move away from ‘box ticking’ compliance; and iii) boost trade by reducing barriers to international data flows.  These core goals are considered and addressed by the following recommendations.

Research and science purposes

DCMS proposes further clarity on the existing protections for the use of personal data for science and research to ensure innovative businesses can fully realise the benefit of the current regulations.  This clarity could be achieved through the consolidation of current provisions, further guidance on interpretation and possibly through a new lawful basis for processing.  This reform would give research and development organisations much needed certainty in respect of their data processing activities.

Lawful basis for processing

The Consultation identifies an ‘over-reliance on consent’ which has resulted in ‘consent fatigue’ among individuals which in turn reduces consent and impedes responsible data use.  A driving factor of the over reliance on consent is the uncertainty surrounding reliance on legitimate interest and the complexity of the legitimate interest balancing test.  The Consultation proposes to publish an exhaustive list of legitimate interests for which an organisation can rely without having to perform the balancing test.

Legitimate interest is often viewed as a more uncertain lawful basis on which to rely but with an exhaustive list of authorised purposes organisations may be more willing to move away from reliance on consent.  Although, to ensure it can withstand the test of time, the list will likely be generic which may still cause interpretation challenges for businesses looking to rely on the list.  The language of the listed legitimate interests will be vital to see the benefit of this proposed reform.

Focus on innovation and AI

DCMS recognises the increased role artificial intelligence (AI) and machine learning will play in future health, social and economic innovation.  There is a recognition that the technology neutral nature of the UK GDPR is important to ensure its effective application, while at the same time guidance is needed on how principles such as “fairness” can be addressed in the context of machine learning.  Currently, for solely automated decision making consent is required to process personal data.  DCMS is proposing that as part of the exhaustive list of legitimate interests (as explained above), the government will include circumstances where legitimate interest can be relied on in relation to AI systems for the purposes of monitoring, detecting and correcting bias.   There is an emphasis on facilitating data use in AI and machine learning within the wider context of regulatory movement in this space. 

Adequacy and international data transfers

According to the UK Government’s press release unveiling the UK’s post-Brexit global data plans, there is an estimated £11 billion worth of trade going unrealised around the world due to barriers associated with data transfers. Recognising this barrier, DCMS notes that the UK government will be adopting an ambitious programme of adequacy assessments to add countries to its adequacy list and increase unrestricted data flows.  Adequacy will be assessed on a risk based analysis to create a scalable, flexible adequacy regime in the UK.   The Consultation proposes to shift the focus of international data transfers mechanisms to ensure they are necessary and proportionate, using a risk based metric that the current transfer mechanisms do not take into account.

Anonymisation

DCMS recognises the current challenges faced by organisations looking to classify data as pseudonymised or anonymised.  As such, DCMS proposes new tests for establishing anonymisation which , in theory, should provide organisations with clarity on using techniques such as pseudonymisation or anonymity for security and data minimisation.  However, in a particularly interesting consideration, the Consultation proposes introducing legislation confirming that anonymisation will be “relative to the means available to the data controller to re-identify”.  It is not clear whether the relative test would replace the motivated intruder test or whether the motivated intruder test would still play a role in establishing what means are available to the data controller in order to re-identify.

Commentary

The Consultation identifies key pain points for businesses and endeavours to resolve them by taking a risk-based, proportionate approach to regulation.  The UK GDPR is a principles based legislation and DCMS recognises the benefits and flexibility of this approach.  However, the DCMS also recognises that there is a need to clarify the application of current data protection laws to facilitate the secure use of data.  While the changes, if implemented, will come as a welcome relief for SME businesses a question arises as to the security of the UK’s adequacy decision from the European Commission if the UK were to implement such widespread data reform.  The UK’s adequacy decision from the EU includes a sunset clause which means the decision will automatically expire at the end of 4 years unless renewed.  If the UK adopts the proposed reforms in the Consultation there is a chance UK data protection law will diverge from EU law to such an extent that it may put the UK’s adequacy decision at risk.

What next?

The Consultation is still in its consultation phase and the recommendations being made are just suggestions at this stage.  The implementation of any of the suggestions may take time and input from numerous stakeholders.  This consultation is the first step in the process of reforming the UK’s regime for the protection of personal data and foreshadows possible changes to come.  

Our thinking

  • Women in Leadership: Planning for the future

    Sarah Wigington

    Events

  • Property Patter – Filming Agreements Part 2

    Naomi Nettleton

    Podcasts

  • Charles Russell Speechlys Paris significantly strengthens litigation practice with notable team hire led by Frédéric Dereux

    Frédéric Dereux

    News

  • Trade Credit Insurance – Protection, Economic Instability and Increased Demand

    Mary Barrett

    Insights

  • Consumer Duty - FCA warns that some firms are “lagging behind”

    Richard Ellis

    Insights

  • UK Government AI Regulation Response & Roadmap – Is the Government behind the wheel?

    Mark Bailey

    Insights

  • Remote Hearings – factors to consider

    Richard Kiddell

    Insights

  • Richard Davies writes for City AM on the lessons that the Premier League can learn from the Super Bowl and NFL

    Richard Davies

    In the Press

  • The ongoing fight against fakes

    Charlotte Duly

    Quick Reads

  • Abu Dhabi’s New Arbitral Centre Unveils its Rules

    Dalal Alhouti

    Quick Reads

  • Fortune quotes Richard Davies on sponsorship deals and the strength of brand/supporter loyalty in football

    Richard Davies

    In the Press

  • Legal tips and trends for Creative Design Agencies in 2024

    Rebecca Steer

    Insights

  • Charles Russell Speechlys advises Downing LLP on the successful refinancing of its loan facility with Kao Data

    News

  • New Regulations for the UAE’s Media Sector in 2024

    Mark Hill

    Quick Reads

  • Megan Paul writes for The Grocer on why green energy can be a 'money saver' for retailers rather than a 'money spender'

    Megan Paul

    In the Press

  • Greenwashing: The Story So Far

    Caroline Greenwell

    Insights

  • Under the Influence: Legal Considerations for Social Media Influencer Partnerships in the UAE

    Mark Hill

    Quick Reads

  • Reuters quotes Megan Paul on supply chain considerations coming out of tensions in the Red Sea

    Megan Paul

    In the Press

  • EU AI Act – Will it become a law for all the world?

    Nick White

    Quick Reads

  • Indemnity Costs in Derivative Claims – Briefing Note

    John Sykes

    Insights

  • Trading insolvently or trading out of difficulty? Are we being naughty or did we have the best intentions? Part 3

    Claudine Morgan

    Insights

  • Ctrl + GCC: The Rise of e-Sports in the Gulf

    Mark Hill

    Quick Reads

  • Digital Markets, Competition and Consumers Bill: Will new consumer protection rules restrict access to Gift Aid?

    Verity Heath

    Quick Reads

  • Radical reforms to fight economic crime: what should businesses do now?

    Rhys Novak

    Insights

  • Arbitration Rules – How Different Are They?

    Mazin Al Mardhi

    Insights

  • Caroline Swain writes for Startups Magazine on 'Green Claims'

    Caroline Swain

    In the Press

  • Caroline Swain writes for Fashion Capital on the EU’s new legal framework on textiles

    Caroline Swain

    In the Press

  • The End of the SAG-AFTRA Strike & What it Means for the Middle East

    Mark Hill

    Quick Reads

  • UAE Strengthens its Position as Leading Destination for A.I.

    Mark Hill

    Quick Reads

  • Dubai Court of Cassation Extends Arbitration Agreement Across Subsequent Contracts

    Peter Smith

    Quick Reads

  • UAE Polishes Federal Arbitration Law

    Peter Smith

    Quick Reads

  • Drone deliveries: Be Prepared

    Emma Humphreys

    Quick Reads

  • Product compliance and Brexit - UK Government concedes to CE markings indefinite recognition

    Jamie Cartwright

    Quick Reads

  • Has the Orpéa plan impaired shareholder's consent? - Le plan de sauvegarde d'Orpéa n'a-t-il pas vicié le consentement des actionnaires historiques ?

    Dimitri-André Sonier

    Quick Reads

  • Will the downturn in the Paris region property market lead property companies to turn to ad hoc proceedings, as they did in the 1990s?

    Dimitri-André Sonier

    Quick Reads

  • Les défaillances en France proches de leur niveau de 2019 - French insolvencies close to 2019 levels

    Dimitri-André Sonier

    Quick Reads

  • Casino Group: An agreement with investors and debt holders is expected at the end of July

    Dimitri-André Sonier

    Quick Reads

  • DIAC Issues First Annual Report

    Georgia Fullarton

    Quick Reads

  • One year on: "Influencer Culture: lights, camera, inaction" remains astonishingly accurate

    Caroline Swain

    Quick Reads

  • Saudi Center for Commercial Arbitration publishes new Arbitration Rules

    Peter Smith

    Quick Reads

Back to top