A Data Protection Bill with an Entirely Different Tone

The Queen’s speech, which was delivered by Prince Charles on May 10th, contained the expected announcement that the UK government intends to reform its data protection law.  Rather than follow the EU path of saying the new law will “give people control over their data,” this announcement emphasized providing more value to society through rules that will create a culture of data protection and will free data to drive responsible innovation.  Tone is important.  Vivien Redding’s 2012 announcement of the GDPR said it would give people more control over their data and would be risked-based.  Over time, the risk-based approach has been marginalized while data subject rights have been in the forefront of GDPR implementation. 

Let’s be perfectly clear.  We only have two pages of government notes and a sentence in a speech.  Let’s also be clear that the bill’s description has many elements that will create angst about regulator independence and risk to the UK’s tenuous adequacy status.  Translating big ideas into legislative language is a Herculean effort.  Most likely, the next document we will see is the government’s response to last Fall’s DCMS consultation.  At some point, legislative language will follow. 

The IAF’s “risk of what” paper has shown that real balancing of risks and rewards has been wrung out of data protection and must be restored to make current and future technologies  and data forward business models work.  The EU GDPR will need to be changed to work hand in glove with Europe’s digital agenda and the associated data and AI acts that recently have been introduced.

Tone is important.  Writing quality data protection law is extremely hard.  But in the end, data protection law needs to find a way to help organizations anticipate adverse processing consequences, both from processing and not processing data, and not just engage in endless check-the-box compliance. 

The sparse two-page outline hints at a laboratory for the development of next generation data protection law.  The IAF team is very interested in the UK’s journey going forward.