The UK government has stated that the purpose of the Bill is to reduce red tape and encourage innovation, modernise the Information Commissioner’s Office, and improve appropriate access to data in health and social care contexts by designing a more flexible approach, focused on privacy outcomes rather than box-ticking exercises.
The Government proposes to2:
- Remove some obligations, such as to:
- appoint a data protection officer;
- conduct data protection impact assessments;
- consult with the Information Commissioner in relation to high-risk processing; and
- prepare records of processing activities.
- Allow broader use of data for research and AI projects, or consolidating the research provisions in the UK GDPR and Data Protection Act 2018 to provide more clarity. [Please note that the ICO have recently issued a draft guidance on the processing for research purposes. More information on this can be found here];
- Change the law to enable public authorities to share personal data for specific purposes, such as public health purposes; and
- Reform the Information Commissioner’s Office to enhance its enforcement powers but also to make it more accountable to the Parliament and public.
The DCMS analysis indicates that the proposed reforms will create over £1 billion in business savings over ten years by reducing burdens on businesses of all sizes3. Despite the revolutionary tone of these announcements, the UK will still likely wish to ensure that the reform does not lessen the protection of personal data and thus does not impact the EU adequacy decision, which enables the free transfer of personal data from the EU to the UK.
It may take some time before the Bill is tabled. At the same time, there seem to be some parallels on approach on the European front. On 3 May, the European Commission launched the European Health Data Space (EHDS) which aims to foster a single market for digital health services and products. Part of the EHDS strategy is improving the use of health data for research, innovation and policymaking4.
