Data Protection and Digital Information Bill - what's happened?

As a general election has been called for July 4th, Parliament had a very limited time to get through pending Bills before Parliament was suspended until after the election. This process is called the ‘wash-up process’ if you've ever wondered. You’ve guessed it, the Data Protection and Digital Information Bill (DPDI Bill) was not one of those that made went through this process.

In a way, I feel it is probably for the best as there were several questions, comments and issues still to be answered. There were controversial parts of the bill that made it the mainstream media and press, for example, the DWP’s bank account snooping powers, which meant there was no cross-party agreement which I am sure hindered the progress through the House of Lords and House of Commons.

There were also concerns about the impact on the EU Adequacy Decision as many EU Member States saw the Bill as a weakening of data protection legislation in the UK and a route to open up more surveillance. Many of us who handle personal data of EU residents or sell services to people in the EU would still have needed to comply with GDPR despite any changes in the UK so we potentially could have had a more complex two-tier approach.

I have not personally advocated for changing courses or policies based on the draft Bill, so if you have heeded this approach, you have saved ourselves a few tasks. You have also ensured that you do not waste your valuable time and budget, nor do you need to attend the anticipated flurry of webinars and courses that would have appeared.

As it stands, the Data Protection Officer (DPO) is still the statutory role and there is no obligation to appoint a board level Senior Responsible Individual (although it is always good to have someone at board level who has a focus on supporting data protection and information governance compliance). The fines for breaches of Privacy and Electronic Communications (PECR) are not increased to mirror those of GDPR, and the Information Commissioner and his Office will not change its format or legal status (my reading was that it was planned to align it to a format and legal status similar to OfWat, OfCom etc).

One of the downsides of the DPDI Bill now being an “failed bill” is for those who work in not-for-profits as that the anticipated ‘relaxation’ for marketing for this sector (and Parliametary parties) will not go ahead. This means we need to continue to find other compliant approaches.

All this means we carry on as before and await whatever any future government decides to do, if anything, about data protection legislation.

Get in touch if you would like advice and support on data protection and information governance.