Faculty cautions against radical data protection reform
A radical overhaul of the United Kingdom’s data protection regime would be premature, the Faculty of Advocates has stated in a consultation submission.
Faculty was responding to the UK Department for Digital, Culture, Media & Sport’s consultation entitled Data: A New Direction. It proposes a package of reforms to "create an ambitious, pro-growth and innovation-friendly regime that underpins the trustworthy use of data". Specifically, it aims to reduce barriers to innovation, lessen burdens on businesses, deliver better outcomes for people, boost trade and reduce barriers to data flows, deliver better public services and reform the Information Commissioner’s Office.
Responding, Faculty states that given that less than four years has passed since the enforcement of the GDPR, it is "difficult to advance any empirical or logical basis as to why the current regime is no longer fit for purpose". There should be greater engagement with the public, private and third sectors to identify any perceived strengths, weaknesses and room for improvement within the current regime before any wholesale reforms. Until then, reforms should be limited to nuanced and incremental changes.
Regarding barriers to innovation, Faculty advises against the implementation of "rigid, technologically specific, and exhaustive provisions", instead retaining the emphasis, in the GDPR and Data Protection Act 2018, on adherence to a principle-based approach to data use.
It comments: "In terms of specific emerging technologies, such as artificial intelligence, and the use of innovative data sharing solutions... it is the position of the Faculty of Advocates that public confidence in the use of personal data in such contexts is the key to unlocking the socio-economic benefits thereof. We submit that the regulatory functions of the ICO paired with the heightened vigilance of the principle-based approach inherent in the GDPR and Data Protection Act 2018 are, in the long-term, conducive to ensuring the responsible use of data in such contexts, whilst striking a fair balance between data protection and realising socio-economic benefits from the use of data.
"Upsetting this balance through reforms which encourage maximisation of the ease of data processing and potentially erode the heightened vigilance of data controllers and processors inherent in the current principle-based system may risk compromising fundamental rights in the interests of the objectives expressed in the consultation document."
Faculty further expresses concerns that a shift in focus towards privacy management programmes tailored to specific businesses "will result in a laissez-faire attitude towards compliance, and potentially undermine the principle-based nature of the GDPR and Data Protection Act 2018".
Parallel concerns are voiced regarding the chapters on boosting trade and reducing barriers to data flows; and on delivering better public services.
In considering whether changes should be made to the Information Commissioner’s Office, Faculty states that in the absence of any compelling evidence that it is unfit for purpose in its current form and function, this would be unwise. It cautions against a wholesale expansion of its enforcement powers, stating that these are already expansive, being both investigative and punitive in nature.
Click here to access the full response.