Small businesses don’t need Data Protection Officer, tougher fines for nuisance calls: UK new data rules

The government said it believed the new rules would not stop the free flow of data with the European Union and lawyers said Britain was adopting incremental reform.

• Chandrashekar Bhat
• 17 June, 2022

By: Chandrashekar Bhat

Britain will set out a new data protection regime on Friday that diverges from EU regulations, which it says will ease the burden of compliance on businesses and reduce the number of annoying cookie pop-ups that plague consumers online.

The government said it believed the new rules would not stop the free flow of data with the European Union and lawyers said Britain was adopting incremental reform.

Britain’s data regulations since Brexit have mirrored the EU’s General Data Protection Regulation (GDPR), the comprehensive legislation adopted in the bloc in 2016.

In return the EU recognised Britain’s standards – a process called adequacy – that enabled the seamless flow of data to continue.

The European Commission (EC) said in August “it would closely monitor any developments to the UK’s rules”, adding that adequacy could be suspended, terminated or amended if changes resulted in an unacceptable level of protection. 

Digital Secretary Nadine Dorries said the reforms would “make it easier for businesses and researchers to unlock the power of data” as well as retaining a “global gold standard for data protection”.

For example, the bill will remove the need for small businesses to have a Data Protection Officer and to undertake lengthy impact assessments, it said, with a privacy management programme used to the same end.

It will also include tougher fines for firms hounding people with nuisance calls.

Britain said the EC had itself made clear that adequacy decisions did not require countries to have the same rules.

“Our view is that these reforms are fully compatible with maintaining the free flow of personal data from Europe,” a government spokesperson said.

Linklaters technology lawyer Peter Church said the government had rejected the idea of replacing GDPR with an entirely new framework and instead opted for incremental reform of the current framework.

“This is good news for data flows between the EU and the UK, as these more modest reforms mean the EU Commission is less likely to revoke the UK’s adequacy finding, which would have caused significant disruption,” he said.

(Reuters)