International Transfer of Personal Data

Another key challenge is for those businesses wishing to operate outside of the UK. Under the new proposals, organisations would be able to take a risk-based approach to assessing the impact of transferring personal data internationally using standard contractual clauses. This change could present a real risk to the free flow of personal data between the UK and the EU. 

Such a risk based approach may differ from the EU approaches where some data protection authorities have said that the GDPR’s provisions on transfers of personal data to third countries do not allow for this approach. 

The very nature of the new Bill is to simplify the UK’s data protection framework, yet in reality for businesses operating outside of the UK it will cause more complexity and more confusion.

More Clarity on Consents 

Finally, the proposed Bill needs to provide more clarity on consents. Currently consent is defined as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.

Under the new Bill if a person gives permission for their data to be used for a specific research project, this consent can be extended (without further permission) to other projects, even if these were unknown at the original time of consent. The idea of the Bill is to reduce consent fatigue, yet although it addresses consent, my fear is that it actually makes things even more complicated.

It will be interesting to see if and how the Bill progresses. The Law Society has aired its reservations surrounding the approach for being too business and innovation focussed which may be detrimental to individual rights and protection. The data rights activist body, Open Rights Group has also commented on the Bill’s restriction of data subject’s rights within the EU GDPR. Without some urgent changes to the points mentioned above I perceive some challenging times ahead. 

If you would like expert support on issues relating to data privacy and GDPR, get in touch so we can advise you on the best solution.

This Article is for information purposes only. It contains our own views and opinions and doesn’t constitute legal advice.  You should not act upon this information without seeking legal advice.