It is undeniable that 2022 promises to be a significant year for developments in the UK’s data protection regime. At the beginning of January, John Edwards became the new UK Information Commissioner. Just a few weeks later, on 2 February, the Department for Culture, Media and Sport laid the International Data Transfer Agreement, the international data transfer addendum to the European Commission’s standard contractual clauses and a transitional provisions document on the use of the current standard data protection clauses for international transfers before the UK Parliament for approval. The protection of children online, through the application of the Age Appropriate Design Code, will also continue to be a key priority of the ICO.
Here, we provide a "taster" of some of the key things to look out for over the coming months.
The shape and direction of UK DPO law
Influenced by the new Information Commissioner
John Edwards has succeeded Elizabeth Denham as the UK’s new Information Commissioner, having previously served as the New Zealand Privacy Commissioner. Mr Edwards intends to spend the next five years in post seeking to ensure that individuals recognise and comprehend how they want their data to be used, as well as ensuring that they have access to remedies if required. With that in mind, he has already announced a “listening exercise” to sound out views from individuals, businesses, and other organisations about their experiences of working with the ICO. This exercise will involve the roll out of a survey and events being held all across the UK. Following on from this exercise, it will be interesting to see how the new Information Commissioner sets new information rights priorities.
Follow-up to the Department for Digital, Culture, Media and Sport consultation “Data: A new direction"
Towards the end of 2021, the ICO published its response to the UK Government consultation, ‘Data: A new direction’, overseen by the Department for Digital, Culture, Media and Sport (DCMS).
The lofty ambition of the consultation is to “develop a world-leading data policy that will deliver a Brexit dividend for individuals and businesses across the UK”. The consultation outlined various proposals for reforming the UK’s data protection legal framework, which was last significantly updated in 2018 when the General Data Protection Regulation and Data Protection Act 2018 came into force, replacing rules that had been in effect for two decades. This consultation may result in a significant overhaul of the UK’s data protection regime.
It is evident from the consultation that the UK Government wishes to regain control of its data protection laws, but the ICO’s response has highlighted that the proposals may not necessarily work in practice and further clarity is required. The DCMS will publish the UK Government’s response to the consultation in Spring 2022, following a thorough analysis of all the submissions.
Update to the ICO Regulatory Action Policy
The ICO launched a public consultation on its regulatory approach in December 2021 and is seeking feedback on the following three documents: the ICO’s Regulatory Action Policy, Statutory Guidance on the ICO’s Regulatory Action, and Statutory Guidance on the ICO’s PECR Powers. These documents stipulate how the ICO intends to carry out its task to uphold information rights for the UK public.
The ICO previously consulted on its statutory guidance in 2020, and the latest review provides stakeholders and the public with an opportunity to comment on how the ICO regulates the laws it monitors and enforces. The consultation concludes at 5pm on 24 March 2022 and updated documents are expected to be issued by the end of this year.
New journalism code of practice
The ICO’s consultation on the draft journalism code of practice closed in January. It invited views on the processing of personal data for the purposes of journalism covering not only traditional press, broadcast media and professional journalists but also, citizen journalists, and the disclosure of information, opinions or ideas, by any means to the public. The draft code details how personal data can be processed in the context of journalistic activities and in compliance with data protection legislation. It does not consider media regulation or other privacy claims that individuals may be able to claim from a legal point of view. Once finalised, the code will serve as a primary resource and reference point for expectations more broadly in relation to the processing of personal data for media content. The consultation closed on 24 January 2022.
This article was co-written by Manahil Qadir.