The UK Prime Minister plans to "rip up" bureaucracy to promote growth, but straying too far from the EU data protection could prove costly.
Personal data has been flowing freely between the UK and the EU under so-called "adequacy decisions." These rulings by the EU Commission basically say that data protection standards are good enough in a third country for EU data to be transferred there.
But that status is set to expire in June 2025, and the EU will reevaluate whether UK law provides adequate data protection guarantees.
The UK government unveiled a new bill on Wednesday (23 October) to update the law and unlock the economic potential of data.
Dubbed the Data Use and Access(DUA) Bill, some parts of it diverge from the GDPR:
The Secretary of State is given power to change what is classified as special category data to approve third countries for data exports.
It introduces "recognised legitimate interest" that can remove the need to do a Legitimate Interest Assessment, which would normally be required for a data processor's right to trump a data subject rights
It allows automated decisions more widely than GDPR, only requiring additional consent or need when special category data is used. This could prove significant for AI applications.
On the economic side, the bill gives room for the government to create more data spaces and introduces registers and frameworks for data sharing and identity verification.
The Government focused mostly on the economic potential in their announcement, saying that the bill will "boost UK economy by £10 billion" (€12 billion).
But while the bill aims to boost economic activity around data, losing the GDPR adequacy status could be its own headache, the House of Lords European Affairs Committee said in a letter to Secretary of State for Science, Innovation and Technology Peter Kyle on Tuesday. They urged the government to maintain EU data adequacy while attempting to fix problems with the GDPR.
"While compliance with GDPR can itself be costly, the loss of data adequacy would also lead to significant financial penalties for many organisations," the letter reads.