A new Data Protection Bill will implement the EU’s General Data Protection Regulation into UK law.
Set to be implemented next May, the new Bill will enable individuals to ask for their personal data to be deleted, with non-compliance to result in companies facing large fines.
Since it was originally proposed, the main criticism of the regulation was the impact it could have on smaller firms, particularly those who regularly deal with and hold client details.
This is because the new Bill will require the consent of individuals to be obtained before they are called, with consumers actively having to opt-in.
Where their data is being passed to third parties, they must have been fully informed beforehand.
The main concern for businesses is the change of internal processes, with employees having to quickly adapt and adhere to the new regulations. A recent survey indicated that the majority of businesses are not prepared for the change, which could cause major problems in the future, given the scale of the sanctions.
Despite the criticism it has received, the Bill has also been praised for providing clients with much more control over their personal data.
Matt Hancock, the Digital Minister took this view, stating that it “will give us one of the most robust, yet dynamic, set of data laws in the world”.
The Bill’s key proposals include:
- Providing individuals with the ‘right to be forgotten’ by businesses
- Simplifying the process to withdraw consent where personal data has been used
- Where sensitive personal data is processed, firms must obtain explicit consent
- The definition of personal data to expand to encompass internet cookies and IP addresses
- Enabling people to obtain any information held on them more easily
- Identifying someone from anonymised data or a pseudonym to be made a criminal offence
- Tampering with data that someone has requested to see to be made a criminal offence
Set to replace the existing Data Protection Act 1998, further information on the new Bill can be accessed here.
