DPDI Bill (Proposed GDPR Reform / Replacement)

[foofighterjim]

Has anyone done much reading on the Data Protection and Digital Information Bill (DPDI) that is going through Parliament? https://bills.parliament.uk/bills/3430

 

This is the proposed UK replacement of GDPR, having read a number of summaries of the proposed bill, I am not particularly in favour. It reads that it would give government the ability to change scopes without prior scrutiny and could effectively make the ICO a governmental department by the back door. It also appears that general accountability will be lowered as will end user protections. I wouldn't say that GDPR is perfect but it has put a number of significant safeguards in place and attempted to make businesses fully accountable for the data they hold (and why).

 

Edit: Edited with the correct Bill link as per @BOOT3988

Edited March 28, 2023 by foofighterjim

[pete]

It's a Dorries' bill so it's going to be awful, but your link suggests it's not going through parliament in the current state?

 

This Bill was withdrawn on 8 March 2023

[BOOT]

It was replaced by a No. 2 bill.

https://bills.parliament.uk/bills/3430

[Ditto]

Only to be replaced by the 2nd bill... https://bills.parliament.uk/bills/3430. 1st reading was 8th March, 2nd reading scheduled 17th April.

[GrumbleDook]

As you might have guessed, I've done a fair bit of reading on it and there is a long way to go before we get a definitive position on what it is going to be like. There are a lot of lobby and advocacy groups chucking their tuppenceworth in on this and so it is still hard to say what could happen.

Key outtakes so far?

DPOs are replaced with Senior Responsible Individuals - this is one of the most heavily contested areas as it reduces accountability and could end up with disparity to the EU ... which could affect adequacy. From a supplier point of view, if you trade within the EEA then little changes for this.

Other accountability changes include narrowing the requirement on Records of Processing ... but that is unlikely to affect schools, as RoPAs will still be needed where there is a high risk to the rights and freedoms of data subjects ... and it would be a brave school that said that this didn't include them! ICO is meant to then produce guidance on what high risk would look like, and I would not be in the slightest bit surprised if schools get included in that.

A possible area of change would be that a recognised Legitimate Interest list would include "processing that is necessary for the purposes of ensuring the security of network and information systems" ... so anything that is part of the ops and security of your network and data might shift to LI ... though there is little difference if you are doing this under Public task right now ... apart from having to do a balance test ... oh, so it could create more work rather than less ... so I guess most would still go with Public task then!

 

Linked to this ... on Friday 31st, The Digital Futures Commission will be running a showcase of the activities they have been doing for the last 3 years around children's data and online activities. In the afternoon, we see their Blueprint for Education Data published and discussed. Baroness Kidron will chair a panel discussion (she was the principal architect in getting the Children's Code written and out there, as well as helping to make an IEEE standard from it and support other countries adopting similar codes). No doubt some of this will get raised during the panel discussion, and possibly the Q&A afterward, and if there is anything I can share back I will do. The panelists will include ICO senior staff, legal expertise, privacy advocacy, and vendor/school specialist (yours truly), and is likely to be a lively debate.