Thread by @allthecitizens

🔴 In July this year #DataReformBill was introduced in the House of Commons. The Bill was this govt's spin off of #GDPR

But it has now hit the brakes, announcing a revamp of the Bill. What were the plans so far & what will change?

A 🧵...

/1
techcrunch.com/2022/10/03/uk-…

The announcement of changes to existing GDPR replacement came from Michelle Donelan.

Speaking about this at the #ToryConference, she said, "we will be replacing GDPR with our business and consumer-friendly, British data protection system" /2
techmonitor.ai/policy/geopoli…

She also said that data adequacy will be retained "so businesses can trade freely."

But many are worried an added regulatory regime on top of the EU's GDPR will only add to the woes of UK businesses working with EU countries. /3

https://twitter.com/mdbuckley/status/1577122696126615553?s=20&t=OjLl-hRgKMNHLck1ouwUZQ

It’s unclear how ‘taking aim at bureaucratic EU “red tape” in a bid to boost growth', this administration’s slogan, will actually help to achieve this, as businesses wanting to provide services to the EU will still have to be GPDR compliant. /4

Additionally, there’s also the time it would take to adhere to the new legislation, involving altering the way legal departments and marketing teams operate, adding an additional burden to firms looking to make the change. /5
browsermedia.agency/blog/what-coul…

Should they not wish to participate in GDPR regulations any longer, then they could also be seen as ‘less trustworthy’. /6

One of the main changes made in the previous version of the Bill was an amendment to the definition of “personal data” - so something would be considered personal data only if “processor” of this data were to think so “at the time of the processing” /7
pinsentmasons.com/out-law/analys…

The changes to meaning of “personal data” is dangerous because companies could use it as a reason to let themself off hook - by stating that they weren’t aware of identifiability of the data at the time of processing. /8

Regarding SAR the bill also changed language surrounding what orgs can refuse, enabling them to do so if they deem the request to be “vexatious or excessive”, altering the language from “manifestly unfounded or excessive”, with the org determining what qualifies as “vexatious” /9

Under right of access, individuals have right to ‘obtain a copy of their personal data, as well as other supplementary information.' /10
ico.org.uk/for-organisati…

'It helps individuals to understand how and why you [as a company] are using their data, and check you are doing it lawfully’, as per the ICO website /11

This Bill, in handing more control of terminology to orgs, could ultimately lead to even fewer responses from govt bodies & private companies.

The government has previously been criticised for presiding over a “profound lack of transparency” already. /12
opendemocracy.net/en/freedom-of-…

It is still unclear what exact direction the #DataReformBill will take in its new iteration; whether it will align with the EU, or move further away from it, and government are currently still considering the direction the legislation will take under Liz Truss. /13

The UK govt recently said it is having talks with the US on data flows and adequacy. But things still are unclear, and the govt has left UK businesses in a state of limbo for now. /14
videoweek.com/2022/10/10/uk-…

Here's the Data Protection Act 2018
legislation.gov.uk/ukpga/2018/12/…