Thread by @allthecitizens

We believe the latest Data Protection and Digital Information Bill, UK’s post-Brexit replacement for Europe’s GDPR data regime, introduced yesterday by @michelledonelan, is worse than the previous one and puts data rights at severe risk.

Here’s why🧵#DPDIBill

Here we explained how the previous version was riddled with thorny issues and a business-centric approach that neglects data privacy and transparency

https://twitter.com/allthecitizens/status/1633079206308462593?s=20

The government now says it has ‘co-designed the latest version of the bill with businesses and data experts”, and that it could save organisations in Britain £4.7bn over ten years.
gov.uk/government/new…

According to the gov, the new bill is aimed at maximising benefits for the UK economy while removing unnecessary admin and expenses.

The new regime is undoubtedly very popular among business leaders, since it waters down their responsibilities and accountability requirements.

DPDI removes GDPR's obligation for all businesses to keep data processing records. This requirement will now only apply to companies engaging in “high risk” activities, e.g. health data. The catch? They can figure out for themselves if their processing activities are “high risk”.

The latest draft of the DPDI Bill also redefines “scientific research” in relation to processing data as any processing that “could reasonably be described as scientific”. It means that businesses have the same leeway as academics to use your data.

It also expands the number of ‘legitimate interest provisions’ to legitimise a wide range of personal data usage.
More in general, the bill empowers the Secretary of State to amend primary legislation without meaningful accountability or democratic scrutiny.

Civil rights organisations and privacy activists fear that the new draft could further infringe on data protection rights, by removing protections and giving businesses more discretionary power on how they use personal information.
techmonitor.ai/policy/privacy…

For example, DPDI lowers legal certainty over accountability requirements and the independence of Data Protection Officers, renamed Senior Responsible Individuals.

According to @burkeabigaile, policy manager at @OpenRightsGroup, the bill fails to address the privacy concerns raised by civil society

.@burkeabigaile also warns that #DPDIBill could harm businesses as it increases the risk of failing to meet EU adequacy requirements. The UK has a post-Brexit “data adequacy” agreement with the EU, but the EU can revoke it if UK data protections plummet
techmonitor.ai/policy/privacy…

We share these concerns.

This is why, with 25 other organisations, we signed an open letter to @michelledonelan asking the government to scrap the new #DPDIBill.

Take action to protect your data rights.

Support our joint campaign openrightsgroup.org/blog/the-data-…