End of an era: What’s next for UK data protection?

At the end of this month, if the UK leaves the EU with an agreement on 31 January, it will enter the transition period which, for data protection, means that EU law and the GDPR will continue to apply until the end of 2020. However, there will be tweaks to the UK Data Protection Act, for example to remove all references to the EU. This version, the so-called “Keeling schedule” for the UK Act, and the UK GDPR, is available here.

For now, the UK GDPR and revised DP Act 2018 will recognise all EEA/EU countries as adequate, as well as the existing EU adequacy decisions. The Department of Culture, Media and Sport (DCMS) is working on the UK’s own adequacy assessments, and of course its application for EU adequacy with the aim of achieving it by the end of the year. We are in close contact with the DCMS and will report on the details as soon as possible.

In this issue we bring you news about a potential important new development – the ICO is lobbying to receive new powers under the Proceeds of Crime Act. The proposals include confiscation and cash seizure powers – very powerful weapons if they were to be added to the ICO’s arsenal. The ICO’s own consultation on this matter may have gone largely unnoticed just before Christmas, but it is now putting representations to the Law Commission. We expect to hear more about the developments in the first quarter of 2020.

Developments on Codes of Conduct may be slow, but it is worth keeping an eye on this area, as codes represent new opportunities for businesses. Read an analysis of the aspects to consider, and UK developments regarding the appointment of the UK Accreditation Service (UKAS) as the certification body.

Our new correspondent, Helena Wootton, reports back on the new guidance issued by the European Data Protection Board on the territorial application of the GDPR.

Also note that the ICO is now consulting on subject access requests until 12 February and seeking comments on its draft Marketing Code by 4 March.

Laura Linkomies
Editor, Privacy Laws & Business

January 2020