Data protection | Regulatory Outlook July 2022

Data Protection and Digital Information Bill laid before Parliament

The Data Protection and Digital Information Bill was introduced to the House of Commons for its first reading on 18 July 2022. The Bill will not be debated until its second reading, which has been scheduled for 5 September 2022. This follows the government's publication of its response to its consultation on proposals to reform the UK data regime, "Data: A New Direction".

According to the government, the Bill aims to "simplify" the data protection framework within the UK in order to reduce burdens on organisations. Measures in the Bill include (among many others):

• Data Protection Officers (DPOs): A requirement for controllers and processors to designate a "senior responsible individual" as opposed to a DPO (the existing requirements in Articles 37-39 of the UK GDPR relating to DPOS would be repealed). The "senior responsible individual" would no longer be required to be "independent" but has to be a member of senior management; and

Data Protection Impact Assessments (DPIAs): The replacement of DPIAs with "assessments of high risk processing". These assessments would need to summarise the purposes of the processing; assess whether such processing is necessary and the risks it poses to individuals; and state how the controller intends to mitigate any risks identified.

• Personal data: Refinement of the definition of "personal data" by setting out that the question of whether an individual is identifiable depends on such matters as whether identity was identifiable by the controller/processor (or by a third party who is likely to obtain that data from the controller/processor) by reasonable means at the time of processing
• Cookies: Removal of the requirement of consent for cookies used purely for web analytics (provided not passed on to third parties).

Please see our Insight on the consultation response for further analysis.

UK government announces adequacy agreement in principle with South Korea

On 5 July 2022, the Department for Digital, Culture, Media & Sport (DCMS) announced that the UK and the Republic of Korea had reached an adequacy agreement in principle. According to DCMS, the agreement follows just under a year's worth of discussions. The announcement, signed on behalf of both countries, makes clear both nations' commitment to "contribute to a healthier and more sustainable global data ecosystem based on free and safe data flows" and to work together to improve data frameworks. It remains to be seen when an actual adequacy agreement will be made.

UK and US governments announce intention to bring Data Access Agreement into force this autumn

On 21 July, the governments of the UK and the US published a joint statement which outlined their intention to bring into force on 3 October 2022 the Data Access Agreement first signed between the parties in 2019. The agreement allows law enforcement in both the US and the UK to directly request data held by telecommunications providers in the other's jurisdiction, provided that this is for the purpose of preventing, detecting, investigating and prosecuting serious crimes.

According to the UK government, the agreement should enable law enforcement agencies to access information critical to their investigations more quickly. The government also clarifies that the agreement does not create any new powers as all requests by law enforcement agencies must comply with existing relevant domestic law obligations, but requires that the UK and US government respectively make sure their laws permit telecommunications providers to respond to such direct requests.