GDPR To be scrapped? Here’s how the UK’s new data rules would impact compliance officers

According to the International Association of Privacy Professionals (IAPP), the proposed bill’s underlying principles are consistent with GDPR. “From a compliance perspective, the essential similarities between the two regimes will not cease to exist once the DPDI Bill becomes law,” it found.

According to Dr Katharina Koerner, senior fellow at the IAPP, the detailed changes will reduce the compliance burden on data protection officers and privacy professionals.

However, Koerner points out some areas where the bill, as proposed, would increase compliance requirements. In addition to these, the new provisions require that unlawful direct marketing be reported to the ICO.

Breach costs may also rise. The maximum fine for infringing web cookie or direct marketing rules is currently £500,000, but this could rise to 4% of global revenue.

The proposed bill would replace GDPR’s requirement for organisations to appoint a data protection officer (DPO) with an obligation to instead identify a “senior responsible individual”. Koerner does not believe this will see the elimination of DPOs, however, as many of the measures mandated by the bill would require specialist expertise. “The need for our profession is ever growing,” she says.

The bill also includes legislation to promote the use of digital identity, allowing users to authenticate their identity without paper documents. This is an “impactful development for privacy professionals”, Koerner says. “New technologies such as self-sovereign identity will possibly get adopted and need to be understood and implemented.”

Artificial intelligence compliance regulations in the UK

Along with a new AI rulebook, also unveiled this week, the DPDI Bill proposes new rules for the way in which organisations use artificial intelligence. For example, “automated decision-making is subject to certain safeguards and the processing of special categories of data for the purpose of mitigating algorithmic bias is legitimate,” explains Koerner.

The AI rulebook, meanwhile, requires that organisations appoint an individual with responsibility for AI use. Will this responsibility fall to data protection and privacy officers? That remains to be seen, says Koerner. “There is a very big overlap between responsible AI and privacy, and as a result, governance models are emerging.”

“The person owning the responsible use of AI may report to the chief privacy officer,” she explains. “But they might both report to a third function, like the general counsel. In SMEs, those two roles can potentially merge in one.”

Best practice for responsible AI is to “integrate it into existing governance structures”, says Lee Howells, head of AI at PA Consulting. This governance should be able to draw on functional expertise from across the organisation, he adds, as “such expertise is likely to be held in multiple resources rather than an individual, especially in larger organisations”.

The rulebook requires that the use of AI is explainable. As a result, says Howells, “the entity responsible for understanding why an AI application has advised a given decision needs to be proficient at asking ‘why’; stopping only when the data scientists responsible for developing the AI application can explain incontrovertibly why it is determining the answer it is.”

Whether or not they are given ultimately responsibility for AI, privacy and data protection officers nevertheless need to understand the technology, says Koerner.

“AI is a fast-growing field. Privacy professionals need to constantly learn and educate themselves in this ever-changing AI environment. Besides technological aspects that must be understood, there are many open legal questions.

“With new regulations coming up, the complexity of AI requirements is increasing, as is the importance of cross-interdisciplinary collaboration, teams, and boards.”

Google, Microsoft and Mastercard offer advice

The government’s International Data Transfer Expert Council, made up of global experts on data, will play a major role in implementing the new laws if they are passed.

The group, which combines academics, organisations such as the World Economic Forum and the Future of Privacy Forum alongside digital industry figures including Google, Mastercard and Microsoft, will be empowered to remove barriers to data flows and ensure services from smart devices to online banking can be provided more reliably, cheaply and securely.

John Edwards, UK Information Commissioner, said: “Data protection law needs to give people confidence to share their information to use the products and services that power our economy and society. The proposed changes will ensure my office can continue to operate as a trusted, fair and impartial regulator, and enable us to be more flexible and target our action in response to the greatest harms.”

Timescales

After a Bill is published, it can take up to two months to receive royal approval. We won’t know for sure what the changes to the law will be until the autumn of 2022.