UK proposes new data protection regime, hopes for £10 billion economic boost

The British government introduced its new Data Use and Access Bill to Parliament on Wednesday, claiming the reforms to the country’s privacy regime could boost the economy by as much as £10 billion over the next decade.

Labour’s reforms have many similarities to those proposed under the previous government’s Data Protection and Digital Information Bill, although that proposal didn’t survive this year’s snap election.

The looming concern driving both bits of legislation — alongside relatively slow economic growth in a very dynamic sector — is a decision due in Brussels next year over whether the United Kingdom’s data protection regime is still compatible with the European Union’s.

This adequacy status means data can be exchanged between Britain and the EU without additional checks and compliance measures. However it has been a political issue in the wake of Brexit, with some in the Conservative Party seeking to capture what they see to be the benefits of having a much more light-touch regulatory system, particularly in relation to AI, that would necessarily involve departing from EU standards.

The counterpoint — reportedly backed by the government’s own internal figures, and recently advocated by a parliamentary committee — argues that the increased compliance costs incurred by British businesses would ultimately undermine any economic benefits.

Labour’s new approach has fewer opportunities to upset Brussels. Peter Kyle, the secretary of state for science, innovation and technology, has stressed he sees value in collaborating with the European Union.

Neil Ross, the associate director for policy at the industry body techUK, welcomed the new changes and said they “strike the right balance between maintaining the UK’s existing high data protection standards and driving forward essential reform.

“However, they must be coupled with the cultural and organisational mindset shift required to seize the full potential advantages of new data-driven technologies,” Ross added.

How does it make £10 billion?

The economic boost suggested by the government is based on estimates of economic costs avoided as well as benefits provided.

The cost-cutting includes hours lost in policing and the National Health Service (NHS) that the government says are otherwise wasted on bureaucracy.

In policing, this involves getting rid of the requirement for police and police staff to record the reasons they have accessed personal data — for instance when looking up a suspect or person of interest on the police database.

The purpose of this is to limit the misuse of data, but according to the government these manually input justifications are of little value and are rarely relied upon, with the persons misusing data — including corrupt police and corrupt police staff — being considered to be highly unlikely to admit to their misdeeds in the justifications entered in formal logs.

Data sharing within the NHS — which is in practice a federated collection of service — has been a challenging issue for several years. The government said the NHS “does not lack data; rather, it faces challenges due to data being fragmented across multiple sources. To unlock the full potential of the NHS, we need to strengthen the underlying infrastructure, improve data quality, and radically enhance the user experience.”

The government expects a reduction in duplicated laboratory testing “could save £65.4 million over 10 years” while the “up to 1.5 million hours” of police time would mean “approximately £42.8 million” annually spent on front-line policing.

Alongside improvement to public services, the bill aims to support the introduction of digital identity services — a voluntary way for people to securely confirm their identities online, and a growing sector the government estimates “could generate £4.3 billion” over the next decade.

Another section of the bill would see the government build a National Underground Asset Register (NUAR) — a “map of the underground pipes and cables” that will be used by businesses working with buries assets like water and electric companies to avoid the roughly “60,000 accidental strikes on buried infrastructure every year - costing the UK economy £2.4 billion.”

Other aspects of the law retained from the Conservative Party’s previous efforts include reforming the data protection regulator, the Information Commissioner’s Office, to create a new Information commission structured like other British regulators led by a chair, chief executive, and other executive and non-executive members.

The new commission would have increased powers, including requiring data controllers or processors to produce reports to aid in the commission’s investigations and the power to call individuals to interview. These powers are likely to address the dwindling number of investigations the regulator has been able to launch in recent years.

John Edwards, the Information Commissioner, welcomed the Bill and said it would “allow my office to continue to operate as a trusted, fair and independent regulator and provide certainty for all organisations as they innovate and promote the UK economy.”

Labour’s new bill also includes providing researchers with access to data held by social media platforms for online safety purposes, similar to the European Union’s Digital Services Act, although it is not yet clear who will qualify as a researcher.

While the EU is aiming to introduce a vetting procedure controlling this access, limiting it to independent research institutions, the British government plans to set out its own researcher access regime through secondary legislation after the bill has passed, informed by an upcoming Ofcom report into the matter.