Will the UK replace GDPR with alternative regulations?

At the 2022 Conservative Party Conference, Michelle Donelan announced in a speech that the UK government is intending to replace the UK GDPR with a new “British data protection system. Now that the UK has left the European Union, the government sees an opportunity to depart from the EU-based regulations”.

Donelan stated that the government “will be replacing GDPR with our own business-and consumer-friendly British data protection system”. She continued by stating, “it will be simpler, it will be clearer, for businesses to navigate. No longer will our businesses be shackled by lots of unnecessary red tape”.

She then went on to cite Israel, Japan, South Korea, Canada and New Zealand as examples of countries that operate without having GDPR, but instead have their own data protection systems in place.

With such a strong and clear-cut statement, it seems as though we may well see significant changes to data regulation in the UK, with the potential scrapping of GDPR and the introduction of a new system that the current government believes to be less bureaucratic.

How does this announcement affect the Data Protection and Digital Information Bill?

In July 2022, before former Prime Minister Boris Johnson resigned, the government published the Data Protection and Digital Information Bill (DPDI), which already aimed to make some changes to existing data regulations.

This was “a bill to make provision for the regulation of the processing of information relating to identified or identifiable living individuals”. It did not aim to replace existing legislation but instead amend the existing UK GDPR.

It is generally thought that the changes outlined in the DPDI would be minor and something that is largely similar to the GDPR system would still be in place. There would have been no radical departures from the existing regulatory system.

However, following Michelle Donelan’s announcement at the Conservative Party Conference, it seems that the government may now consider more substantial changes to data regulation in the UK.

The Data Protection and Digital Information Bill’s passage through the legislative process was paused in September 2022 to allow for further consideration following changes to the UK’s governmental leadership. It may now be withdrawn and replaced with some more substantial in line with Donelan’s speech.

What would a replacement for UK GDPR look like?

We do not yet have many details about a new UK data protection system, but it sounds as though government want to find a simpler way for organisations, particularly small businesses, to navigate consumer privacy, while still continuing to protect their data. They want a solution focused on “growth and common sense” while still protecting data privacy.

There is an important balance to be met though, as it is essential that the UK maintains the EU’s adequacy decision (which currently enables the sharing of personal data between the UK and EU). Risking this by decision by oversimplification may only result in increasing trade barriers with the EU. We must maintain ‘essential equivalence’ with GDPR in order to maintain the adequacy decision.

The Information Commissioner’s Office, the UK regulator for data protection, released a statement following the speech, stating, “We are pleased to hear the Government’s commitment to protecting people’s privacy, preserving adequacy and simplifying data protection law.”

Updates from the government on new data protection rules will likely become available in due course, so we will keep you updated.

In the meantime, please do get in touch with our employment team if you have any queries.