A British data protection system to replace UK GDPR

The Secretary of State for Digital, Culture, Media and Sport has recently announced the Truss Government’s intention to replace UK GDPR with a new British data protection system.  We have previously commented on the Johnson Government’s Data Protection and Digital Information Bill, which if implemented would have retained UK GDPR as the main UK legislative framework.  It now seems likely that the Government will pause this Bill whilst wider-reaching legislation is prepared.  The announcement in outline suggests:

• The changes are intended to support the Government’s growth agenda by reducing regulatory burdens and simplifying compliance for data controllers.  At the same time they are also intended to protect data privacy and help prevent loss from cyber attacks and data breaches.
• The new regime will move away from a “one size fits all” approach and be less onerous in particular for some smaller organisations and businesses.
• The Government will also seek to retain the EU-UK adequacy decision so as to minimise the risk of disruption to the flow of personal data from the EEA to the UK.  In drawing up proposals it will consider the approach in other countries that currently have EU adequacy decisions without adopting GDPR.  These include Israel, Japan, South Korea, Canada and New Zealand.

Further detail of the proposals and the timeframe for implementation have yet to be confirmed.  The announcement states that the new regime will be “co-designed” with business, which suggests there will be some consultation before legislation is put before Parliament.