Data Protection and Digital Information Bill: A threat to fair markets and open public services

KEY POINTS

• The government is seeking to fundamentally alter the UK’s data protection regime through a Bill reforming the UK GDPR.
• As well as threatening the UK’s ‘data adequacy’ determination from the EU (which allows data to freely flow between the UK and EU), it undermines crucial rights:
  • It will be easier for organisations to ignore requests and take longer to resolve disputes, creating an incentive to refuse the exercise of data subject rights.
  • Processing in many areas – such as the excessive data collection on gig economy workers to detect supposed fraud – will be easier.
  • A new definition of personal data may drastically reduce protections for ‘pseudonymised’ data, including that processed by third party processors often used by sectors such as the gambling industry.
• Vulnerable workers and consumers have come to rely on these rights:
  • Gig economy workers use data rights to understand how platforms regulate their participation in rigged markets, giving them greater bargaining power.
  • Online gambling customers have uncovered how companies profile them to maximise profits, even when they have stopped gambling.

RECOMMENDATIONS

• The new ‘recognised legitimate interests’ should be removed, retaining the requirement to consider how data processing affects individuals.
• The new and lower thresholds to refuse data subject requests should be removed.
• The new definition of personal data must be clarified.
• Representative bodies should be empowered to bring claims and ‘super-complaints’ on behalf of data subjects to improve levels of legal compliance.