ICO publishes view on Data Protection and Digital Information Bill

The Data Protection and Digital Information (DPDI) Bill was first introduced to Parliament in 2022 but the legislative approval process was paused to enable collaboration with and input from business leaders and data experts. The DPDI Bill was re-introduced to Parliament on 8 March 2024 following various amendments by the Government. The ICO has now published its opinion on the latest version of the DPDI Bill.

The amendments to the DPDI Bill seek to improve the ability for academics and scientists to use data for research purposes, reduce the record-keeping burden on organisations to demonstrate compliance and clarify the application of safeguards for automated decision-making. The opinion published by the ICO states that although the ICO supports the objectives of the DPDI Bill, further revisions are required to ensure the DPDI Bill is clear and effective.

The ICO was positive regarding the Government’s technical amendments to provide greater legal certainty on international data transfers for law enforcement purposes and calculation of time periods. The ICO also noted that its concerns regarding the narrow definition of personal data had been addressed by the latest amendments.

However, the ICO emphasised that many comments by the ICO given in May and December 2023 had not been addressed. One area of particular concern relates to high risk processing, where the ICO requests that high risk processing activities are listed in the DPDI Bill (as they are currently under the UK GDPR) and that the ICO is given powers to designate other processing activities as high risk in order to future proof this definition.

We will continue to monitor developments in relation to the DPDI Bill and report on them.

The ICO opinion on the latest and previous drafts of the DPDI Bill are available here. We have published a summary of the changes proposed by the DPDI Bill here.