CM July and August 2023 digital

More documents

Recommendations

Info

OPINION Trial and Tribulation New legislation will change the landscape for data protection. AUTHOR – Jeanette Burgess “The intention is to update and simplify the UK's data protection framework, reducing burdens on organisations while maintaining high data protection standards.’’ AT the start of March, the Government announced the reintroduction of the Data Protection and Digital Information Bill. First mooted in July 2022, the original Bill was withdrawn ‘to allow ministers to consider the legislation further.’ But if the UK General Data Protection Regulation (GDPR) and UK Data Protection Act (DPA) are around five years old, why is the Government introducing new legislation… and why now? The Government says that it is seeking to capitalise on post-Brexit freedoms to make changes to the current data protection regime. The Government's view, according to the new Bill’s explanatory notes, is that some elements of the UK GDPR and DPA create barriers, uncertainty and unnecessary burdens for businesses and consumers. This new Bill is the culmination of a reform programme which began with a public consultation back in autumn 2021. A Bill was first introduced in July 2022, but it never got off the ground and was paused so that ministers could engage in a co-design process with business leaders and data experts. This new version of the Bill is the result of that process. It doesn't create wholesale change, but rather seeks to amend current laws. Brave | Curious | Resilient / www.cicm.com / July & August 2023 / PAGE 20
As part of the drive to cut ‘red tape’, the Bill relaxes the currently strict rules around website cookies. – Jeanette Burgess The goal of the Bill In its announcement of the new Bill, the Government describes it as a 'commonsense-led' UK version of the EU's GDPR. The intention is to update and simplify the UK's data protection framework, reducing burdens on organisations while maintaining high data protection standards. One of the key aims is to give businesses more flexibility with how they comply, moving away from a box-ticking approach. The Government also wants to promote growth and innovation and 'unleash' more scientific research. In overview, key features of the new Bill include: • a reduction in the paperwork and the number of consent pop-ups people see online; • the establishment of a framework for the use of trusted and secure digital verification services; • an increase in public and business confidence in AI technologies; • an increase in fines for nuisance calls and texts; and • reforms to the ICO and to the rules on transferring personal data to third countries. Overall, the Bill doesn't radically change the data protection regime and organisations will still need to make sure that they only process personal data where they have a lawful basis to do so and that data protection principles are complied with. There are, however, various changes introduced by the Bill which could help businesses reduce costs. For example, under the proposed new regime, the obligation to maintain records of data processing will only apply to organisations that carry out high risk processing activities. The role of the Data Protection Officer will be replaced with that of the Senior Responsible Individual (SRI). Organisations will only need to appoint an SRI where they are a public authority or otherwise engaged in high-risk processing. As the name implies, the SRI must be a senior person in the organisation but can carry out this role in addition to other functions. It remains to be seen what impact these changes will have on organisations in practice, and it will depend on the nature of their processing activities. (There are also proposed changes to the data subject access requests (DSARs) regime – see below.) Companies with operations in the EU will still need to comply with the EU GDPR, and so it may be cheaper for them to continue to follow the current regime in the interests of consistency – to the extent that is possible under the new Bill. If they choose to adopt separate compliance programmes for their EU and UK operations, that is likely to increase rather than reduce costs. Businesses will be able to continue to use their existing international data transfer mechanisms to share personal data overseas if they’re already compliant with current UK data laws, meaning that they won't need to incur extra costs in implementing a new system. The Bill proposes the establishment of a 'digital verification services trust framework' where providers of digital verification services are accredited and listed on a DVS register. 'Verification services' means services provided at an individual's request and involve ascertaining or verifying a fact about the individual from information provided by another source, and confirming to another person that the fact about the individual has been ascertained or verified from the information provided. In essence, once an individual has created a re-usable digital identity, it is anticipated that they may – once in wider acceptance – be able to re-use it to assert their identity or something about themselves – for example, their age or address. It will also give individuals more control over the data points they share, rather than sharing a whole document that doesn’t allow an adjustable level of control. If implemented effectively, the framework could make it easier for employers to use digital verification services providers when verifying employees/future employees. The devil will be in the detail, however, and the Secretary of State will need to consult with the ICO and possibly others when setting up the framework. In a similar vein, the Bill creates powers for the Secretary of State and HM Treasury to introduce smart data schemes in consumer Brave | Curious | Resilient / www.cicm.com / July & August 2023 / PAGE 21 “It will also give individuals more control over the data points they share, rather than sharing a whole document that doesn’t allow an adjustable level of control.’’ continues on page 22 >
Page 1 and 2: CREDIT MANAGEMENT CM JULY & AUGUST
Page 3 and 4: SEAN FEAST FCICM MANAGING EDITOR Ed
Page 5 and 6: CICM GOVERNANCE President: Stephen
Page 7 and 8: NEWS ROUNDUP Mixed signals from bus
Page 9 and 10: NEWS ROUNDUP >NEWS IN BRIEF Stephen
Page 11 and 12: CCeeer ttiiiffiiiccaatteee ooff CCo
Page 13 and 14: “The fact that arbitration exists
Page 15 and 16: TECH IN ACTION SMART THINKING Leade
Page 17 and 18: a ‘foreign representative’ may
Page 19: Zilch wants to see the outright ban
Page 23 and 24: Fill your vacancy or find your next
Page 25 and 26: “Providers must of course do what
Page 28 and 29: CICM TRAINING Training courses that
Page 30 and 31: Rising stars A new series which put
Page 32 and 33: International Trade Monthly round-u
Page 34 and 35: COUNTRY FOCUS Jamaica goes beyond t
Page 36 and 37: COUNTRY FOCUS “Jamaica is not wha
Page 38 and 39: BUSINESS ADVICE Little things HMRC
Page 40 and 41: CICM BEST PRACTICE Setting Standard
Page 42 and 43: Choosing the right career path that
Page 44 and 45: Introducing our CORPORATE PARTNERS
Page 46 and 47: HR MATTERS Web of Lies Lying on a C
Page 48 and 49: STATISTICS Data supplied by the Cre
Page 50 and 51: LOOKING FOR YOUR NEXT CAREER MOVE?
Page 52 and 53: LEGISLATION MISSING IN ACTION The B
Page 54 and 55: NEW AND UPGRADED MEMBERS Do you kno
Page 56 and 57: Cr£ditWho? CICM Directory of Servi
Page 58 and 59: Cr£ditWho? CICM Directory of Servi
Page 60: Ethical and efficient debt recovery

CM July and August 2023 digital

Create successful ePaper yourself

Delete template?

Save as template?