Plus ?a change: the year in data protection

So that was 2022.

And what a year it was. We’ve had - at the time of writing - three prime ministers, four chancellors, two secretaries of state at DCMS, and one brand new Information Commissioner. Add to that a draft bill to reform UK data protection law that was introduced, paused, for a time appeared to have been scrapped altogether and then (possibly) revived, and you’d be forgiven for struggling to keep up.

But all this political chaos has taken us precisely nowhere. Data protection law ends 2022 stubbornly in the same place as it began. A rare year of consolidation, if not exactly tranquility, in a period where change has become the norm.

The Data Protection and Digital Information Bill was supposed to be a flagship reform, moving the UK's laws away from the moribund EU model and unleashing innovation. At least that was the idea. But after its first reading in June, political events led to a pause, which has been extended as the Sunak government rethinks its priorities and tries to avoid further political turmoil. We still don't have a date for the Bill's second reading.

It's a similar story on human rights reform. Then Deputy Prime Minister, Dominic Raab, introduced a bill to replace the Human Rights Act 1998 with a new 'British Bill of Rights' in the summer. When he lost his job under Liz Truss, the idea was shelved, only to be brought back (along with Raab himself) when Rishi Sunak became Prime Minister. I'm not sure anyone can say with any confidence what'll happen next to these controversial proposals.

With all these reforms stalled, the major change in 2022 has been a new Information Commissioner. John Edwards took up the post in January and has certainly made his mark, with a flurry of new guidance published and a new regulatory approach. In particular, his decision to stop fining public sector bodies was controversial, but has led to an increased focus on the use of reprimands. The ICO's recent decision to publish all reprimands is a welcome step and adds to wider understanding of the ICO's approach.

Looking further afield, the thorny issue of international data transfers hasn't gone away. In March, the EU and the US announced a new framework that may ultimately replace the now-defunct EU-US Privacy Shield. Not to be outdone, the UK government announced a parallel framework that would operate for UK to US transfers. All this appears to be good news, but any new adequacy arrangements will be followed by inevitable legal challenges. Meanwhile, November saw the ICO finally publish its long awaited guidance on international data transfers. In short, it's (still) complicated.

So what might we see in the coming year? In such strange times, it’s difficult to make predictions with any confidence. But the political equation hasn’t fundamentally changed, so expect to see renewed attempts at data protection reform in 2023.

We still have a Brexit government that is instinctively sceptical about any laws originating from the EU, including the GDPR, and wants to push its pro-business credentials. Reform of data protection law ticks both boxes and so will be back. Following the chastising events of 2022, the government is unlikely to attempt anything too radical, so expect to see the return of the Data Protection and Digital Information Bill in broadly the same form.

Privacy campaigners will continue to be infuriated, seeing any change as a ‘watering-down’ of protections, and government spokespeople will applaud a Brexit ‘win’. For the rest of us, there’s the weary resignation of trying to get to grips with yet more changes.

The proposed Retained EU Law Bill is an altogether more worrying prospect. If enacted, it would automatically repeal any laws derived from the EU at the end of 2023, unless those laws are preserved or amended by Ministers. Retained EU law in the firing line includes the UK GDPR, the Privacy and Electronic Communications Regulation and approximately 6,000 others, although no-one knows the exact number. To get all of these reviewed in twelve months is more than optimistic, especially in the current political climate. Hopefully common sense will prevail, otherwise we’re in for even more chaotic times ahead.

Plus ?a change, as the French might say.