Duhs, Eleonor

SOAS Research Online

SOAS ICOP Policy Briefings   To Inform Government and Parliamentary Debates For further information contact the author at e.duhs@bateswells.co.uk. Contact Professor Alison Scott-Baumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS. Changes to Data Protection Law and the Risks to the UK Economy by Eleonor Duhs, Barrister Partner and Head of Privacy at Bates Wells, (8th March 2023) The free flow of personal data across borders is essential to the modern economy. Finance, banking, retail and hospitality, which make up large segments of the service sector powering the UK’s prosperity, all depend on the free flow of personal data.  The free flow of data between the UK and its biggest trading partner, the EU, is therefore of crucial importance. Reforms to our data protection and human rights frameworks, as well as sweeping changes to laws we inherited from the EU, could put EU-UK data flows at risk. A lack of free flow of personal data from the EU to the UK could cost UK businesses up to £1.6bn. Currently, there is a free flow of data from the EU to the UK. This is because the EU has assessed the UK’s framework as providing an equivalent level of protection of personal data as the EU. The basis for this assessment is:    • the fact that the UK has an independent regulator for data protection, the Information Commissioner; • the UK’s adherence to the European Convention on Human Rights; and •  the UK’s current data protection regime, the UK GDPR, which is retained EU law and mirrors the EU’s data protection framework. The Government’s legislative agenda could risk the free flow of data between the EU and the UK if it: • Undermines the Information Commissioner’s independence (previously clause 31 of the Data Protection and Digital Information Bill required the Commissioner to seek approval from the Secretary of State when issuing codes of practice). • Places freedom of speech above the right to privacy in a way which unbalances the relationship between competing rights, potentially undermining people’s ability to enforce their privacy rights (see Clause 4 of the Bill of Rights Bill). • Fundamentally changes the way in which retained EU law (of which the UK GDPR is an example) operates and is interpreted, giving rise to uncertainty (see the Retained EU Law (Revocation and Reform) Bill).   MPs are urged to use the debate at second reading of the Data Protection and Digital Information Bill to point out that diverging from EU data protection standards and changing the way in which UK data protection law is interpreted could lower data protection standards in the UK and therefore risks the free flow of data from the EU, which will add to the burdens on UK businesses.   

Changes to Data Protection Law and the Risks to the UK Economy

SOAS ICOP Policy Briefings   To Inform Government and Parliamentary Debates For further information contact the author at e.duhs@bateswells.co.uk. Contact Professor Alison Scott-Baumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS. Changes to Data Protection Law and the Risks to the Economy by Eleonor Duhs, Barrister, Partner and Head of Privacy at Bates Wells  (17th April 2023) The free flow of personal data across borders is essential to the modern economy. Finance, banking, retail, and hospitality, which make up large segments of the service sector powering the UK’s prosperity, all depend on the free flow of personal data.  The free flow of data between the UK and its biggest trading partner, the EU, is therefore of crucial importance.  Reforms to our data protection framework as well as sweeping changes to retained EU law could put EU-UK data flows at risk.  A lack of free flow of personal data from the EU to the UK could cost UK business up to £1.6bn.   Currently, there is a free flow of data from the EU to the UK.  This is because the EU has assessed the UK’s framework as providing an equivalent level of protection of personal data to that in the EU.  The basis for this assessment includes:    • The fact that the UK has an independent regulator for data protection, the Information Commissioner.  • The UK’s current data protection regime, the UK GDPR (which is retained EU law) mirrors the EU’s data protection framework. The Data Protection and Digital Information (No. 2) Bill, as well as the government’s wider legislative agenda could risk the free flow of data between the EU and the UK through: • Undermining the Information Commissioner’s independence (for example, clause 31 of the Data Protection and Digital Information (No. 2) Bill requires the Commissioner to seek approval from the Secretary of State when issuing codes of practice). • Fundamentally changing the way in which retained EU law (of which the UK GDPR is an example) operates and is interpreted, giving rise to uncertainty (see the Retained EU Law (Revocation and Reform) Bill); and  • Conferring powers on Ministers to remove fundamental protections that exist under the current regime, such as the right not to be subject to solely automated decision-making (see clause 11 of the Data Protection and Digital Information (No. 2) Bill and the regulation-making power in new Article 22D). This power could be used to remove protections as recommended by the Taskforce on Growth and Regulatory Reform (see paragraph 225).   MPs are being urged to use the second reading debate of the Data Protection and Digital Information (No. 2) Bill to highlight the potential risks of diverging from EU data protection standards and changing the interpretation of UK data protection law. The powers conferred on Ministers in the Bill could also lower data protection standards in the UK, leading to an increase in burdens on UK businesses and potentially impacting the free flow of data from the EU. In addition, the current impact assessment conducted by the government ignores the collective impact of the reforms. The changes could result in significant legal uncertainty and make our data protection regime difficult to interpret, leading to increased costs. 

Changes to Data Protection Law and the Risks to the Economy

SOAS ICOP Policy Briefings   To Inform Government and Parliamentary Debates For further information contact the author at e.duhs@bateswells.co.uk. Contact Prof Alison Scott-Baumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS. Changes to data protection law and the risks to the UK economy by Eleonor Duhs, Barrister,  Partner and Head of Privacy at Bates Wells (5th September 2022).  The free flow of personal data across borders is essential to the modern economy.    Finance, banking, retail and hospitality, which make up large segments of the service sector powering the UK’s prosperity, all depend on the free flow of personal data.  The free flow of data between the UK and its biggest trading partner, the EU, is therefore of crucial importance.  But reforms to our data protection and human rights frameworks, as well as sweeping changes to laws we inherited from the EU could put EU-UK data flows at risk.  A lack of free flow of personal data from the EU to the UK could cost UK business up to £1.6bn. Currently, there is a free flow of data from the EU to the UK.  This is because the EU has assessed the UK’s framework as providing an equivalent level of protection of personal data as the EU.   The basis for this assessment is:    • the fact that the UK has an independent regulator for data protection, the Information Commissioner; • the UK’s adherence to the European Convention on Human Rights; and •  the UK’s current data protection regime, the UK GDPR, which is retained EU law and mirrors the EU’s data protection framework. The Government’s legislative agenda risks the free flow of data between the EU and the UK by: • Undermining the Information Commissioner’s independence by requiring the Commissioner to seek approval from the Secretary of State when issuing codes of practice (see Clause 31 of the Data Protection and Digital Information Bill). • Placing freedom of speech above the right to privacy in a way which unbalances the relationship between competing rights, potentially undermining people’s ability to enforce their privacy rights (see Clause 4 of the Bill of Rights Bill). • Fundamentally changing the way in which retained EU law (of which the UK GDPR is an example) operates and is interpreted, giving rise to uncertainty (see proposals for the forthcoming “Brexit Freedoms Bill”). MPs are urged to use the debate at second reading of the Data Protection and Digital Information Bill to: • point out that together the Data Protection and Digital Information Bill, the Bill of Rights Bill and the “Brexit Freedoms Bill” will lower data protection standards in the UK. • emphasise that the reforms risk the free flow of data from the EU, which will add to the burdens on UK businesses.   