Impact of EU-GDPR on local authorities in England : an investigation into how the introduction of new EU data protection legislation will affect Local Authorities in the UK and what the key changes will be that this new law will force on these organisations.

Abstract

This research explores the EU General Data Protection Regulation (2016/679) (GDPR), due to come into force in May 2018, and its impact on UK local authorities. Its key objectives were to identify how the pending changes to data protection legislation might impact on current compliance procedures and policies. Its aim was to provide recommendations for local authorities regarding the key issues in order to minimise the risk of non-compliance with the new law by being better informed of the obligations the new rules impose on data controllers. The study first looked at the structure of the EU and the procedure for introducing new laws, to understand the provenance and supremacy of the legislation. It then looked at the political and legal background regarding data protection and compared the previous and existing legislation to the new Regulation to evaluate the amount of change likely.Consideration was then given to the current compliance situation in local authorities. Studies conducted by the ICO and Big Brother Watch identified major problems in some local authorities with breaches of the Data Protection Act resulting in considerable fines totalling in the millions. Whilst key principles of data protection will remain the same the new regulation will introduce important changes requiring greater vigilance over compliance if fines are to be avoided. One is the compulsory requirement to report data breaches, which could pose a serious problem in many local authorities. According to Big Brother Watch, 38% reported never having had a breach; at best this means they have little experience of dealing with one, at worst there could be more fines to come.The new law imposes a distinct change of direction, from educating organisations after a breach has occurred to requiring proof they took adequate measures to avoid one. This will necessitate implementing clear policies, recording any incidents, training staff adequately and having full accountability throughout the organisation. To avoid further losses to public sector services it is essential that local authorities make the needed changes to meet the new law