On March 15, 2024, the Information Commissioner's Office (ICO) published its view on the Data Protection and Digital Information Bill (DPDI Bill). In particular, the ICO stated that whereas it supports the DPDI Bill's objectives, further revisions are needed to refine its provisions and enhance its effectiveness.

Government amendments to the Data Protection Framework

The ICO welcomed Government amendments to the Data Protection Framework aimed at enhancing legal clarity and maintaining high data protection standards by ensuring that the statutory override in the current Data Protection Act (DPA) is unaffected by the Retained EU Law Act (REUL Act), guarding against inadvertent overrides by other legislation.

Definition of personal data

The ICO explained that it had initially raised concerns that the DPDI Bill's drafting could lead to a narrow interpretation of what constitutes personal data. The ICO noted that the Government has since clarified that the controller's subjective intention is not a determining factor in identifying personal data, a position the ICO intends to reinforce through future guidance.

High-risk processing

The ICO advocates for clearer definitions of high-risk processing within the DPDI Bill, suggesting the inclusion of a list of high-risk activities akin to Article 35(3) of the UK General Data Protection Regulation (GDPR). According to the ICO, this would help organizations better assess their processing activities and adhere to the law. Furthermore, the ICO suggests a provision allowing it to designate additional high-risk processing activities, subject to parliamentary approval, to ensure the framework remains adaptable to future challenges.

Social security information requirements

Further, the ICO discusses the proposed power to require information for social security purposes, emphasizing the need for legislative precision to minimize data collection and clearly define the scope of information processing to ensure the measure is necessary, proportionate, and compliant with data protection standards.

Overall, the ICO supports the DPDI Bill, emphasizing its potential to refine the UK's data protection landscape. The ICO explained that it would continue to provide its independent advice on further changes during the remaining phases of the parliamentary process.

You can read the ICO's view here.