EU data protection rules to be rolled into UK law

People will be given new powers to control their own data under new legislation proposed by Westminster on Monday.

The Data Protection Bill would let citizens ask for their personal data, or information that was posted or stored when they were children, to be deleted.

And companies which ignore the laws would be subject to marge fines, according to the Digital Minister Matt Hancock.

The proposal included aspects of the European Union’s upcoming General Data Protection Regulation, to be rolled into UK law in preparation for Brexit.

“The new Data Protection Bill will give us one of the most robust, yet dynamic, set of data laws in the world,” Matt Hancock said.

“It will give people more control over their data, require more consent for its use, and prepare Britain for Brexit.”

Included in the bill were proposals to make it easier for Britons to withdraw previous consent for their personal data to be stored and used, along with a method for people to ask for data to be deleted.

The bill would also require firms to obtain clear and explicit consent before processing and using personal data.

Under the bill’s descriptions, things such as IP addresses, DNA and computer cookies would fall under personal data for the first time in law.

People would also be given new powers to access the information companies hold on them more easily, and it would become a criminal offence to identify people from anonymised data.

Businesses were cautiously welcoming of the new legislation, with the British Chambers of Commerce saying having the EU regulation formalised in UK law would give business owners clarity ahead of Brexit.

“Bringing these measures into domestic law now will give businesses more certainty about the UK’s data protection regime during the Brexit transition, but more communication is needed to ensure that every company is aware of the changes,” BCC director general Dr Adam Marshall said.

“Firms of every sector want to be sure that their trade with suppliers and customers around Europe can continue without interruption, which means that the long-term compatibility of UK and EU data protection rules must be a priority.”

Dr Marshall said consumers needed assurance from business that any personal data held would not be misused, and businesses needed a helping hand from government as the changes came into effect, particularly those at the smaller end of the scale.

“This is a complex set of changes, so firms must be helped to get them right – and no small or medium-sized business working hard to adapt to the new regime should be hauled over the coals for unintentional mistakes in the early days.

“We await further information when the bill is published later this year on whether the proposals meet these tests.”