The provisions of the GDPR – new European data protection legislation – will be enshrined in UK law with the publication of a new Data Protection Bill, the UK government has confirmed.
The government had previously asserted that the new and strengthened rights for indivduals with regard to personal data in addition to new obligations on companies that the GDPR introduces would continue post-Brexit, and the government’s “statement of intent” on data protection reform published today confirms this will be the case.
The GDPR comes into force across the EU on 25 May 2018 and will impose significant new responsibilities on companies that manage and use personal data. There will be tougher penalties too for those that break the law, with fines of up to £17 million or 4% of annual global turnover.
Matt Hancock, minister of state for digital, said: “Our measures are designed to support businesses in their use of data, and give consumers the confidence that their data is protected and those who misuse it will be held to account.
“The new Data Protection Bill will give us one of the most robust, yet dynamic, set of data laws in the world. The Bill will give people more control over their data, require more consent for its use, and prepare Britain for Brexit.”
The government has also confirmed it will implement a number of derogations available to it, with regards to the age at which children can consent to data processing, processing criminal conviction and offence data, automated profiling, the protection of journalist’s sources and the use of personal data for research purposes.
A survey recently found half of consumers intend to take advantage of their new rights under GDPR, with 15% expecting to activate them immediately.
