Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, whether the Government has made an assessment of the potential merits of reforming the recording regulations in the Data Protection Act 1998 to ensure that consent is obtained from all parties before the processing of data can take place.

The UK’s data protection legislation is now set out in the Data Protection Act 2018 and UK General Data Protection Regulation. Like the previous legislation, consent is not the only lawful ground on which processing of personal data can occur. For example, it might be necessary for organisations to process data for public interest reasons, such as crime prevention or safeguarding, without seeking the consent of the individual first. Similarly, there may be some non-intrusive commercial activities that customers may reasonably expect organisations to take without seeking their specific consent.

We are taking steps in the Data Protection and Digital Information (No. 2) Bill to reform aspects of the current legislation. Where processing of personal data is based on a person’s consent, the Bill will not make any changes to the rules which require consent to be freely given, specific and informed. The Bill will make some changes to existing record-keeping requirements which can place unnecessary burdens on small businesses in particular. In the future, organisations will only have to keep records of their processing activities if their processing activities are likely to pose high risks to the rights and freedoms of individuals. This will help to make sure that organisations are not spending disproportionate amounts of time and resources on unnecessary paperwork.