JON FIELDING explores the way that data protection laws in the UK are likely to evolve.
GDPR has been hailed as a success story. It’s been a leading light for other jurisdictions, as a result of which 75 per cent of the global population is expected to be covered by data protection regulation by next year, according to Gartner.
The regulation has teeth, with the Information Commissioner’s Office (ICO) handing out €3,987,196,353(4,353,619,697.84) in fines (as of June 2023) and coming down hard on tech giants such as Meta. It’s undoubtedly elevated the topic of data protection to board level, but has it really improved data protection?
Those fines also indicate that businesses are struggling to secure their data. A recent survey carried out by Apricorn found that 39 per cent of the organisations surveyed had notified the ICO of a breach or potential breach under GDPR and that this had increased year-on-year from 25 per cent in 2020. The number of organisations reported by somebody else was also up at 32 per cent (compared to 21% in 2020, despite having dropped to 4% in 2022) which signals that the increase in breach reporting isn’t necessarily down to businesses being more conscientious or more compliant.
Five years on
We’ve been complying with GDPR for five years now but if you look at the results published by the ICO in its Data Security Incident Trends, the number of cyber-security incidents disclosed has risen from 469 incidents in Q4 2019 to 564 incidents in Q4 2022, up 20 per cent.
The ICO report further reveals that only 18 per cent of incidents reported at the end of 2022 were caused by cyber-attacks such as phishing, ransomware, brute forcing credentials and malware, while 65 per cent of incidents were down to user error or the incorrect use, or configuration of software.
These figures tell a very different story about GDPR’s impact and effectiveness, plus they indicate that we should be looking at how we can improve data protection by minimising the potential for human error.
The introduction of UK GDPR following Brexit presents us with the opportunity to reappraise the regulations. Proposals first made under the Data Reform Bill, which was paused at the end of the Truss administration, are now being taken forward under the Data Protection and Digital Information Bill by the newly formed Department of Science, Innovation and Technology (DSIT). It’s wending its way through Parliament and is expected to become law in 2024.
The changes include the reclassification of what constitutes ‘personal data’, the legitimate reasons for processing and where Automated Decision Making (ADM) can be used. Those processors that are not handling ‘high risk’ data will no longer be compelled to keep Records of Processing Activities (ROPA), do Data Protection Impact Assessments (DPIAs) or appoint a Data Processing Officer (DPO).
However, those that do will need to continue to keep such records and appoint a Senior Responsible Individual (SRI). These requirements also apply to small businesses that were previously deemed out of scope.
Conditions under which the business can decline a Data Subject Access Request (DSAR) will also change, with the business now able to charge for, or decline vexatious or excessive requests.
Fines associated with ePrivacy and cookies will also increase as they are brought into line with those under GDPR. Enforcement of the regulations will also fall to a board rather than just the Information Commissioner.
A change for the better?
For the most part, the bill is widely viewed as a relaxation of GDPR, particularly when it comes to record keeping, but there are still issues to be ironed out. Points such as how ‘high risk’ will be defined, and whether oversight by a board of individuals will lead to a conflict of interest when it comes to prosecuting big business.
There’s also the risk that businesses that operate internationally may need to adopt two separate processes if the EU is not satisfied UK GDPR meets data adequacy requirements (which demands data be awarded the same level of protection in both jurisdictions). Many have warned that UK GDPR could become a watered-down version of its predecessor, but the reality is that GDPR needed to be revised. There were ambiguities in the wording which this new version addresses; elements of it such as DSARs were open to abuse; plus technology and even the way we access data has moved on.
Almost a quarter of businesses say that remote working has made it harder to comply with GDPR, according to the Apricorn survey.
The new UK GDPR looks at what’s appropriate and makes the obligations workable and easier to comply with. Easing the compliance burden is vital because it gives businesses the flexibility to meet the requirements in a meaningful way, rather than as a tick-box exercise, and to focus on the real issue of protecting data. This means we can begin to address the issue we saw before in the ICO reporting of human error.
Preventing user error is extremely difficult which is why security awareness training and policy enforcement are so important. But these strategic approaches need to be backed up be effective controls.
Deploying encryption and, specifically, implemented in hardware rather than software, on end user devices, for example, can dramatically reduce the risk of data loss if that device becomes compromised, lost or stolen.
Software-based encryption can still leave the device susceptible to counter resets, hacking, screen capture or keylogging, whereas hardware encryption is built-in and afforded protection by the hardware on which it is installed. Rolling out FIPS certified encryption across all the organisation’s devices can then ensure data is kept safe, irrespective of whether the workforce is in the office or working remotely.
It’s this ability to dedicate time and resource to policy and its implementation that UK GDPR promises to deliver. By freeing up the business through clearer requirements and less red tape, the new regulations put data protection, rather than compliance, front and centre.
- Fielding is Managing Director, EMEA for Apricorn.
