Key Changes in the Revised UK Data Protection and Digital Information Bill

Key changes in the revised UK Data Protection and Digital Information (No.2) Bill:

• Definition of scientific research: The new bill retained the proposed definition of scientific research from the previous version but added further clarifications. The new definition includes scientific research for “transported commercial or non-commercial activities.”
• Recognized legitimate interests: The revised bill maintains the concept of “authorized legitimate interests” introduced in the previous version. This means that processing activities are automatically deemed to satisfy the balancing of legitimate interests test, providing greater certainty to controllers intending to rely on this legal basis. The new bill also confirms that legitimate commercial activity can be a legitimate interest.
• Record of processing: The revised bill removes the exception to the recording of processing requirements for organizations employing less than 250 employees. The recording of processing now applies to activities that may pose a high risk to the rights and freedoms of the data subject. The new bill also requires the Information Commissioner to publish a document containing examples of the types of processing that may pose a high risk to individuals.
• Automated decision-making: The revised bill expands on the previous version’s regulation of automated decision-making. It adds a provision that the Secretary of State may, by regulation, prescribe whether there is meaningful human involvement in decision-making.
• International data transfer: The new bill allows transfer mechanisms entered into before the bill’s entry into force to remain valid and allows companies to use existing international data transfer mechanisms to transfer data already transferred to third countries.

The revised bill will now go through the legislative process and start its “second reading” in the House of Commons. The date for the second reading has not yet been announced.