Privacy & Information Security Law Blog

On December 2, 2020, the Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth submitted its response to the UK Department for Digital, Culture, Media and Sport’s (“DCMS”) UK National Data Strategy  (“NDS”) consultation.

In June 2018, the Secretary of State for the UK DCMS announced the UK Government’s intention to develop a NDS that would unlock the power of data across government and the wider economy while also building citizen trust. The aim of the NDS is to drive the collective vision that will support the UK in building a world-leading data economy and to ensure that people, businesses and organizations trust the data ecosystem, are sufficiently skilled to operate effectively within it and can get access to high-quality data when they need it.

In its response, CIPL highlights several considerations for the DCMS when further developing and implementing its NDS:

• The UK central government’s role is crucial in articulating, promoting or supporting appropriate policy and legal frameworks to improve access to data for all relevant economic actors in all sectors, and the UK Government should promote constructive engagement on an ongoing basis with these actors, as well as with regulators.
• Interpretation of the UK’s data protection framework should be consistent with the inherent principle-based, outcome-based and risk-based approach of the UK Data Protection Act 2018, in order for it to remain fit for its purpose in a digital economy and society in which the importance of data will only increase.
• Alignment between data protection and other legal areas. The UK Government must also consider how the data protection regime fits with other areas of digital law and policy, including consumer, competition, AI, online harm, platform/content and cybersecurity.
• Accountability and a risk-based approach should be incorporated in the NDS (such as building on the existing experience under the GDPR and UK Data Protection Act 2018), as this concept is relevant for all areas of digital and data regulation, including specifically with respect to the development and use of AI and data sharing.
• Encouraging accountability. Consistent with the nudge theory of behavioral economics, government must put in place incentives to encourage and reward those organizations that are implementing and are able to demonstrate accountability in their data use and management.
• Data sharing between public and private organizations should be enabled through a framework based on demonstrable and enforceable organizational accountability and its essential elements—the UK ICO should work with organizations to develop a framework for accountable data sharing that can work with the UK Data Protection Act of 2018 and that is in line with the ICO’s recently released Accountability Framework.
• Interoperability. A UK data strategy must be developed with an eye on global interoperability and collaboration if the UK wants to create a truly attractive policy environment for its data economy.
• Innovative regulatory oversight. An innovative and future-oriented UK data strategy should provide for innovative regulatory oversight that includes regulatory sandboxes and data review boards.
• Codes of conduct and certifications should be promoted and implemented, especially programmatic certifications that certify an entire data protection management program, both for domestic compliance and for cross-border transfer purposes.
• International data transfers should be enabled and facilitated, such as through unlocking the potential of Binding Corporate Rules as an international data transfers tool, as well as Standard Contractual Clauses, codes of conduct and certifications, which should be interoperable with data protection regimes of other regions. Adequacy findings should be prioritized through the lens of greatest impact on the UK economy and the level of complexity of the analysis.
• Centre for Data Ethics and Innovation. This new organization should be complimentary to the ICO and other regulators, supporting their work, but with a separate and different remit that could focus on thought-leadership to enable regulating AI, data-driven technologies and all modern data processing activities.

Download a copy of CIPL’s full response.