United Kingdom: Issued Information Commissioner's opinion on Data Protection and Digital Information (No. 2) Bill including data protection regulation

On 30 May 2023, the Information Commissioner (ICO) published its opinion on the Data Protection and Digital Information (No.2) Bill. The Bill would amend the UK Data Protection Regulation provisions in regard to the obligations of entities collecting personal data and data subject rights. In particular, the Bill aims to amend the data protection principles and the legal basis for collecting and processing personal data. Under the Bill, the entities would be allowed to process personal data if the purpose is compatible with “the original purpose” specified when it obtained consent from the data subjects. The Bill outlines legitimate interests for data processing and exceptions that could be made in cases involving national security, emergencies and crimes. Finally, the Bill would amend the obligations of entities to respond to a request from data subjects, allowing entities to extend the period for complying with a request and giving entities the right to refuse to act on “vexatious or excessive requests”. The ICO supports the inclusion of defined legitimate interests for data processing, as it enables organisations to utilise personal data responsibly, leading to social and economic advantages. Concerning the requirement for entities to address data subject requests, the ICO welcomes the continuation of free access to personal data in the majority of situations.