United Kingdom: Introduced Data Protection and Digital Information (No. 2) Bill including data protection regulation

On 8 March 2023, the Data Protection and Digital Information (No. 2) Bill, including data protection regulation, was introduced in the United Kingdom (UK) Parliament. The Bill would amend the UK Data Protection Regulation provisions in regard to the obligations of entities collecting personal data and data subject rights. In particular, the Bill aims to amend the data protection principles and the legal basis for collecting and processing personal data. Under the Bill, the entities would be allowed to process personal data if the purpose is compatible with "the original purpose" specified when it obtained consent from the data subjects. The Bill outlines legitimate interests for data processing and exceptions that could be made in cases involving national security, emergencies and crimes. Finally, the Bill would amend the obligations of entities to respond to a request from data subjects, allowing entities to extend the period for complying with a request and giving entities the right to refuse to act on "vexatious or excessive requests”.