Smarter regulation? Data privacy impact of the Government’s deregulation agenda

On 16 May 2024, the UK Government released a White Paper on “Smarter Regulation: Delivering a regulatory environment for innovation, investment and growth”. The White Paper is the Government’s full formal response to the 2023 Call for evidence “Smarter Regulation and the Regulatory Landscape” and the House of Lords Industry and Regulators Committee Report “Who Watches the Watchdogs: Improving the performance, independence, and accountability of UK regulators”, published in February 2024. 

It is part of the Government’s broader deregulation agenda, and the White Paper focusses on ensuring a well-functioning landscape of regulators, the third pillar of its smarter regulation programme. The White Paper covers “business regulators”, including the ICO amongst many others, such as the CMA and Ofcom. However, it specifically excludes the financial and professional services regulators. 

Addressing disproportionate and inflexible approaches

Its purpose is to drive a review of how regulations are made and administered in the UK in order for the UK economy to grow and to enable the creation of technologies that will improve UK productivity. This reflects that two thirds of consultation respondents considered regulators to be too risk averse, resulting in what was considered to be a disproportionate and inflexible approach in areas where businesses are trying to innovate. Given the ICO is generally considered to be a pragmatic regulator, and the strides it has made, both individually and through its participation in the Digital Regulation Cooperation Forum, to support innovation, this response does not seem to fully reflect the ICO’s approach.

Setting strategic direction for regulators

The Government considers it has a critical role to play in setting regulators’ strategic direction and the outcomes for them to deliver across all sectors of the UK economy. This includes using Government strategic steers to regulators and setting out the strategic priorities of the Government to which the regulatory authority may have regard. The Government considers that this is “entirely consistent with a model of operational independence for regulators”. Others may however disagree. Given that the European Parliament’s LIBE Committee has already expressed concern about the impact of the proposed reforms in the Data Protection and Digital Information Bill on the ICO’s independence, this approach is likely to give rise to some discussion as part of the EU’s reconsideration of the UK’s data privacy adequacy decision.

Maintaining safeguards but reviewing fines

The White Paper clarifies that its purpose is to understand the cost of the Government’s regulation on business and society and is not about reducing regulatory safeguards. This statement should provide some reassurance to the EU on data privacy standards. However, it also states the Government intends to review the impact of turnover-based fines on prospective investors who may be concerned by the “risk of incurring disproportionate fines for infractions”. This is likely to raise questions at the EU level as, depending on the outcome of the review, it could result in less incentive for organisations to comply with data privacy laws in practice. 

Concluding thoughts

Time will tell how effective this attempt at regulating the regulators is in achieving the Government’s growth aims, and how this is balanced with the business regulators’ roles in protecting consumers and the like. Whilst none of this should ultimately impact the EU’s adequacy decision for the UK, it will raise further questions that need to be answered in discussions ahead of next year’s scheduled refresh of the EU decision.