Well the difference is very small. The new UK Data Protection Act which was announced last week are broadly the same. Only the name has been changed to confuse businesses.
Why change the name?
Well really there are a couple of reasons. Firstly our Data Protection Act has always been called that. But secondly the main reason is that by 2019 we will probably no longer be part of the European Union. This means that we won’t be governed by European laws.
However in order to be able to trade and pass data across Europe we have to have the same overall laws in place.
So what’s the difference?
Unfortunately at this stage, the government has not set out in detail the content of the Data Protection Act so we don’t know. However, they have made it clear in their statement of intent that they will only be invoking a few derogations.
For instance they will look to protect companies who have large archives of material from bogus subject access requests. (Imagine if you rang the Nation Archives Centre and asked them under the guise of a free subject access request to furnish you with any information they held about you. Genealogy job done in one go!)
They are also looking at modifying areas around automated processing. This is typically used by large credit agencies to determine card applications.
There is a disconcerting area where 3rd party companies will still be able to access criminal record information. This may come back to bite us as a country over the next couple of years. We need to remember that from 2019 will will no longer be part of the European Union. After that time the UK will be a “3rd country” meaning that automatic transfer of data and cross border processing can only take place as long as we meet the stringent requirements of GDPR. The UK will in fact need an adequacy approval from the EU.
The government must ensure that this does not contravene the GDPR . Currently Canada may be about to lose its adequacy status with the EU.
We won’t even know if we can make the adequacy status until we leave the EU. According to EU officials Adequacy con only be assessed on non-EU countries – and we won’t be one of those until we leave the European Union – and then it may take months to negotiate that agreement.