Out-Law / Your Daily Need-To-Know

Out-Law News 2 min. read

The scope to re-use personal data under GDPR could be clarified in ICO guidance, says government


The scope organisations will have to re-use personal data under new EU data protection laws could be clarified in new guidance, the UK government has said.

The government has published its response (14-page / 216KB PDF) to a report published in February by the Science and Technology Committee in the House of Commons on the subject of big data. It said it would aim to ensure that the UK's new data protection regime, implementing the EU's General Data Protection Regulation (GDPR), "strikes the right balance between the benefits of processing data and respecting people’s privacy concerns, within the scope of the principles and definitions provided for".

In its report the Committee had called on the government to "clarify its interpretation" of the GDPR "on the re-use and de-anonymisation of personal data". It said at the time that the Regulation "appears to leave it open for data to be re-used, and potentially de-anonymised, if 'legitimate interests' or 'public interest' considerations are invoked" and that this raises the question of how to best to balance "the potential benefits of processing data … and people’s justified privacy concerns".

The Committee said it would be "unsatisfactory" for the government not to address the matter.

In its response the government said: "The Information Commissioner’s Office (ICO) provides advice and guidance to organisations on the issue of anonymisation. We will use the implementation phase of the EU General Data Protection Regulation to work closely with the ICO to ensure we deliver a new domestic regime that strikes the right balance between the benefits of processing data and respecting people’s privacy concerns, within the scope of the principles and definitions provided for."

"In addition to effective sanctions being available, the government recognises the need for a range of measures, including transparency of processing, raising the public’s awareness of how personal data may be used, and the adoption of robust measures by organisations to mitigate the risks or re-identification or de-anonymisation of personal data," it said.

The government said that it would also consider another Committee recommendation to introduce imprisonment as a new criminal penalty for data protection breaches as part of the GDPR implementation process.

The government also rejected calls to compel local authorities to open themselves up for data protection audits by the ICO when asked to do so by the watchdog.

"The government has noted that, through joint work with the Information Commissioner’s Office and the Local Government Association, the percentage of data security incidents that can be attributed to local councils has now halved," the government said. "In view of this progress, we consider that compulsory data audits for local authorities may not be required at this stage."

"Instead, we feel that local authorities should continue to be provided with support to further improve their performance on handling personal information. This should however still include challenges to local authorities when standards are not being met and poor performance is identified," it said.

In its report the Committee recommended that the government set up a Council of Data Ethics within the Alan Turing Institute to help address "the growing legal and ethical challenges associated with balancing privacy, anonymisation, security and public benefit". In its response the government said it would act on the recommendation.

"The government has already established a number of internal mechanisms to consider ethics and data science, but we recognise the need for leadership in this field for the UK as a whole," it said. "Therefore, the government agrees with the Committee’s proposal for independent oversight and will consider how a Council for Data Science Ethics should be established."

"This body would address key ethical challenges for data science and provide technical research and thought leadership on the implications of data science across all sectors. The Alan Turing Institute is well placed to play a leading role and to be a convening power. Clarifying and providing guidance on ethical, legal and technical issues will allow data science to develop more quickly and appropriately, giving the UK an opportunity to gain a global advantage," it said.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.