Changes to the Data Protection Act 2018, UK General Data Protection Regulation and the Privacy and Electronic Communications Regulations 2003
Targeted reforms to the UK’s data protection legislation intend to maintain high standards of protection, whilst facilitating the safe deployment and development of modern technologies, and the responsible use of personal data. These reforms intend to support economic growth and a modern digital government. Changes include:
Making it clear that research organisations can seek broad consent for areas of scientific research;
Allowing legitimate researchers doing scientific research in commercial settings to make equal use of the provisions by clarifying that commercial research activities can benefit from the special position of research in the data protection framework;
The creation of a new lawful ground under the UK GDPR of ‘recognised legitimate interests’;
Clarification of the rules in relation to the purpose limitation principle to address existing uncertainty around re-using personal data, including for public interest purposes; and
Permitting decisions based solely on automated processing which have legal or similarly significant effects for individuals to be taken in wider circumstances and clarifying the safeguards that must be in place when organisations take such decisions.
	The Act also modernises the governance structures of the ICO by:
Introducing a chair, non-executive and chief executive roles;
Providing a clearer framework of objectives and duties on which to report to Parliament; and
Introducing new, stronger powers of enforcement.
	The Act updates the Privacy and Electronic Communications Regulations 2003 through new provisions on: unsolicited direct marketing communications (e.g. nuisance calls); personal data breach reporting by communications service providers; confidentiality of terminal equipment; soft opt-in for charitable purposes; ICO’s enforcement powers; and sectoral codes of conduct.
	The Act clarifies the rules on international transfers and cross-border flows of personal data. International data flows can drive commerce, support research and innovation, and help people to stay socially connected to one another. This Act is intended to facilitate international trade by providing a clearer and more stable framework for international transfers of personal data.