The UK Government will on Monday publish a “statement of intent” to introduce a new law for data protection, called the Data Protection Bill.
The new law empowers the Information Commissioner Office, ICO, to fine organizations on data breaches which could be up to £17 million or four percent of their global turnover; whichever is higher. The previous maximum fine was £500,000.
The Data Protection Bill include:
- making it simpler for users to withdraw consent for the use of personal data
- allowing people to ask for their personal data held by companies to be erased
- enabling parents and guardians to give consent for their child’s data to be used
- explicit consent should be necessary for processing sensitive personal data
- the broadened definition of personal data to include IP addresses, internet cookies, and DNA
- bringing data protection laws up to date
- streamlined acquisition of data processes for individuals in terms of the data that an organization holds on them
- easing moving between service providers for customers
The Bill will be introduced in September when the House of Commons resumes after its summer break, and the law will be passed before 25 May 2018. The due date for the implementation of EU’s General Data Protection Regulation, GDPR.
The Data Protection Bill will, however, be modified to fit GDPR within the UK.
Organizations are implored to modify their system to meet the specification of the law within the next 10 months or face sanctions.