Data Protection

Thursday 22nd November 2012 Written Statements

[The Parliamentary Under-Secretary of State for Justice (Mrs Helen Grant)]

Today, I will publish the Government’s impact assessment of the European Commission’s proposals for data protection.

In January this year, the European Commission published a draft data protection regulation which will impact on business, the public sector and charities and a draft data protection directive, covering the police and judicial sector. Coupled with the publication, the European Commission published its impact assessment of the proposals.

The Commission’s impact assessment estimates that the new regime would bring an administrative saving to the EU, totalling €2.3 billion each year. As the analysis published today shows, the Government disagree with this assessment and believe that the burdens the proposed regulation would impose far outweigh the net benefit estimated by the Commission. For the UK alone the annual net cost of the proposal (in 2012-13 earnings terms) is estimated to be between £100 million and £360 million a year.

The Government’s view is that the Commission both overestimates the benefits achieved through harmonised EU data protection law and fails to address the full costs and unintended consequences of its own proposals, by only considering administrative costs. Our analysis addresses some of these failings by considering in full the impact of the proposed regime, including the additional costs for businesses, including small and medium enterprises, the additional costs to supervisory authorities, conducting data protection impact assessments and complying with other new obligations.

This impact assessment focuses on the proposed regulation. Under article 6a of the UK’s Title V opt-in protocol we believe that the proposed directive will have a limited effect on the United Kingdom, in that it will only apply to data being processed under an EU instrument that binds the UK. Therefore, criminal justice system agencies within the UK will avoid being bound by the directive when processing personal data outside of such provisions.

It is worth noting that organisations which process criminal justice data will also process personal data covered under the regulation and so some of the monetised costs and benefits stemming from the regulation could be shared (for example, the cost of designating a data protection officer). The directive would require transposition into UK law, at which point domestic legislation would also be needed to cover that processing purely internal to the UK. There is therefore a degree of flexibility for member states in determining how the EU-level rules in the proposed directive would be transposed and a fuller assessment of the costs and benefits specific to the proposed directive will be produced nearer the point of transposition.

The UK Government are seriously concerned about the potential economic impact of the proposed data protection regulation. At a time when the eurozone appears to be slipping back into recession, reducing the regulatory burden to secure growth must be the priority for all member states. It is difficult therefore to justify the extra red tape and tick-box compliance that the proposal represents. For example, we estimate the costs for UK small businesses of simply demonstrating compliance with the new rules to be around £10 million (in 2012-13 earnings terms) every year. A further serious issue is the possibility of stifling innovation through prescriptive and inflexible rules on gaining individuals’ consent and informing them about the processing of their personal data, while offering people an unworkable “right to be forgotten”. Instead the focus must be on achieving the right ends: meeting people’s rightful expectation that their personal information is used lawfully, proportionately and securely, while being able to offer them the goods and services they want and need.

Negotiations on the proposals are ongoing in Brussels. With the evidence set out in the impact assessment published today, the UK Government will continue to push for a lasting data protection framework that is proportionate, and that minimises the burdens on businesses and other organisations, while giving individuals real protection in how their personal data is processed.

Copies of the impact assessment will be placed in the Libraries of both Houses and on the Department’s website at, www.justice.gov.uk.