It is proposed that these Regulations will be made under the controversial Retained EU Law (Revocation and Reform) (REURR) Act 2023<\/a> which grants the Government sweeping powers, including Henry VIII powers, to amend and replace law.<\/p>\n The draft Regulations would not directly nullify any of the duties or specific rights within UK data protection and are therefore less significant than general reduction of the status of the UK GDPR to something below that of secondary law which is directly effected through section 3 of the REURR Act<\/a>.\u00a0 It must also be recognised that earlier statutory instrument<\/a> changes to the GPDR and DPA 2018, which were made under the EU (Withdrawal) Act 2018<\/a> at the end of the Brexit Implementation Period, inserted references to directly enforceable retained EU rights but that these are to be abolished at the end of 2023 under sections 2<\/a> (and 4<\/a>) of the REURR Act. However, it is important to note that this reference was without a clear legal basis insofar as it sought to apply to those parts of the DPA 2018 which engage processing that always went beyond the scope of EU law, such that which concerns the intelligence services area.\u00a0 Nevertheless, this earlier insertion means that some legal intervention is now necessary.\u00a0 It does not, however, follow that any such intervention would need to extinguish data protection as a fundamental right or narrow the concept of fundamental rights and freedoms in any other way.<\/p>\n This lack of such necessity is important since such a narrowing is in tension with the broader understanding of fundamental rights and freedoms in the Council of Europe\u2019s Data Protection Convention 108<\/a> (1981) and, even more so, the updated Convention 108+<\/a> (2018, but yet to come into force due to having only 30 as opposed to the 38(+) State Parties necessary).\u00a0 Article 1 of Convention 108 explicitly refers to a free-standing and fully horizontally applicable \u201cright to privacy\u201d<\/em> which is wider and more categorical than the right to respect for private life set out in Article 8 of the ECHR.<\/p>\n Meanwhile, its advisory Explanatory Report<\/a> refers to an overarching fundamental right to \u201cnon-discrimination\u201d<\/em> (para. 25) which is only comprehensively set out within the ECHR under Protocol 12<\/a>, a sub-instrument which the UK has neither signed nor ratified<\/a>.\u00a0 Meanwhile, the Convention 108+ preamble explicitly recognises \u201cthe right to the protection of personal data\u201d<\/em> itself as a fundamental right. \u00a0\u00a0This wider understanding of fundamental rights will no longer reflected in domestic law should the draft Regulations be enacted and so these could at most only be recognised as mere data subjects interests.\u00a0 That, in turn, could lead to their underweighting by data controllers, the Information Commissioner\u2019s Office (ICO) and ultimately the courts.\u00a0 This may be especially concerning when such data subject interests conflict with controller interests including, most notably, the economic interests which data protection often also has to take into account.<\/p>\n Nevertheless, since the new draft Regulations would not in and of themselves disapply any duties or specific rights, it is hard to claim that they would directly violate the UK\u2019s international obligations.\u00a0 This is particularly the case as the UK is only a signatory<\/a> as opposed to a ratifier of the Protocol<\/a> which would bring Convention 108+ into force and so it is only obliged to refrain from acts which could defeat the very object and purpose of the new instrument (Vienna Convention<\/a>, art. 18(a)).<\/p>\n It is proposed that the draft Regulations be made under the REULRR Act which grants the Government sweeping powers not only to revoke any \u201csecondary EU retained law\u201d<\/em> but, with few restrictions, also to replace such law with any provision which the Government consider \u201cappropriate\u201d<\/em> (s. 14<\/a>) as well as making any purely supplementary, incidental or consequential provision (s. 20(1)(b)<\/a>).\u00a0 Even if not necessary, the basic thrust of the draft Regulations could reasonably be considered appropriate. \u00a0It follows that the various amendments proposed to the UK GDPR are clearly intra vires<\/em> since, despite being derived from an EU Regulation (the highest form of ordinary EU law making), this law is not a primary statute.\u00a0 Given that the definition of fundamental rights and freedoms in the DPA 2018 was inserted by secondary instrument, amendment here is also generally permissible although this must be subject to the caveat that this definition was without a clear legal vires<\/em> as regards those parts of the DPA 2018 which go beyond what was formally EU law.<\/p>\n It is even more difficult to justify removing recognition of the fundamental right to data protection from that part of the DPA 2018 which regulates the ICO\u2019s international mutual assistance (s. 120(1)(b)<\/a>) since this provision dates from the original primary enactment and has always had a scope which can extend to processing, for example as regards intelligence services, which have always been outside the reach of EU law.\u00a0 Amendment of this provision could therefore, at least arguably, be considered not to be purely supplementary, incidental or consequential to the other changes and, if so, then it would be ultra vires<\/em>.<\/p>\n Notwithstanding its apparent technicality, there are clearly some important legal and policy questions raised by this draft Regulation both from a domestic and also international standpoint.\u00a0 These arguments are further considered in the following SSRN working paper<\/a>. Whilst not similarly explored in the draft Regulation\u2019s Explanatory Memorandum<\/a>, Parliament can and should insist on fuller consideration.\u00a0 Following receipt of an early iteration of some of these arguments, both the House of Lords\u2019 Secondary Legislation Scrutiny Committee<\/a> and the House of Commons\u2019 European Secondary Instrument Committee<\/a> have recommended that the draft Regulations be subject to the affirmative, as opposed to only the negative, resolution procedure.\u00a0 Hopefully, a debate in both chambers will now happen and this will provide an opportunity to consider the significant implications of the changes now proposed and also obtain clarity on whether the UK still intends to become a State Party to Convention 108+ and, if so, when.<\/p>\n This piece has been reposted from the<\/span> Inforrm Blog<\/a>, with permission and thanks. This blog post was first published on the Inforrm Blog on 24 October 2023.<\/span><\/strong><\/p>\n David Erdos<\/a> is Professor of Law and the Open Society and Director of the Centre for Intellectual Property and Information Law in the Faculty of Law and WYNG Fellow at Trinity Hall, University of Cambridge.\u00a0 He is also an <\/span>associate member<\/a> of Matrix Chambers.<\/span><\/strong><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":" In a little noticed or commented on proposal, the UK Government published draft Regulations last month which would remove the overarching right of data protection from UK law and limit fundamental rights or freedoms within UK data protection law (however and wherever expressed) to rights protected within the European Convention on Human Rights (ECHR) as […]<\/p>\n","protected":false},"author":1,"featured_media":114997,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[97],"tags":[11603,23662,49480,12685,2118,51201,13922],"dealstore":[],"offerexpiration":[],"class_list":["post-114996","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-legal","tag-data","tag-freedoms","tag-fundamental","tag-law","tag-protection","tag-reformulating","tag-rights"],"yoast_head":"\n![\"\"](\"https:\/\/infolawcentre.blogs.sas.ac.uk\/files\/2023\/10\/shutterstock_1931787956.jpg\")
In a little noticed or commented on proposal, the UK Government published draft Regulations<\/a> last month which would remove the overarching right of data protection from UK law and limit fundamental rights or freedoms within UK data protection law (however and wherever expressed) to rights protected within the European Convention on Human Rights (ECHR) as recognised by the Human Rights Act 1998<\/a>. <\/p>\n