The new GDPR legislation governing data regulation will require organisations to make the personal privacy rights of consumers a top priority.
The GDPR – General Data Protection Regulation – will apply in the UK from 25 May 2018, taking the place of the 1998 UK Data Protection Act.
The UK’s decision to leave the EU will not affect the commencement of the GDPR.
UK information commissioner Elizabeth Denham said the GDPR will bring a “more 21st century approach” to how personal data is processed and warned organisations they “should seize the opportunity to set out a culture of data confidence in the UK”.
She told the ICO’s annual Data Protection Practitioners Conference in Manchester: “The GDPR provides more protections for consumers and more privacy obligations for organisations.
“It aligns with people’s expectations for strong safeguards, and recognises the advance of digital services in the public and private sector.”
While the GDPR gives specific obligations for organisations, Denham emphasised that the real change for organisations will be understanding the new rights for consumers.
She added: “I want to see comprehensive data programs as the norm, organisations better protecting the data of citizens and consumers, and a change of culture that makes broader and deeper data protection accountability a focus for organisations across the UK.”
The ICO has the power to impose monetary penalties of up to £500,000, but the GDPR provides fines for up to four per cent of annual worldwide turnover – whichever number is larger.
Strengthened rules around consent will give consumers a choice and ongoing control over how organisations use their data.
The GDPR will also introduce a duty for all organisations to report serious data breaches to the regulator and in some cases to the individuals affected.