The Information Commissioner’s Office (“ICO”) has unveiled a package of measures which it says is intended to support the Government’s growth agenda.

We have commented here on the Action Plan announced by HM Treasury which seeks to reform the regulatory system. Among other things, regulators will be better equipped to help deliver economic growth by working with businesses to reduce burdens and unpredictability, as well as by challenging excessive risk aversion.

The ICO has responded to the Government’s calls for reform by setting out a series of measures:

1. Data Essential Training

The ICO will launch an SME Data Essentials training and assurance programme later this year which will provide free training to small businesses on how to comply with data protection law.

2. Experimentation Regime

Building on the success of the ICO’s Regulatory Sandbox and Innovation Advice services, and drawing inspiration from similar frameworks in Japan and South Korea, the ICO intends to pilot an experimentation regime which will allow businesses to “trial innovative data-driven solutions within a controlled regulatory environment”. According to the ICO, the scheme will start with allowing businesses to trial solutions free from any worry about the enforcement of consent rules for privacy-preserving advertising models, in the hope that any findings will inform future regulatory reforms.

3. AI Guidance

The ICO will publish “simpler” guidance on compliance with data protection law for businesses developing or deploying AI, and work with the Government to develop a statutory code of practice.

4. Privacy-friendly Advertising Review

The ICO is in the process of reviewing the Privacy and Electronic Communications Regulations (“PECR”) which currently mandate that all profitable digital advertising requires user consent. As the ICO explains, the PECR apply even where some activities can have “minimal privacy impact” and, given that behaviour advertising is most profitable, “there is no incentive for businesses to adopt less intrusive advertising techniques as the same regulatory burden applies in all cases”.

The ICO will assess whether PECR consent requirements could be relaxed in certain circumstances and will publish a statement in the autumn which will identify low risk activities which are unlikely to warrant enforcement action.

5. International Data Transfers

Finally, the ICO will publish new and updated guidance on international data transfers “making it quicker and easier for businesses to transfer data safely”. It commits itself to working with international partners to reach international agreements on “increasing mechanisms for trusted free flows of data” and working with the Government to reviewing the adequacy assessments for “key trading partners”.

To read more, click here.