Basis the UK government's response, one can conclude that there are five broad objectives as the government seeks to future proof the data protection regime.

As I read through the consultation response, I recall the following as key changes that are being proposed.

The consultation response states that government plans to replace the requirement to appoint a Data Protection Officer with a requirement to designate a suitable individual to oversee the organization’s data protection compliance. At present, the larger organizations did appoint a 'privacy sponsor', 'privacy owner' or 'privacy executive' to work with DPO to oversee compliance as privacy management requires business understanding and buy-in, And understanding and buy-in are with business executives. Even large organizations never had the budgets for appointing DPO and were reliant on business executives to shoulder responsibility. However, what has been missed is the fact that understanding privacy requires deep knowledge of data protection law which was facilitated by the DPO role.

In my view, this does not change much except that reality on the ground is formalized in regulation because larger organizations will appoint DPO for ensuring the right knowledge, skill and oversight is available to the business executive. Of course, it would make things easier for smaller businesses wherein the appointment of DPO was overhead and often confused.

The consultation response states that the government plans to remove the requirement for DPIA and DPA consultation for high-risk processing. At the same time, the consultation states "organisations will still be required to consider risk through the implementation of their risk-based privacy management programme, and therefore this in itself is likely to mitigate the potential risk of protected characteristics not being identified".

In my view, this may seem to make things easier but what does "consider thorough risk-based privacy management" mean? It indirectly means conducting a risk assessment and that is exactly what DPIA offered. So, what would change? Nothing in my view except the name.

To address issues with regard to the current balancing test for processing under legitimate interest, there is a proposal that certain processing activities that shall not require a balancing test. For example, processing to prevent crime or report safeguarding concerns, or processing activities necessary for other important reasons of public interest may be allowed without the need for a balancing test.

In my view, this is a welcome change as it will set the precedent on what can be processing activity based on legitimate interest.

Almost all of us dislike cookie banners. To address issues with regard to cookie banners, the government plans to legislate to remove the need for websites to display cookie banners to UK residents. This will be in two steps.

• Step 1: In the immediate term, the government considers allowing the placement of non-intrusive cookies without user consent.
• Step 2: In the longer term, the government to work with industry and regulators for finding solutions like browser-based solutions, and opt-out preferences.

In my view, this is a welcome change and must be pursued globally by creating a global standard for cookie management on websites.

We all know that the data transfer scenario is a mess. To address issues with regard to data transfers, the government plans "to take this reform forward and ensure new mechanisms". What does this mean? There has been talk about adequacy risk assessment but it is not yet clear on how it shall be different from current requirement for transfer risk assessments.

In my view, there were some interesting proposals with no consensus or mixed opinion, we got to live with the challenges we have for now.

In addition, there are other changes being proposed in the context of:

John Edwards, UK Information Commissioner has fully endorsed this consultation by stating 

The EU General Data Protection Regulation (GDPR) has been setting the bar very high. Now that the UK has its own version of data protection regulations inform the Data Protection Act 2018 and the UK General data protection regulation (UK GDPR), this is a step in the right direction that takes data protection forward. In my view, most of these changes are practical and necessary to make privacy management pragmatic and less burdensome.