The Data Protection Act of 2018 replaced the Data Protection Act of 1998, and implements the government's manifesto commitment to update the UK’s data protection laws.
In 1998, google had just been founded, offices were still using word-processors and most people had never heard of the internet. A lot had changed in 20 years when the data protection laws in the UK were finally modernised to be more suitable for our increasingly data-central world.
In general, the 2018 Act strengthens most provisions under the 1998 act to reflect the value of people's personal data today, and addresses the way technological advancements have affected data collection, data use and storage. For example, the use of web cookies to collect data from our internet searches and use them for advertising purposes was not around in 1998.
The key changes between the Data Protection Act of 2018 and the Data Protection Act of 1998 are:
- Harsher penalties; the 1998 Act gave the ICO the power to issue penalties of up to £500,000, the 2018 Act allows penalties of up to £17m or 4% of global turnover.
- Seeking consent and holding data for no longer than necessary; the 2018 Act requires organisations, with only a few exceptions, to gain people's consent to use their information, and requires organisations to hold personal data for no longer than necessary.
- Transparency and explicit purpose; the 2018 Act requires organisations to make efforts to be transparent with individuals about exactly why they are collecting their personal data, and the type of data they are collecting, this was not necessarily required under the 1998 Act.
- Type of data collected; the type of data that could be collected by companies was also up for interpretation under the 1998 Act, as long as data processing was not ‘excessive’ to its original purpose. Under the 2018 act, processing is limited to only that data considered relevant.
The implementation of all principles of the GDPR; unlike the 1998 Act, the 2018 Act implements principles from the GDPR, for example, before the GDPR was implemented in 2018, organisations could charge a specified fee for responding to a Subject Access Request (SAR) of up to £10, now there is no fee. Therefore, your right to receive a copy of the data a company holds on you is strengthened.