• From 25 May 2018 all businesses and organisations in the UK will need to abide by the new General Data Protection Regulation.
  • This will require them to follow new procedures when collecting and storing personal information, unless they have a lawful reason to do otherwise or have been exempted to do so.
  • The Government has now outlined its set of exemptions and which industries will be affected.

At a Glance:

Businesses and organisation up and down the UK are currently in the process of reviewing how they collect and store data in light of the introduction of the new General Data Protection Regulation in May 2018. However, in its new Data Protection Bill the Government has outlined new exemptions for the research, financial services, journalism, and professional services sectors. These exemptions will allow these industries to carry on conducting the important work that they do, while still safeguarding personal data.


The Details:

The Government has revealed exemptions to the upcoming General Data Protection Regulation (GDPR), which should help protect the operations of certain UK industries.

Article 23 and Chapter 9 of the GDPR allow Member States to introduce exemptions (i) to the GDPR’s transparency obligations and individual rights and (ii) in relation to specific processing activities in certain circumstances.

The Data Protection Bill, published in draft on 14 September 2017, transposes much of the GDPR into UK law, however an important part of the Data Protection Bill is the exemptions it contains.

The exemptions will largely apply to the research, financial services, journalism, and professional services sectors.

In a statement, the Government said it will allow these industries to continue to process sensitive data if it achieves a balance with individuals’ rights.

The GDPR will become law for all UK businesses from 28 May 2018 until the UK leaves the EU.

Firms who fail to comply with the new rules risk heavy fines – up to €20 million or four per cent of annual global turnover, whichever is higher.

The Data Protection Bill will also ensure that consumers have more control over their data, including a ‘right to be forgotten’.

Matt Hancock, Minister of State for Digital, said: “We are strengthening Britain’s data rules to make them fit for the digital age in which we live and that means giving people more control over their own data.

There are circumstances where the processing of data is vital for our economy, our democracy and to protect us against illegality. Today, as we publish the Data Protection Bill, I am offering assurances to both the public and private sector that we are protecting this important work.”

The Bill will include exemptions for data processing in the following areas:

  • Processing of personal data by journalists for freedom of expression and to expose wrongdoing is to be safeguarded
  • Scientific and historical research organisations such as museums and universities will be exempt from certain obligations which would impair their core functions
  • National bodies responsible for the fight against doping in sport will continue to be able to process data to catch drug cheats
  • In the financial services sector, the pricing of risk or data processing done on suspicion of terrorist financing or money laundering will be protected
  • Where it is justified, the Bill will allow the processing of sensitive and criminal conviction data without consent, including to allow employers to fulfil employment law obligations.