The European Commission’s assessment of the impact of the proposed new European Union data protection law – the General Data Protection Regulation – has not fully considered the cost to business. Those are the views of the Ministry of Justice, after it collated responses to its request for evidence on the Commission’s proposals. In particular, it has underestimated the cost to businesses with more than 250 people of having Data Protection Officers, as well as the impact of the “right to be forgotten”. Another example of the red tape is the plan to introduce a requirement for organisations to conduct data protection impact assessments where there are specific risks to personal data.
The MoJ’s summary of responses can be found here: summary of responses.