From cyber safety to employment rights: UK government’s new bills

Answer

On 17 July 2024, King Charles set out the UK government’s legislative proposals for the current parliamentary session. The proposals represent a significant shift in the legal landscape, with a focus on economic stability, data and cyber safety, and tackling injustice. The introduction of these new bills will no doubt keep commercial lawyers very busy, both in the interpretation and understanding of the new legislation and in the preparation of advice to clients.

Three of these new bills and their impact on commercial lawyers in different practice areas will be discussed below: the Cyber Security and Resilience Bill, the Employment Rights Bill and the Data Use and Access Bill (DUAB).

The Cyber Security and Resilience Bill

What is it?

In the backdrop of increased cyberattacks across various sectors, the bill aims to strengthen the UK’s cyber defences and ensure that critical infrastructure and digital services are secure.

Key proposals

The bill will update the existing Network and Information Systems Regulations 2018 (the NIS Regulations), which are a set of rules designed to improve the overall cybersecurity and resilience of critical infrastructure and digital services in the EU. In response to the growing complexity and scale of cybersecurity threats, the EU has introduced NIS 2, a more advanced version of the original NIS Regulations. The Cyber Security and Resilience Bill is the UK's equivalent, seeking to bridge the gap between the existing regulatory framework and the evolving cybersecurity challenges faced today.

A draft of the bill has not yet been published, but the government has indicated in its report that it'll:

• widen the scope to cover more sectors including digital services and supply chains;
• control increased incident reporting including ransomware attacks; and
• give regulators more power and funding.

Impact on commercial lawyers

The imposition of cybersecurity obligations on sectors that were previously unregulated and the proposed reporting obligation for ransomware incidents will substantially increase the range of incidents that are reportable. Once enacted, cybersecurity lawyers will need to adapt their advice to encompass the act's expanded scope, while also assisting clients first hand with increased need for incident reporting.

The Employment Rights Bill

What is it?

The Employment Rights Bill been described as a "once-in-a-generation" overhaul of workers' rights and is intended to reshape workers' rights across the UK.

Key proposals

The first draft of the bill was unveiled on 10 October and brings forward 28 individual employment reforms. These range from:

• covering the removal of the two-year qualifying period for unfair dismissal claims;
• making flexible working more accessible;
• increasing the restrictions on 'fire and re-hire' practices;
• banning 'exploitative' zero-hours contracts;
• ending the three-day waiting period for statutory sick pay; and
• much more.

The government has published a 'Next Steps' document that outlines the reforms that it’ll seek to implement in the future. These reforms are subject to consultation and may not materialise until autumn 2026.

Impact on commercial lawyers

Once the bill becomes law, employment lawyers will need to take the new provisions into account when drafting employment contracts, advising clients and preparing for potential litigation.

The Data Use and Access Bill

DUAB represents a strategic shift in the UK's approach to data management, privacy and digital transformation. It aims to unlock the power of data across various industries, improve regulatory clarity and strengthen protections for individuals. The bill expands on existing frameworks rather than replacing them entirely. The UK GDPR and the Data Protection Act 2018 remain fundamental, with amendments designed to refine rather than replace the existing legislation.

Key proposals

The DUAB still retains elements from the previous Data Protection and Digital Information Bill, introduced under the previous government. For example, it establishes clearer rules for Automated Decision-Making (ADM), limits the scope of Data Subject Access Requests, aligns the Privacy and Electronic Communications Regulations 2003 with GDPR fines and broadens the 'research' exemptions for processing data. However, the new bill builds on these proposals to better address the evolving demands of modern data management.

Impact on commercial lawyers

Data lawyers will need to keep abreast of these changes, ensuring that their clients, particularly those using AI/ADM, performing data transfers or in the Adtech and targeted marketing sphere, remain compliant with the new regulations.

Mimosa Canneti is a trainee solicitor at RPC.