UK government proposes Data Protection Bill that includes new “right to be forgotten” legislation for users and fines for companies that breach users' data
Google and Facebook could face fines stretching into billions of pounds if they breach users' privacy under a new law.
Context & Ripple Effects
This 2017 proposal is the opening move in what became a decade-long UK regulatory arc against big platforms: the Data Protection Bill pairs a user-facing right to be forgotten with default-privacy protections for minors, and threatens Google and Facebook with fines that could reach into the billions of pounds.
What makes the story durable is that its enforcement logic — percentage-of-revenue penalties backed by a named regulator — was later scaled up in the Online Safety Act's £18M-or-10%-of-turnover regime, after MPs kept adding offenses and compliance duties like safety controllers along the way.
First-order effects
- Google and Facebook now face direct financial exposure in their UK operations: any breach of user data could trigger fines measured in billions rather than millions, making UK privacy compliance a board-level cost line for both companies.
- Users gain a legally enforceable right to demand deletion of personal data held by platforms, shifting the burden of proof onto companies to justify retention.
Second-order effects
- Platforms must build deletion and consent infrastructure across their ad-targeting systems, since the data most at risk is the behavioral profile that powers their advertising businesses — raising operating costs precisely where margins are highest.
- The fine structure creates a template competitors cannot ignore: any platform holding UK user data must match the same compliance posture, effectively setting a floor for the whole market.
Third-order effects
- If revenue-linked fines become the standard instrument, UK tech regulation consolidates around a single enforcement model that successive bills — data protection, then online safety — keep extending to new categories of harm, embedding permanent regulatory overhead into how platforms operate in Britain.
The trend: The UK is building a layered, escalating fining regime for large platforms, starting with data rights in 2017 and extending through online safety by 2023.