The new Data (Use and Access) Bill – what we know so far
4th November 2024
The Data (Use and Access) Bill, or DUAB, created by the Department for Science, Innovation, and Technology was published by the Government on October 23rd, 2024. It aims to refresh the UK’s approach to data management.
The DUAB will introduce new ‘open data’ principles while establishing safeguards to protect privacy and retain the UK’s adequacy status with the EU and other countries. Many of the policies are taken from the Data Protection and Digital Information (DPDI) Bill proposed by the former Conservative government, which was not passed before the wash-up period before the Labour Party came into power.
Here are some of the main provisions included in the Bill – bear in mind that it is subject to change as it is still on its second reading in the House of Lords at the time of writing (October 2024). We will bring you more updates in the DUAB as and when they arrive.
Update 6 June 2025: The House of Lords has once again voted in favour of adding copyright protections to the Data (Use & Access) Bill – the fourth time the Government has been challenged on the issue as the proposed legislation continues to “ping pong” between the Lords and the Commons. If the bill is not passed before the end of the parliamentary session, the Bill effectively dies and must be reintroduced if it is to be considered again. Source: Decision Marketing
Key Provisions of the DUAB
Automated Decision Making
The DUAB will permit automated decision making (ADM) in certain circumstances but require human intervention for some decisions, including those involving special category data. Data subjects will need to give explicit permission for ADM, unless it is required for the performance of a contract or if required by law. The DUAB takes a more relaxed approach to ADM than the DPDI Bill, offering businesses more flexibility while protecting individuals’ rights.
Upgrades to the ICO’s Fining and Enforcement Powers
The DUAB will increase the maximum fines that can be levied by the ICO for PECR violations (PECR is concerned with unsolicited electronic marketing), and extend their powers concerning investigations. The DUAB will also change the ICO from being a ‘body sole’ to a ‘body corporate’, introducing a formal board structure with an appointed CEO, and strengthening its administrative structure. The Chief Executive will be appointed by the Chair and Board and not the Secretary of State, hopefully avoiding any conflicts of interest.
Compatible Processing Purposes
Compatible processing allows for personal data collected for one purpose to also be used for another, providing it is compatible with the original purpose. Much like the DPDI Bill, the DUAB makes allowance for compatible processing, and adds specific purposes for public interest, crime and safeguarding. This will allow organisations to use data responsibly in ways that benefit society.
International Data Transfers
The DUAB will introduce an adequacy test that can be applied to third countries and requires those countries to maintain protections on data that are ‘not materially lower’ than the UK’s allowing for more flexibility while protecting personal data when transferred abroad.
Recognised Legitimate Interests
Much like the DPDI Bill, the DUAB will include a list of recognised legitimate interests including fraud prevention, business operations, safeguarding, crime prevention, public interest, and more. No balancing exercise is required for the activities in the list, which are mainly only relevant to the public sector.
Scientific Research
This bill will expand the definitions for scientific, historical and statistical research, providing more flexibility for processing personal data for research purposes. The definition of scientific research will be expanded to include commercial research, and like the compatible processing provision, allows data subjects to consent to their data being used for more than one type of research. This will facilitate innovation while protecting the necessary privacy safeguards, especially in healthcare.
Digital verification services (DVS)
A new trusted register of organisations that offer digital verification services is to be created, this will assist in the growing requirement for age and identification verification services whilst at the same time protecting data subjects’ rights to privacy.
Overall, the DUAB appears to provide some modernisation of the UK’s data protection laws, taking a more practical approach with consideration given to new technology while reinforcing protections of data subjects and their rights. As mentioned previously, this bill is still in its infancy and it will be some time before it passes into UK law, with many changes anticipated along the way. We will be monitoring its progress and keep you up to date with any key changes it undergoes throughout the legislative process.
If you have any concerns about how the DUAB or any other data protection legislation will affect your organisation’s activities, you can contact us here at Griffin House Consultancy for more guidance and advice.
Author: Mike Martin LLM
Mike is an information governance specialist and one of the founder Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.
Sources
