Time for a Change? - UK Government announces new Data (Use and Access) Bill

In our Summer 2024 newsletter, we discussed the new government’s agenda for data protection reform and its manifesto promises. In this newsletter, we report on the first “fruits” of that agenda, namely the Data (Use and Access) Bill (the “Bill”).

What does the Bill Cover?

More Scope for Automated Decision-Making (“ADM”)

The Bill facilitates the greater use of ADM by limiting the restriction on its use to the processing of special category data and where there is no meaningful human involvement.

This reform is seemingly aimed at encouraging the use and development of AI. However, organisations proposing to use ADM should still be conscious of the remaining restrictions on its application.

(Some) help with Legitimate Interests

Under the Bill, the following types of processing purposes are more likely to count as “legitimate interests”: (i) intra-group transfers for internal administration; (ii) direct marketing; and (iii) network/IT security. 

Whilst this is a helpful “nudge” for organisations selecting their lawful basis for such purposes, the Bill stops short of doing their homework for them and deeming these purposes are always being legitimate interests. Many organisations have already concluded that their direct marketing in particular is underpinned by the legitimate interests basis.

DSAR to be “Reasonable and Proportionate”

Another area of mild reform. Data subjects would only be entitled to personal data that could be revealed by a “reasonable and proportionate” search. 

In theory, this proposal helps relieve the burden on organisations that deal with DSARs. In reality, the Bill would merely codify a case law standard that organisations have applied for some years.

Less red tape with your Cookies

Like its predecessor, the Bill would cut-back some red tape wrapped around cookies consents. It would remove the need to get user consent to place cookies or similar technologies that are solely used to: (i) collect statistical data to make improvements to the website/online services; (ii) improve the appearance or performance of a website; or (iii) to adjust the website to the user’s preferences.

These purposes would not be “frictionless”, however. Online service providers would still need to meet conditions around transparency, rights to object and purpose scope.

Where an online service provider relies on these exemptions, it would also need to update its cookies notices and consent mechanisms.

Use of Research Data

The Bill broadens the concept of “scientific research” so that it includes any research that "can reasonably be described as scientific". It also allows individuals to consent to multiple types of scientific research, even if those types of research were not identified at the time they gave their consent.

These changes are clearly aimed at supporting the wider conduct of scientific research and use of research resulting from that research.

Digital Identities

Digital verification services are a useful way for individuals to prove who they are and attributes relating to them. They are often more “privacy-friendly” than alternatives such as ID cards. The Government intends to support the further adoption of such services across various sectors of the economy.

To do this, the Bill aims to ensure that digital identity products and services offered in the UK can be trusted by those that want to use them.

The legislation would not force people to use digital identities but it would introduce a framework of standards, governance and oversight within which digital verification service providers would operate.

Under the framework, the Government would publish a baseline set of rules called a “trust framework”, followed by supplementary codes for specific sectors. This trust framework would be accompanied by a register of digital verification service providers that are certified under the framework. 

The Bill will also enable the Government to award a “trust mark” to those service providers whose applications for registration it accepts under the scheme. So, digital verification service providers that would like to be registered under this scheme should monitor the standards that they would be expected to meet to obtain a trust mark.

Smart Data

The Bill will give the Science and Technology Secretary and HM Treasury the power to introduce new Smart Data schemes through regulations which will specify the scope of a scheme. These regulations include:

• Who is required to provide data.
• What data they are required to provide.
• How and when they must provide that data.
• How that data is secured and protected, including who authorises access to data.

This will allow consumers and businesses to safely share information about themselves with regulated and authorised third parties. In turn, this will generate personalised market comparisons and financial advice to cut costs. 

These schemes will provide for the sharing of consumer data with authorised and regulated third parties, building on the UK GDPR framework that allows individuals to obtain and share their data.

An example of such a scheme is open banking, which gives consumers better access to their banking data. 

The UK Government hopes this legislation will pave the way for the smart data model to be used in other sectors. For example, customers could compare prices between energy providers, allowing them to find better deals and reduce their energy use. The Bill could also stimulate a market for authorised intermediaries to help consumers switch service providers.

National Underground Asset Register

This is a new government digital service that would give authorised users access to a map of underground wires and cables in England, Wales and Northern Ireland. To support this service, owners of underground infrastructure will be required to register their underground assets.

Information Commission

Last (but not least), the Bill provides for the reform of the Information Commissioner’s Office. It will get a new name (the “Information Commission”) and a new structure and powers to go with it.

The ICO’s View

For its part, the Information Commissioner has welcomed the Bill, describing it as a pragmatic and proportionate amendment to the UK regulatory landscape.

The Information Commissioner also welcomed the government's renewed commitment to preserving the UK’s adequacy status for frictionless transfers from the UK. In his view, the Bill strikes a positive balance and should not adversely affect the UK’s adequacy status.

Next Steps

The Bill is sponsored by the Department of Science Innovation and Technology and originates in the House of Lords. It is currently at the second reading stage in the upper chamber. It therefore has a couple more hurdles to clear before it is passed down to the House of Commons for consideration.

Our Views

It is very early days for the Bill. It is likely to be subject to change, prior to its entry into force.  Organisations should therefore keep the Bill’s progress and its evolution on their “radar”. Freeths shall continue to monitor and report on the Bill’s passage as it makes its way through the legislative system.

If you have any queries regarding the Bill, please contact one of our Data and Information solicitors.