By Sue White, Information Governance Manager
Up until the last General Election, Data Protection professionals up and down the UK were geared up to deal with the changes which would be implemented by the proposed Data Protection and Digital Information (DPDI) Bill. This Bill fell at the last minute but in October 2024, the UK Government introduced the Data Use and Access (DUA) Bill which includes some, but not all of those changes proposed by its predecessor.
The failed DPDI Bill had proposed some controversial changes to UK data protection laws, such as a loosening of the rules around Data Protection Impact Assessments (DPIAs), and the removal of the need for many organisations to appoint an independent DPO. Many data protection professionals expressed grave concerns around these proposals, suggesting that such relaxations in the legislation could adversely affect the EU’s decision on the UK’s adequacy status. In any case, many of these more controversial proposals appear to have been discarded and do not form part of the new Bill.
A stated in the Explanatory Notes, which should be read alongside the Bill itself, the DUA Bill’s intention is ‘to harness the power of data for economic growth, support a modern digital government, and improve people’s lives.’ So, let’s have a whistle-stop tour around some of the changes proposed by the Bill:
- Automated Decision Making: Currently, under Article 22 of the UK GDPR, there are restrictions around organisations using automated systems (such as AI) to produce decisions about individuals, which could have legal or significant impacts upon them. The DUA Bill seeks to make it easier for organisations to use automated decision-making (including profiling) by limiting the scope of these restrictions to only cover automated decisions made using Special Category Data.
- PECR Fines: The DUA Bill proposes to increase fines for breaches of the PECR from £500,000 to UK GDPR levels. Therefore, organisations could face fines of up to £17.5m or 4% of their global annual turnover (whichever is higher) for the most serious breaches of the PECR.
- Cookie usage: The new Bill proposes to permit the use of cookies, without consent, for the purposes of web analytics and to install automatic software updates.
- Legitimate Interests: In specific circumstances, such as processing personal data for certain national security, emergency response and safeguarding reasons, the Bill seeks to legislate that Controllers will not be required to undertake Legitimate Interests Assessments (LIAs).
- International Data Transfers: A new test is proposed by the DUA Bill when risk assessing internation data transfers. This will assess whether the general processing of personal data in the receiving country or organisation is not materially lower than that of the UK GDPR.
- Smart Data: The DUA Bill includes provisions on ‘Smart Data schemes’ which, upon the customer’s request, would allow secure sharing of customer data held by organisations, such as communications or financial services providers, with authorised third-party providers/intermediaries. This would enable the use of customer data to provide services, such as efficient switching and personalised market comparisons and/or account management.
- Birth and Deaths: The new Bill intends to reform the registration of births and deaths in England and Wales from the current paper-based format onto an electronic register.
- Online Safety: The Bill proposes to introduce amendments to the Online Safety Act 2023 and create a requirement for OFCOM, when notified of a child death by the coroner to issue an information notice to specified online service providers requiring them to retain certain information relating to the use of the service by the deceased child for a specified period. This may assist in providing evidence for any online activity which may have led to the death of a child.
- The ICO: The Bill proposes to modernise the governance structures of the ICO by introducing a chair, non-executive and chief executive roles; providing a clearer framework of objectives and duties on which to report to Parliament; and introducing new, stronger powers of enforcement.
- Changes to marketing laws for charities: Another proposed change in the PECR is good news for charities who currently face challenges when trying to reach supporters for fundraising and donations. The DUA Bill seeks to soften some of the restrictions placed on charities and give them the same ‘soft opt-in’ opportunities as commercial organisations. This is a recent amendment to the DUA Bill, and we have recently written a news article for our website, which you may find informative and interesting.
Of course, the DUA Bill will be debated and is subject to changes and amendments while it progresses through Parliament. However, in its current form, this new Bill does not appear to make many particularly controversial or fundamental changes to data protection laws in the UK.
Further help
If you found this useful and want to deepen your expertise in data protection, explore our Intermediate and Advanced Certificates in Data Protection, or contact our Training Manager at info@naomikorn.com.