Data (Use and Access) Bill: New proposed changes to UK Data Protection laws
Reading Time: 4 minutes
Authors:
Trilateral Research |
Date: 27 January 2025
The Data (Use and Access) Bill was introduced to the UK Parliament on the 23rd October 2024 and a general debate was held on all aspects of the bill during its second reading on the 18th November. This new bill proposes several amendments to current UK data protection legislation, including “recognised legitimate interests” where the balancing test is not required and a reform of the research provisions. It also introduces new provisions for automated decision-making and includes amendments to data subject access rights clauses and complaints. These aim to support three core objectives to “grow the economy, improve public services and make people’s lives easier”.
We’re currently waiting for the report stage scheduled on the 21st January 2025 following a line by line examination of the bill (the committee stage) that has recently concluded. In the meantime, this article outlines the key proposals of the new bill and examines how (or if) these differ from the previous Data Protection and Digital Information Bill put forward by the Conservative government in 2022.
Data Protection and Digital Information Bill (2022)
Let’s first remind ourselves of the earlier proposals set out in the Data Protection and Digital Information Bill (“DPDI Bill”), which are outlined more fully in our blog post from the time. The changes set out were controversial and mainly aimed to reform the current accountability framework (inherited from the EU General Data Protection Regulations or “EU GDPR”) that the Conservative government viewed as ‘too prescriptive and burdensome for businesses’. Yet, they received considerable opposition from those working within the data protection sector.
The DPDI Bill also proposed substantial changes to the right of access following concerns raised by the government about situations where data subjects may circumvent the ‘strict disclosure… protocols’ under other legal gateways, such as the Civil Procedure Rules. They also outlined that the high threshold for applying the “manifestly unfounded or excessive” exemption makes it difficult for data controllers to apply. The ICO, however, raised concerns and made it clear the changes could potentially undermine the right of access itself.
Data (Use and Access) Bill (2024)
The DUA Bill contains several proposals to both the UK General Data Protection Regulations and the Data Protection Act 2018 (“UK data protection laws”), which include the following:
| Section | UK Data Protection Laws | DUA Bill Proposals |
| Legitimate Interests | Requires a Legitimate Interest Test (or balancing test) to be completed for all processing when relying on this lawful basis. | Introduce “recognised legitimate interests” where the balancing test is not required. These will be listed to clarify when the lawful basis can be relied upon. However, the proposal remains unclear as to whether organisations would still need to complete an LIA to determine the necessity and proportionality of the processing being considered. |
| Research Purposes | Contains broad interpretations and examples, including “technological development and demonstration, fundamental research, applied research and privately funded research”. | Adding new definitions to clarify when processing of personal data is for scientific, historical, and statistical research purposes (examples outlined in the full briefing paper). Additionally, there are proposals to incorporate the “broad consent to processing for research purposes” wording from Recital 33 of the EU GDPR into UK legislation. |
| Purpose Limitation | Requires personal data to be “collected for specified, explicit and legitimate purposes”. Allows further processing for scientific or historical research purposes with safeguards in place. | Changes in relation to the purpose limitation principle whereby new exemptions would set out the circumstances in which the processing of personal data for a different purpose would be considered compatible with the original purpose set out by the data controller. |
| Data Subject Rights | Sets out statutory deadlines for responding to data subject rights requests (including when to extend) and contains broad instructions for clarification. | Amendments to data subject rights clauses aim to align legislation with guidance issued by the ICO. The proposed changes relate to time limits for requests and changes wording to “before the end of the applicable time period”. This allows for the extension of a SAR where necessary due to complexity and/or number of requests; and when the ‘clock stops’ for additional information requested. |
| Automated Decision-making | Individuals “have the right not to be subject to a decision based solely on automated processing” that produces a legal effect, and there are strict restrictions in place when using special category data. | The expansion of automated decision-making provisions under Article 22 of the UK GDPR. These changes would introduce a “significant decision” that “produces a legal effect for the data subject” or “has a similarly significant effect for the data subject” (Clause 80). It also sets out new safeguards required to ensure transparency and enable data subjects to contest decisions and obtain human intervention. |
| International Transfers | A data controller must have appropriate safeguards in place when transferring personal data outside of the UK, such as Standard Contractual Clauses or Binding Corporate Rules. | Clarifying the rules for Adequacy Decisions, the UK GDPR international transfer regime, and the transfer of information in relation to law enforcement. Wording of the bill suggests a more risk-based approach to assessing an international transfer. However, the ICO has expressed concerns that this section needs further clarity, and in particular to the “Data Protection Test”, which could lead to some confusion. |
| Data Protection Complaints | There are currently no specific requirements on how to handle data protection complaints, except where an accredited body monitors a Code of Conduct. | Amendments to how data protection complaints are handled by organisations. The bill will require organisations to have a complaints procedures in place and consider any complaints received before they are escalated to the ICO, which incorporates an approach outlined by the supervisory authority in recent years. |
| Cookie Consent | Organisations are required to obtain informed consent prior to download, except for ‘strictly necessary’ cookies. | Amendments to cookie consent requirements whereby the new bill would prevent the storage of or access to information contained within subscriber devices (“terminal equipment”), unless this is done in accordance with new conditions the bill sets out. These introduce new exemptions for collecting statistical information (i.e., how a user is using a website with the aim to make improvements) and enable geographical location to be discovered. |
In many ways, the proposals set out in the DUA Bill build on the ideas presented in the DPDI Bill, as there are some familiar amendments. The DUA Bill, however, removes the more controversial proposals and refines others with the aim of providing more clarity with regards to some types of processing (e.g. scientific, historical, and statistical research) and aligning with current ICO approaches or guidance. The Information Commissioner (John Edwards) has also responded to the new DUA Bill and welcomes a commitment to “modernising the data protection landscape” with a “positive and balanced package of reforms” that are pragmatic and proportionate.
Trilateral Research provides UK organisations with comprehensive DPO and DPO Assist services, and we are continuously monitoring the progress of the Data (Use and Access) Bill. If you would like to know more about how our data protection experts can support your organisation in building robust frameworks, policies, procedures and training to ensure compliance with data protection rules, check out the specialist services we provide, please contact our advisors.
