The new UK Data Use and Access Bill (October 2024) is set to bring real changes to the UK’s data landscape. If passed, the Bill is reported to have the potential to boost the UK economy by £10 billion over 10 years and save significant staff hours and costs, particularly for the NHS and the Police.

The UK Government states that the legislation will also expand the open banking model to other sectors. This will create new smart data schemes, allowing consumers and businesses to share personal data safely with third parties for personalised market comparisons or advice to save money.

This is the third attempt to update data protection laws (UK GDPR) in the UK post-Brexit. There is optimism that this Bill has a better chance of becoming law. It also seems to remove some earlier provisions that would have amended the UK GDPR and brought into question the UK’s EU-UK Adequacy Decision. The European Affairs Committee in the House of Lords has highlighted this year that losing EU-UK Data Adequacy status would impose significant costs and burdens, countering the UK Government’s growth agenda.

The UK Information Commissioner:

“We welcome the introduction of the Data Use and Access Bill in the House of Lords and look forward to seeing it progress through Parliament to Royal Assent.

This legislation will allow my office to continue operating as a trusted, fair, and independent regulator, providing certainty for all organisations as they innovate and promote the UK economy.

Our response to the Bill will be published in due course.”

One major benefit of the Bill is the potential for economic growth by simplifying the regulatory environment. For in-house lawyers, this means a (hopefully) simpler framework for data exchange and sharing, freeing up resources for innovative projects. However, the interpretation of the Bill’s provisions will be crucial. Legal teams must continue to balance innovation with compliance.

Key areas to watch include:

• Automated decision-making

• Legitimate interests (e.g., direct marketing, intercompany data sharing, network and information system security)

• Structural changes with the creation of the Information Commission (replacing the Information Commissioner)

• Amendments to the Privacy and Electronic Communications Regulations with GDPR-level fines

• Digital verification services

• Simplifying cookie consent

• Similarities to the EU Data Act

• National Underground Asset Register …and more.

Many commentators have already focused on the importance of changes to automated decision-making, especially with the rise of AI. These changes would allow businesses to use automated decision-making more broadly than under the EU GDPR. Only where special category data is used would companies be subject to additional requirements to show consent or that the processing is required for a contract or legal compliance. It is expected that individual rights of objection and to require human intervention are to be preserved. 

Other commentators are focusing on data sharing and digital verification aspects.

The Data Use and Access Bill aims to advance data governance and boost the UK economy. While it offers opportunities, in-house counsel must remain vigilant and proactive to fully leverage its benefits.

RMOK Legal Comment

We are keeping a close eye on this Bill as it progresses through Parliament. If you have questions or need legal support, RMOK Legal is here to look after it for you.