UK Data (Use and Access) Bill in consideration
The House of Lords is currently considering the latest iteration of the UK Data (Use and Access) Bill. The Bill was introduced to Parliament on 23rd October 2024 and is expected to be given royal assent before the summer recess.
Aim of the Bill
This landmark piece of legislation is aimed at modernising how data is used and accessed across both the public and private sectors. It builds on existing UK data protection laws, including the Data Protection Act 2018 and GDPR by creating a framework that balances innovation with privacy. Its objectives include:
- Streamlining access to data for innovation: Encouraging responsible data sharing between organisations to drive advancements in areas such as healthcare, technology, and scientific research.
- Protecting personal data: Ensuring robust safeguards are in place to prevent the misuse of personal information.
- Facilitating public trust: Promoting transparency and accountability in how organisations use and share data.
Scope of the Bill
Key provisions your business will need to be aware of include:
- Automated decision making: keeping pace with the development of artificial intelligence and its various use cases across the public and private sector, the Bill softens current restrictions on automated decision making
- Collection and use of research data: The changes introduced by the Bill are intended to benefit organisations that conduct research or use research results – in particular scientific research. It broadens the scope of what people can consent to their data being used for. For example, data can potentially be used for more than one type of scientific research, or for purposes that were not identifiable at the time consent was given.
- Digital Identity: Under the bill, the Office for Digital Identities and Attributes (OfDIA), will oversee a standards framework for online digital verification and will issue certification to compliant organisations.Compliance requires that business do not profile users for third-party marketing purposes; don’t create large datasets that could risk revealing sensitive user data; ensure users explicitly understand how their data is being shared
- Smart Data: A Smart Data regime will be implemented to allow for sector specific smart data schemes.These schemes will allow individuals to request that their data be shared directly with them, or other authorised and regulated third-party organisations. Schemes must also establish a framework to ensure secure storage and transfer of data to enhance consumer confidence whilst also improving access to products and services, personalisation of advice, and streamlining digital experiences.
- Cookies and tracking: In a change to current legislation the Bill will not require that users consent to use of cookies/tracking technologies, if they are used for statistical purposes to make improvements to services, user experience, or website performance. However, it will include conditions such as the right to object and not using data for purposes out of the scope of requirements.
- Legitimate interest: The Bill provides that certain types of data processing will be more likely to count as legitimate interest processing, such as for direct marketing, internal data sharing, network and IT security etc.
Preparing for the Bill – Advice for businesses
Six things your business should be doing to prepare:
- Consider how your business may increase the use of automated decision making in future to ensure you will comply with the conditions and restrictions of the Bill.
- When it comes to research data, be careful. There are still guardrails you must implement. Ensure your policies and procedures consider the safeguards and limitations included in the Bill to remain compliant.
- Whilst compliance with the digital identity standards framework will not be mandatory, your business should seek to obtain certification to ensure data processing practices are compliant with the enhanced obligations
- Do you have a smart data scheme, or do you need to implement one? Get ahead of the game, especially if you operate in the finance, telecom or energy sectors.
- In terms of use of cookies and tracking technologies, review current procedures and implement any changes necessary to ensure ongoing compliance, for example introduce consent management and update cookie policies.
- Review what your business currently deems to be legitimate interest processing and ensure you are within scope of the legislation.
What next?
The main provisions of the bill are likely to come into force by early 2026, with transitional arrangements to help your business achieve full compliance.
Make sure you keep an eye on developments as it moves forward through the parliamentary process, and consider its potential impact on your business, your operations, and your customers.
If you would like to discuss how The UK Data (Use and Access) Bill may affect your business, please get in touch with a member of Leverets specialist team. We can assist in several ways:
- Legal Compliance and Risk Management:Advising on compliance with new data access and privacy regulations introduced by the bill.
- Contractual and Transactional Support:Assisting in drafting and reviewing contracts to ensure they align with the updated data protection requirements.
Strategic Legal Guidance: Providing insights into how the bill’s provisions may impact business operations and advising on best practices to mitigate legal risks
