The Data (Use and Access) Bill (DUA Bill) is a substantial piece of legislation now in its final stages in Parliament. Introduced into the House of Lords on October 23 2024, and available to be tracked here, the DUA Bill aims to modernise the UK’s approach to digital and data regulation, reducing burdens on active organisations, while maintaining high data protections standards.
Background
Originally, the former Conservative government sought to push forward sweeping data reforms through the Data Protection and Digital Information Bill (DPDI Bill), with similar goals to the DUA Bill. The current Labour government reintroduced the legislative push with an enhanced focus on leveraging data protection and regulation and harmony between government, public services and data-using organisations, to help drive economic growth.
Aim
The aim of the DUA Bill is to:
- Stimulate economic growth through smarter data management;
- Simplify data regulation to drive efficiencies for both private bodies and the UK’s public services; and
- Improve people’s lives by creating an ecosystem of trust, efficiency and personal data empowerment.
Major Reforms
Legitimate interests
- Notably, the DUA Bill has established a new lawful basis for processing personal data, under “recognised legitimate interest”.
- The introduction of a list of recognised legitimate interests, such as for ensuring security of IT systems, emergency response and internal administration purposes, should give more confidence to organisations and enhance efficiency in the handling of personal data.
Data Subject Access Requests (DSARs)
- Introducing a new Article 12A into the UK GDPR, the DUA Bill allows DSAR deadlines to be extended in exceptional circumstances (such as when further information is needed or due to multiple requests from the same subject), benefitting data controllers.
- The DUA Bill clarifies that controllers will only have to execute DSARs within reason and proportionality.
Automated Decision Making (ADM)
- The DUA Bill proposes a reform of Article 22 of the UK GDPR, relaxing constraints around ADM.
- Proposed is to permit solely automated decisions as long as individuals affected by those decisions can interact with the decisions and challenge said decisions.
Smart data schemes
- Smart data schemes will be introduced to enable the secure sharing of customer and business data. The Information Commissioner’s Office (ICO) commented that ‘this can lead to significant positive effects’, centred around people’s empowerment in using their own data.
- This implementation will enhance the freedom provided by open banking through price-comparison and will be administratively supported by newly introduced data intermediaries.
Digital Verification Services (DVS)
- The DUA Bill brings in DVS, to more universally adopt digital identities and enhance national security.
- The DVS measures will not introduce mandatory identity requirements, but certified companies will receive a ‘trust mark’ and will boost their, and the wider ecosystem’s, digital trustworthiness.
Special Category Data
- The bill empowers the Secretary of State to impact the governing of special category data, with permissions to add new categories and exempt specific processing activities in certain uses of sensitive data, relaxing the compliance requirements of the GDPR.
Children’s data
- Another important proposed change is the introduction of stronger protections for children’s personal data, requiring online services to be designed with ‘children’s higher protection matters’ in mind.
Regulatory change
- Introduces a new regulatory body, the Information Commission, to take over the functions of the ICO, inheriting its powers, responsibilities and progress.
- Like much of the DUA Bill, the ICO is supportive, and it believes will facilitate operational improvements, while maintaining a ‘trusted, fair and independent regulator’.
Other measures
- The DUA Bill establishes the National Underground Asset Register (NUAR) a digital service to improve the efficiency and safety of underground work.
- The requirement under DPA 2018 for law enforcement authorities to record a justification in the log when consulting or disclosing personal data will be removed to improve efficiency and cut costs.
- The requirement in England and Wales for registers of births and deaths to be held in paper form will be removed, opting for electronic recording.
- The DUA Bill redefines how scientific research purposes are defined in terms of using personal data. There is ongoing debate around whether the definitions should lie in servicing the ‘public interest’.
Conclusion
While some small amendments may be made before the DUA Bill is passed, all organisations across the UK which engage in commercial activities or operate in the digital ecosystem should be preparing for its imminent passage into law.
The Labour government’s more popular, and modernised version of the DPDI Bill aims to improve efficiency, modernise the UK and consider the positioning of the population, authorities, businesses, regulatory bodies and more, in an evolving digital ecosystem where personal data is inseparable from privacy, public trust and economic growth.
Please contact Jose Saras and Xavier Prida for detailed advice on the above.
The material contained in this article is only for general review of the topics covered and does not constitute any legal advice. No legal or business decision should be based on its content.
This article is written in English language. Preiskel & Co LLP is not responsible for any translation of all or part of its content into any language.