The UK’s Data (Use and Access) Bill (the "Bill") has now successfully passed through both Houses of Parliament and awaits Royal Assent to become law. The Bill forms a key part of the UK Government’s data strategy and engaged a huge amount of parliamentary commentary as well as public commentary including from creative industries and celebrities including Sir Elton John and Dua Lipa.
We will be closely monitoring the Bill's passage to Royal Assent and provide updates as further detail emerges, but in the meantime, here is a reminder of some key changes:
- Changes to direct marketing and fundraising: The maximum fines for non-compliance with rules around electronic communications and marketing will be substantially increased, and the soft opt-in exemption will be extended in its application.
- Trusted Data Sharing Frameworks: New structures are introduced to support secure data access via accredited data intermediaries, helping to streamline data-sharing agreements between organisations.
- Safeguards for Personal Data and Clarification of Legitimate Interests: While enabling greater data access, the Bill includes additional safeguards to ensure that personal data is used appropriately. This also includes a list of examples of pre-determined legitimate interests which may be used by controllers under Article 6 of the UK GDPR.
- Research and Innovation: The Bill creates new opportunities for approved researchers and innovators to access valuable datasets, particularly in health, science and AI development. Some of the key changes include a definition of scientific research and streamlining of consent requirements in this context.
- Oversight and Enforcement: The legislation provides for the establishment of new oversight bodies and clarifies enforcement powers to ensure compliance with the new data access regimes, including rights of the ICO to compel interviews and expanded powers to demand information.
- Facilitating Access to Public Sector Data: The Bill seeks to establish clearer legal gateways for sharing and reusing public sector datasets for research, innovation, and service delivery.
Impact for the healthcare sector
Organisations that rely on access to public sector data including those in healthcare, AI, life sciences, financial services and research are likely to benefit from the Bill’s more permissive yet controlled data access environment. However, businesses will also need to engage with the new regulatory frameworks and ensure that any data sharing is conducted in compliance with the new legal requirements. This will involve in-depth reviews of existing processing frameworks and impact assessments.
The Bill is particularly significant for organisations operating in healthcare, life sciences and AI development, where access to real-world datasets can drive research, clinical trials, drug development, public health interventions and AI model training. However, these sorts of organisations will need to carefully engage with the emerging accreditation regimes for trusted data intermediaries, demonstrate robust governance, and ensure ethical use of personal data to gain and maintain access.
It also included a significant addition in the form of powers to the Secretary of State to make changes to the types of data classed as special category data, which means that businesses will need to ensure they keep up-to-date with these requirements and classifications to ensure that processes are legally compliant.
Copyright and AI
Most notably, and perhaps the area of the Bill which received the most debate was in relation to the use of copyright materials to train AI. Campaigners had been seeking for amendments to the Bill to force companies to declare their use of copyright materials in training AI models. However, the Bill has been passed without these amendments, with the Government stating that this will be considered under its separate consultation on copyright law. In addition, the High Court is in the process of hearing the long-awaited Getty Images v Stability AI case, which has potentially significant ramifications for the issue of using copyright materials for AI model training.
Data Transfers
The European Commission had extended the current UK adequacy decision to the end of the year to allow it to assess the impact of the Bill on data transfers. The Bill introduces a subtle change to the UK data transfer regime. It is now yet to be seen what approach will be taken on the UK's current EU adequacy decision in light of the Bill.
Preparing for change
Amendments to the UK data protection and direct marketing laws are expected to come in quickly. This means that existing data protection frameworks and marketing strategies should be reviewed and amended, if needed, as a priority.
MFMac's Commercial team can assist with this or any wider guidance around the implications for data controllers and data processors set out in the Bill, so please do not hesitate to get in touch if you would like any further information on the support we can provide.
