Data (Use and Access) Bill (DUAB) – Legislation update
The Data (Use and Access) Bill (“DUAB”) is swiftly working its way through the legislative process having received its first reading in the House of Lords on 23rd October 2024, followed by its second reading on 19th November 2024.
It completed the Committee Stage in December 2024 and is awaiting the Report Stage in January 2025. The DUAB replaces the now defunct Data Protection and Digital Information (No.2) Bill (“DP&DI”) which did not make it onto the “wash-up” list before the dissolution of Parliament in 2024 before the general election.
Some of the provisions proposed in the DP&DI have been carried across to the DUAB but there are some differences. In some cases, the new proposals will make it easier for organisations to comply with the data protection requirements and, in other cases, it will become more onerous.
However, overall, the proposals, if enacted, will mean that the UK will be more aligned with the EU GDPR than if the DP&DI had become law.
Let’s look at some of the key proposals below.
Changes to the Information Commissioner’s Office (ICO)
As proposed in the DP&DI, the structure and governance of the UK regulator will change. At the moment, all authority is vested in the Commissioner who delegates, as necessary. However, under the new structure, the ICO will become a corporate body called the Information Commission and it will have a similar structure to the Financial Conduct Authority and the Competition and Markets Authority, in that it will be made up of a Chief Executive Officer, a Board and a Chair.
The Information Commission will have new enforcement powers including the following:
- Compelling someone to attend an interview (including former employees of an organisation);
- Requiring an organisation to instruct an approved person to prepare a report (the content of which can be specified by the Information Commission and must be paid for by the organisation) and;
- Requiring someone to produce specific documents.
E-privacy under the DUAB
Under the DUAB, it will not be necessary to collect consent from users for cookies used for low-risk purposes such as analytics, providing the user is given the opportunity to opt out.
Also, the maximum fine for breaching the rules relating to direct marketing and the use of cookies under the Privacy and Electronic Communications Regulations will increase from the present maximum of £500,000 to £17.5 million or 4% of global annual turnover, whichever is the greater, making it equivalent to the maximum fine under the UK GDPR.
However, although it was proposed under the DP&DI that the soft opt-in would be extended to cover political parties, elected representatives, charities and not-for-profits, this is not included within the DUAB. That said, there is a campaign to bring it back, so there is a possibility that this could change again.
Statutory right to complain to a controller
The DP&DI proposed that controllers must adopt an in-house complaints process that data subjects would be invited to follow before submitting a complaint to the ICO. This proposal has been retained by the DUAB and data subjects will, therefore, have a statutory right to submit a complaint to the relevant controller and controllers will be obligated to set up an in-house complaints procedure, whereas there is no such requirement in place at the moment. The aim of this proposal is to enable complaints to be resolved between the parties more quickly and easily without the regulator’s involvement.
Data subjects’ rights
In terms of subject access requests, the DUAB explains the situations in which the “clock stops” on the deadline for responding to such requests and confirms that controllers are only required to conduct a “reasonable and proportionate” search. Both proposals are aligned with case law and the ICO’s existing guidance.
However, one proposal under the DP&DI which has not been carried across to the DUAB is the lowering the threshold from “manifestly unfounded” to “vexatious” in relation to charging a fee for dealing with a data subject request or refusing to deal with a request. Therefore, the same test that presently applies will continue to apply. Consequently, controllers hoping to be able to reject more subject access requests on the grounds that they are vexatious will be disappointed.
Automated decision-making, relaxed under the DUAB
The DUAB proposes to relax the restrictions on the use of automated decision-making, the effect of which will be that this type of processing will be permitted, providing certain safeguards are implemented. Such safeguards would include, amongst other things, ensuring that the Equality Act is complied with, explaining the reasons for the automated decision-making to data subjects and ensuring that any review by a human is carried out by a competent person.
The general prohibition on the use of automated decision-making (which produces legal effects or similarly significant effects) and the existing exceptions, will only apply in relation to special category personal data.
This takes into account, the increase in the use of artificial intelligence (AI) and is likely to enable more low-risk AI systems to be implemented without the “red tape”. However, organisations will still need to be mindful of the applicable AI legislation, such as the recently enacted EU AI Act. Indeed, the EU AI Act will need to be read alongside the DUAB to ensure compliance with both, where applicable, as although this is EU legislation it also applies outside the EU in some situations.
We would not expect any conflict between the DUAB and the EU AI Act, bearing in mind that the relaxation in the rules relating to automated decision-making under the DUAB still requires appropriate safeguards to be implemented and the existing rules will still apply to special category personal data. Nonetheless, it remains to be seen whether any such scenarios will arise.
Privacy notices
The DUAB proposes to amend the transparency rules by removing the requirement for controllers to serve privacy notices on individuals from whom they collected their data directly, in circumstances where it is impossible or requires disproportionate effort to do so. Presently, this exemption only applies when a controller collects the data subjects’ data from a third party.
When assessing whether it would involve disproportionate effort, relevant factors would include the number of data subjects, how old the personal data is and any appropriate safeguards that have been implemented. However, a controller relying on this exemption would still need to make the relevant privacy notice publicly available, such as publishing it on their website.
Legitimate interests
As proposed under the DP&DI Bill, there will be a list of processing activities that will be deemed to be “recognised legitimate interests” which includes processing activities such as national security, emergencies, detection, investigation or prevention of crime and safeguarding vulnerable individuals. The Secretary of State will have the power to make changes to this list.
The effect of this list is that the rights and freedoms of the individuals will not need to be balanced against other interests in a legitimate interests assessment, thereby streamlining the process for processing activities that are generally low risk and in the public interest.
In addition to the “recognised legitimate interests”, the DUAB also contains some examples of other activities that “may” be processed under the lawful basis of legitimate interests and these include processing for direct marketing purposes, intra-group transfers and security of networks and systems. These situations will still require the balancing test to be carried out.
Smart data schemes
Part 1 of the DUAB sets out provisions relating to real-time sharing of data and it is envisaged that these provisions will support the development of open banking and open finance in the UK. However, the DUAB does not provide the details of how the Smart Data Schemes will work and this will be set out in secondary legislation
Special categories of data
A new power not mentioned under the DP&DI which appears in the DUAB is that the Secretary of State can add new types of special category personal data and new types of processing activities to Article 9 of the UK GDPR without the need for further primary legislation. New items added may also be removed, although the existing provisions under Article 9 of the UK GDPR cannot be removed.
Data transfers
Presently, when exporters are transferring personal data to a country that does not have adequacy status, the exporter must carry out a detailed Transfer Risk Assessment (“TRA”) to assess the level of protection the personal data will be afforded in the destination country. However, the DUAB proposes a “data protection test” which is a more risk-based approach, whereby exporters need to consider whether the protection for personal data in the destination country is “materially lower” than the UK and must apply this test “reasonably and proportionately”. This should make it easier for the transfer of low-risk data, in alignment with the ICO’s existing guidance.
What is NOT in the DUAB
There were numerous changes proposed by the DP&DI that have not been carried across to the DUAB which include, amongst others:
- To replace Data Protection Impact Assessments with less prescriptive Risk Assessments;
- To replace the requirement to appoint a Data Protection Officer with a Senior Responsible Individual;
- To allow data controllers to charge a fee to respond to subject access requests or refuse to respond in more situations;
- To remove the requirement for organisations established outside the UK to appoint a UK representative and;
- Amend the requirements relating to keeping a Record of Processing Activities.
The next steps for the DUAB
Whilst it looks likely that the DUAB will proceed through the legislative process quite quickly, the ICO has asked for clarification in relation to legitimate interests, data transfers and automated decision-making. As such, the final version of the DUAB may look slightly different to the present version. However, huge changes are not expected.
Our advice for organisations
We would advise organisations to start to review their compliance frameworks against the DUAB proposals in readiness for the new law, although any changes that need to be implemented should not be significant, since the DUAB is still closely aligned with the UK GDPR. In any event, once the legislation has been enacted, there will be a reasonable period of time before it becomes enforceable to allow organisations to make the necessary adjustments.
If you plan to outsource your DPO or you’d like to broaden internal discussions to include some independent and transparent GDPR advice, then feel free to contact us; we can guarantee a friendly and informal chat about the best option for your organisation with no ‘hard sell’. You may also find our white paper on GDPR Accountability useful.
Image by rawpixel.com on Freepik
