UK Passes Data Use and Access Regulation Bill

Data privacy legislation modifying European data protection law the United Kingdom adopted before leaving the trading bloc in 2020 is now the law in only country to leave the European Union.

See Also: Expert Panel | Data Classification: The Foundation of Cybersecurity Compliance

The Data Use and Access Bill gained royal assent Thursday after multiple years of consideration in Parliament under different guises, but always with the aim of modifying the General Data Protection Regulation – the famously difficult to navigate continental regulation (see: European Court Fines European Commission for Privacy Breach).

“The new data regime is set to pump 10 billion pounds into the British economy over the next decade – speeding up roadworks, and turbocharging innovation in tech and science,” the U.K. government said.

The Labour government of Prime Minister Keir Starmer introduced the bill in 2024 after previous conservative governments sought to enact similar bills modifying the GDPR. Among the changes to the GDPR is a new processing standards for “recognized legitimate interest” for national security, crime and emergency purposes that will not require organizations to run an assessment test to determine the lawfulness of their data processing.

The Data Use and Access Bill relaxes rules regarding the use of artificial intelligence-powered automated decision-making. The regulation also increases the fine for direct marketing from 500,000 pounds to 17.5 million pounds, or 4% of global annual revenue, whichever is higher.

The new law amends the duties of the Information Commissioner’s Office to require business customers to first raise any privacy concerns before escalating any complaints to the data regulatory body. The regulation renames the ICO to the Information Commission.

Information Commissioner John Edwards said in January the bill would “boost innovation,” and support “data-driven business across a wide range of economic activities.”

The data regulator will continue to operate as an independent agency, Edwards said, addressing concerns that the regulation could undermine his agency’s power.

With the latest regulation, the government has attempted to “walk a thin line between change and maintaining an EU adequacy decision,” said Jonathan Armstrong, a partner at Punter Southall.

The EU requires data processors outside trading bloc boundaries to treat Europeans’ data with a similar level of protection. A finding that a country’s legal protections as a whole are on par with European standards leads to the EU making an “adequacy” determination. Great Britain is one of 15 countries whose commercial data processors can legally handle European data without separate contractual process and one of three whose law enforcement agencies can easily process personal data for criminal investigations.

Whether the EU will continue to find British law adequate enough has been an open question that shadowed consideration of GDPR modifications. The EU adequacy decision, made in June 2021, was valid only for a four-year period given concerns in Brussels that the GDPR might go the same way as British commitment to the European Union itself. The European Commission in March proposed a six-month extension of U.K. adequacy status to last until Dec. 27.

How Europe receives the Data Use and Access Bill “remains to be seen,” Armstrong said. “The benefit of GDPR was that, broadly speaking, companies could apply one set of processes across Europe. Adding changes, even if only cosmetic in terms of changing terms etc., adds cost and complexity.”