Breaking: Government Tables New Data Bill

The UK Government has tabled the much-anticipated Data Use and Access Bill, which will form a key tenet of the UK’s data legislative infrastructure going forward.

The Bill, delivered by the Department for Science, Innovation, and Technology, is designed to “put technology and data protection at the heart of the economy,” and “promote growth, improve public services and make people’s lives easier.”

Ministers expect the measures to “generate approximately £10 billion towards the UK economy across ten years by legislating on data sharing to generate a host of benefits for both consumers and businesses.”

The DMA has been active in promoting measures of importance to the Data and Marketing Industry and welcomes the positive engagement from Ministers and officials to date.

As is reflected in the legislation, it is clear the UK Government has taken seriously the issues and priorities of the DMA and its members. We will continue to make the case for our members’ interests as the Data Use and Access Bill makes its way through the Parliamentary process.

DMA CEO Chris Combemale said,

“We welcome the focus on economic growth and improved public services enabled by data sharing, which we believe will promote public and private sector collaboration and enable businesses to communicate with their customers more effectively,” commented Combemale. “The DMA has long been committed to fighting for essential reforms in data protection legislation and skills that are essential to our members, their customers, their teams and the economy, and we are pleased that the new Bill puts technology and data protection at the heart of the economy.”

“The DMA has always been committed to getting the balance right between protecting privacy and promoting innovation. Our members will welcome maintaining a high level of data protection and the current accountability framework. Getting the balance right is essential to building trust in both the public and private sectors, ensuring that people have confidence in the modern products and services that will improve their lives.”

“We are in full support of the government’s vision to unlock the power of data to grow the economy and improve people’s lives and look forward to continuing to support our members in line with the new measures introduced to Parliament today.”

Key Issues that will be of interest to DMA members

1. Legitimate Interests: Direct marketing has been included in the main text of GDPR as an example of a legitimate interest in Article 6.1.f. This provides greater certainty for our members when using legitimate interests as a lawful basis, especially when considered in the context of recent UK and EU case law that both confirmed that direct marketing and advertising could be legitimate interests subject to necessity and balancing tests (Legitimate Interest Impact Assessments)

2. Definition of Direct Marketing: the definition has been added to GDPR and PECR confirming a wide definition of direct marketing as “the communication (by whatever means) of advertising or marketing material which is directed to individuals.

3. Exemptions to consent for cookies: a range of exemptions to consent for cookies are listed in Schedule 12 of the Bill, including strictly necessary, statistical purposes, website appearance and emergency assistance being provided. The DMA believes that many websites that are not advertising supported such as pure play ecommerce, B2B and corporate websites may be exempt from cookie consent pop-up banners.

4. Accountability framework in GDPR: changes that were proposed in the DPDI have not been included in this Bill so the status quo of Accountability requirements such as Data Protection Officers and Records of Processing activity remain as is under GDPR.

5. Codes of Conduct: the legislation confirms the importance of Codes of Conduct developed by trade associations under GDPR Articles 40 and 41 and extends Codes of Conduct to include PECR issues. This confirms the co-regulation of data protection and enables the DMA to resume work on a Direct Marketing Code of Conduct with the ICO delegating authority for investigating breaches to the Data and Marketing Commission.

6. House of Lords: The bill will begin its legislative journey in the House of Lords where it had its First Reading on 23 October 2024 around 6 pm. The Second Reading has not been scheduled.

7. Scientific research and technology development: The Data (Use and Access) Bill addresses the need to clarify how data can be better used to support scientific research and technology by expanding the definition of what constitutes “scientific research” under UK GDPR. It also allows for the processing of personal data without explicit consent under certain circumstances, provided the research meets specific ethical and legal requirements. The Bill insists on strong safeguards around the processing of personal data for research purposes.

The DUA Bill will go to 2nd Reading on the 19th of November, with provisional committee dates on the 3rd, 10th, 16th and 18th of December. In the meantime, the proposed Bill and related information can be found on the UK Government website.