The Data Use and Access Bill: Time's up for the ICO?

Marketers across the UK will gasp in disbelief (or perhaps relief) that the ICO’s days appear to be numbered. That is, if the Data Use and Access Bill (DUAB) has its way: sections 115-118 detail the complete abolition of the ICO.

But... what appears to be a big shakeup may just be more of a re-structure and re-focus. Indeed, if passed, the DUAB will create a new ‘Information Commission’.

The Information Commission will take over all regulatory responsibilities previously held by the ICO.

So, plus ça change? Well, yes and No.

This new body will operate with a more flexible structure, designed to support innovation while maintaining strong data protection standards.

This shift is part of a modernization effort, aiming to better align data protection regulation with the increasing complexities of digital economies and innovation, such as AI and Smart Data systems.

The new Commission will have broader powers and a more dynamic governance structure.

It will also have a greater focus on innovation and competition, balancing its enforcement role with a supportive approach to businesses developing new technologies.

The Commission is also tasked with evaluating the impact of its actions on economic growth, particularly in sectors driven by data innovation like AI and smart technologies.

Importantly for the DMA, the Information Commission will also have the authority to issue and enforce codes of practice for the processing of personal data, including guidance on AI, automated decision-making, and international data transfers​.

The legislation confirms the importance of Codes of Conduct developed by trade associations under GDPR Articles 40 and 41 and extends Codes of Conduct to include PECR issues. This confirms the co-regulation of data protection and enables the DMA to resume work on a Direct Marketing Code of Conduct with the ICO delegating authority for investigating breaches to the Data and Marketing Commission.

The UK Government Secretary of State for Science, Technology and Innovation will gain more powers. Under the new Bill, the Secretary of State gains increased authority over the Information Commission.

The Secretary will be able to appoint the members of the Commission, including the Commissioner, which contrasts with the current ICO’s more independent governance structure.

The Secretary of State will also be able to issue policy directions to the Commission, giving the government more control over the strategic direction and priorities of the regulator. This allows the government to align the Commission’s actions with broader innovation and economic goals.

Finally, the new framework requires more accountability to Parliament and regular reviews of its performance, potentially increasing transparency, but also increasing governmental oversight.

While some may think this is a politicisation, it could be argued as a sensible step for increasing regulatory flexibility in the face of new arising challenges and also aligns with political and economic priorities of Parliament. The current leadership of the ICO support the changes, too.

The DUAB has been introduced to the House of Lords and still needs to go through the complete legislative process. The proposals are subject to change.

The DMA has been and will continue to represent the interests of its members as the Bill makes its way through Parliament.