UK data bill opens up new data opportunities

Keen analysts of UK data protection law are busy comparing the new Data (Use and Access) Bill(1) with the previous government’s Data Protection and Digital Information Bill, which fell with the Conservative government. But most businesses are more likely to ask about the differences between the new Bill and the current Data Protection Act 2018.

A briefing on the UK’s Data (Use and Access) Bill 2024

Join us to be one of the first to learn from the government’s policy team who drafted the text. I invite you to attend the Privacy Laws & Business briefing in-person or online on Monday 25 November hosted and sponsored by Linklaters, at their office in central London. The briefing will develop the themes covered here and much more.

PL&B Report Subscribers can register for this event for free when you register by 15 November.

What can business expect from the new data bill?

As the new government has a large majority in Parliament, what can businesses expect if the new Bill is enacted as currently drafted?
It is clear that the government intends that this data bill will:

• Amend both the Data Protection Act 2018 and UK GDPR
• Maintain high standards of protection
• Bring clarity to existing legislation
• Encourage the growth of smart data schemes and other forms of tech innovation, such as digital verification services, so that companies which provide tools for verifying identities will be able to get certified against the government’s stringent trust framework of standards, and receive a ‘trust mark’
• Win EU approval when it reviews the UK’s “adequacy” test next year.

The government is building on the existing familiar legislative framework so neither the Data Protection Act 2018 nor the UK GDPR are being repealed.

My first impressions

The first point to notice on page 1 of the Bill is that six different government departments are referenced as having contributed to the explanatory texts, showing that all of them have a vested interest in the Bill’s trajectory to help stimulate the economy. They include not just the lead Department for Science, Innovation and Technology, but also the Department for Business and Trade, and the Department for Energy Security and Net Zero.

The second point on page 1 is that the minister declares that the provisions of the Data (Use and Access) Bill are compatible with the Council of Europe Convention on Human Rights. Although this is normal practice, the context in this case is that some ministers in the previous government wanted the UK to withdraw from the Convention.

This statement at the beginning of this new Bill now appears as a way of showing that the new government is committed in a credible and unified stance to stay working within the Convention, which is the first step in achieving EU adequacy when it is reviewed next year.
What do organisations have to do differently? As the Bill runs to 250+ pages, the answer is rather complex. I will deal here with just two points.

Is marketing research “scientific research”?

There has been much unease in business circles, for example by the Data & Marketing Association over interpretation of the term “scientific research.” Does this term include marketing and other types of commercial research? The definition in section 67 of the Bill, helpfully for business, opens up the definition to wider interpretation:

“the processing of personal data for the purposes of scientific research … are references to processing for the purposes of any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity.”

The Bill permits organisations in all sectors to take the initiative to assess on a case-by-case basis whether their research can be reasonably described as “scientific”. All organisations conducting scientific research including those with commercial interests, must also meet all the safeguards for research laid out in the UK GDPR as well as comply with the legislation's core principles such as fairness and transparency.

Organisations could now make a credible argument that the term should also include commercial marketing research which would fall within Section 67 (1) (b) 5 (see box).

This type of analysis is assisted by publication of the 158 pages of Explanatory Notes(2) where paragraph 525 on page 69 states:

“This list provides examples of types of scientific research, such as applied or fundamental research or innovative research into technological development. However, this list is non-exhaustive and scientific research is not restricted to exclusively these types.” [My emphasis added]

Broader consent for the conduct of research

The new bill makes a change to when consent is requested in broad terms where it is not fully clear what the research project will be at the time when the data is collected. A scientific example is when collecting data for the study and treatment of cancer rather than a specific cancer. However, the principle could easily be applied to commercial marketing research or many types of social research.

The UK GDPR already acknowledges the concept of “broad consent” for scientific research when only the area of research is known. But this is tucked away in the recitals, meaning researchers may be unsure of when they can use it. This reform will give researchers certainty and confidence when using broad consent, allowing them to focus more on conducting the research than meeting the tight definition of the research’s purpose.

We look forward to receiving your registration for the UK bill event on 25 November and learning together about the new legislation.

Best regards,

Stewart Dresner
Publisher, Privacy Laws & Business

September 2024