On 23 October 2024, the UK government set out its proposed reforms of UK law relating to the use of and access to data, with the introduction to Parliament of the Data (Use and Access) Bill (the “DUA Bill”). The DUA Bill is intended by the UK government to enhance the UK’s digital strategy and unlock the use of data, harnessing its capabilities to boost public services and contribute to the UK economy.
Many of the changes proposed in the DUA Bill can be traced back to the previous government’s attempts at reform in this area under the Data Protection and Digital Information (DPDI) Bill, which failed to progress through Parliament before the general election on 4 July 2024. The new government’s intention to continue with reforms in this area was outlined by the King’s Speech 2024, the background briefing notes of which laid out its plans for a Digital Information and Smart Data Bill that would harness the power of data for economic growth, to support a modern digital government, and to improve people’s lives.
In this Law-Now update, we introduce the key areas for change and will publish a series of further Law Now updates that will focus on each of these in more detail.
What are the key areas of reform under the DUA Bill?
Key areas targeted by the DUA Bill include the following:
Smart data powers: Sharing customer and business data
The DUA Bill sets out a framework for the Secretary of State and the Treasury to establish new smart data schemes that will require data holders who are in-scope of such a scheme to provide access to customer data (broadly, information relating to a customer of a trader) and business data (broadly, information about goods and services supplied or provided by a trader). Such access may be to customers and other specified third parties that are authorised by the customer to receive the data. These reforms have parallels with recent data developments in the EU, in particular the requirements of the EU Data Governance Act (which has been applicable since September 2023) and the EU Data Act (which came into effect on 11 January 2024 and will become applicable in September 2025). However, unlike the Data Governance Act, the data sharing reforms proposed by the DUA Bill are not limited to public sector data, and unlike the Data Act, which is focussed on IoT technology, the reforms proposed by the DUA Bill are not exclusively about access of data generated by connected products.
Beyond Open Banking and towards Open Finance
The smart data framework described above is also intended to be used to support the UK’s Open Banking scheme on a long-term basis, and to spark further innovation in the financial services sector. The Treasury will be able to empower the Financial Conduct Authority (FCA) to make rules to regulate smart data schemes in the sector and to use its supervisory and enforcement powers. This is intended to enable so-called ‘Open Finance’, which has been discussed for a number of years, and is intended to roll out the principles of data sharing beyond banking, to other financial services, including investment advice and personalised guidance.
Public sector data sharing
The DUA Bill seeks to enhance public services by facilitating better data sharing among public bodies. This includes the creation of a National Underground Asset Register (NUAR), a new government digital service that will provide access to a map of the underground infrastructure in England, Wales and Northern Ireland. These proposals will make it mandatory for organisations that install apparatus underground to sign-up and record prescribed information regarding the installation. The government hopes that the NUAR will streamline the process by which infrastructure asset data is shared and improve the way buried infrastructure is installed, maintained, operated and repaired.
The DUA Bill also proposes the introduction of mandatory information standards for all suppliers of IT services to the UK health and care system, to ensure that health and care data is recorded and managed in a standardised manner. This is intended to enhance health and care professionals’ access to such data by making it more interchangeable.
These proposed reforms are comparable to recent developments in the EU under the Data Governance Act and the Common European Data Spaces, which seek to increase access to data held by public bodies and enhance data sharing in strategic sectors.
Digital identity verification
As with the DPDI Bill, the DUA Bill sets out a framework for establishing ‘trusted’ providers of digital verification services. This includes a ‘trust mark’ for organisations that have been certified against the framework, a register of providers, and an information-sharing gateway. The government hopes that use of the trust mark will enable consumers to make informed decisions about organisations with whom they share personal data and give them confidence that organisations displaying the trust mark will process their personal data to a stringent set of standards.
Data protection reform
The DUA Bill introduces a number of significant reforms to UK data protection law. Many of the changes to the UK GDPR that are set out in the DUA Bill address areas that were in line for change under the earlier DPDI Bill. This includes: clarifying what commercial activities fall within the scope of processing for “scientific research purposes” and relaxing the conditions for obtaining consent to such processing; defining processing activities that may be necessary for purposes of a legitimate interest; introducing criteria for assessing whether new processing is compatible with its original purpose and a list of conditions that would be considered compatible with the original purpose; and changing the rules on automated decision-making to permit it where certain conditions are met.
Next steps
The DUA Bill had its first reading in the House of Lords on 23 October 2024. Its second reading is not yet scheduled. It is anticipated that its progress through Parliament should be relatively swift, given that many of the proposed changes have their origins in the earlier DPDI Bill, which had progressed to an advanced stage before the UK general election.
Look out for future Law-Now updates, in which our specialists will focus in more detail on each of the key areas of change proposed by the DUA Bill.
Social Media cookies collect information about you sharing information from our website via social media tools, or analytics to understand your browsing between social media tools or our Social Media campaigns and our own websites. We do this to optimise the mix of channels to provide you with our content. Details concerning the tools in use are in our Privacy Notice.