After a long and winding road, the U.K. Parliament passed the proposed Data (Use and Access) Bill, which reforms the existing U.K. General Data Protection Regulation and the Privacy and Electronic Communications Regulations.
The passage, which now only needs Royal Assent, follows a month-long "ping pong" between the House of Commons and House of Lords. The main issue in this latest round of debate involved artificial intelligence and copyright, and calls from the House of Lords to include transparency obligations. Several high profile U.K. musicians — including Elton John, Paul McCartney and Dua Lipa — had weighed in on the debate, calling for stronger copyright protections. The House of Commons pushed back on the provision arguing that such requirements would be handled in another AI-based bill.
According to Hunton Andrews Kurth, U.K. Parliament reached a compromise that "includes provisions requiring the Secretary of State to, amongst other things, draft legislation containing proposals to provide transparency to copyright owners regarding the use of their copyright works as data inputs for AI models."
The U.K. government applauded the DUA Bill's passage. A spokesperson for the Department for Science, Innovation and Technology said, "This Bill is about using data to grow the economy and improve people's lives, from health to infrastructure, and we can now get on with the job of doing that."
Last November, Bird & Bird's Ruth Boardman, Emma Drake and Laura Goold offered an in-depth analysis of what was in the reform package released by the Labour Party last October and how it changed from previous iterations.
Notably, the bill's passage comes as the EU-U.K. adequacy agreement is up for renewal. The original adequacy review deadline was moved from June to December to give U.K. lawmakers time to advance the reform package and allow EU officials to examine updated provisions.
Taylor Wessing Senior Counsel Debbie Heywood offered insight into what the DUA Bill could mean for EU-U.K. data transfers. Though several EU-based civil society groups, including the Open Rights Group and European Digital Rights, recently sent an open letter to EU Justice Commissioner Michael McGrath raising concerns about the U.K.'s data protection standards, the U.K. government does not believe the agreement is at risk.
"The government insists that nothing in the DUA Bill jeopardises the EU adequacy decision," Heywood wrote in her blog post, "and so far neither the (European Data Protection Board) nor the (European Commission) have rung serious alarm bells, despite underlining they will be paying close attention."
Outside of the DUA Bill, a potentially bigger issue for EU adequacy would likely involve the U.K. Investigatory Powers Act and recent news that the government required Apple to circumvent its encryption protections for users.
Jedidiah Bracy is the editorial director for the IAPP.
