After intensive debates, the United Kingdom parliament has finally passed the ‘Data (Use and Access) Bill’ (DUA Act), intended to simplify the use of and access to personal data for U.K. data regulators whilst easing the administrative burden of using personal data.
The DUA Act builds on the Data Protection Act 2018 and the General Data Protection Regulation (GDPR)—the landmark European Union regulation on information privacy and data use—to modernize the U.K.’s data regime and facilitate more streamlined compliance processes without eroding the protections of the GDPR legislation.
On June 11, the bill passed from the House of Lords to the Royal Assent stage—the final stage of the legislative process in the U.K., in which the King essentially rubber stamps bills that Parliament has approved.
When it does get its Royal approval—at a date to be decided soon—the DUA Act will become law and herald in the most significant change to the U.K.’s data protection framework since GDPR.
Key updates in the bill include expanding the scope for data processing under ‘Legitimate Interests,’ such as for direct marketing and security processing, reducing interruptive and ineffective cookie consent banners, and provisions to boost market research, product development, and technological innovation.
The structure and remit of the U.K.’s information rights regulator, the Information Commissioner’s Office (ICO), will also be “modernized,” requiring it to consider the public interest in promoting innovation and competition alongside privacy and data protection.
Another change involves streamlining the process of submitting a ‘Data Subject Access Request’ to make it more efficient for individuals and organizations to request information on how a company uses or stores its data.
However, one key change the bill doesn’t include is a much-debated amendment to force big tech firms and artificial intelligence (AI) companies to get permission and/or pay for U.K. content, as the government insisted that it was planning to address this topic in future AI and copyright legislation—after the conclusion of a consultation on the topic in February.
The DPO Centre, a leading U.K. data protection officer and resource center, described the DUA Act as “a targeted evolution of the current regime” rather than a complete departure from existing frameworks.
The rocky road to Royal Assent
The DUA Act’s passage to Royal Assent was a long, bumpy road that started under the previous Conservative government with the Data Protection and Digital Access (DPDI) Bill, first introduced in 2022.
The DPDI set out a range of provisions for how data can be accessed, used, and processed, including making it easier and clearer for organizations to use and re-use data for research purposes; clarifying the processes and safeguards for the re-use of personal data; and easing compliance burdens on organizations related to record keeping, breach reporting and responding to unreasonable information requests from individuals.
However, the DPDI failed to pass before the 2024 general election, and in October 2024, the new Labour government introduced the revised DUA Act.
The Labour bill retained much of the original content while removing some of the more controversial provisions of the DPDI, including one that would have allowed government oversight of the ICO’s strategic priorities and another that required telecom providers to report suspected illegal marketing to the ICO.
On May 12, the House of Lords—the Upper chamber of U.K. Parliament—voted by a 147 majority to amend the DUA Act, adding transparency requirements to ensure U.K. copyright holders have to give permission for their work to be used.
The amendment would have forced tech companies to declare their use of copyright material when training AI tools so that they could not access U.K. content without paying for it—a proposal backed by prominent U.K. recording artists such as Elton John and Dua Lipa.
However, a couple of days later, the House of Common—the lower (and elected) chamber of Parliament primarily responsible for producing legislation—rejected this change, with the government reasoning that it was already carrying out a separate consultation on AI and copyright and wanted to wait on the outcome.
In an interview with BBC journalist Laura Kuenssberg, Elton John described the Commons’ rejection of the amendment as “criminal,” adding that if ministers went ahead with plans to allow AI firms to use artists’ content without paying, they would be “committing theft, thievery on a high scale.”
The Commons’ decision also resulted in an extended back and forth, known as a ‘ping-pong,’ between the two houses of Parliament, as amendments were debated, changed, and rejected, with the legislation bouncing from one chamber to another in the process.
Ultimately, a compromise was struck, with the Commons rejecting the Lords’ amendment on AI, but the government agreed to publish reports on its AI and copyright proposals within nine months of Royal Assent.
Ben Seretny, Head of DPOs at The DPO Centre, says, “The final version of the DUA Bill feels more like a careful update than a radical overhaul of the UK GDPR and Privacy and Electronic Communications Regulations (PECR) frameworks.”
Commenting on June 12 on the bill’s passage from Parliament, Seretny warned that “while some areas are now clearer, others may introduce uncertainty.”
In particular, he noted that the DUA Act gives the Secretary of State more power to decide which countries have data protection standards that are not “materially lower” than the U.K.—a shift in language that he suggested may concern the European Commission, which is due to review the U.K.’s data adequacy status in December.
In order for artificial intelligence (AI) to work right within the law and thrive in the face of growing challenges, it needs to integrate an enterprise blockchain system that ensures data input quality and ownership—allowing it to keep data safe while also guaranteeing the immutability of data. Check out CoinGeek’s coverage on this emerging tech to learn more why Enterprise blockchain will be the backbone of AI.
Watch: Blockchain & AI unlock possibilities
title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen=””>