Cheers and boos as data reforms Bill ends up in the bin

The Government’s failure to include the Data Protection & Digital Information Bill (No2) into its “wash up” process, which fast-tracks some legislation before Parliament is dissolved, has been both cheered and booed, with the Bill now likely to be consigned to the legislatory scrapheap.

The DPDI first emerged in 2021, but was still going through the committee stage in the House of Lords. However, most industry observers recognise it was the Government’s own decision to pile in 240 amendments on the third reading in the House of Commons in November last year which led to huge delays and ultimately the Bill’s downfall.

Although many elements of the Bill would have benefitted the marketing industry, including bigger fines for rogue telemarketers, a soft-opt in for charity emails, relaxing the online cookies law and a potential relaxation of “legitimate interests”, other areas proved more controversial. The shake-up of the Information Commissioner’s Office was a particular bone of contention as were greater Government snooping powers and watered down consumer data rights, including making it harder to file subject access requests.

On X, Defend Digital Me hailed the move, insisting: “These changes go to the heart of data protection legislation, and [would have undermined] the very essence of what #DataProtection law is for.”

At the same time, the Open Rights Group, which was one of the staunchest critics of the DPDI Bill, has cited its “Stop the Data Grab Bill” campaign as one of the key reasons why the legislation has failed.

Arguing that the Bill was an attack consumers’ ability to challenge data abuse, ORG also claimed it would erode fundamental data protection rights.

ORG was also among many which were incensed by plans to allow the Department of Work & Pensions to snoop on the bank accounts and financial assets of anyone who claims any benefit, including child benefit and the state pension, alongside tax credits and universal credit.

Executive director Jim Killock said: “The DPDI Bill contained many dangerous proposals that would have harmed the data protection rights of people in the UK and beyond. The fact that it is being dropped at this late stage is not just down to good timing but also because civil society has been challenging this attempt to undermine our rights, hand more power to government and corporations, and weaken the ICO.

“The next government should learn from the mistakes that have been made during this long parliamentary process. Our data is valuable and we need government to ensure that there are laws in place to protect it, and a strong regulator to ensure that rules are enforced.”

The Ada Lovelace Institute, which specialises in research on data and AI, also welcomed the Bill’s demise but for a slightly different reason; it claims it did not go far enough.

Associate director Michael Birtwistle said: “The Bill was an opportunity to better safeguard people from harmful impacts of data use and ensure the wider distribution of benefits. But while it contained some welcome provisions – around smart data, for example – it neglected the chance to build a positive vision.

“Instead, what we got was a set of piecemeal changes that, taken together, would have undermined our existing regulatory regime. As drafted, the Bill would have compromised vital protections for people affected by harmful or exploitative uses of data, including some types of AI.

“The Bill contained other concerning provisions. It would have enabled widespread data use for ‘democratic engagement’, risking further Cambridge Analytica-style scandals. It would have circumscribed the independence of the Information Commissioner’s Office and abolished the biometrics commissioner.

“An urgent priority for the next Parliament will be to bring forward comprehensive legislation that gives people greater control over how data and AI affect their lives. We look forward to working with the next Government, and with MPs and peers from all parties, to deliver this.”

IT industry association techUK has also waded in, pointing to the potential of the Bill to support the development of AI technologies and create a new framework for smart data and digital identities.

It commented: “The fall of the DPDI Bill is disappointing, particularly given there was broad support in Parliament for the wider reforms it introduced.

“The UK tech industry will be frustrated at the failure of the bill to pass, particularly given the extensive consultation on the Bill that had taken place. Following the election, it will now be the responsibility of the next Government to resume these reforms.

“Whichever political party wins the election should not make this a missed opportunity. Instead, they should build on the good progress made in this bill by seeking to create a pro-innovation and high standard data protection regime for the UK.

“This should also include enabling smart data and digital ID schemes, allowing us all to better manage our data and interact with public services.”

TechUK said that it is preparing a position paper, setting out its views on which clauses of the Bill should be revived after the election, along with some further policy proposals.

Meanwhile, legal firm Mischon de Reya said in a statement: “It will now have to be seen whether the next administration – whatever its political colour – has any appetite to revive the Bill in something like its current form.

“Should Rishi Sunak be Prime Minister of the next government, with something like his current cabinet in place, it would seem quite likely the Bill would be relatively swiftly resurrected.

“Should, instead, a Labour government assume power, it is probably unlikely that an identical data protection bill would be high on its agenda, but there has been speculation that Labour might look to introduce a digital bill in the autumn on entirely different lines which would include legislation on AI.”