DMA claims Data Act victory as privacy groups seethe

Industry trade body the DMA is giving itself a big slap on the back following the UK data reforms officially becoming law, insisting it has been at the forefront of securing major concessions, however, privacy advocates have slammed the move, issuing dire warnings over the erosion of consumers’ data rights.

The Data (Use & Access) Bill received Royal Assent yesterday (Thursday), just a week after being signed off by both Houses of Parliament but four years after it was first presented to the House of Commons under the previous Conservative Government, as the Data & Digital Information Bill.

The Bill underwent extensive revision before falling at the last due to the 2024 general election. It was resurrected by the Labour Government as the DUA Bill within weeks of coming to power.

The Act introduces a series of key reforms designed to modernise how personal data is used and governed, a move aimed at making the UK more competitive, cutting unnecessary red tape, and supporting innovation while maintaining strong protections for individuals.

Some privacy organisations, however, have been fierce opponents. In fact, the Open Rights Group claims the reforms contain dangerous provisions that will not only make it harder for people to have control over their personal data and lives, but also threaten adequacy status with the EU.

Even so, the DMA reckons its lobbying across two governments means the marketing industry can breathe easier.

Through member-led roundtables and policy engagement, the DMA claims it “successfully secured several critical changes that will support responsible, customer-centric data use across sectors”.

Former DMA chief executive Chris Combemale, who recently took on the role of director of policy, stated: “[We] welcome the Act as a balanced and forward-looking piece of legislation.

“The Government has clearly listened to industry, and we’re pleased to have played a constructive role in shaping reforms that support both innovation and privacy. Key changes – such as greater clarity on legitimate interest, the extension of soft opt-in to charities, and sensible cookie reform – will make it easier for organisations to grow responsibly and build trusted customer relationships.

“The Act reflects modern data practices while safeguarding individual rights. It positions the UK as a competitive, pragmatic leader in the global data economy. With clear guidance and a proportionate approach, we’re confident businesses will implement these changes successfully.”

However, the Open Rights Group is just one of the organisations that has been fighting against the Bill. Platform power programme manager James Baker said: “While the public debate has focused on the impact of AI on the creative industries, this law is harmful for everyone in the UK.

“At a time when people increasingly feel they aren’t in control, the Government has made it easier for big tech to make automated decisions about us. This is a power grab from the public to the powerful with organisations now being able to do more things with your personal data.

“The passing of the Bill is also a blow for democratic procedures in the UK as ministers can now change the way our data is shared with minimal parliamentary scrutiny.”

According to the organisation, consumers are now in less control over how algorithms and AI make important decisions that affect their lives, as the Government rejected attempts to put additional safeguards around the use of automated decision making.

It claims that the Government can now create new legal grounds for using and sharing personal data. This can be done using statutory instruments which will be rubber-stamped by Parliament: the last time the House of Commons opposed a statutory instrument was 1979. This will make it easier for any future Government to concentrate power and establish an AI surveillance state, the organisation argues.

And, despite scandals such as police officers accessing the files of murder victim Sarah Everard, the police no longer have to record why they are accessing someone’s data on a police database. This reduces police accountability at a time when the police should be reassuring the public.

The Act also lowers accountability over how data is shared and accessed for law enforcement and other public security purposes.

Over the past few months, debate around the use of AI in the creative industries dominated in Parliament, with the House of Lords fighting but ultimately failing to get measures to protect copyrighted materials from being exploited by tech companies.

However, ministers rejected safeguards around the use of personal data held by Government being used in large AI training models for ‘research purposes’. In particular, they refused to stipulate that research exemptions under data protection law should be relied upon only for research which is carried out in the public interest.

Meanwhile, despite claims that the UK adequacy agreement with the EU is safe, last week, European civil society organisations wrote to the European Commissioner Michael McGrath asking that the Commission re-evaluate the deal in light of the erosion of privacy and data protection rights in the UK.

The ORG also has concerns about how Secretaries of State now have unaccountable powers, which they can use to influence the Information Commissioner’s Office and create new rules for sharing data with minimal scrutiny. The organisation insists the new law also lowers protections for international data transfers, meaning data could be transferred to countries with lower data protection standards.

Baker concluded: “This further attack on privacy threatens the UK’s future trade and collaboration with Europe. Losing our adequacy status when the Government is trying to grow the economy would be disastrous for the UK.”