The DMA has reiterated its call for the Government to enforce existing data protection legislation in the fight against the worst excesses of AI, citing recent action by the new Information Commission as evidence that “if it ain’t broke, don’t fix it”.
The industry body has responded to the ICO’s recent announcement, which has seen the regulator secure commitments from ten major AI developers, including OpenAI, Google and Microsoft.
These include clearer transparency information, stronger mechanisms for people to exercise their rights and tougher assessments of safeguards. The ICO said it is monitoring developers’ progress against their commitments.
The watchdog has also set out its regulatory position on key issues, including how special category data can be used lawfully and whether foundation models themselves may contain personal data.
The ICO said: “We acknowledge that current foundation model training practices present technical challenges when it comes to complying with UK data protection law and data protection by design principles. We are proactively raising these boundaries of the law with Government, as addressing them will require ongoing collaboration between industry, regulators and Government as the technology continues to evolve.”
DMA director of policy and public affairs Michael Sturrock argues that this is evidence that existing data protection laws can address many of the issues raised by AI, and that policymakers should focus on applying and enforcing those rules before considering new legislation or regulators.
Through its work with members and direct engagement with Government, the DMA has been examining how data protection rules apply to AI in practice and what businesses need to comply.
Sturrock said: “Given the rapid development of frontier AI, and its impact on how we manage and handle data, it is imperative that we do not rush to create new regulation before establishing whether the existing framework is genuinely fit for purpose.
“Data protection is fundamental to the responsible application of AI at every level, and what we hear from our members at the DMA is consistent with the ICO’s position. The existing regulatory framework already provides a strong basis for addressing many of the key data protection issues raised by AI.
“Furthermore, the commitments already secured from Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI are significant. They demonstrate that the ICO can use its existing powers and influence to drive meaningful change across some of the world’s largest AI developers.
“Through the DMA Code, our members commit to the highest standards of data protection and responsible marketing practice. AI is undoubtedly creating new and complex questions around the use of personal data, but the ICO is showing that it can respond to those challenges and push the industry towards higher standards of compliance.
“Our focus must now be on making sure the regulator has the clarity, technical capability and resources to continue doing that effectively.
“Where genuine gaps remain, they should be addressed on the basis of evidence. But we should establish clearly what those gaps are before creating something entirely new.”
Related stories
DMA: ‘UK must enforce GDPR before drawing up AI Bill’
Untrained and unsupervised: The real source of AI slop
ISBA: 99% of brands are using GenAI, few see benefits
DMA urges Govt to work with industry to drive AI boom
Three priorities for CMOs in the new AI-driven world
PwC: Act now so that data and tech spend gets results
Gartner: Industry must grasp ‘AI nettle’ or wither on vine
Be the first to comment on "DMA hails ICO action as proof UK GDPR works for AI"