The DPDI Bill – a narrowing window to prevent the UK from falling behind in AI regulation

The Data Protection and Digital Information (DPDI) Bill – now in Committee stage in the House of Lords – threatens to water down data subject rights, reduce accountability and increase the risk of automated discrimination and profiling. It could also undermine the UK’s data adequacy decision from the European Commission. Taken together, the Bill provides uncertainty for businesses processing European data.

The Bill is also a missed opportunity for the UK Government in its aim to be a leader in AI regulation. Whilst the UK Government recently announced plans to invest over £10 million to bolster AI regulation and address risks, the DPDI Bill weakens key legal rights that individuals can use to understand how AI impacts their lives and to put things right when it harms them.

AWO’s analysis and recommendations

The Social Market Foundation (SMF), a non-partisan think tank, asked AWO to deliver an independent analysis of the DPDI Bill. That paper was published on 20 March 2024.

Building on our previous work and assessing the most recent amendments to the Bill, we assessed the possible impact of the amended data protection provisions for individuals. Our analysis highlighted the following particular concerns:

• The Bill would narrow the definition of personal data. The new definition may in turn change how organisations treat pseudonymised and anonymised data and in turn increase the risk of data breaches and reidentification of data subjects.
• The Bill would limit data subjects’ rights – including the right to access their personal data – by increasing the timeframe to answer requests or allowing controllers to refuse ‘*vexatious*’ requests. This pared down approach to data subject rights will undermine individuals’ understanding of – and influence over – how data-driven technology affects their lives.
• The Bill’s lowered data protection and accountability standards may threaten the UK’s current data adequacy determination from the EU. If it were rescinded or had significant conditions placed on it, this would be counter-productive to the UK’s aim of reducing administrative burden and simplifying data protection obligations.
• The Bill would also weaken protections against automated decision-making, increasing the risk of automated discrimination and bias as AI is increasingly used in the public and private sectors.

Conversely, the Bill misses opportunities to improve the data protection regime. For example, the Bill does not provide for increased accountability mechanisms, such as “super complaints” from representative organisations on behalf of large numbers of individuals. The Bill could also improve researcher access to platform data, preventing the UK from falling behind the EU in developing a legal framework for research into platform harms.

Parliament has an opportunity to use this Bill to protect the rights that give UK citizens agency over how data-driven technology affects them. A balance must be struck between fostering innovation and maintaining trust and safety.

Digital future

By maintaining high standards of data protection, the UK’s aspiration to lead the world in regulating the digital and AI economy can be realised. AWO were previously instructed by the Ada Lovelace Institute to analyse the current legal protections that exist to protect against harms caused by AI. As the Ada Lovelace Institute found:

“Independent legal analysis commissioned by Ada last year found that these changes [in the DPDI Bill] are likely to erode the incentives that currently exist for organisations to properly assess and manage any systems being used to make automated decisions. With these reforms, it will be simpler to make automated decisions about people without their knowledge, and without seeking their consent.”

The Equality and Human Rights Commission expressed similar concerns:

“We are particularly concerned about the proposals in the [DPDI] Bill as they relate to Artificial Intelligence (AI). The Bill must be read alongside the Government’s approach to regulating AI, set out in the White Paper A pro-innovation approach to regulating AI […] In the White Paper, Government set out five principles for regulating AI, including transparency and explainability, fairness, and contestability and redress. Proposals in the Bill undermine these principles.”

Only by maintaining high standards of data protection can the UK hope to realise its ambition of leading the world in AI regulation.