What You Need to Know
The UK government has introduced the Data (Use and Access) Bill (DUA Bill), a sweeping piece of legislation aimed at modernising how data is handled across public and private sectors. Announced in the King’s Speech of July 2024, the Bill is designed to:
- Boost economic growth by making data more accessible for businesses.
- Improve public services with smarter data sharing and digital solutions.
- Make life easier by simplifying digital identity verification and regulatory processes.
But what’s actually changing? Let’s break it down.
1. Goodbye ICO, Hello IC
One of the biggest shake-ups is the overhaul of the Information Commissioner’s Office (ICO). It’s being replaced by the Information Commission (IC), which will function more like other UK regulators (think Ofcom or the FCA) with a board of directors and a separate CEO.
John Edwards, the current Information Commissioner, will stay on as the IC’s first chair until 2027. The change aims to bring more accountability and efficiency to the data watchdog.
2. Tougher Investigations Ahead
The IC is getting new powers to step up enforcement, including:
- Interview Notices: The IC can summon individuals (past or present employees) for interviews if they suspect data breaches. These interviews could happen even years after someone leaves a company.
- Document Requests: Companies will be required to hand over specific documents during investigations, making regulatory compliance even more critical.
- Mandatory Reports: In cases like data breaches, firms could be ordered to produce detailed reports, which could end up being used in legal actions.
3. Stricter Penalties for Digital Missteps
For firms handling personal data or marketing activities, the stakes are rising. The Bill raises the cap on penalties for breaches of Privacy and Electronic Communications Regulations (PECR) to match UK GDPR fines—up to £17.5 million or 4% of global turnover.
This means businesses involved in email marketing, cookies, and data tracking need to tighten up compliance to avoid costly penalties.
4. Giving Data Subjects More Power
Individuals will now have a new right to complain directly to organisations about data mishandling. Businesses must acknowledge complaints within 30 days, and respond without “undue delay” (a phrase likely to spark debate).
The shift aims to ease the burden on the IC by having firms handle more complaints themselves—but expect a rise in administrative work for businesses.
5. Smarter Data Sharing and Digital ID
The Bill also introduces provisions to make public sector data more accessible to businesses and improve digital identity verification, helping to create seamless interactions with government services. This could mean quicker verification for things like mortgages or job applications.
What’s Next?
The DUA Bill is currently making its way through Parliament, but it’s already clear that businesses need to get their data houses in order.
Expect more regulatory scrutiny, higher fines, and a greater focus on compliance and transparency. Whether you’re a startup or a large corporation, now’s the time to review your data protection processes and prepare for a stricter regime.
