British Conservative lawmakers are pushing ahead with legislation modifying the U.K. codification of European privacy law despite objections from privacy advocates and concerns about the legislation’s impact on European trade. Government backers say the bill will bolster the domestic AI industry. The Digital Protection and Digital Information Bill cleared the House of Commons on Thursday and now heads to the House of Lords.
The bill underwent significant modification before being sent to the House of Lords, with amendments including allowing a court to determine if a data subject and intelligence agencies have the right to access data, granting the secretary of state more power to obtain social security information for law and order purposes, removing the veto power of the Information Commissioner’s Office, and allowing British law enforcement agencies to retain biometric data such as fingerprints and DNA profiles for criminal conviction purposes. Whether the bill becomes law may depend on when Prime Minister Rishi Sunak calls a general election that polls currently suggest his Conservative party would lose. Should Sunak delay the election until fall, “then there is more of a possibility of it becoming law although this is by no means guaranteed,” said Jonathan Armstrong of law firm Cordery Compliance.
The Sunak administration envisions the bill making it easier for British companies to transfer data abroad, advancing the United Kingdom into “the world’s most attractive data marketplace,” according to analysis conducted by the Department for Digital, Culture, Media and Sport. Critics contend the government is ignoring the risks posed by the rapidly developing technology. The bill does not provide an effective framework for governing high-risk data-driven technologies – such as live facial recognition and AI foundation models,” said Michael Birtwistle, associate director at the Ada Lovelace Institute. The bill poses a good opportunity for the U.K. government to build on its promise made at the U.K. AI Safety Summit and prioritize “making data and AI work for people and society,” according to Birtwistle. Critics argue that the bill raises privacy concerns, potentially weakening safeguards and amplifying biases in AI applications, as it moves to the House of Lords for further consideration.
Multiple groups have raised concerns that heavy modifications of the UK GDPR could jeopardize commercial data flows with members of the European Union. Even after its 2020 withdrawal from the trading block, the U.K. still depends on European regulators’ opinions of its data protection regulations. Without what the European Commission dubs a finding of adequate protection, commercial data flows depend on cumbersome case-by-case contractual mechanisms, and even those could be prohibited by European courts. The European Commission in 2021 made an adequacy finding for the U.K. but limited its duration to just four years. European officials said they have introduced the sunset clause out of concern that Parliament could separate the U.K. privacy framework from the GDPR. Government officials have downplayed concerns that Europe would revoke its adequacy determination should the bill become law.
