New government bill seeks to strengthen data protection
On Tuesday, the government announced a new Data Use and Access Bill that it says will “unlock the secure and effective use of data for the public interest, without adding pressures to the country’s finances”.
The government estimates that the bill would help boost the UK economy by £10bn by unlocking efficiencies in businesses and the public sector around the use of data while retaining “vital safeguards […] to track and monitor how personal data is used”.
A previous data bill, the Data Protection and Digital Information Bill, was not passed during the wash-up period in the summer before the general election.
Konrad Shek, director of public policy and regulation at the Advertising Association, welcomed the new bill “as a successor to the bill that fell at the end of the last parliamentary session”.
He continued: “A lot of good work went to the previous bill. We are glad that many of our recommendations have carried over and some of the more contentious parts have been dropped.
“Fundamentally, it is important that the UK can modernise its data protection framework but still preserve the high levels of data protection we currently enjoy. Responsible use of data sits at the heart of the online advertising industry. It is key to a modern 21st-century data-driven economy and important to its growth.
“As the bill was only published today, we will continue our analysis of the bill to determine what impact it will have on industry. We will also monitor the bill’s progress through parliament with great interest and will continue to advocate for member priorities.”
Online harms research
While the bill is targeted primarily at cutting down administrative work at places such as the NHS and police departments, it could have implications for data practices in the media industry.
For example, the bill intends to “boost the UK’s approach to tackling online harms” through the power to create a “researcher data access regime” that will support online safety researchers in accessing data held by online platforms.
A spokesperson for the government said this is designed to “boost transparency and evidence on the scale of online harms and the measures which are effective in tackling them”.
Last week, broadcast regulator Ofcom warned that social media companies will begin facing punishments under the Online Safety Act, passed earlier this year, for failing to take action to curtail online harms. Ofcom now has the power to fine companies up to 10% of the global turnover should they found to be in breach of such rules.
Further details of the Data Use and Access Bill’s research regime will need to be set out in secondary legislation, including the process by which platforms would be asked to provide data access where possible.
However, the scope of the legislation is such that data requests from researchers would need to relate only to online safety matters, while other exemptions could be carved out.
‘Getting the balance right is essential’
The bill will legislate on digital-verification services, meaning companies that provide tools for verifying users online can get certified against a government framework and receive a “trust mark” as a result.
In a statement, the Data and Marketing Association (DMA) welcomed the new bill, revealing that CEO Chris Combemale has worked closely with the government in shaping reform of the UK’s data regulation framework.
Combemale said the bill maintains high levels of data protection while reducing concerns around data adequacy.
“The DMA has always been committed to getting the balance right between protecting privacy and promoting innovation,” he said. “Our members will welcome maintaining a high level of data protection and the current accountability framework.
“Getting the balance right is essential to building trust in both the public and private sectors, ensuring that people have confidence in the modern products and services that will improve their lives.”
Cookie centralisation binned…
The Professional Publishers Association (PPA) also welcomed the bill, with CEO Sajeeda Merali stating she was “pleased” the government removed previously included provisions in the bill relating to cookie centralisation.
That provision, known as regulation 6B, would have assigned powers to the government to centralise all cookie consent with browsers, namely Google’s Chrome.
Such provisions would have “had a significant commercial impact on the [publishing] industry”, given many publishers have data collection as an “integral part of their business”.
Merali said: “Publishers have a unique and trusted relationship with their audiences, who allow them to collect cookie data to deliver high-quality, reader-sensitive and relevant content. This provision would have overridden the existing cookie-consent relationship between audience and publisher, affecting the audience experience and suppressing growth of the magazine media industry.”
She added: “We fully support data-protection measures that allow businesses to flourish and will continue to work closely with the government as this bill progresses to ensure our members can deliver a quality product to audiences in a way they want it.”
Shek echoed Merali’s points, telling The Media Leader: “At first glance, the exemptions for certain cookies look useful. Furthermore, we also welcome duty on the [Information Commissioner’s Office] to have regard to promoting innovation and competition. Finally, we are pleased to see that provisions to enact a form of ‘centralised cookie control’ via secondary legislation and direct marketing for the ‘purposes of democratic engagement’ were dropped.”
…but more ICO consideration wanted
Merali told The Media Leader that for publishers and advertisers in the short term “we can expect business as usual”.
However, in the long term, the bill includes stipulations that will change how the Information Commissioner’s Office (ICO) conducts its enforcement, with “a shift towards more consideration for business and competition”.
“Since November 2023, there have been measures taken by the ICO that have negatively impacted the publishing sector, including restrictions to how they can present cookie banners,” Merali explained. “This bill […] will mean the data protection regulator has a statutory requirement to consult other regulators when introducing legislation that would impact economic growth.
“For publishers, we are hopeful this means that there will be more consideration from the ICO of their business models and consumer rights in conjunction with individual data privacy rights. Consequently, we would like to see a more balanced approach to enforcement on publishers’ cookie banners. The need for this is something that the PPA has continuously raised awareness about with government and regulatory stakeholders since November.”