Status update on the UK’s new Data (Use and Access) Bill

The question

The UK’s new Data (Use and Access) Bill (DUA Bill) is on its way, but where is it in the legislative process? And what are proving the sticking points?

The key takeaway

The DUA Bill is currently progressing through the House of Commons. The ICO has emphasised its continued support for the Bill, following the conclusion of debate and amendments in the House of Lords. However, proposed amendments to the definition of “scientific research” and amendments regarding web crawlers have been met with controversy at the House of Commons and appear to have been dropped.

The background

The DUA Bill, which was introduced to Parliament on 24 October 2024, (see our Winter 2024 edition of Snapshots (here) has completed its passage through the House of Lords and is currently progressing through the House of Commons. The ICO previously responded to the DUA Bill in October 2024.

The development

On 10 February 2025, the ICO released its updated response to the DUA Bill, providing commentary on the proposed amendments and key areas of debate in the House of Lords. A summary of the ICO’s response to the most significant House of Lords amendments and an additional update on the DUA Bill is set out below.

1. Amendment to the definition of scientific research: The DUA Bill was amended in the House of Lords, by crossbench peer Viscount, Lord Colville, to require that where personal data is processed for the purposes of scientific research, that it must be in the public interest. In response to this, the ICO has said that it can provide guidance on what is meant by “the public interest” in the context of scientific research. However, in the 13 March 2025 version of the Bill as amended in the Public Bill Committee, this amendment has been dropped.
   
   
2. Transparency of web crawlers: Crossbench peer Baroness Kidron proposed a series of amendments aimed at empowering online creators to protect their IP rights from operators of web crawlers and general-purpose AI models. This included an amendment to the DUA Bill to require that all operators of web crawlers comply with UK copyright law, if they are marketed in the UK. The new clause would make the ICO responsible for the enforcement of these measures which the ICO said it had not been consulted on. Not surprisingly, in the 13 March 2025 version of the Bill as amended in the Public Bill Committee, this controversial amendment has been dropped.
   
   
3. Other amendments eg “higher protection matters”: Additional House of Lords amendments of significance include a Government amendment to further protect children’s personal data and ensure that online services that are likely to be accessed by children are designed to consider “higher protection matters”, such as the fact that children may be less aware of the risks and rights associated with the processing of their personal data. The ICO has called on the Government to provide further clarity on the wording of this amendment and the policy intent behind it.
   
   
4. Progress in the House of Commons and further updates: The DUA Bill is currently in the House of Commons report stage. Once this stage is complete, the Bill will undergo its 3rd reading at the House of Commons. It has also been reported that the EU Commission may be pushing back their UK adequacy review from June 2025 to later in the year to enable review of the final version of the DUA Bill.

Finally, speaking at an IAPP conference on 12 March 2025, Chris Bryant, Minister of State at the Department for Science, Innovation and Technology, announced that the DUA Bill should complete its Parliamentary process by Easter. Bryant also suggested that the Government will legislate on AI in the next 18 months and that the ICO may not be responsible for the regulation of AI. The ICO has however, announced its intention to produce new codes of practice for AI and automated decision making.

Why is this important?

The DUA Bill has had a long journey since its previous iteration as the Data Protection and Digital Information Bill that did not pass the last Government’s parliamentary wash-up process. The slimmed down DUA Bill focuses on key reforms but does not stray too far from fundamental principles under the GDPR, so as not to threaten the UK’s adequacy with the EU. Attempts at the House of Lords to shoehorn AI and IP protections into the text have unsurprisingly failed as the Government carries out a parallel consultation on the implications of AI on UK copyright law.

Any practical tips?

Businesses should continue to monitor the progress of the DUA Bill for any last minute amendments in the House of Commons. Although unlikely to require any significant changes, businesses should consider how their current processes should be updated to reflect the new regime under the DUA Bill.

Spring 2025