Dangerous Data Bill Affects Us All, Not Just Creative Industries
Digital rights campaigners, the Open Rights Group have warned that the Data Use and Access Bill contains dangerous provisions that will not only make it harder for people to have control over their personal data and lives, but also threaten adequacy status with the EU.
Platform Power Programme Manager James Baker said:
“While the public debate has focussed on the impact of AI on the creative industries, this law is harmful for everyone in the UK.
“At a time when people increasingly feel they aren’t in control, Government has made it easier for Big Tech to make automated decisions about us. This is a power grab from the public to the powerful with organisations now being able to do more things with your personal data.
“The passing of the Bill is also a blow for democratic procedures in the UK as ministers can now change the way our data is shared with minimal parliamentary scrutiny.”
The Bill’s most dangerous provisions
We no longer have a right to opt-out of automated decision making
People are now in less control over how algorithms and AI make important decisions that affect their lives. Government rejected attempts to put additional safeguards around the use of automated decision making.
The Bill gives arbitrary and unaccountable powers to the Secretary of State
Government can now create new legal grounds for using and sharing personal data. This can be done using statutory instruments which will be rubber-stamped by Parliament: the last time the House of Commons opposed a statutory instrument was 1979. This will make it easier for any future Government to concentrate power and establish an AI surveillance state.
The government has learned nothing from the Sarah Everard data breach
Despite scandals such as police officers accessing the files of murder victim Sarah Everard, the police no longer have to record why they are accessing someone’s data on a police database. This reduces police accountability at a time when the police should be reassuring the public.
We can have no meaningful expectation of privacy when it comes to data sharing by government
The Bill lowers accountability over how data is shared and accessed for law enforcement and other public security purposes.
Made it easier to feed public data into the hands of AI training models
Debate around the use of AI in the creative industries dominated in Parliament. However, Government also rejected safeguards around the use of our personal data held by Government being used in large AI training models for ‘research purposes’. In particular, they refused to stipulate that research exemptions under data protection law should be relied upon only for research which is carried out in the public interest.
Threat to the adequacy agreement
Last week, European civil society organisations wrote to the European Commissioner Michael McGrath asking that the commission re-evaluate the UK’s adequacy status in light of the erosion of privacy and data protection rights in the UK.
Some of the key concerns include Secretaries of State having unaccountable powers, which they can use to influence the Information Commissioner’s Office and create new rules for sharing data with minimal scrutiny. The new law also lowers protections for International Data Transfers, meaning data could be transferred to countries with lower data protection standards.
Losing the UK adequacy decision would cost UK businesses to £1-1.6 billion costs in legal and compliance costs alone, and threaten the functioning of the EU-UK Trade and Cooperation Agreement and the Windsor Framework.
Baker added:
“This further attack on privacy threatens the UK’s future trade and collaboration with Europe. Losing our adequacy status when the government is trying to grow the economy would be disastrous for the UK.”
What the new law could have done
Supported survivors of domestic abuse
The new law could have addressed the failure of the Information Commissioner’s Office’s to deal with complaints brought by survivors of violence against women and girls and other vulnerable people. But MPs did not vote on an amendment, tabled by Sian Berry MP, to protect those for whom data privacy can be a matter of life and death.
Protect our data and trade wth the EU
MPs did not vote on an amendment brought by Alex Sobel MP to introduce safeguards for international data transfers, which would protect our data and the Adequacy agreeement that is vital for our ongoing trade with the EU.
Limited the role of digital ID
As increasing numbers of services move online, those without reliable internet access, digital skills, or ID documentation are being locked out. MPs could have helped ensure older, migrants, and other vulnerable people have access to services by voting to ensure that we have the right to use non-digital ID. Without this safeguard the law paves the way for Digital ID systems.
‘Stopped poacher becoming gamekeepers’
There is a rotating door between big tech companies that feed our personal data into their surveillance capital platforms, and regulators that protect people’s data rights. Yet Government rejected a group of amendments by Lord Clement-Jones that would have addressed this issue and strengthened the independence of the ICO.
