Common Cause III
“The Government overturned the majority of the limited headway made in the House of Lords to amend the Data (Use & Access) Bill. Baroness Owen’s amendments in relation to non-consensual intimate image abuse largely survived save that a new defence was introduced. ”
The House of Commons Public Bill Committee on the Data (Use & Access) Bill resumed its consideration of the Bill on 11 March 2025, picking up with Part 5 of the Bill ‘Data Protection and Privacy’.
Third Committee Session
In the Committee’s third session, consideration was given to clauses 66 to 116 of the Bill. The only amendments agreed to the Bill were government amendments to reverse amendments introduced in the House of Lords.
The Committee reversed Viscount Colville’s amendment to clause 67, which would have required that scientific research be in the public interest in order to benefit from relaxed requirements including in relation to data re-use (Amendment 13).
The Committee also reversed the inclusion of the requirements introduced by the Lords at clause 95(1) for the Commission to include in its report an assessment of the fulfilment of its duties in relation to enforcement (Amendment 22).
The Liberal Democrats put forward several amendments to the Data (Use and Access) Bill, all of which were rejected by the government, including:
to limit the powers proposed to be afforded to the Secretary of State to amend primary legislation by secondary legislation;
to secure, whether in the Bill itself or through subsequent guidance from the Information Commissioner, a definition of meaningful human involvement in the context of automated decision-making;
to introduce new clauses to give statutory effect to the requirements of the Algorithmic Transparency Recording Standard (ATRS), impose requirements to maintain a statutory register of deployments of AI or other automated decision making and to enhance data subject’s rights in relation to high risk AI decisions, albeit that the proposal may not have gone further than the recent Dun & Bradstreet decision;
to increase the age at which children and young people can give valid consent in the absence of parental consent from 13 to 16 years of age. While this secured soe support from Conservative Committee members, it was rejected by the government in favour of allowing the Online Safety Act 2023 to bed in and waiting for the outcome of a feasibility study commissioned by the Department for Science, Innovation and Technology from the University of Cambridge to “review and summarise existing research on the impact of smartphones and social media on children and young people’s mental health, wellbeing, physical health, lifestyle and health behaviours, and educational attainment”.
to require the Information Commission to report annually on data sharing between law enforcement and the intelligence services under the relaxed regime proposed by the Data (Use and Access) Bill; and,
to require the Secretary of State to consult with the Science, Innovation and Technology Committee of the House of Commons in relation to any guidance or statement of strategic priorities to be imposed on the Information Commission.
Conservative members put forward several amendments related to AI and copyright, which would have required the Intellectual Property Office to issue a Copyright Notice in relation to web crawlers and AI models, to develop a plan in relation to the transparency of web crawlers, publish a technological standard for watermarking and publish a report on reducing barriers to entry for AI start ups and SMEs. These were voted on and rejected during the fourth session.
Other than the government amendments to clauses 67 and 95, the Bill progressed without further amendment.
Fourth Committee Session
During the fourth and final Committee session, consideration commenced with clause 117 and the remainder of the Bill.
The Liberal Democrats proposed, again unsuccessfully, several amendments including:
to provide structure to proposals to increase public sector digitisation, by requiring the publication of a data vision and strategy, government departments and the NHS to appoint a technology or information officer or equivalent to their boards, the Secretary of State to publish an annual report on the use of data in public service delivery;
to require that the appointment of the Chair of the Information Commission be approved by both Houses of Parliament;
to require records to be maintained of the sharing or accessing of health and/or social care records;
to require the Secretary if State to report annually on compliance with clause 124 of the Bill, i.e. the obligation on providers of internet services to retain information in response to a notice issued by Ofcom in connection with death of a child upon a request made by a senior coroner to Ofcom;
to require law enforcement agencies and the police to review the retention of biometric data every 12 months and erase any data which is no longer strictly necessary and proportionate;
to require an assessment to be made of the likely impact of the Bill and other domestic frameworks on the European Commission’s adequacy decision in respect of the UK, due to expire in June 2025;
to require the Secretary of State to establish a strategy for public interest data trusts and communities;
to require the Secretary of State to establish a framework for the recognition and registration of data altruism organisations;
to establish a right to use non-digital verification services; and,
to increase the age at which children and young people are able to give consent to the processing of their persona data in the context of information society services from 13 to 16.
Conservative amendments that were rejected were:
to require the Intellectual Property Office to issue a Copyright Notice in relation to web crawlers and AI models or for the Secretary of State to use some other mechanism to issue a statement;
to require the Secretary of State to lay before Parliament a plan related to transparency of AI training material; and,
to require the publication of a technical standard for a machine-readable digital watermark.
Government Minister Chris Bryant asserted in the context of the re-branding of the ICO into the Information Commission that it was the Government’s intention to “maintain the title of the Information Commissioner in respect of the chair of the Information Commission”.
Government amendments made to the Bill were:
to amend Schedule 15 to insert a clarification that information may not be processed for the purposes of new section 251ZC of the Health and Social Care Act 2012, relating to the public censure of relevant IT providers, if processing would contravene the data protection legislation (Amendment 14);
to remove the provisions secured by Baroness Kidron in the House of Lords to afford certain protections for copyright holders against the web scraping of copyright material for the purposes of training AI, which would enact safeguards supplementing the Government’s proposals as set out in its AI and Copyright consultation, thus deleting clauses 135 – 139;
to remove clause 140 which had been inserted into the Bill pursuant to Lord Lucas’ amendment, which would have required government to establish a data dictionary or taxonomy to address concerns regarding inconsistent datasets and would have had a particular impact in relation to the definition of sex;
to remove the offence of solicitation of the creation of a purported intimate image of an adult in the form incorporated into the Bill as a consequence of Baroness Owen’s amendment, but to instead introduce an offence of intentionally requesting the creation of a purported intimate image of another person who does not consent and in respect of whom there is no reasonable belief in their consent, including whether the request is for that image to include or exclude an element and certain other related minor amendments (Amendment 28, Amendment 29 and Amendment 31);
to introduce a defence of reasonable excuse to the creation of a purported intimate image of an adult (Amendment 30);
to establish maximum sentences in relation to the offence of intentionally requesting the creation of a purported intimate image of another (Amendment 37); and,
to extend the period during which an individual may be tried for an offence of creating or requesting the creation of a purported intimate image of another (Amendment 38).
The Committee Stage was required to conclude by 18 March 2025, but concluded early on 11 March 2025 after four sittings, and the Data (Use & Access) Bill will now progress to consideration by the whole House at Report Stage, which is yet to be scheduled.
Handley Gill submitted written evidence to the Committee, which was accepted and published.
You can read our previous posts on the passage of the Bill here:
The Data (Use and Access) Bill as amended in Public Bill Committee is now available.
If you want to understand the practical impact of the Data (Use & Access) Bill, download our comprehensive briefing on the Data (Use and Access) Bill and copies of the unofficial Keeling Schedules showing the changes that the Bill will make to the Data Protection Act 2018, the UK GDPR and the privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) via our Data Protection Reform page in our Resources section.
For advice on how the Data (Use & Access) Bill and other data protection legislation impacts you and your organisation, book a free initial consultation.
Find out more about our data protection and data privacy services.