“We see data protection law as the foundation on top of which the government, in an ideal world, would layer on specific AI-focused legislation.”  

However, this approach is at risk because the DPDI Bill, in its current form, is weakening existing protections, which create tensions with the Government’s AI strategy. There are three areas of concern. 

Weakening existing protections 

First, the Bill weakens existing protections. “The Bill proposes changes that could make organisations handling data less accountable,” argues Matt.  

For instance, the Bill proposes to switch the burden of proof from businesses to individuals around automated decision-making. “Currently, the General Data Protection Regulation [also known as GDPR] prohibits the processing of personal data for decisions about individuals with ‘legal or similarly significant’ effects based solely on automated processing, with limited exceptions. The onus is on businesses to comply.” 

However, the Bill replaces this general prohibition with a set of safeguards. “While this may sound like a technical change, it increases the number of contexts in which automated decision making can be used. In situations of non-compliance, an individual would need to complain to a regulator or seek remedy through the courts.” explains Matt. “This could open the door to practices we don’t want to see.”

Failing to modernise data protection law 

Second, the Bill fails to take the opportunity to modernise data protection law. While Large Language Models (LLMs) and biometric technologies are not new, the explosion in their use over the last year or so has been. 

Currently, the law defines biometric data as data used to identify someone. However, organisations also use biometric data to categorise people. 

“Such a narrow definition narrows the scope of what is regulated and creates significant gaps in the oversight of these technologies. Many private sector use cases are effectively unregulated,” argues Matt. 

Given the potential of biometrics across a range of use cases and the likelihood that it will underpin the next generation of AI technologies, it’s easy to understand the concern. 

Matt explains, “The current Bill could be an opportunity to strengthen the regime and introduce more robust oversight mechanisms to address these issues.”

Missed opportunity to plug the gaps in the AI white paper 

Third, plugging the holes in the Government’s AI strategy. There is currently no legislation in front of Parliament to address AI. Given this, the Government could use the Data Protection Bill to fill the specific holes in the framework set out in its AI white paper. 

“For instance, the Bill could be used to introduce a duty on regulators to adhere to the Government's five principles for regulating AI as set out in its white paper – and empower them with the tools they need to do so effectively,” says Matt. 

While the UK's Data Protection and Digital Information Bill is a step forward in addressing the complexities of AI and data protection, there is room for improvement. 

“We are very keen to work with the Government – and all stakeholders – to bring about a compromise that ensures this Bill delivers on its promise. There is an opportunity here to strengthen the UK’s data protection laws for the AI era,” concludes Matt. 

Given the promise of artificial intelligence and the foundational importance of data, let's hope the Government is listening.