Data Protection and Digital Information Bill
Influencing regulation that affects data governance
The Data Protection and Digital Information Bill (DPDIB) was the Government’s legislative proposal to reform the UK’s data protection and governance regime. It fell when the 2019-2024 parliament was dissolved before the 2024 General Election. It will not become law.
We brought together the Data and AI Civil Society Network and collaborated to hold events and create shared resources, to help support a coordinated response to the Bill.
We also supported MPs and peers responding to the Bill, through written and oral briefings, providing evidence, and drafting amendments.
This is a living document collating resources – background, briefings, and commentary – about the UK’s Data Protection and Digital Information Bill. It’s open, so do suggest any additions that you find useful.
This is our public briefing note for the Lords’ Committee stage on the UK’s Data Protection and Digital Information Bill.
Our key points are:
- The Horizon scandal demonstrates the very human cost of technology going wrong, and underlines the need for rights and regulations to bring such errors to light, correct decisions made about us, and hold organisations accountable. But the Data Protection and Digital Information Bill lays the groundwork for both making similar scandals more likely in the future, and making it even harder for campaigners to achieve justice.
- Data is a significant driver of power and progress in modern democratic societies. It is the foundation of AI and automated decision making and has become the medium of relationships between citizens and the state, and between consumers and companies. How it’s regulated affects almost every aspect of our work and lives.
- The Data Protection and Digital Information Bill is the only legislation of this Parliament with direct relevance to AI regulation, but contains provisions that run counter to the government’s AI White Paper. It is out of step with comparator jurisdictions including the EU and USA. It misses a critical opportunity to build public confidence in technology and innovation and deliver business and public benefit.
- The Government added 240 amendments just before Commons Second reading, including controversial and consequential ones around DWP access to benefit claimants’ bank accounts and the use of data by political parties. This risks undermining public confidence further and makes scrutiny by the Lords even more vital.
- The Bill trades off citizen data rights for marginal and unproven economic benefits while undermining existing safeguards, parliamentary sovereignty, and democratic governance of data. Instead, it should give citizens and communities a powerful say through a combination of meaningful individual rights, powerful collective representation, and proper democratic scrutiny and accountability.
Data Protection and Digital Information Bill: what happened at Lords Second Reading?
Introduction
On Tuesday 19 December 2023 – the last day before their Christmas break – the House of Lords got to debate the Data Protection and Digital Information Bill for the first time.
This is known as Second Reading – First Reading is a formality, where the Bill is introduced to the House after moving through the Commons, and it will next go to Committee stage (for detailed scrutiny), then Report Stage and Third Reading (for amendments and further debate in the Chamber).
Below is a brief summary of the debate (starting with a table of contents). You can also read the debate in full, read my live tweeting, watch the debate or check out our page of resources on the Bill and its parliamentary passage.
This is our public briefing note for the Lords’ Second Reading on the UK’s Data Protection and Digital Information Bill. Our main points are:
- Data is a significant driver of power and progress in modern democratic societies. It is the foundation of AI and automated decision making and has become the medium of relationships between citizens and the state, and between consumers and companies. How it’s regulated affects almost every aspect of our work and lives.
- The Data Protection and Digital Information Bill is the only legislation of this Parliament with direct relevance to AI regulation, but contains provisions that run counter to the government’s AI White Paper. It is out of step with comparator jurisdictions including the EU and USA. It misses a critical opportunity to build public confidence in technology and innovation and deliver business and public benefit.
- The Government added 240 amendments just before Commons Second reading, some of them controversial and consequential, such as DWP access to benefit claimants’ bank accounts and the use of data by political parties. This risks undermining public confidence further and makes scrutiny by the Lords even more vital.
- The Bill trades off citizen data rights for marginal and unproven economic benefits while undermining existing safeguards, parliamentary sovereignty, and democratic governance of data. Instead, it should give citizens and communities a powerful say through a combination of meaningful individual rights, powerful collective representation, and proper democratic scrutiny and accountability.
- Data is a driver of power and progress in modern democratic societies. It has become the medium of relationships between citizens and the state, and between consumers and companies, as well as being the foundation of AI and automated decision making. How it’s regulated affects almost every aspect of our work and lives.
- The Data Protection and Digital Information (No.2) Bill removes important citizen data rights and undermines existing safeguards, parliamentary sovereignty, and democratic governance of data. It misses a critical opportunity to build public confidence in technology and innovation and deliver business and public benefit.
- At the same time, the Bill’s business benefits are minimal and its changes provoke the risk of a politicised decision on data adequacy by the European Commission at a time of already strained relations with the EU. Most SMEs are already exempt from the most costly aspects of GDPR. The largest companies will achieve negligible savings as they need to support new and multiple regimes. The Bill’s impact on public trust will counterproductively hamper data sharing and technology adoption.
- Amendments are needed to give citizens and communities a powerful say through a combination of meaningful individual rights, powerful collective representation, and proper democratic scrutiny and accountability. This will enable agile and context-aware regulation, protect citizens, and foster sustainable and responsible innovation.
This is our public briefing note on the UK’s Data Protection and Digital Information (No.2) Bill. Our main points are:
- Data is a significant driver of power and progress in modern democratic societies. It has become the medium of relationships between citizens and the state, and between consumers and companies, as well as being the foundation of AI and automated decision making. How it’s regulated affects almost every aspect of our work and lives.
- The Data Protection and Digital Information (No.2) Bill trades off citizen data rights for marginal and unproven economic benefits while undermining existing safeguards, parliamentary sovereignty, and democratic governance of data.
- The Bill misses a critical opportunity to build public confidence in technology and innovation and deliver business and public benefit. It should give citizens and communities a powerful say through a combination of meaningful individual rights, powerful collective representation, and proper democratic scrutiny and accountability.
Note: This briefing has been superseded by our briefing on the second version of the Bill.
This was our public briefing note on the initial version of the UK’s Data Protection and Digital Information Bill. Our main points were:
- Data is a significant source of power in modern democratic societies. It is becoming fundamental to the social and political contract between citizens and the state, and to transactions between consumers and the private sector.
- The Data Protection and Digital Information Bill undermines existing safeguards and democratic governance of data and misses a critical opportunity to extend it for citizen, community, business and public benefit.
- Amendments are needed to: address the collective impacts and risks of modern data processing; empower those affected by automated decision making; and build trust through transparency, effective redress mechanisms, and public participation.
Over the next year the UK government will be looking at how it replaces GDPR following Brexit, through the Data Protection and Digital Information Bill. At the same time all the major political parties will be developing their manifestos in the run up to the next General Election, scheduled for 2024 if not before.
We think this means there is a unique opportunity to influence the democratic and participatory governance of data, to ensure it works for us all, as part of the UK’s post-GDPR future.
The Data and AI Civil Society Network brings together diverse civil society organisations and campaigners to share and collaborate on policy, campaigns and advocacy on data and AI.
Participants in the Network work for data and AI related policy and practice that is democratic and inclusive, that upholds the highest standards of human rights and brings benefits to communities, societies and the environment.
Find out more and join the Network here: https://data-and-ai-cso-network.org/
Almost every modern policy reform relies on new data systems, and increasingly involves technologies labelled as Artificial Intelligence (AI) to make and shape decisions. Whether that’s education, health, benefits, housing, social care, work, policing, democratic engagement or a multitude of other areas.
Described as an “essential part of [a data processor’s] accountability obligations” by the ICO, Data Protection Impact Assessments are intended to support the identification and preemption of harms prior to data processing, and are a key piece of evidence for effectively contesting processes or decisions by companies, the government and other data processors.
Parliamentary scrutiny of the Data Protection and Digital Information Bill (No.2) kicked off on 10 May 2023 with the opening day of the Public Bill Committee.
The cross party Committee, comprised of 17 MPs and chaired by Ian Paisley Jr (DUP) and Philip Hollobone (Con), is charged with scrutinising the Bill line by line and will run to no later than 13 June.
On the first day, the Committee heard evidence from a range of stakeholders, including the ICO, business and tech interests and civil society, including CONNECTED BY DATA’s Jeni Tennison.
As the Data Protection and Digital Information Bill continues its erratic legislative journey, we convened an open call for interested parties to share, discuss and maybe act together. In this open Zoom meeting, Gavin Freeguard chaired an open discussion of first reactions and thoughts in a confidential and trusted space.
On 5th December 2022, CONNECTED BY DATA organised an event in parliament, hosted and chaired by Lord Tim Clement-Jones, to explore three key areas around the future of data governance: automated decision-making, data at work and data in schools.
These are all areas that could be affected by the Data Protection and Digital Information Bill, expected to return to parliament for its second reading at some point in 2023. We think the Bill represents an opportunity to influence how data is governed in a more democratic and participatory way, but worry that – in its present form – it undermines existing safeguards and misses the chance to extend democratic data governance.
The three areas under discussion also represent domains where growing data collection and use could have both significant benefits and harms in the future, regardless of what happens to the Bill. The event invited opening contributions from civil society and academic experts on each topic before opening up to a wider discussion. The experts were on the record unless they requested otherwise, with everyone else being unattributed under the Chatham House Rule.
On 30th September 2022, CONNECTED BY DATA organised a civil society workshop to explore the Data Protection and Digital Information Bill.
As we wait for the date for the second reading of the Data Protection and Digital Information Bill, many civil society organisations have different concerns and interests, and can see different opportunities and risks.
Here at CONNECTED BY DATA, for example, we think the Bill presents a real opportunity to influence how data is democratically and participatively governed, to ensure it works for us all, as part of the UK’s post-GDPR future. However, we also fear that, in its present form, the Bill reduces individual citizens’ control and influence, removes transparency and key safeguards, limits opportunities for engagement and ignores evidence about the collective and equality impacts of data processing and AI.
Recent news
Hello, and welcome to our 22nd Data Policy Digest, bringing you all the latest data and AI policy developments.
Our 22nd edition, and first under a Labour government.
neil kinnock voice: a LABOUR government
Hello, and welcome to our twentieth Data Policy Digest, bringing you all the latest data and AI policy developments.
Going through the motions, too cautious, little spark, relief that it will soon be over, and little mention of data and tech… enough about England and Scotland at the Euros, the general election is a week today. And civil society tried to inject some data and AI discussion into the campaign with two events this week - more below.
Hello, and welcome to our eighteenth Data Policy Digest, bringing you all the latest data and AI policy developments. 18 whole Digests. 18!
Appropriate number, 18.
It’s when you can legally vote - this is a very election-heavy newsletter.
And it’s when you can legally drink - I could do with several after sifting through FIVE manifestos this week.
(And still 20 days to go! Cheers!)
Hello, and welcome to our sweet sixteenth Data Policy Digest, bringing you all the latest data and AI policy developments. From April showers to a May data deluge - with details of Lords committee stage for the Data Protection Bill, more AI developments than you can shake a large language model at and much more besides.
Hello, and welcome to our fifteenth Data Policy Digest, bringing you all the latest data and AI policy developments.
A short one this time, with very little going on.
Kidding!
(Late) April Fool!
Hello, and welcome to our fourteenth Data Policy Digest, bringing you all the latest data and AI policy developments. The Budget, national insurance cuts, tax cuts, and a possible May election are just some of the topics dominating the political fiscal discourse and doubling as an SEO-friendly introduction to this fortnight’s newsletter, a blockbuster on a par with anything at this weekend’s Oscars and with more political intrigue than Super Tuesday or a day in the life of Christian Horner at Red Bull. If that doesn’t game Google, nothing will.
Hello, and welcome to our thirteenth (lucky for you) Data Policy Digest, bringing you all the latest data and AI policy developments. Of which there continue to be many.
Hello, and welcome to our twelfth Data Policy Digest, bringing you all the latest data and AI policy developments. Rest assured, this is one DPD that won’t use AI to swear at you. (Though may have you swearing at AI.)
Hello, and welcome to our eleventh Data Policy Digest, bringing you all the latest data and AI policy developments.
And Happy New Year! (If it’s not too late to wish you that.) After the data and AI policy carnival of chaos that was 2023, we have a much quieter year to look forward to.
Kidding, obviously. Just the odd controversial bit of data-related legislation, a government response to the AI White Paper, more AI Summits, continued AI development at breakneck speed, the unfolding of the Post Office Horizon scandal, the small matter of a general election being called at some point and goodness knows what else to keep us busy. The Digest will be with you all the way.
Hello, and welcome to our tenth Data Policy Digest, bringing you all the latest data and AI policy developments. I don’t know about you, but after a long (if fun and interesting) year, I feel like I’m stumbling towards the finishing line - though with a steeplechase-sized hurdle, in the form of the Lords debating DPDIB today, now firmly in view.
This will be the last Digest of 2023 - thanks for reading this year, and I hope it’s been useful. My new year’s resolutions are to make it shorter and more frequent. If you want to give a friend the gift of data this Christmas, why not encourage them to subscribe?
Have a wonderful festive season and see you in 2024! (Unless you decide you would like to follow me live-tweeting the DPDIB debate…)
On Wednesday 29 November, the Data Protection and Digital Information Bill came back to the House of Commons for report stage and Third Reading. (You can also watch the video, or catch up on live tweeting from the Open Rights Group.) Report stage is where MPs vote on the amendments made during committee stage (back in May) – and on the 150+ pages of (mainly government) amendments that appeared a few days before the debate on the 29th. A vote on Third Reading sends the Bill to the Lords. Here’s what happened, seen through the various votes (or divisions) on the Bill.
Hello, and welcome to our ninth Data Policy Digest, bringing you all the latest data and AI policy developments. We have a wrap up of the AI Summit - and fully endorse this sentiment - but there’s also a lot about to happen, Bills-wise.
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via gavin@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1, Digest #2, Digest #3, Digest #4, Digest #5, Digest #6, Digest #7 and Digest #8.
Hello, and welcome to our eighth Data Policy Digest, bringing you all the latest data and AI policy developments.
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via gavin@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1, Digest #2, Digest #3, Digest #4, Digest #5, Digest #6 and Digest #7.
Hello, and welcome to our seventh Data Policy Digest, bringing you all the latest data and AI policy developments.
And Happy International Access to Information Day for yesterday! There is a lot of information to access in today’s edition, including a rundown of the various data and AI policy events at party conferences for those of you lucky enough to be going. I’ll be at Conservative, Green and Labour conferences if you want to say hi (assuming I recover from yesterday’s shocking news from Google).
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via gavin@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1, Digest #2, Digest #3, Digest #4, Digest #5 and Digest #6, or sign up to the Digest and/or Connected by Data’s monthly newsletter via email.
Hello! Or rather, tere!
Our sixth Data Policy Digest, bringing you all the latest data and AI policy developments, comes to you from this year’s Open Government Summit in Tallinn, where Tim, Helena and I are flying the flag for Connected by Data. We ran a workshop yesterday; give us a shout if you happen to be here in Estonia.
If not, there’s plenty to catch up on back in the UK, as parliament returns after its summer break.
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via gavin@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1, Digest #2, Digest #3, Digest #4 and Digest #5.
Hello, and welcome to our fifth Data Policy Digest, bringing you all the latest data and AI policy developments. We’ll be taking a short break while parliamentarians are enjoying their recess (we, like them, will be back in September), but there are a few updates based on things rushed out before the break.
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via gavin@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1, Digest #2, Digest #3 and Digest #4.
Welcome to the fourth edition of Connected By Data’s Data Policy Digest, your one stop shop for all things data and AI policy. You’ll be pleased to know it’s shorter than our previous epic - but there’s still been plenty going on.
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via jonathan@connectedbydata.org. We’re on We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1, Digest #2 and Digest #3.
Hello, and welcome to the third Data Policy Digest from Connected by Data! The Digest aims to bring you all the main developments in data and digital policy, including the Data Protection and Digital Information Bill, the AI White Paper and beyond. (Often way beyond.) It’s been more than six weeks since the last edition (I’ve been away). Good job it’s been a quiet month or so in data policy…
If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via jonathan@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform. You can also catch up on Digest #1 and Digest #2.
Hello, and welcome to Connected by Data’s second Data Policy Digest!
This is our attempt to keep track of the many things currently going on in data policy world. If there’s something we’ve missed, something you’re up to that you’d like us to include next time or you have any thoughts on how useful the Digest is or could be, please get in touch via jonathan@connectedbydata.org. We’re on Twitter @ConnectedByData and @DataReform, and Digest #1 is here.
Hello, and welcome to the first Data Policy Digest from Connected by Data!
With such a lot going on in data policy world at the moment – including the return of the Data Protection and Digital Information Bill to parliament, the parliamentary progress of the Online Safety Bill, the expected Digital Markets, Competition and Consumer Bill, the AI White Paper and a select committee inquiry into AI Governance – we thought it was the perfect time to start a regular summary of everything going on.
If we’ve missed anything, you’d like to add something for next time, you have a view on whether this is useful or not, or you’d like to get more involved with our activities (especially around the Data Protection and Digital Information Bill), please get in touch on jonathan@connectedbydata.org
Weeknotes