Data reform to affect AI

The new government’s Data (Use and Access) Bill looks to be AI-friendly. The Bill will allow more flexibility around automated decision-making, particularly for non-sensitive personal data. This is a departure from EU GDPR which is stricter.

In particular, the Bill places emphasis on “significant decisions” which produce a legal or significant effect for the individual. This follows the spirit of EU GDPR which already refers to this concept. The Bill also introduces the concept of “meaningful human involvement”. Again, EU GDPR refers to “human intervention” but not a threshold of what is meaningful.

There must be safeguards in place for significant decisions generally. These include providing the individual with information about the decision and allowing them to make representations. Alongside this, the individual can require human intervention and contest the decision. Notably, consent is not required.

For significant decisions involving special category data, there are extra conditions. These include obtaining the individual’s explicit consent. Alternatively, the processing can occur if necessary to perform a contract with the individual or to comply with law and it is in the public interest. A significant decision can’t be made on the basis of a “recognised legitimate interest” – for which, see below.

Other reforms

There are other proposed changes too. The Secretary of State can expand the list of special category data and provide extra protection for children’s data. The Bill proposes a blanket concept of “recognised legitimate interest” which automatically allows processing in a number of scenarios. These include for national security and defence, responding to emergencies, safeguarding vulnerable people and crime detection.

What next?

The last government failed in its attempts to reform UK GDPR after Brexit. Those changes could have threatened the UK’s crucial “adequacy status.” This is what allows the free flow of personal data with the EU.

The new Bill excludes some of the more controversial measures from before and looks more likely to succeed.

Why does this matter?

The key changes are that personal data not classified as special category data is not subject to the extra restrictions. This means solely automated decision-making can take place on the basis of legitimate interests. Also, the new ground of “recognised legitimate interest” removes doubt over certain types of processing.

If you’re an individual, you’re more likely to be exposed to automated decision-making. Where such decisions will have a legal or significant effect, there are safeguards.

For AI providers, this appears to make automated decision-making easier. There are safeguards in the EU AI Act but that’s not directly enforceable in the UK. Even so, as AI providers adapt to these measures generally, these will apply in the UK too.