DUA (Lipa) Second Reading: The AI void

As foreshadowed in our briefing on the latest incarnation of the UK's data protection reform, November maintained the steady momentum of the DUA Bill. The Bill received its Second Reading in the House of Lords on 19 November and is set to return for the Committee Stage on 3 December.

The Second Reading is an opportunity for a general debate on all aspects of the DUA Bill. Introducing the Bill, Baroness Jones noted that the changes to it since the Data Protection and Digital Information Bill "have been broadly welcomed". However, chief among the topics subsequently raised by peers were the "lack of AI-related protection" in relation to data scraping, automated decision-making (ADM) and, more generally, the regulation of AI. These are topics that are currently under the close scrutiny of global data protection authorities and government authorities, with a particular spotlight in the UK after the much hyped "AI Bill" did not materialise as part of the King's Speech in July 2024 (refer to our piece here for further information).

Baroness Kidron, among other peers, saw the DUA Bill as a missed opportunity to make the UK "AI ready", stating that it "fails to tackle present day or anticipated uses of data by AI", particularly given that any so-called "AI Bill" is expected to be delayed "until the Government understand[s] the requirements of the new American Administration." A point, in itself, she felt was a cause for concern.

Missed opportunity around data scraping: It was not lost on a number of the peers that copyright issues remain front and centre of the development, training and use of AI - particularly to protect the creative industries as well as the lives and rights of children. Many highlighted the government's failure to address this issue through legislation, to which Baroness Jones commented that "the Government is working hard on this and [is] developing an effective approach that meets the needs of the UK. We will announce more details in due course." Such clarity will be welcome given this is a feat that has eluded the Intellectual Property Office's working committee to date.

Abuse of scientific research exemptions: The broad definition of "scientific research" introduced by the Bill (alongside the exemptions that apply to it) was discussed at length, alongside the potential risk of abuse by technology companies for commercial gain - particularly opening "the door to data reuse and mass data scraping by any data-driven product development under the auspices of scientific research" (beyond the policy intention of these provisions). Peers requested further clarity around this fine line, particularly given the nascency of emerging technologies.

Relaxing GDPR Art 22 restrictions on ADM: Lord Byn Davies, among others, felt that proposals in the Bill to relax the existing Article 22 prohibition around ADM, broadly represent an unfavourable shift, moving "responsibility [onto] individuals to enforce their rights rather than on companies to demonstrate why automation is permissible." Many queried how data subjects will be able to effectively assert their rights. However, Baroness Jones, responded by stating that organisations "must first inform individuals if a legal or significant decision has been taken in relation to them based solely on automated processing, and then they must give individuals the opportunity to challenge such decisions, obtain human intervention for them and make representations about them to the controller."

UK approach to regulating AI: Viscount Camrose, among others, re-highlighted the five common principles set out in the previous Government's AI white paper to which regulators must have regard when considering AI (such as safety, security and robustness; fairness; accountability and governance; appropriate transparency and explainability etc), refer to our previous blog here for more information). Peers re-requested that the Bill consider putting these principles on a statutory footing, including in respect of any ADM. Baroness Jones re-iterated the Government's commitment "to establishing appropriate legislation for companies developing the most powerful AI systems", that the Government will consult with industry, civil society and experts across the UK to this end, and that the long awaited "AI opportunities action plan" will set out an AI road map for the UK in due course. The timing and nature of any related legislation remains unclear.

The UK – EU adequacy tension: Various peers re-iterated the need to have one eye on the significant benefits brought about from the UK's EU adequacy status when considering the Bill – particularly, according to Lord Clement-Jones, any tensions brought about by the new US Administration "if there are very different bases for dealing with data transfers between countries". Baroness Jones sought to reassure the House that ministers were already engaging with the European Commission and supporting the EU's review of the UK adequacy status ahead of the June 2025 deadline. The Secretary of State will also respond in due course to the House of Lords European Affairs Committee's letter of 22 October 2024  setting out recommendations from its recent inquiry into UK – EU data adequacy.

Next steps: The next step for the Bill is the Committee stage, where the House will examine the text on a line-by-line basis. Whilst the Bill is in its early stages, its predecessor (on which much of the Bill was based), proceeded almost to enactment with few outstanding points, before it fell at the final hurdle when the General Election was called. Twinned with the Government's majority in the House of Commons and the introduction of the Bill in the House of Lords first, a smooth trajectory is expected at a relatively rapid pace.