UK data reforms (including for Smart Data) are resurrected: what do we know so far?

The UK government has set out the details of its proposed legislative program in the King’s Speech this week. This includes proposals for a new Digital Information and Smart Data Bill (the DISDB), which will resurrect a number of (but not all) aspects of the Data Protection and Digital Information (DPDI) Bill that the previous government had failed to pass before the general election. As well as reinvigorating the DPDI’s changes to the ICO, and potentially a limited number of other aspects of its data protection reforms (discussed below), the DISDB will give statutory footing to three “innovative uses of data” from the DPDI Bill: 

• Digital verification services to support the creation and adoption of secure and trusted digital identity products and services from certified providers (e.g. for moving house, pre-employment checks and buying age restricted goods and services).
• A national underground asset register to help planners and excavators access data to help with the installation, maintenance, operation and repair of underground pipes and cables through a new digital map. 
• Smart Data schemes (going beyond the GDPR’s portability right) to help with the secure sharing of customer data, upon their request, with third party providers. 

Smart Data

The revival of the previous government’s Smart Data plans for a new data sharing regime will be broadly welcomed. Set against the EU’s success in implementing its pro-innovation Data Strategy (e.g. with the Data Governance Act and Data Act) this will be seen as an important step forward for the UK, building on the success of the Open Banking regime. Increased data mobility was touted in the previous government’s Smart Data Roadmap (published only in April 2024) as potentially increasing GDP by £27.8bn a year, with data portability through Smart Data earmarked to play an instrumental role in achieving this. As well as empowering consumers, the regime promises to facilitate innovation, drive competition and provide opportunities for efficiency savings for businesses.

The previous government had planned for the Smart Data regime to be rolled out on a sector-by-sector basis with retail banking, finance, energy, telecoms and transport indicated as priority sectors. The DPDI Bill would have introduced framework primary legislation, with the detail to be added in secondary legislation. 

It remains to be seen how closely the new government’s approach to Smart Data will be aligned with its predecessor’s, but detail in the briefing notes accompanying the King’s Speech suggests that there may be significant alignment as the DISDB will be used to underpin Open Banking (as was the plan under the DPDI Bill) as well as to “encourage the economic growth we’ve seen from Open Banking, across the economy”. 

The ICO and data protection reform 

On the UK data protection regime, the DISDB appears to retain the DPDI Bill’s changes to the following areas:

• around scientific research by enabling scientists to ask for broad consent for areas of scientific research and to facilitate research in commercial settings; 
• transforming the ICO into a more modern (and common amongst UK regulators) structure with a CEO, board and chair. It will also have “stronger powers”; and 
• introducing targeted reforms to “some data laws” that will maintain high standards of protection but which are currently unclear and impede the safe development and deployment of some new technologies. There is no more detail yet on what these changes might be or which, if any,  of the DPDI Bill’s proposals fall within this bucket (e.g. the DPDI Bill’s amendments to the rules around automated decision making or even the definition of personal data).

The DISDB does not appear to include any changes to the provisions around international transfers, data protection officers or the requirement to maintain records of processing – most of which were promoted by the previous government as cutting red tape and facilitating compliance, particularly for small businesses. 

Changes to the marketing and cookie regime are not mentioned either. It is possible, however, that “stronger powers” proposed for the ICO could include the uplifted fining power for marketing/cookie infringements from the DPDI Bill (which would have brought maximum fines in this area up to UK GDPR levels). This wording could also, or alternatively, suggest that the DISDB is taking forward the DPDI Bill’s enhanced powers for the ICO in the context of its enforcement work, such as in relation to the commission of expert reports.

Outlook 

We can tentatively expect draft legislation and more detail on these proposals to follow in the coming months during this first Parliamentary session which runs until July 2025, particularly given the work already carried out by the previous government on the DPDI Bill and in relation to the wider Smart Data regime. 

It is clear though that looking further ahead, the new government’s plans in the digital arena go beyond the DISDB. For example, while the government stopped short of explicitly announcing draft legislation for regulation of AI, the King’s Speech confirmed that the government will seek to do so, to place requirements on those working to develop the most powerful AI models (as we discuss further in this blog).