Although the Data Protection and Digital Information Bill brings some potential benefits – for example, in supporting further smart data schemes – the Open Data Institute remains concerned that it fails to shape our future data ecosystem for the better.

Rather than presenting a positive vision for the use of data in the economy and society, the Bill reduces our data rights, threatens the trust essential to future innovation and misses the opportunity to strengthen our data infrastructure so it works for everyone.

In reports in March and April 2023, and in our submission to the Bill Committee, we highlighted several areas of particular concern including:

  • Weakening rights and safeguards, including requirements around data protection impact assessments, automated decision making and Subject Access Requests
  • Not mandating transparency around the use of algorithms, particularly in the public sector
  • Threatening the independence of the Information Commissioner
  • Missing the chance to support the role of data intermediaries, and future smart data schemes.

Support for amendments

To that end, we welcome many of the amendments proposed by members of the Lords, and in particular support the following:

  • Amendments to clause 9 from Lord Clement-Jones, Baroness Jones and Lord Sikka on Subject Access Requests that would either leave the existing regime in place, or tighten and provide more transparency around the proposed new regime
  • Amendments after clause 14 from Lord Clement-Jones mandating public bodies to report their use of algorithmic decision making against the Algorithmic Transparency Recording Standard
  • Amendments to clause 20 from Lord Clement-Jones maintaining current requirements to conduct data protection impact assessments

We also welcome amendments:

  • To Clause 20 on data protection impact assessments, including:
    • adding a requirement for public authorities to publish them (page 40, line 19)
    • ensuring group- and societal-level impacts are captured (page 40, line 25)
    • strengthening consultation especially with impacted communities (page 40, line 38)
    • Clause 14 on automated decision making – to cover partly as well as wholly automated decisions, on safeguards, and on expanding the definition of data subjects to include those impacted by decisions
    • Clauses 31-38 on ICO independence, including parliament, rather than government, appointing the commissioner
  • After clause 149, on enacting article 80(2) of GDPR which would allow organisations to raise data protection complaints (collective rights/representation)

We also welcome the amendments from Baroness Kidron probing the idea of ‘data communities’, discussed in debate on 20 March - the ODI has been researching data trusts and other intermediary institutions for several years.

In addition to our main areas of focus on the Bill, we welcome:

  • After clause 142, on the Postcode Address File - the ODI has long campaigned for this to be made available
  • After clause 27, on access to data for vetted researchers - the ODI supported greater such access during the passage of the Online Safety Act
  • The opposition to clause 128 and schedule 11 on DWP powers, and clauses 114 and 115 on democratic engagement - these are controversial and poorly explained late additions which could damage public trust.

ODI briefing