The final stages of the Data (Use and Access) Bill were more eventful than expected. Interventions from figures like Sir Elton John and Dua Lipa brought rare attention to the issue, tapping into growing public unease about artificial intelligence. Many people see the potential of AI but are also concerned about its impact on the things they value—from music to jobs.
With Parliament now turning to a future AI bill to address questions around the creative industries, it’s worth pausing to consider what has already changed. Behind the high-profile debates, the UK has quietly weakened key data protection rights.
A major shift involves how algorithms are used to make decisions about people’s lives. Under the previous law, individuals had the right to not to be subject to decisions made solely by automated systems. That safeguard has now been removed for most cases. People may face serious consequences—such as losing benefits or being denied visas—without a clear right to human review.
The algo-state
Where earlier debates focused on the “database state,” we now face the rise of the “algo-state.” Government has moved further toward automated, opaque systems that make decisions with little transparency. When these systems get it wrong, the consequences fall on individuals, who now have the responsibility for understanding these issues and challenging bad uses of technology.
At the same time, the government has also reduced individuals’ rights to pursue remedies and redress, turning this into a lose-lose scenario for most of us. The Data (Use and Access) Bill also expands government powers to share and repurpose personal data for law enforcement, national security and administrative purposes. Also, ministers can now define new legal grounds for data processing using statutory instruments, without meaningful Parliamentary scrutiny. This means data provided to one public body could be accessed and reused by others.
Information ranging from smart meter readings to children’s educational needs may be shared across departments for these reasons, or any new reason written in a future statutory instrument that is approved during a 30 minute session behind the doors of a Parliamentary committee.
Policing is the other area that got little attention. A requirement to log and record why police have accessed our records is removed by the Bill. This is despite scandals such as when dozens of police officers accessed the files of murder victim Sarah Everard without a legitimate policing purpose. Reducing police accountability will further harm trust in our institutions.
Data adequacy threatened
The government may argue these changes support innovation and growth, but the empowerment of bad government and big tech will undoubtedly put pounds in the pockets of the US and China’s large technology companies, rather than those of the British public. The DUA Bill (soon to be Act) also threaten the UK’s data adequacy agreement with the EU, which is essential for cross-border data flows in business and policing. European civil society groups have already raised concerns with the European Commission.This Bill was a missed chance to strengthen independent oversight and give the Information Commissioner’s Office the tools it needs to protect the public. Instead, it marks a shift toward more government control of regulatory functions, more politicisation of market enforcement, and more cronyism.
After years of political promises to “take back control,” the irony is clear: this law does the opposite. It hands greater power to government and big tech, and reduces the rights of individuals. If people begin to connect the dots between data, AI and control, this quiet shift in the law may not stay quiet for long.
James Baker, is platform power programme manager at Open Rights Group
