Earlier this month, I had the pleasure of being part of a panel speaking at a Data & Marketing Association (DMA) briefing event on the upcoming Data Usage and Accountability Bill (DUA) which is currently making its way through parliament. The session was an overview of the bill, and the work the DMA has done to shape it. There were some highlights that are worth sharing.

Yes, this is a blog about government legislation… and I know your thumb is involuntarily moving towards the “back” button - don’t try and pretend otherwise! But please give me a moment more, because perhaps, like me, you might find the bill is a lot more interesting than you think.

The UK Government want the bill to “harness the enormous power of data to boost the UK economy by £10 billion”. Now that’s a grand ambition, and one that’s music to the ears of a data professional like me, but the bill also reconsiders data protection and privacy – bringing a more pragmatic approach to some of the more outdated and impractical compliance practices.

I’m not about to go through all aspects of the bill – the latest draft weighs in at 271 pages – but there are a few interesting highlights to share and perhaps debate.

Cookies

Before we proceed, I forgot to ask for your consent to eat some cookies whilst writing this blog. And no, I’m not one of those helpful blogs that gives you an “Essential Cookies Only” option. I’m going to list out all the different cookie types (custard creams are my favourite) and make you decide. Yes, I know you’re in a hurry, and just want to read it, but I must insist.

One of the most notable (and welcome) things from this bill is that it might lead to a significant reduction in cookie consent banners on websites. The bill legislates that cookies used for security purposes or to improve the service offered, can be used without requiring any explicit consent. Consent will still be required for more invasive cookies – one’s that harvest your data for third parties for example – but many will now be exempt.

Soft Opt-in for Charities

The DUA bill contains a section on the use of email for direct marketing which changes the rules around “soft opt-in” for charitable organisations. Without going into the technical details – it means that charities will be able to reach a far wider audience for their email campaigns. Figures from the DMA predict this change could help unlock £290 million extra funding for charity annually.

Smart Data

One of the most progressive items in the bill are changes to further support Smart Data schemes. Data Portability (allowing for your personal data to be shared with other organisations or services you want to use) has a lot of potential. You’ve perhaps heard of the Open Banking scheme, where financial organisations can (with permission) share your data between each other to offer services such as a complete view of all your accounts/pensions/policies in one place.

DUA offers provisions to make further smart data project easier to get started. Similar schemes could transform services offered by energy companies, telecommunications providers, transport providers, retailers, and many others.

Digital Verification Service

The bill creates a framework for trusted identity verification services. I could write an entire blog about this alone. But imagine if we all walked around with a device that allows us to share as much or as little identification information as we’d like with a third party – using a trusted platform that’s universally recognised and accepted. It could transform everything from getting a bank loan, to booking a GP appointment, to being asked for your ID in a pub (which happens to me all the time).

Digital Subject Access Requests

The bill will change the requirements for DSAR to only require a “reasonable and proportionate” search for information. We live in an age where a few clicks of a mouse can send a piece of information to the four corners of the globe and copy it across multiple cloud platforms. It simply isn’t practical for organisations to identify and recover every scrap of data they have for a subject. Doing so can be time-consuming and expensive. The new bill accounts for this, giving the data holder more rights to define the scope of a search.

Research

At the start of this blog, I promised you that I could save the human race. Perhaps that statement was as bold as the government’s aspiration for a £10 billion DUA return. But there are some very exciting prospects in the bill for scientific research.

In the last few decades, computational analysis techniques have led to many new discoveries in fields such as biochemistry, microbiology, pharmacology, and virology. The development of the Covid-19 vaccination was sped up by using machines to analyse data.

DUA aims to remove some of the barriers that stop datasharing for scientific research. With appropriate safeguards, research organisations will find it easier to access data that is considered more sensitive and has traditionally been off limits. Accessing this data will enhance abilities to use computational analysis for good purposes.

Yes, privacy is a concern, but I don’t believe the answer is prohibition. It’s having the right governance and controls in place, so we can safely harness the many benefits that using data can bring.

In the last few years, we fought back against a global flu pandemic with a vaccination that is estimated to have saved 19.8 million lives. That vaccination was made possible (in part) thanks to data. It’s my belief that anything that helps us use data for a greater good can’t be a bad thing. The benefits to using our data for research far outweigh the risks.

So there you have it. The DUA bill might not be the most exciting thing you’ve ever read about. But hopefully you’ll agree it wasn’t as dull as you might have thought. And who knows – maybe one day it’ll save your life.

‍