Reinforcing Data Protection Laws for the Artificial Intelligence Age is Long Overdue

Reinforcing Data Protection Laws for the Artificial Intelligence Age is Long Overdue

In the ever-evolving digital landscape, the UK is taking significant steps to mitigate potential harms from Artificial Intelligence (AI) decision-making and ensure transparency and human oversight. These efforts are focused on updating legal frameworks, such as the recent Data Use and Access Act 2025 (DUAA), to create a more accountable and human-centric AI environment.

The Data Protection and Digital Information Bill, currently before the House of Lords, proposes reforms to data protection law that are expected to weaken existing protections. However, the Bill provides an opportunity to provide people with greater transparency about when automated decision-making is being used, and the right to opt out of this.

Key measures include clarifying lawful bases for AI data processing under the UK GDPR, revising rules on automated decision-making, enhancing transparency and auditability, ensuring human oversight, increasing regulatory enforcement powers, and embedding ethical principles into legal requirements and compliance frameworks.

Clarifying lawful bases for AI data processing is critical for balancing individual rights with the need for AI applications. Recognized legitimate interests that allow automatic processing in specified contexts are being emphasized. Similarly, revised rules on automated decision-making, particularly concerning special category data used in AI-driven decisions, will permit such processing when necessary for contracts or public interest, but with procedural safeguards maintained.

Transparency and auditability are being enhanced through technical and legal mechanisms ensuring traceability of AI data sources and decision logic. This will facilitate external audits and help detect biases and errors. Moreover, human oversight is being mandated, with AI decisions involving significant effects requiring review mechanisms and opportunities for individuals to challenge outcomes.

Increasing regulatory enforcement powers and complaint processes are also crucial. Data controllers must assist individuals in raising concerns, with phased implementation of enhanced complaint channels and ICO’s strengthened audits. Embedding ethical principles such as autonomy, fairness, beneficence, and non-maleficence into legal requirements and compliance frameworks will ensure responsible AI use aligned with societal values.

Meaningful human review is a key component for achieving appropriate oversight over automated decision-making, protecting individuals from unfair treatment, and offering an avenue for redress. For meaningful human review to be effective, it should be performed by a person with the necessary competence, training, understanding of the data, and authority to alter the decision.

More than half of respondents in a survey carried out last year in the UK expressed a desire for clear procedures to appeal AI decisions. Independent legal analysis commissioned by Ada last year found that these changes are likely to erode the incentives for organizations to properly assess and manage automated systems.

The use of the 'Frank' platform by Deliveroo to manage gig worker delivery riders through automated decision-making was found to be unlawful by the Italian Data Protection Authority. The Post Office scandal, involving hundreds of postmasters being prosecuted for theft and fraud based on flawed accounting software, illustrates the dangers of integrating complex technological systems into the economy at pace and uncritically.

These steps reflect a pragmatic balance between innovation and rights protection, making AI deployment more transparent, accountable, and human-centered in the UK’s evolving data protection regime. The effectiveness of these measures depends on detailed secondary legislation and robust enforcement going forward.

Technology plays a crucial role in data-and-cloud computing, particularly in the development and implementation of artificial intelligence (AI) systems. The regulatory changes proposed in the Data Protection and Digital Information Bill aim to strengthen technology's role in enhancing transparency and auditability, ensuring that AI decisions are both accountable and human-centric.

Read also: