Data (Use and Access) Bill: A step forward without transparency

After months of debate and several rounds of parliamentary “ping-pong”, the Data (Use and Access) bill (“DUA Bill”) has now passed both the House of Commons and House of Lords and the (now) Data (Use and Access) Act (“the DUAA”) was given Royal assent on 19 June 2025.

You can read our previous legal update here for a summary of the key aspects of the DUA Bill which remain unchanged in the DUAA.

AI and Copyright

One of the most contentious issues during the DUA Bill’s passage through parliament, and the reason for its delay, was the debate between the Commons and the Lords over Baroness Kidron’s amendments to the DUA Bill which sought to impose greater transparency requirements on AI developers using copyrighted works to train their AI models. The Government ultimately succeeded in excluding the transparency requirements proposed by Baroness Kidron, arguing that the DUA Bill was not the right place to address such a complex issue, and has instead committed to produce an economic impact assessment and a report on the use of copyright works in the development of AI systems within nine months of the DUA Bill getting Royal Assent. Despite what might feel like a blow to the creative industries, AI and copyright issues has been propelled to the forefront of the legislative agenda, signalling a pivotal step toward greater accountability and protection for human creators in the age of artificial intelligence.

Coincidentally and in a somewhat very timely manner, the long-awaited trial between Getty Images and Stability AI kicked off earlier this month in the High Court in London. This case addresses important questions around how UK copyright law applies in the context of generative AI training and outputs. It challenges whether generative AI models can lawfully train on copyrighted materials at scale, or whether such use constitutes infringement, trademark misuse, and database-right violations under UK law. This case is pivotal and has the potential to help regulate this area, inform the Government’s steps towards legislative reform and influence how creative industries and tech firms interact in the UK and beyond. The trial in London began on 9 June 2025, and will run for approximately 3 weeks, scheduling to conclude around 30 June, with judgment expected later this year.

Key features of the DUAA

Smart data powers

The DUAA introduces new “smart data” powers, which aim to extend the data-sharing principles of open banking to sectors like energy and telecoms. The intention of new smart data schemes is to allow consumers and businesses to share their information with regulated and authorised third parties so that they can obtain personalised market comparisons. By giving consumers and businesses more control over their data, third-party providers can offer better, more competitive services.

Cookies

The DUAA expands the current cookie consent exemptions under the Privacy and Electronic Communications Regulations (PECR) so that certain ‘low risk’ cookies, such as those used for basic analytics or improving website appearance, can be set without obtaining prior consent if they do not pose significant privacy risks. Users will still need to be clearly informed about the cookies used (transparency) and offered a simple opt-out, and marketing cookies remain subject to explicit user consent.

These changes provide long-awaited clarity for website operators, but it is important to note that these changes only apply to the UK. UK businesses who also operate in the EU would need to excise some caution before relying on an exemption under UK law as the EU GDPR has different rules. Compliance with both regimes is therefore still likely to be needed.

The Information Commissioner’s Office (ICO) (who will be reformed under the DUAA as the Information Commission) is expected to issue a statement this autumn to clarify the advertising activities it deems to be “low-risk” and would not trigger enforcement action.

PECR Fines

One of the changes introduced in the DUAA is the ability for the new Information Commission to issue higher fines under PECR for non-compliance. Previously fines under PECR were capped at £500,000. Under the DUAA, fines for infringement of PECR will now be brought in line with the much more substantial fines under UK GDPR – up to a maximum of £17.5m or 4% of the organisation’s total annual worldwide turnover, whichever is higher. Businesses should therefore ensure that their marketing activities and use of cookies comply with PECR (as amended) and follow the guidance issued by the Information Commission.

What’s next?

The changes imposed by the DUAA should prompt businesses to review their current processing activities and update their policies and procedures, especially around cookies, marketing, data sharing and use of automated decision-making. Since much of the DUAA relies on secondary legislation, its full application will not take effect immediately and so compliance at this stage will mean keeping a close eye on developments and the passing of secondary legislation.

Final thoughts

The DUAA marks a significant step forward in modernising the UK’s data landscape. While it introduces transformative measures such as smart data powers, a digital identity trust framework, and enhanced enforcement capabilities, the most closely watched issue remains the intersection of AI and copyright. The Government’s commitment to publishing an interim and full report on AI and copyright enforcement reflects the complexity and sensitivity of this topic. We also eagerly await the judgment on Getty Images v Stability AI expected later this year. This will be a landmark decision influencing how generative AI models can legally use copyrighted materials in the UK. The outcome of this case will likely change the future of AI as we currently see it.

We will continue to monitor these developments closely and provide updates as the Government releases its reports and as further regulatory clarity emerges. Businesses should stay alert to these changes, be ready to adapt, whist also exploring the potential opportunities the DUAA brings, such as those presented by smart data schemes.

If you have any questions or would like to discuss any of the topics in this article, please contact Selina Clifford in our Intellectual Property team.