Key Facts

• Jonathan Sellors is the general counsel of UK Biobank, a globally accessible clinical research resource with 500,000 participants.
• Tom Schumacher works for Medtronic as chief data and privacy counsel, the world’s largest medical device maker with three manufacturing sites in the UK.
• The new definition in the Bill helps clarify what constitutes scientific research, allowing private industry to participate more effectively.
• The Bill takes a sensible approach by clarifying existing GDPR provisions without impacting EU adequacy.
• Proper ethical approval from relevant ethics committees is required for research involving patient data.
• De-identification of data is crucial to ensure that research does not link back to individual health information.
• The session is moving from one panel of witnesses to another.
• Harry Weber-Brown is the chief engagement officer at ZILO.
• Phillip Mind is the director of digital technology and innovation at UK Finance.
• The banking community supports the Bill's data protection reforms.
• Open banking has over 7 million active customers.
• Smart data initiatives extend an open data regime to other sectors.
• Secondary legislation is imperative for ensuring firms use smart data schemes to the same standards.
• Australia's approach to consumer data rights is seen as a model for others.
• Extending data rights could provide consumers with a full view of their financial holdings and debt.
• The UK's open banking standards have been successfully exported to other jurisdictions.
• The trust framework is being developed by the Department for Science, Innovation and Technology.
• Part 2 of the Bill outlines a certification regime for identity providers to ensure compliance with the trust framework policies.
• Self-sovereign identity schemes are evolving, allowing consumers to control their data stored on blockchains.
• Keith Rosser is the chair of the Better Hiring Institute.
• Since 1 October, employers have been using digital identity verification services.
• A study involving 70,000 hires showed that 83% opted for the digital identity route.
• The digital identity process takes an average of three minutes and 30 seconds compared to a week without it.
• Digital identity verification detected 200 cases of fraudulent documents out of 70,000.
• Currently, nearly one in three companies providing DVSs are not certified.
• Helen Hitching is the Chief Data Officer for the National Crime Agency.
• Aimee Reed is the Director of Data at the Metropolitan Police Service and chair of the national police data board.
• Police officers are required to log their justification under section 62 of the Data Protection Act 2018, which is a considerable burden due to outdated technology systems.
• The Bill will list 'detecting, investigating or preventing crime' as a recognised legitimate interest, simplifying data rules and aiding serious crime tackling in the UK.
• The new standard for international data sharing is 'not materially lower', ensuring protection levels are maintained.
• The Biometrics Commissioner's focus on developing technology legally and consulting with the public will be retained post-regulation transfer to the Information Commissioner’s Office.
• Aimee Reed states that clearer guidance would help enable better charging decisions within the Crown Prosecution Service.
• Data sharing is constrained by the structure of the Data Protection Act, which splits regulations into sections, limiting cross-sectional data analytics.
• The Bill will highlight how biometric data should be managed and future-proof new types of biometric data.
• Andrew Pakes is a deputy general secretary and research lead for Prospect union, representing scientific, technical and professional workers.
• Mary Towers leads a project at the TUC looking at AI in employment relationships.
• The use of surveillance software and performance management technology has risen due to digital advancements and remote work during the pandemic.
• The Bill is seen as potentially opening a backdoor for dodgy surveillance software into the UK market.
• There are particular concerns about the reduction of powers around data protection impact assessments (DPIAs).
• Trade unions argue that collective rights of workers, including data protection and consultation rights, could be reduced by the Bill.
• The GDPR recognises high risk decisions impacting employment relationships.
• Workers must be consulted directly or through representatives on matters affecting them.
• Concern over employers using discretion to refuse data subject access requests under the new Bill.
• The TUC has red lines regarding the use of workplace technologies, including transparency, explainability, and non-discrimination.
• Discriminatory pay calculations may occur based on how long certain groups wait before accepting a gig.
• Worker and union involvement is critical at each stage of AI development to prevent discrimination.
• Around a third of members report being subject to digital monitoring or tracking.
• A recent European Commission’s Joint Research Centre report found that 20% of German people and 35% of Spanish people are subject to algorithmic management systems.
• Microsoft's productivity score feature was eventually withdrawn due to concerns.
• The Government has a system with six reports of the use of automated decision-making technology in government.
• The Public Law Project’s parallel register includes over 40 systems involving partly automated decisions about people.
• Changes to subject access requests and data protection impact assessments are seen as problematic for transparency.
• The Bill introduces altered regimes for national security certificates and derogation notices.
• Under human rights law, interferences with data or privacy rights must be strictly necessary.
• Safeguards in the bill are considered weak due to the Secretary of State's authority over publication of notices.
• Alex Lawrence-Archer is a solicitor who litigates data rights cases at AWO.
• The Bill aims to relax restrictions on automated decision making and alter the definition of personal data.
• Current resolution times for basic data breaches can take up to 10 to 12 months under the current regime.
• The age-appropriate design code was praised as a success but could be undermined by the Bill.
• The Bill introduces grey areas that companies might exploit for less transparency in processing personal data.
• Recognised legitimate interests under the new regime do not require balancing against data subjects' interests.
• The session involved over four-and-a-half hours of evidence from 23 witnesses.
• It was described as a 'masterclass' on topical data protection and digital information issues.