Crunch time for the UK’s National Data Strategy

The beginning of December saw the close of the consultation period on the UK Government’s National Data Strategy (NDS). Data - “information about people, things and systems”, as the policy paper defines it - is vital for everyone from online retailers and social network companies to Covid-19 researchers and transport planners. The UK’s data market is Europe’s largest, so it’s no surprise that the Government plans to make the most of it.

However, there are complications. The UK’s Brexit deal with the European Union (EU) is still being negotiated and the deadline drawing closer. Much depends on the EU’s willingness to allow data from the European Economic Area to flow into the UK. Related, and also uncertain, is the UK’s data deal with the US. To understand the issues, it’s worth recapping the NDS as it has been set out so far.

Unlocking the value of data

The Government’s aim is to make better use of data, by removing barriers to access, making rights clearer and encouraging organisations to use it better. That leads to five missions. First, unlocking the value of data across the economy. Second, maintaining a pro-growth and trusted data regime. Third, transforming government data use. Fourth, ensuring the security and resilience of data infrastructure. And fifth, championing international data flow.

To achieve all that, the Government will recruit a Chief Data Officer and train 500 public sector data analysts. It will invest £2.6m in removing barriers to data sharing and detecting online harm, as well as creating 10 Innovation Fellowships to transform Government data use. Finally, the Government will introduce primary legislation to boost participation in Smart Data initiatives, allowing consumers more freedom to find better deals from service providers using their data, similar to what has been achieved in Open Banking.

All of this sounds good, but the detail is what matters. The policy paper says: “The Government is committed to an economy where consumers’ data works for them, and innovative businesses thrive.” However, the wishes of consumers and businesses don’t always align. How will the rules work when there is contention? Likewise, the government wants “a regulatory regime that is not overly burdensome for smaller businesses and that supports responsible innovation”. Once again, where will the line be drawn if these goals conflict?

Data sharing and the EU

The consultation is designed to untangle those competing objectives. There are deeper complications that will be harder to resolve, however. The first is whether the EU considers the UK to be ‘data adequate’. At the moment it doesn’t, and European Courts have been critical of the UK’s Investigatory Powers Act.

In early November, John Whittingdale, Media and Data Minister, said: “It is our ambition to achieve an agreement with the EU that the UK remains data adequate, so that there is no impediment to the flow of data. We don’t see any reason why we shouldn’t get data adequacy.” However, he also said, that once the UK is “no longer bound by European law, we want to champion the benefits that data can deliver”, and that’s where the problem might arise.

European Courts have twice struck down data transfer mechanisms negotiated with the US because the EU expects greater consumer protection. As Julian Hayes, Partner at BCL Solicitors, puts it: “How could [the Commission] grant an EC adequacy decision to the UK, allowing the free flow of EU personal data to Britain when the UK could, in turn, grant its own adequacy decision to the US, theoretically facilitating EU personal data to flow westwards to the US without what the EC regards as adequate protection?” The NDS, he warns, could inadvertently stifle the digital sector, if not properly thought through.

Carissa Veliz, of the Institute for Ethics in AI at Oxford University, has more serious concerns. She warns of the danger of the UK establishing a ‘data haven’, “being willing to host data acquired in unlawful ways (e.g. without proper consent or safeguards) that is then recycled into apparently respectable products”. The UK risks falling out of step with the developed world, she argues, if it does not take data privacy seriously.

The future of the UK’s digital economy will depend to a large extent on how things play out over the next few months. What happens next? We don’t yet have enough data.