Data protection
While data protection did not feature in the King’s speech itself, the background briefing notes published by the government explicitly refer to a proposed Digital Information and Smart Data Bill. Its aim is to reform data sharing and data protection standards, help scientists and researchers make more life enhancing discoveries and give the regulator (the Information Commissioner’s Office, or ICO) new, stronger powers and a more modern structure.
Of particular note for the life sciences sector will be the ability of scientists to seek broader consent for scientific research and to make scientific research in commercial settings easier. Although the details are yet to be confirmed, the bill may incorporate some elements of the Data Protection and Digital Information Bill, which failed to make it into law before the end of the previous Conservative government.
It is proposed that the ICO will see reforms to both its powers and its structure, with the ‘strengthening’ of existing sanctions and the introduction of a CEO, board and chair.
Based on the initial announcement, it seems likely that any changes to the UK’s current data protection framework will be subtle, and is unlikely to compromise the UK’s adequacy status for international data transfers with the EU, as they will not affect the essence of the UK’s data protection framework.
Artificial intelligence (AI)
Although it had been reported that an AI Bill was likely to be introduced, the King’s Speech did not include such a specific proposal. There was, however, a general statement that the government will “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”. The fact that this immediately followed the Government’s commitment to employment rights may be an indication that at least one focus of any new AI legislation will be to place safeguards on the use of AI for recruitment and employment decisions (which is an area of particular focus in the recently published EU AI Act). Given the relevance of AI-related innovation in the context of the wider UK Government’s objective to grow the economy, future UK AI regulation will likely seek to establish protections against perceived risks while supporting innovation.
Cyber security
Arguably one of the most significant proposals for digital regulatory reform came in the form of the Government’s proposal for a new Cyber Security and Resilience Bill. This is an unsurprising development for two reasons. Firstly, there has been an increasing number of cyber attacks on both public and private infrastructure, including those that recently impacting London hospitals and the Ministry of Defence. Secondly, the UK’s current regime is based on the EU’s NIS Directive, which will be replaced by the NIS-2 Directive from 18 October 2024. As a result of the UK leaving the EU, the NIS-2 Directive does not form part of UK law and so there would otherwise have been a regulatory gap in the UK’s cyber resilience compared to that of the EU.
The obligations in the Cyber Security and Resilience Bill have the potential to reflect some of the changes introduced by NIS-2, strengthening existing incident reporting obligations, and crucially bringing more sectors within scope to regulate a wider set of digital services and supply chains. The Government also proposes introducing cost recovery mechanisms to provide resources to regulators, as well as give regulators the powers to proactively investigate potential vulnerabilities.
What’s next?
The proposals under the King’s Speech are at an initial stage, and will need to make their way through the parliamentary process before they become law. We will monitor these developments as they evolve and the Government articulates further its intentions in relation to these issues.
Take a look at our 2024 Elections Hub for more analysis of the impact of the UK General Election result and new government and the latest insights on the other key elections taking place across the globe this year.
