Data Privacy & AI

Policy

AI

The King’s Speech said that it will “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models” – this is not included in the Employment Rights Bill but has been anticipated in as a separate AI Bill.

The Plan to Make Work Pay, also included some comments about AI in the workplace, saying:

• it recognises the importance of new technologies including AI but that it sees that it can also pose risks to jobs and livelihoods;

• it wants to ensure rights and protections keep pace with technological change, safeguard against discrimination and put the worker voice at the heart of digital transition;

• it would work with workers and unions to safeguard against the invasion of privacy through surveillance technology, spyware and discriminatory algorithmic decision making; and

• at a minimum, it will ensure that proposals to introduce surveillance technologies would be subject to consultation and negotiation, with a view to agreement of trade unions or staff representatives (see the Collective bargaining and trade unions section).

The Government may perhaps look to the TUC’s draft AI Bill for inspiration for any domestic rules here on the use of AI systems by employers in relation to workers, employers and jobseekers.  

Since the King’s Speech and the Plan to Make Work Pay’s publication, there have been some developments to AI (although not all directly employment-related) which demonstrate the Government’s ever-changing position in respect of AI. These include:

• On 5 September 2024 the Government and the EU announced their signature of an international convention in respect of Artificial Intelligence and Human Rights, Democracy and the Rule of Law.  As part of the Government’s announcement on this, it confirmed that it will work closely with regulators, the devolved administrations, and local authorities as the convention is ratified to ensure it can appropriately implement the new requirements.
• In December 2024, the Government has also launched a new consultation relating to AI and copyright, which also includes consideration on the regulation of deep fakes, transparency of AI systems and labelling of generative AI outputs. The aim of the consultation is to set out the “plan to deliver a copyright and AI framework that rewards human creativity, incentivises innovation and provides the legal certainty required for long-term growth in both sectors” – clearly seeking to balance innovation and regulation. This consultation closed 25 February 2025.
• On 13 January 2025, the Government published its AI Opportunities Action Plan, with which it hopes to “position the UK to be an AI maker.” Although it is not yet clear what (if any) specific actions will arise from this plan at this stage, the Government sees AI as a way to achieve economic growth and improve skills.  
• In February 2025 it was reported that the UK (along with the US) refused to sign a declaration on the international AI statement at the global AI summit in Paris. Signatories to the statement affirmed priorities such as reinforcing international co-operation and ensuring that AI is open, inclusive, transparent, ethical, safe, secure and trustworthy, considering international frameworks.
• Recent press reports from late February 2025, have now also indicated that the Government’s plans to introduce an AI Bill “to place requirements on those working to develop the most powerful artificial intelligence models”, is on hold (or dropped) in an alignment with the US’s position on the regulation of AI under President Trump’s government. Perhaps indicating more of a political alignment with the US on AI regulation more generally.
• As a final note, the new Data (Use and Access) Bill (the ‘DUA Bill’) is currently making its way through the Parliamentary process. Although much of this Bill relates to data protection (see below), it does propose to relax the restrictions on automated decision-making resulting in current restrictions only applying in relation to special category data.

Data Privacy

As mentioned above, the DUA Bill separately proposes some reforms in respect of data privacy and AI that, although not necessarily linked to the Plan to Make Work Pay, may be of interest to employers.

Although much of the DUA Bill is not employment related, there are some key changes that are of note from an employment perspective, including:

• Introducing an exhaustive list of ‘recognised legitimate interests’ on which businesses can rely by default as a lawful ground for processing ordinary personal data.
• Relaxing the test for data transfers to third countries where the standard of protection is ‘not materially lower’ than that of the UK.
• Clarifying the principles relating to DSARs (specifically in respect of timing, extensions and stopping the clock), and confirmation that complaints must first be sent to employers before escalating to the Information Commissioner.
• Replacing the ICO with the Information Commissioner and clarifying its powers.
• Finally, as mentioned above, relaxing the restrictions on automated decision-making resulting in current restrictions only applying in relation to special category data.

Note that the EU-UK adequacy decision on data transfers (allowing for the transfer of data between the EU and the UK) was due to expire on 27 June 2025, but is likely being extended by six months to 27 December 2025 to allow for the passage of the DUA Bill. Accordingly, the EU will need to reconfirm that the UK continues to provide an equivalent level of data protection as the EU. It has been suggested that the changes recommended by the DUA Bill may undermine the UK’s adequacy status, which could result in companies needing to implement alternative measures to transfer data from the EU to the UK, but this has not been confirmed.

---

Timing and developments

AI

Partly mentioned in King’s Speech. To be considered further in the new consultation and AI Opportunities Action Plan. Small changes to automated decision-making in the DUA Bill. AI Bill reported to largely be on hold.

Await developments on key reforms.

Data privacy

The DUA Bill was published on 23 October 2024 and is currently going through the House of Commons (having started in the House of Lords). It is expected to be passed before Summer 2025. EU-UK adequacy decision due for renewal on 27 June 2025.