Knowhow

Data (Use and Access) Act 2025

The Data (Use and Access) Act (the Act) received Royal Assent on 19 June 2025.

The Act brings about changes to data protection law in the UK, diverging to some extent from equivalent EU provisions. Whilst there are a number of points of interest from a data protection perspective arising out of the Act (the renaming of the Information Commissioner’s Office to the “Information Commission” being one of the less eye catching items), in this note we focus on what has not been addressed by the Act – namely, in respect of the heavily debated topic of copyright and AI.

Background

The Data Protection and Digital Information Bill was initially introduced by the Conservative Government in March 2023. The Bill was reintroduced by the Labour Government in October 2024 as the Data (Use and Access) Bill.

When the Bill was reintroduced to Parliament, the Government stated that it would, among other things, “bring an estimated £10 billion boost to the UK economy across 10 years”, with the use of new Smart Data powers and the National Underground Asset Register driving economic growth by improving the way consumers, businesses and asset owners can share data.

The Government also stated that the Bill would aim to improve public services and make lives easier by ensuring that people know which digital providers are secure and trustworthy, requiring digital identity providers to become certified against rules on data privacy, security and inclusion.

Copyright and AI

There has been considerable back and forth in recent months between the House of Commons and House of Lords regarding the use of copyright materials to train AI. Several high-profile artists, including Sir Elton John, Sir Paul McCartney and Dua Lipa, were opposed to the Bill, on the basis that the Bill did not require tech companies to declare their use of copyright materials when training AI tools.

A number of significant amendments were proposed in the House of Lords to this effect, including proposed clauses regarding transparency of business data used in relation to AI models. For example, the House of Lords proposed clauses to require UK AI developers to provide: (i) copyright owners with information regarding the data used in relation to the training of their AI models; and (ii) a mechanism to enable copyright holders to identify individual works that have been used for these purposes.

Although these amendments were ultimately rejected by the Government, it was agreed that the Government must, within nine months, publish the following (with a progress statement within six months):

  • an assessment of the economic impact in the UK of the possible policy options outlined in the Consultation (see section below), including with reference to the impacts on copyright owners, developers of AI systems, and users; and
  • a report on the use of copyright works in the development of AI systems, including proposals on:

(i) technical measures and standards to control the use and accessing of copyright works to develop AI systems;

(ii) the effect of copyright on access to, and use of, data by developers of AI systems;

(iii) the disclosure of information by AI developers on their use of copyright works;

(iv) the granting of licences to AI developers to do acts restricted by copyright;

(v) the enforcement of rules relating to the use and accessing of copyright works to develop AI systems.

Consultation

The Government ran a consultation from 17 December 2024 to 25 February 2025 (the Consultation) seeking views on how to ensure that the UK’s legal framework for AI and copyright supports the UK creative industries and AI sector together. A key proposal here is an ‘opt-out’ regime - similar to that introduced by the EU AI Act - whereby text and data mining for commercial purposes (instead of the current general exception for text and data mining for non-commercial purposes only) would be permitted unless copyright rightsholders actively opted out of the regime (i.e. notified developers that they would not be permitting their works to be scraped by bots and scrapers in the training of AI tools). The outcome of the Consultation is yet to be published, but will presumably now dovetail with the new reporting requirements under the Act referenced above.

Key takeaways

The reporting requirements are a compromise, reflective of the importance and complexity of the topic. Given the robust debate in the lead up to its finalisation however, we can expect more of the same when the issue resurfaces next year.

Please feel free to reach out to Chris.Johnson@northridgelaw.com if you have any questions regarding this update, or George.Willis@northridgelaw.com if you would like any help understanding and navigating the new data protection rules.