Debate contribution: The Data (Use and Access) Act 2025

Debate contribution by Mr Gerry Carroll on 30 June 2025.

MLA

Mr Gerry Carroll

Party at the time

People Before Profit Alliance

Date

30 June 2025

Type

Debate contribution

Business

Executive Committee Business

Heading

The Data (Use and Access) Act 2025

Assembly identifier

Official Report component 5043719

Read the official Assembly record

Text

Sometimes; sometimes not. The British Government do not give a damn about people here generally, and, given their handling of the legislation, they do not care about their data and how it is used and protected. My concerns run further than process and procedure, and I hope that I can get some answers to my points from the Minister. In many ways, I agree with Mr Frew that it is a bit of a pointless debate, but we are all here. The legislative process has been and gone, but there are massive questions about what extra powers the companies that hold data have and what companies that employ people and have huge control over people's lives will be able to do now that the legislation has been passed at Westminster. In the right hands, AI could bring benefits to the vast majority of people. Unfortunately, AI and much of the technology surrounding it is in the wrong hands. It is in the hands of people who not only do not give a damn about democracy and suck up to the likes of Trump and his autocratic regime but are willing to suck up resource and energy usage for the expansion of AI, no matter the financial, environmental or human cost, some of whom are willing to fight trade wars and actual wars with China over resource and access to markets. In its original form, the Data (Use and Access) Bill referred to:

"protections for individuals in current UK law from harms arising from the development and use of AI".

I am deeply concerned about whether the Act does that at all, and it is not just me. The Ada Lovelace Institution, the App Drivers and Couriers Union (ADCU) and others have raised concerns that the impact of the changes have not been fully considered in light of the last few months, and I will raise their concerns throughout my contribution. If the public were focusing on this botched process — I do not blame them for not focusing on it — I would hazard a guess that they would be asking far more questions about what has happened and what is now acceptable and in law. The so-called democratisation of AI tools has resulted in automated decision-making being deployed on a much greater scale across the economy than ever before and in many more high-risk and complicated contexts with no proper regulation. The Couriers Union has discussed people being dismissed from their job by an algorithm — by a ping on their app. Deliveroo's use of the Frank platform to manage more than 8,000 gig-worker riders through the automated decision-making process was found to be unlawful by the Italian Data Protection Authority, which stated that it produced:

"a significant effect on the rider concerned, consisting in the possibility of allowing (or denying) access to job opportunities".

A Dutch court made a similar decision on Uber and Ola's practices around automated decision-making. Given the shambolic process with the LCM, I have no idea whether that process has been extended here. I suspect that it has. I wonder whether the Finance Minister or the Economy Minister has inquired about the impact of the Act on couriers or delivery workers here. I doubt that they have, but I am happy to be corrected. AI companies are motivated by hoovering up as much data as possible and maximising profit. It is critical that the provisions leave no scope for abuse. I remain unconvinced of that. The Data (Use and Access) Act contains measures that would lower safeguards for personal data, which should concern everybody here, especially those who talk about freedom of speech. The Ada Lovelace Institute identified three aspects of the Act that require particular scrutiny. The Act removes the general prohibition on automated decision-making. That means that people no longer get to choose whether to be subject to automated decision-making. It places the responsibility on them to enforce their rights, rather than on companies to demonstrate why automation is permissible. It is a very risky process to put the onus on the individual rather than on resource-rich organisations that have a material interest in quick, automated decision-making to boost profit and maximise access to and use of data. There are safeguards mentioned in the Act, but my concern is that they will not be enough. Part of the drive and rationale for the Act is to stimulate innovation through broadening the definitions of scientific research for which data can be shared and reused. There is a concern that:

"provisions are susceptible to misuse that would enable mass reuse of personal data scraped from the internet or acquired through social media for AI product development"

and be classed as scientific research. I have no idea what safeguards are in place to protect people from that. I am happy to give way to the Minister or anyone else on that point. Worryingly, the Bill gives regulation-making powers to the British Secretary of State that would:

"enable the effective removal of key data protection safeguards via secondary legislation by adding ‘recognised legitimate interests’ that would allow organisations to bypass the core tests they otherwise need to comply with, to use people’s data."

In other words, there will be a free-for-all for big corporations, and no protections were mentioned by the Minister in the process at all. The Secretary of State was also given new regulation powers, as referred to by the Minister, to effectively allow the wide use of automated decision-making to take place in regard to new universal technologies. Already-limited protections will be disregarded and, moreover, large tech companies could abuse the provisions to legitimise mass data scraping. Personal data scraped from the internet or collected via "legitimate interest" by a social media platform about its users could potentially be legally reused for training AI systems for the new provisions, and developers can claim that it constitutes scientific research. It sounds technical and is, but the devil is in the detail. A lot of clarity is needed, and the Minister has failed to provide that clarity today. His Department has failed to provide it throughout the whole process, so I will join others and vote against this shambolic process again.

1,036 words. Text as published by the Northern Ireland Assembly.

Assessment

Not flagged

Jev’s structured answers

Assessed 21 October 2026 at 13:06 UTC by jev-1.13.0 (requested as typesafe/jev) under rubric 2026.10-r9, methodology 1.9.

Disagree with this assessment?

Classifications can be challenged. A person reads every challenge, and any change is recorded publicly above with its reason.

Challenge this classification