Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026

Viscount Camrose Excerpts

Tuesday 17th March 2026 Grand Committee

In summary, we accept these regulations as a matter of legislative housekeeping, but we maintain our criticism of the 2025 Act, which we believe traded independence for bureaucratic convenience. We will be watching the new Information Commission closely to ensure that it remains a defender of the public, not an instrument of the department. I look forward to the Minister’s response.

[Viscount Camrose (Con)]

My Lords, I too thank the Minister for introducing these regulations. I note that he is having a spectacularly busy day. Clearly, these regulations are essentially technical in nature, as the noble Lord, Lord Clement-Jones, said, but they play an important role in ensuring that the statute book remains coherent following the passage of the Data (Use and Access) Act 2025.

That Act, as a partial continuation of the itself much-debated DPDI Bill, made a great many important changes, not least a significant structural change to the United Kingdom’s data protection regulator, replacing the previous officeholder model with the new corporate body of the Information Commission. The purpose of these regulations is therefore straightforward. They update references across the statute book so that legislation refers to the new body rather than the former Information Commissioner’s Office.

These are consequential amendments that are technical but necessary to provide legal clarity and continuity. We on this side recognise the importance of maintaining a regulatory framework that is both clear and workable. Data protection and digital regulation now sit at the heart of our modern economic and civic lives. In an increasingly digitised world, the institutions responsible for overseeing that framework must be capable of responding to fast and far-reaching technological developments while maintaining public trust.

The creation of the Information Commission as a board-led body is intended to support that objective by strengthening governance and resilience at the top of the organisation. Needless to say, structural reform is a necessary but not a sufficient condition for the regulator’s effectiveness. The commission’s responsibilities will continue to expand as new technologies and new risks emerge. It is therefore at least as important that it has the strategic clarity and operational capacity required to discharge its functions effectively. Will the Minister explain how the Government propose to ensure, today and in future, that the commission is able to balance two objectives, both vital to the United Kingdom: protecting individuals’ rights and privacy; and enabling innovation and economic growth in our digital economy?

It seems to me that without a principles-based adaptive approach, we are going to enjoy a great many repeats of this debate, in one way or another, as the Government of the day, of whatever flavour, struggle to keep up with emerging technologies. I look forward to the Minister’s response to the points raised by myself and by the noble Lord, Lord Clement-Jones.

[Lord Leong (Lab)]

My Lords, first, I am really grateful to the noble Lord, Lord Clement-Jones, and the noble Viscount, Lord Camrose, for their contributions. The Government are committed to the integrity of the new data protection regulator, the Information Commission. Having regulatory powers and responsibilities shared across an independent board, rather than vested in one individual as is currently happening under the Information Commissioner, will ensure diversity and resilience in the decision-making process.

As I have outlined, the Information Commission needs modern, effective governance structures in place to enable it to perform as a dynamic regulator and sustain its well-established international reputation. This ties in with the question that the noble Lord, Lord Clement-Jones, asked earlier about independence. These regulations, in line with the governance structures established by the Data (Use and Access) Act 2025, lay the foundations to achieve this. As I mentioned, the new governance structures model will safeguard the Information Commission’s independence. It is important that the regulator continues to operate independently, and the Government believe that having its responsibilities spread across a board with executive and non-executive directors will ensure greater independence and integrity. The new governance models will create greater clarity and certainty, allow for the appropriate public appointment processes by the Government and are commonplace for UK regulators.

The noble Lord also asked about the transfer of functions from the current ICO to the Information Commission. The Government are currently concluding the public appointments process for the Information Commission’s non-executive directors. DSIT is also working closely with the ICO to ensure operational readiness and a smooth transfer of all functions from the Information Commissioner’s Office to the Information Commission. A separate instrument containing commencement and transitional provisions will bring Sections 118 and 119 of the Data (Use and Access) Act into force, abolishing the Information Commissioner’s Office and transferring all regulatory and other functions from the ICO to the new Information Commission. This is due to occur later in spring—I cannot be clearer than that, I am afraid—and I am happy to keep the House informed on progress in this area.