The UK government’s newly minted Data (Use and Access) Act 2025 is being hailed by ministers as a modern, post-Brexit data reform that will drive innovation, boost economic growth, and improve public services. But dig past the buzzwords—“smart data,” “proportionate regulation,” “digital transformation”—and a more disturbing reality emerges: this Act is not about empowering citizens. It’s about centralising control, neutering oversight, and prying deeper into people’s lives under the pretext of progress.
Rebranded Surveillance with a Smile
At its core, the Act dramatically expands the government’s ability to access, share, and repurpose personal data across agencies, companies, and sectors—with little transparency and even less accountability. From biometric data retention to compulsory data sharing between departments, the law creates a labyrinth of “lawful purposes” so broad they could accommodate almost any use, from profiling welfare recipients to enabling predictive policing.
The phrase “digital innovation” cloaks what’s essentially a rebranding of state-sanctioned surveillance. Consider the government’s push to digitise birth and death records, health interactions, and public service data flows. In practice, this means more centralized data lakes controlled by a state increasingly comfortable with using private information as a tool of administration, behavioral nudging, or worse—political manipulation.
The Death of Independent Oversight
One of the most troubling aspects is the effective dismantling of the Information Commissioner’s Office (ICO)—the UK’s independent data watchdog—and its replacement with a politicised “Information Commission” governed by a board appointed by ministers. This shift guts regulatory independence and raises serious concerns about how future data breaches, complaints, or abuses will be handled—particularly if they involve the state.
Worse still, under the new regime, individuals are required to first approach companies directly with complaints before the Commission will investigate. This may sound efficient, but in reality it’s a significant barrier for vulnerable individuals and an implicit green light for corporate obfuscation.
Legitimate Interests or Legal Loopholes?
The Act also loosens restrictions on data use under the guise of “recognised legitimate interests”, allowing organizations to bypass key safeguards—particularly for purposes like national security, law enforcement, and even direct marketing. The result? A slippery slope where your data could be shared or sold without your consent or even your knowledge, as long as it’s framed as being “in the public interest.”
Add to this the weak guardrails around automated decision-making, and you have a recipe for opaque algorithms making impactful judgments—on credit, jobs, policing—without meaningful human oversight.
An Assault on Digital Rights
While the government touts the Act as a way to “simplify” and “streamline” data regulation, it’s hard to ignore how many rights are being weakened in the process:
- Data Subject Access Requests (DSARs) can now be delayed or denied under the vague standard of “disproportionate effort.”
- Cookie consent rules have been diluted to the point of irrelevance.
- International data transfers are now subject to political approval rather than legal adequacy—putting UK citizens’ data in the hands of foreign jurisdictions with weaker protections.
Weaponizing Data in the Age of AI
The most glaring battleground—AI and copyrighted content—exposes the Act’s real agenda. For months, the government tried (and failed) to sneak through amendments that would let AI companies scrape copyrighted works without consent, enabling large-scale intellectual property theft under the banner of “innovation.” Only fierce resistance from the Lords kept this provision at bay—for now.
But the Act still requires the Secretary of State to bring forward new legislation on this within 3 months, a thinly veiled promise to return with more expansive powers.
A Trojan Horse of Control
The Data (Use and Access) Act 2025 is not a neutral piece of legislation. It is a Trojan horse—sold as simplification and innovation, but hiding an aggressive expansion of state and corporate power over personal data. It weakens individual rights, centralises oversight, and grants sweeping discretion to ministers under vaguely defined goals.
Rather than empowering citizens, it empowers those who already hold data and want more of it—whether for profit, policy, or political advantage. And in the absence of stronger safeguards, judicial review, or truly independent oversight, we risk normalising a digital infrastructure of perpetual surveillance by design.
This is not progress. This is regression wrapped in digital rhetoric.