Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026

Considered in Grand Committee

Moved by

That the Grand Committee do consider the Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026.

My Lords, these regulations were laid before the House in draft on 2 February. They make consequential amendments to references to the Information Commissioner and their office—the ICO—across the statute book. They reflect the reforms to the regulator’s governance structure introduced by the Data (Use and Access) Act 2025.

Specifically, that Act abolishes the office of the Information Commissioner, which is a corporation sole, and transfers its functions to a new body corporate—the Information Commission—led by a chair and a chief executive, as well as other executive and non-executive members with collective decision-making responsibilities. This will increase diversity and resilience at the very top of the organisation, so that the Information Commission can function effectively with integrity and independence. It will also bring the commission in line with how other regulators, such as Ofcom, are governed.

These regulations prepare the statute book in anticipation of the transfer of functions from the ICO to the new Information Commission later in spring this year. They will ensure that the statute book is coherent, consistent and provides full legal clarity to support the transition from the ICO to the Information Commission. The regulations also make amendments to the title of the regulator across relevant Scottish, Welsh and Northern Irish legislation, on which devolved Governments were consulted.

In addition, Regulation 3 contains a transitional provision that provides for the Information Commissioner to retain their existing pension arrangements for the duration of their tenure as first chair of the Information Commission, a role that the Information Commissioner assumed on commencement of Schedule 14 to its parent Act on 20 August 2025, under paragraph 2(2) of that schedule.

Finally, the regulations also contain three minor and technical amendments to the Data Protection Act 2018, in consequence of Sections 67 and 91 of the Data (Use and Access) Act. These changes are intended to signpost references correctly and to reflect numbering changes, and do not have substantive legal effect. The consequential amendments, alongside the transitional provision and other minor and technical amendments contained in these regulations, will facilitate the smooth governance transition from the Information Commissioner’s Office to the new regulator, the Information Commission. I beg to move.

My Lords, I thank the Minister for his introduction. Of course, we recognise that this instrument is a technical necessity. It ensures that the statute book remains coherent as we transition from the Office of the Information Commissioner to the new Information Commission. Obviously, not to agree these regulations would be to invite legal ambiguity across hundreds of pieces of legislation, from the Public Records Act to the UK GDPR.

However, accepting the technicality of this SI does not mean that we on these Benches have moved past our deep-seated reservations regarding the original Data (Use and Access) Act 2025. The Liberal Democrats argued throughout the passage of the original Bill that the governance upgrade that the Government describe is in reality a threat to regulatory independence. By replacing a singular independent Information Commissioner with a commission, the members of which are largely appointed by the Secretary of State, the Government have increased the risk of political interference. We remain concerned that the Act has weakened the rights of citizens, as we debated during the passage of the Act, and specifically we regret the reduced independence, with the new structure allowing the Secretary of State to have a greater hand in the commission’s strategic priorities.

On data subject complaints, we warned that changes to how complaints are handled could make it harder for individuals to challenge the misuse of their personal data. On the vague purpose of research, we consistently argued that broadening the definitions of “research and statistical purposes” in Section 67 without robust safeguards risks opening the door to corporate data mining under the guise of scientific progress.

I have several questions for the Minister regarding the timeline for the new commission. On the commencement of Section 119, these regulations generally come into force only when Section 119, on the transfer of functions, is fully active. The Minister mentioned that it would be later in the spring, but can he provide a definitive date for when the Information Commissioner will be abolished and the commission will take over?

On the appointment process, while we see the transitional provisions to protect the pension of the first chair, what is the status of the recruitment for the remaining executive and non-executive members? Is the Minister satisfied that the transfer of staff and property under Section 120 is on track to ensure that there is no dip in enforcement capability during this period of restructuring?

Given that these amendments touch upon legislation in Scotland, Wales and Northern Ireland, has the Minister received assurances from the devolved Administrations that they are ready for this change on their respective statute books?

In summary, we accept these regulations as a matter of legislative housekeeping, but we maintain our criticism of the 2025 Act, which we believe traded independence for bureaucratic convenience. We will be watching the new Information Commission closely to ensure that it remains a defender of the public, not an instrument of the department. I look forward to the Minister’s response.

My Lords, I too thank the Minister for introducing these regulations. I note that he is having a spectacularly busy day. Clearly, these regulations are essentially technical in nature, as the noble Lord, Lord Clement-Jones, said, but they play an important role in ensuring that the statute book remains coherent following the passage of the Data (Use and Access) Act 2025.

That Act, as a partial continuation of the itself much-debated DPDI Bill, made a great many important changes, not least a significant structural change to the United Kingdom’s data protection regulator, replacing the previous officeholder model with the new corporate body of the Information Commission. The purpose of these regulations is therefore straightforward. They update references across the statute book so that legislation refers to the new body rather than the former Information Commissioner’s Office.

These are consequential amendments that are technical but necessary to provide legal clarity and continuity. We on this side recognise the importance of maintaining a regulatory framework that is both clear and workable. Data protection and digital regulation now sit at the heart of our modern economic and civic lives. In an increasingly digitised world, the institutions responsible for overseeing that framework must be capable of responding to fast and far-reaching technological developments while maintaining public trust.

The creation of the Information Commission as a board-led body is intended to support that objective by strengthening governance and resilience at the top of the organisation. Needless to say, structural reform is a necessary but not a sufficient condition for the regulator’s effectiveness. The commission’s responsibilities will continue to expand as new technologies and new risks emerge. It is therefore at least as important that it has the strategic clarity and operational capacity required to discharge its functions effectively. Will the Minister explain how the Government propose to ensure, today and in future, that the commission is able to balance two objectives, both vital to the United Kingdom: protecting individuals’ rights and privacy; and enabling innovation and economic growth in our digital economy?

My Lords, first, I am really grateful to the noble Lord, Lord Clement-Jones, and the noble Viscount, Lord Camrose, for their contributions. The Government are committed to the integrity of the new data protection regulator, the Information Commission. Having regulatory powers and responsibilities shared across an independent board, rather than vested in one individual as is currently happening under the Information Commissioner, will ensure diversity and resilience in the decision-making process.

As I have outlined, the Information Commission needs modern, effective governance structures in place to enable it to perform as a dynamic regulator and sustain its well-established international reputation. This ties in with the question that the noble Lord, Lord Clement-Jones, asked earlier about independence. These regulations, in line with the governance structures established by the Data (Use and Access) Act 2025, lay the foundations to achieve this. As I mentioned, the new governance structures model will safeguard the Information Commission’s independence. It is important that the regulator continues to operate independently, and the Government believe that having its responsibilities spread across a board with executive and non-executive directors will ensure greater independence and integrity. The new governance models will create greater clarity and certainty, allow for the appropriate public appointment processes by the Government and are commonplace for UK regulators.

The noble Lord also asked about the transfer of functions from the current ICO to the Information Commission. The Government are currently concluding the public appointments process for the Information Commission’s non-executive directors. DSIT is also working closely with the ICO to ensure operational readiness and a smooth transfer of all functions from the Information Commissioner’s Office to the Information Commission. A separate instrument containing commencement and transitional provisions will bring Sections 118 and 119 of the Data (Use and Access) Act into force, abolishing the Information Commissioner’s Office and transferring all regulatory and other functions from the ICO to the new Information Commission. This is due to occur later in spring—I cannot be clearer than that, I am afraid—and I am happy to keep the House informed on progress in this area.

My Lords, I am sorry to interrupt the Minister, but there must be a planning date. If any private business were transforming itself, it would have a target date of April the 5th or 6th, or whatever it might be, but there seems to be no certainty here, and therefore the Minister does not even know when this statutory instrument will actually become live. It is important that it becomes live, I am assuming, on the same day that the transfer of functions takes place.

I said earlier that the appointment process is currently taking place. The current Information Commissioner will be chair, and the current CEO will be interim CEO until the new Information Commission is set up. The composition of the governing board—the executive and non-executive directors—is currently in process; we have appointed some, but not everybody. We have to get that first before we can decide on the date that everything is rolled over. That is the situation we are in.

Regarding devolved Administrations, the power to make consequential amendments conferred on the Secretary of State by Section 139 of the DUA Act, under which this instrument is being made, does not require the consent of the devolved Administrations. Nevertheless, in line with usual practice, the department has consulted with the Northern Irish, Scottish and Welsh devolved Administrations on the changes to legislation within their competence, and they are content with the approach taken in the instrument. Additionally, the Minister for Digital Government and Data has written to the relevant devolved Ministers to inform them of the nature and scope of the changes made to devolved legislation at the time of laying this regulation.

On the point made by the noble Viscount, Lord Camrose, about the functions of innovation and growth, I will have to come back to him on that.

We look forward to being able to announce in due course the conclusion of the appointments process, as I mentioned earlier, for the non-executive members of the Information Commission board. The board will provide independent oversight alongside constructive scrutiny and challenge to the complex, wide-ranging and important regulatory work of the Information Commission.

Motion agreed.