Data and Democracy
Briefing: Data Use and Access Bill Henry VIII powers threaten democracy and UK adequacy
Henry VIII clauses are delegated legislative powers that allow the government to override or amend primary legislation as it was enacted by Parliament.
The Data Use and Access Bill makes extensive use of delegated legislative powers and Henry VIII powers: if the Data Bill were to be approved as it is, it would provide 87 quasi-arbitrary powers that the government and its Ministers could use to modify key aspects of UK data protection law via Statutory Instrument.
The Data Bill’s delegated legislative powers are ripe for abuse:
- They lack meaningful parliamentary scrutiny: “no SI has been rejected by the House of Commons since 1979”.1
- The 3rd Report of the House of Lords Constitution Committee stated that they “are not satisfied that the case has been sufficiently made to entrust the powers in these clauses to secondary legislation.”2
- In general, Henry VIII powers do, in the words of the House of Lords, “make it harder for Parliament to scrutinise the policy aims of the bill and can raise concerns about legal certainty”.3 The same report also states that these powers should, “be recognised as constitutionally anomalous”, and their use acceptable “only where there is an exceptional justification and no other realistic way of ensuring effective governance”.
This would allow governments to change primary legislation according to the politics of the day, undermining trust in digital verification services and endangering democratic safeguards. It would also introduce significant risks for the retaining of the UK adequacy status: either these powers would never be used, and thus they don’t need be provided, or they would be used in ways that would guarantee the invalidation of the UK adequacy decision.
Digital Verification Services: mission creep and enforced state monopoly
Clauses 28 and 29 give the government the power to prepare and publish “the DVS trust framework” and “supplementary codes”, which sets out rules concerning the provision of digital verification services, Further, Clause 34 provides the power to refuse registration in the DVS register, and Clause 45 allows to mandate data sharing from public bodies to registered DVS providers.
In a previous iteration of the Bill, Clause 45 would have required Ministers to use their powers to force public bodies to disclose to a DVS provider whether a person had changed their sex. This provision has been removed from the Bill, but the arbitrary nature of this power means that Ministers couldrequire at their sole discretion disclosure of sensitive characteristics such as gender, ethnicity or health conditions. This includes data sharing mandates with the Department of Work and Pension, the Home Office or HM Revenue Service to run background checks on any kind of information or attribute held by public bodies or DVS providers.
Likewise, there is nothing in the Data Bill that would prevent Ministers from imposing burdensome, unreasonable or otherwise arbitrary requirements on DVS providers. This, for instance, could happen if the government was interested in favouring the adoption of its public digital identity system, such as One Login or GOV.UK Wallet, over private providers of DVS services.
Erosion of democratic safeguards and integrity of elections
Clause 70 introduce new legal bases for processing, known as “recognised legitimate interests”, while Clause 71 would introduce exemptions to the purpose limitation principle, known as “list of compatible purposes”.
These powers could be used to undermine the integrity of our elections. Any party in power could change the rules around how electoral data is used just months before an election takes place. Opposition parties might worry Labour (whose election database runs on Experian, the credit agency servers) might use these powers to self-preference themselves and obtain even more access to commercial data.
These powers could also be used to enable and legalise a US-style mass seizure of government data by an unconstitutional agency like DOGE. Whereas DOGE’s misappropriation of government datasets is being successfully challenged on privacy law grounds in the US, a future, “rogue” UK government would only need to lay Statutory Instruments that authorise the illegal appropriation of government data to make their misuse legal. This weakens UK data protection law’s ability to protect the public during the event of a constitutional crisis, and make it easier to by-pass Whitehall departmental decision-making processes that operate under a cabinet style of Government.
Endangering UK adequacy and relationships with the EU
Clause 74 would empower the government to designate categories of data which are not to be considered as “special categories data”, also known as sensitive data. Further, schedule 7 would empower the government to authorise transfers of personal data to third countries on a purely discretionary basis.
If these powers were to be used, at any time, to authorise personal data transfers to a country that does not enjoy adequacy status from the EU, or to restrict the definition of special category data, this would guarantee the revocation or annulment of the UK adequacy status.
These powers were also identified by the EU stakeholders as a main source of concern regarding the continuation of the UK adequacy decision, whose review is due in December 2025. The House of Lords inquiry into UK adequacy concluded that “lawful bases for data processing and the ability to designate legitimate interests by secondary legislation made by Ministers” constituted a significant concern for EU stakeholders and the continuation of the UK adequacy decision.4 Henry VIII powers were also identified by the European Parliament review of the EU-UK Trade and Cooperation Agreement as a potential barrier to the functioning of such agreement.5
Conclusion and recommendations
Henry VIII clauses introduce unacceptable risks, and are being introduced in the absence of a meaningful justification.
The government has generally argued that these powers would allow ministers to update the law and to adapt it to technological progress. This statement does not hold to scrutiny: the UK GDPR is already principle based and allows both the ICO and the Court System to adapt the interpretation of UK data protection law to a changing reality. Independent regulators and Courts are better suited than the government at doing that, since they are independent and non-partisan. Further, Henry VIII clauses allow Ministers to override Primary legislation: the stated intent of using such a wide-ranging power to merely update legal provisions is suspicious and should be rejected as an unacceptable attempt to interfere with the role of Parliament.
We recommend MPs to reject Clauses 70, 71, 74, 80, 85 and Schedule 7. Further, we recommend MPs to bring Clauses 28, 29, 34 and 45 back to the drawing board in order to introduce meaningful limits to the government discretion when regulating DVS providers.
1 The Hansard Society, Delegated legislation: the problems with the process, p.16, at: https://www.hansardsociety.org.uk/publications/reports/delegated-legislation-the-problems-with-the-process
2 House of Lords Select Committee on the Constitution, 3rd Report of Session 2024–25, Data (Use and Access) Bill [HL], p.4 paragraph 13, at: https://publications.parliament.uk/pa/ld5901/ldselect/ldconst/40/40.pdf
3 Delegated Powers and Regulatory Reform Committee, Democracy Denied? The urgent need to rebalance power between Parliament and the Executive, at: https://publications.parliament.uk/pa/ld5802/ldselect/lddelreg/106/10602.htm
4 Lord Ricketts, Letter to Rt Hon Peter Kyle MP re: UK-EU data adequacy, at: https://committees.parliament.uk/publications/45388/documents/225096/default/
5 Opinion of the Committee on Civil Liberties, Justice and Home Affairs (10.10.2023) within REPORT on the implementation of the EU-UK Trade and Cooperation Agreement, at: https://www.europarl.europa.eu/doceo/document/A-9-2023-0331_EN.html#_section11
Joint letter
Henry VIII powers in Data Use and Access Bill could undermine election integrity
Find out more