Author: Tom

The King’s Speech has outlined the new Government’s bold proposed changes to current employment legislation. Their plans include the introduction of a new Employment Rights Bill and a draft Equality (Race and Disability) Bill.

The Employment Rights Bill, promised within the first 100 days of this parliament, will make protection from unfair dismissal a ‘day one’ right for all workers. This means that employees will no longer need 2 years’ of employment to be able to claim for unfair dismissal (subject to probationary periods to assess new hires). Parental leave and sick pay will also become available from the first day of work.

The Government plans to ban “exploitative” zero-hour contracts and end ‘fire and rehire’ practices. The existing “discriminatory” age bands that apply to the National Minimum Wage will also be dropped to create a “genuine living wage”.

There are plans for Statutory Sick Pay to be made available to all workers, removing the waiting period and average earning requirement of £123 per week currently required for individuals to be eligible. Flexible working will become the default position for all workers, with employers being required to accommodate flexible working as far as is reasonable.

There is also increased protection for new mothers. Under the new Government’s plans, it will become unlawful to dismiss a woman who has had a baby for six months after their return to work (except in specific circumstances).

Amongst other changes, the Government also proposes to establish a new ‘Single Enforcement Body’ (Fair Work Agency) to strengthen the enforcement of workplace rights, and aims to remove unnecessary restrictions on trade union activity, including reversing the approach to minimum service levels taken by the previous Government.

The Government have said that their proposed draft Equality (Race and Disability) Bill will “tackle inequality for ethnic minority and disabled people by enshrining in law the full right to equal pay for ethnic minorities and disabled people”, thereby making it easier for ethnic minority and disabled people to bring equal pay claims where they have been underpaid. The Government also proposes to introduce mandatory ethnicity and disability pay reporting for employers with 250+ employees.

The Government say the changes will be a significant step towards its aim of delivering the “biggest upgrade to workers’ rights in a generation”.

Our team will be available to advise on these changes as and when we have more detail. Please do not hesitate to get in contact with a member of the team if you require assistance.

On 17 July, as part of the King’s Speech, the new UK Labour Government announced its plan to introduce the Digital Information and Smart Data (DISD) Bill.

Generally, the DISD Bill is aimed at improving access and sharing of data in general in order to benefit public services and public protection. This comes after the lapse of the Data Protection and Digital Information Bill which could not be completed at the end of the “wash-up” period before the dissolution of Parliament under the previous Conservative government.

In the Labour Party’s manifesto, the party made no specific mention to the data protection landscape in the UK. However, it did state that to “kickstart economic growth” it will “ensure [its] industrial strategy supports the development of the artificial intelligence (AI) sector, removes planning barriers to new datacentres.” The party stated it “will create a National Data Library to bring together existing research programmes and help deliver data-driven public services, whilst maintaining strong safeguards and ensuring all of the public benefit.” The concept of the National Data Library has been backed by a number business groups and MPs with a recent report by Onward (a non-profit thinktank) said a British data library would allow start-ups and scientists to easily access the data needed to build AI models, attracting talent and investment to Britain.

In a nutshell, the DISD Bill aims to:

1. Establish Digital Verification Services – to support the creation and adoption of secure and trusted digital identity products and services from certified providers to help with things like moving house, pre-employment checks, and buying age restricted goods and services.
2. Develop a National Underground Asset Register – a new digital map that revolutionises the way that pipes and cables transferring data are installed, maintained, operated and repaired. This is to give planners and excavators standardised, secure, instant access to the data they need, when they need it, to carry out their work effectively and safely.
3. Set up Smart Data schemes – to securely share customer’s data upon their request, with authorised third-party providers.
4. Make changes to the Digital Economy Act – to help the Government share data about business that use public services. This includes an electronic system for the registration of births and deaths and apply information standards to IT Supplier in the health and social care system.
5. Allow scientists to make better use of personal data – Scientists will be able to ask for broad consent for areas of scientific research and allow legitimate researchers doing scientific research in commercial settings to make equal use of the data regime.
6. Strengthen the ICO’s powers and target reform to some data laws – it will be transformed into a more modern regulatory structure, with a CEO, board and chair with new, stronger powers. This will be accompanied by targeted reforms to some data laws that will maintain high standards of protection but where there is currently a lack of clarity impeding the safe development and deployment of some new technologies. It will also promote standards for digital identities around privacy, security and inclusion. The DPDI Bill aimed to do the same.
7. Establish a Data Preservation Process – to enable coroners (and procurators fiscal in Scotland) to initiate when they decide it is necessary and appropriate to support their investigations into a child’s death. This will help coroners get access to online information they need when investigating a child’s death. For example, seeking copies of personal data from social media companies to investigate a child’s death further in relation to suicide. This complements the Online Safety Act and the fact that data protection rights only apply to living people.

It is clear that a complete reform of the UK’s data protection framework is not yet a priority for the new Labour Government. As such, this DISD Bill may come as a relief to those who were dubious about how the DPDI Bill would impact its current adequacy status from the EU given the importance of free-flowing personal data transfers between the two. However, this new government in power has not ruled out a reform of current UK data protections and its mention of “targeted reform to some data laws” gives the impression that it will explore data protection more widely in due course. Data practitioners will keep a close eye on this given the sunset clause which strictly limits the duration of the adequacy decision deadline to expire four years after its entry into force, i.e. 27 June 2025. After that period, they will only be renewed if the UK continues to ensure an adequate level of data protection.

If you would like to keep up to date on the latest in data protection, please get in touch to subscribe to our newsletter, The Data Download.

Click here for the King’s Speech 2024 briefing notes.

Last month, we hosted a panel event on the use of AI in Financial Services in conjunction with UK Fintech Week. Partner and leading AI expert Emma Wright led the panel in a varied and interesting discussion about the current state of play as well as outlooks on the future of AI in the financial services industry. Here we touch on four key themes that came out of the discussion in a bit more detail.

1. High Risk AI Systems

The AI Act takes a broadly risk-based approach to the monitoring and governance of AI systems, with those deemed to be the highest risk banned completely, and those deemed to pose the least risk having the fewest additional compliance requirements.

Fintechs and other financial institutions should start reviewing and classifying the AI systems that they use ahead of the AI Act coming into force, as those categorised as “high risk” attract the most significant compliance burden. Whilst a lot of these requirements will not be unfamiliar to financial institutions used to dealing with a heavy regulatory load, there are requirements unique to the AI Act, such as informing the provider or distributor of risks and incidents, and keeping and monitoring automatically generated logs. Furthermore, for those companies operating within the financial services sector but falling outside of the scope of a lot of the existing regulation and oversight, a lot of this will be new.

Those fintechs and other financial institutions operating in or providing services relating to assessing creditworthiness as well as pricing and risk assessments in life and health insurance are most likely to be utilising high risk AI systems. In addition, all companies should be mindful of deploying AI systems intended to be used in the recruitment or candidate selection process, including to place targeted job adverts, to evaluate candidates, and to analyse and filter job applications, which may also be considered high risk.

2. Garbage in, garbage out

Whilst the AI Act has a focus on the use case(s) of the relevant AI system when classifying risk, another point that was raised by all our panellists is that the use and the output of any AI system is only as good as the input to that AI system, or in other words the data that has been used for its training and validation. An AI system can have an incredibly sophisticated algorithm, but if the input data is poor quality then the output will likely be poor quality as well.

Data can be poor quality in a number of different ways, from inaccurate and inconsistent, to outdated, irrelevant for the particular use, and incomplete. All of these factors can significantly impact the output of AI systems in different ways leading to incorrect results, bias and discrimination. If the AI system is further trained on the results it produces then this will serve to compound the problem.

This is obviously not unique to the financial service sector, but due to the existing significant regulatory framework applicable to the sector, the size and importance of the sector, and the potential consequences of poor data input and therefore output, it is particularly prescient.

3. Consumers

A key feature of a lot of the financial services industry is the vast number of consumers accessing and using key services every day and consequently the volume of consumer data that is stored and generated. For regulated firms, the FCA’s Consumer Duty is relevant when it comes to deploying AI systems. For example, the duty requires firms to take into account the different needs of their customer base, including vulnerable customers as well as those with protected characteristics. “One size fits all” AI systems will not necessarily allow for compliance with this, so firms will need to think carefully about how their targeted use of AI can help them to achieve this nuance, and this also links to the issue of data quality discussed above.

When it comes to consumer personal data, firms are by now used to the requirements of data protection legislation. Fintechs and other financial institutions will need to think about how these requirements manifest when deploying AI systems – in particular, transparency obligations to consumers in terms of how their personal data is being used and for what purpose, allowing consumers to exercise their data subject rights, ensuring that impact assessments are completed where appropriate, and aligning the use of AI with the rules relating to decisions made by so-called “black box” algorithms.

4. Operational Resilience

As AI systems develop and mature, the likelihood is that such systems will become more embedded within the functions of the financial services sector, which will in turn become more reliant on such systems and their creators and distributors.

The general trend with other IT products, services and systems, such as cloud, has been a movement away from developing in-house capabilities towards outsourcing to third parties, a trend which we are likely to see replicated with AI. In 2021, the Financial Policy Committee concluded that “the increasing reliance on a small number of [cloud and other critical providers] for vital services could increase financial stability risks in the absence of greater direct regulatory oversight of the resilience of the services they provide”, a statement which could equally be made in respect of the use of AI.

With outsourcing in financial services expected to increase, and a concern from regulators that such outsourcing could be concentrated within the hands of a few big players in the market, a focus on operational resilience not only in the financial services sector but also the outsourced providers is crucial. This is already playing out in a number of new regulatory proposals and legislation coming into effect, including the Digital Operational Resilience Act as well as the Critical Third Party monitoring regime in the UK. Fintechs and financial institutions deploying and using AI systems as well as those entities developing and distributing AI systems will need to be cognisant of these requirements.

In order to receive updates from Harbottle & Lewis, and to receive invites for our remaining AI event series, please sign up here.

More than 22 million viewers have watched dark comedy-drama Baby Reindeer since it launched on Netflix on 11 April 2024. Much of the show’s tension, and no doubt success, derives from the fact that it is based on a true story. The show follows Donny, a stand-up comedian, who is stalked by an obsessive middle-aged woman called Martha, and subjected to severe sexual abuse by his mentor, a successful older writer called Darrien. The show has been written by Richard Gadd, who plays Donny, and dramatises the real-life trauma suffered by Gadd at the hands of his stalker and abuser.

Gadd has been open in interviews about the fact that the events depicted are based on his own experiences. Details have been changed in the show to protect the identities of his stalker and abuser but the weeks since its release have seen frenzied speculation online about who these individuals could be. The speculation became so bad that last week Gadd took to Instagram to try to calm things down, saying that people he loves and admires were “unfairly getting caught up in speculation. Please don’t speculate on who any of the real-life people could be. That’s not the point of our show.” Despite this, the woman who allegedly stalked Gadd has now identified herself, challenging the show’s depiction of her and claiming that she is considering legal action.

Jigsaw identification

Even where names are changed to avoid identifying real-life individuals, there is a risk that different, accessible pieces of information can be pieced together to reveal a person’s identity. This process is known as jigsaw identification and is defined as “the ability to identify someone by using two or more different pieces of information from two or more sources – especially when the person’s identity is meant to be secret for legal reasons.” In the case of Baby Reindeer, for example, viewers have been trying to piece together the project Gadd was working on at the time of the alleged assault by his mentor to work out the alleged abuser’s identity. This has led to several names in the screen-writing world being circulated online with potentially damaging implications. In the case of the woman on whom Martha is based, it seems she has been identified partly from the use of real emails and social media posts sent by her to Gadd and referred to in the show.

Defamation and privacy

For any production based on real-life events there will be a risk that the depiction of the individuals may be defamatory if they can be identified. A person may have a claim in defamation if they can show that they were identifiable as the person in question, and that serious harm has been caused to their reputation as a result. Of course, the programme-makers may have a number of defences available to any defamation claim, including truth, honest opinion and/or public interest.

Similarly, a person may have a claim in privacy if they can show they were identifiable and that the portrayal of them breached their right to privacy. In such a case the programme-makers would need to show that the right to freedom of expression and/or public interest outweighed the individual’s right to privacy. In relation to both defamation and privacy issues, whether any claim is likely to succeed will turn on the facts of the case.

Mitigating the risk

There are several ways to mitigate the risk of jigsaw identification where there are concerns around defamation and/or privacy issues. In addition to changing the person’s name, it may also be worth changing their age, the chronology of events, the location where the events took place and the date the events are set. Consideration should be given to how an individual might be identifiable from other information in the public domain and ultimately a balance must be struck between telling an effective story and mitigating against the risk of a potential defamation claim.