Labour government plans new laws around cyber security, data sharing and skills

Cyber security

The Cyber Security and Resilience Bill aims to “strengthen our defences and ensure that more essential digital services than ever before are protected”. It will expand the remit of existing regulations, give more powers to regulators, and impose new reporting requirements on businesses.

The bill aims to address supply chain attacks such as the recent incident at blood testing company Synnovis, which led to London NHS trusts that used its pathology services having to cancel more than 6,000 appointments.

It will also introduce mandatory reporting of ransomware attacks to help the government gather better information on the scale and type of threats UK organisations face. “This will improve our understanding of the threats and alert us to potential attacks by expanding the type and nature of incidents that regulated entities must report,” said the government, in the background briefing notes to the King’s Speech, published by 10 Downing Street.

Data sharing

The previous government’s proposed Data Protection and Digital Information Bill failed to be passed before the general election, but many of its measures have been picked up by Labour as part of a new Digital Information and Smart Data Bill.

The bill aims to “ensure we harness the power of data for economic growth, to support a modern digital government, and to improve people’s lives”.

The legislation will create a statutory basis for data to be used in digital verification services – such as digital identities and age verification services – and to support a National Underground Asset Register, which was first proposed in 2019. The register will create a digital map of buried pipes and cables.

The bill will also support the creation of smart data schemes, whereby customer information can be shared with authorised providers to develop new and innovative services. In effect, this extends the concept of open banking and is likely to be important for other areas of financial services as well as energy and telecoms companies.

The legislation will also make it easier for government departments to share data, introduce a digital system for registration of births and deaths, and determine IT standards for suppliers to the health and care sector.

As planned by the Tory administration, the bill will also reform the role of the Information Commissioner’s Office (ICO), with a new structure and greater powers. “This will be accompanied by targeted reforms to some data laws that will maintain high standards of protection, but where there is currently a lack of clarity impeding the safe development and deployment of some new technologies,” said the government.

Skills

A Skills England Bill will set up a new body, Skills England, which aims to “simplify and improve the skills system, ensuring the supply of skills needed for the economy and breaking down barriers to opportunity”. The IT sector has for many years struggled due to skills shortages in a number of areas, not least cyber security and AI.

The new organisation will work with employers, unions and education and training providers to develop a national picture of skills needs.

The bill will reform the much-criticised Apprenticeship Levy by broadening it into a Growth and Skills Levy, in support of the government’s planned Industrial Strategy.

Datacentres

The Planning and Infrastructure Bill aims to reform the planning system to “accelerate the delivery of major infrastructure projects”. Labour’s election manifesto highlighted the need to build more datacentres.

“We will simplify the consenting process for major infrastructure projects and enable relevant, new and improved National Policy Statements to come forward, establishing a review process that provides the opportunity for them to be updated every five years, giving increased certainty to developers and communities,” said the government.

AI safety

There was much speculation that the government would introduce new legislation to enable regulation of AI models, following on from the Conservative government’s focus on AI safety.

The King’s Speech said the government “will seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”. But there are no plans for AI-specific legislation, and the only mention of AI in the background briefing to the speech is as part of a Product Safety and Metrology Bill, which aims to respond “to new product risks and opportunities to enable the UK to keep pace with technological advances, such as AI”.

The wider bill is intended to improve product regulation and consumer protection, and recognises the impact of new technologies and the way that e-commerce has affected high street retailers.

“It will ensure the UK is better placed to address modern day safety issues, harness opportunities that deliver economic growth, and ensure a level playing field between the high street and online marketplaces,” said the government.

Hillsborough Law

The government intends to create a bill to enact the so-called Hillsborough Law that was called for as a result of the Hillsborough scandal. The new law will impose a legal duty of candour on public servants and public bodies to improve transparency and accountability.

The plan will be welcomed by victims of the Post Office scandal, where innocent subpostmasters were prosecuted using data from the flawed Horizon IT system, despite staff at the Post Office being aware of bugs that could have caused the accounting errors for which branch managers were blamed.

Reaction

Technology trade association TechUK welcomed the new legislation, but warned against proceeding too fast without industry consultation.

“There is a huge amount that industry and government will need to work through,” said TechUK chief executive Julian David.

“This will include close collaboration with industry as new laws on artificial intelligence and employment rights are drafted ensuring that we get the right balance between new laws and promoting the economic growth needed for the new Prime Minister to achieve his missions for government.”

BCS, the Chartered Institute for IT, called for greater information about the government’s plans for AI regulation.

“Most IT experts' concerns are not that AI is too powerful but that basic guardrails are not in place,” said BCS AI standards expert Adam Leon-Smith.

“There must be high professional standards to ensure AI is directed and developed by individuals who adhere to agreed measures of competence and ethics. We advise against focusing too narrowly on a handful of companies. By setting high standards within our profession, the UK can lead the way in responsible computing and be an example for the world.”

Think-tank the Social Market Foundation highlighted the challenges of keeping workforce skills up to date as technology advances.

“A simplified skills system, with better long-term planning, will be welcomed by employers emerging from recent years of instability and uncertainty,” said Dani Payne, senior researcher at the Social Market Foundation.

“However, developing a ‘single picture’ of national and local skills needs is not a small task, with technological advances liable to have rapid and unforeseen impacts on our workforce needs.”