Category Archives: legislation

Ignoring the role of time in Data Governance

The words we use to define data

In the 2021 Defend Digital Me report, The Words We Use in Data Policy: Putting People Back in the Picture, we examined why public conversations about personal data often fail. We highlighted the need for systemic changes in how we talk about data to better account for children’s data within the UK’s national data strategy. A central issue is how we think about data—often seen and framed through misleading metaphors. Metaphors like ‘flows,’ ‘footprints,’ or ‘traces’ influence public opinions and policy but oversimplify governance challenges. These framings profoundly affect views on what should be done with data. This matters as the Data Use and Access Bill in Parliament seeks to rewrite UK data protection law, threatening to undermine public trust in administrative data just as AI companies and others lobby for increased access.

Data as language, not a commodity

But imagine instead that data is not a fixed entity or commodity; it is more akin to language telling the story of your life. Data, turned into information, conveys meaning, which varies by source, user, context, and time. Misinterpreting or ignoring these dimensions leads to poor governance and flawed decisions. Data’s characteristics and value are ephemeral and interpersonal. Like Dr Louise Banks in Arrival, policymakers must recognise that UK data governance requires a multidimensional approach to understanding what data is—not just substance, but traceability, context, and meaning across the data life cycle. We need to talk more about the dimension of time in data governance laws.

The Time Dimension in Data Governance

Time reshapes data governance, affecting its accuracy, personal nature, and user relationships. Personal data may shift between personal and non-personal depending on context, use, and linkage over time.

  1. Personal Data Over Time
    Data can simultaneously be personal or non-personal depending on who holds it and what it is combined with. What identifies an individual in Dataset A may not identify another without access to Dataset B but while I hold A and you hold both A and B, then it is only personal data to you. Over time, data’s ‘personal’ characteristic may shift to include me depending on its use or linkage or breadth of access or leaks and more.
  2. Accuracy and Completeness
    Data degrades over time. For instance, a “current address” loses accuracy when someone moves house. But changing systems—such as updated postcode formats to give a new one to the same property or new categorisations (e.g., introducing “White Northern Irish” into a population that may have previously selected “White British” in a census)—can undermine past data’s comparability and completeness. More importantly, how would you know and how will AI systems know if we have no context, no life-cycle ROPA, and give up enforcing the importance of this?
  3. Children’s Data and Vulnerabilities
    Special protections for what is labelled “children’s data” in law raises questions: Do these protections apply only at the time of collection because the person the data is about is aged under 18, or do they persist as a characteristic of the data even after the person it is from, ages into adulthood? The concept of a “clean slate,” as proposed by the High-Level Expert Group on AI (HLEG), goes some way to solving this issue. However, current practices fail to provide such safeguards that the original GDPR deemed necessary. Failures of which, are demonstrated in the National Pupil Database as the prime case study over time.
  4. Evolving Definitions and Legal Changes
    Policy shifts, such as the UK’s Data Use and Access Bill, can change how data is categorised and handled over time by recategorising it as of the law’s commencement date. Such changes affect its characteristics and governance.

Why lifecycle governance matters

Data governance is a constraint on the imbalance of power beyond the lifetime of the data itself and the relationship between the data subject and their user. European data protection laws, rooted in human rights principles, emphasise lifecycle governance. Concepts like data minimisation, retention limitation, and respect for data subject rights ensure that the relationship between individuals and data users remains dynamic and accountable.

The point of data collection is not to produce the KPI, or the report, or benchmark, or even to follow the money in delivery of a public service. The point is the delivery of a public service. Public administrative data collected on the side is a by-product, often opinion based, in the process. Statistical data may follow standards and a review process. Much of the rest of public admin data may not. A return might suggest 100% completion but that is no measure of accuracy. When public policy deifiesthe product” of data as AI, we focus on the wrong end of the process. Data about public administrative services is a set of contextualised inputs, a dynamic and interpretive representation of public-service delivery and the person’s life it involves, not fixed outputs with fixed characteristics or quality. The person must be kept in the picture in a continuous governance process. Engagement in public service delivery must not end when someone walks out the door, if their data continues to be processed.

We must ensure any public policy or AI creating inferences of meaning are built only on data that are correct, and used within the context in which the meaning intended at source is valid over time.

This is a critical period in which AI companies and others are lobbying hard for more access. Ignoring the role of time in data governance avoids accountability for the problems of data quality and contextual collapse, but will mean datasets that are not fit for purpose will become the foundations for public policy, or for building AI to use or to export. Carnegie UK’s research offers a sobering reminder: poorly designed systems can waste taxpayer money, erode public trust, and fail to deliver promised benefits.

Let’s talk more about the exercise of traceability, context, and meaning across the personal data life cycle. We need to talk more about the dimension of time in data governance laws.

The Deregulation Bill – Episode III : Regulate, what with?

Regulation, the use of regulatory powers and the authority to oversee them, are in flux in England.

Some will have lesser discussed, but long term, wide ranging effects such as the regulatory framework and requirement for profit in almost all public bodies.

A significant amendment [1] appears to have been proposed by Lord Hunt of Kings Heath on 9th Jan, 2015 in the Deregulation Bill [2]. The next discussion date of which seems to be provisionally scheduled for February 3rd and 5th.

The amendment proposes the removal of ten regulatory functions in health and care, from the requirement to exercise the clause of considerable concern, renamed from clause 83 to clause 88: the statutory duty towards a desirability to promote economic growth.

My last post in November on this clause was after the debate in which Lord Tunnicliffe concluded:

”if our fears comes to pass, these three clauses could wreak havoc in a regulatory regime within this country.”

Later  he asked:

“are these new clauses a licence for regulators to approve regulations that kill people to save money?”

Clause 88: background on the clause to ‘promote economic growth.’

Almost a year ago, in February 2014, [3] MPs had discussed this same clause in its passage in the House of Commons.

MPs were asked to support a reasoned amendment tabled by Caroline Lucas, Jonathan Edwards, John McDonnell and Jeremy Corbyn MPs.

They proposed the removal of the clause, requiring the desirability for economic growth, and they had concerns:

…”that this Bill represents a race to the bottom and an obsession with GDP growth at any cost which is not in the public interest.”

(my underlining):

[…]”the Health and Safety Executive, which is irresponsible and risks undermining their core roles; further considers that this Bill is another illustration of a Government which is embarking on a deregulatory path without due consideration of warnings, including from businesses, that effective regulation is essential to create jobs and innovation and that ripping up vital green legislation risks locking the UK into polluting industrial processes for decades to come, jeopardising future competitiveness, damaging the UK’s attractiveness for green investment, and undermining new industries.”

This clause must be reviewed thoroughly and transparently from scratch. If indeed these ten bodies are to be considered for exclusion from the clause there must be a detailed case of why. This leads automatically to ask for the benefits to justify the inclusion of others. If this has not been made transparent to the Lords debating the clause by now, then the bill should not pass as is without reasonable justification.

Is there an MP or Lord who will gladly take the responsibility to say:

“I agreed to a new law, the consequences of which I was not clear, but I did not ask the questions I should have done. I ignored that Lord Tunnicliffe asked: “are these new clauses a licence for regulators to approve regulations that kill people to save money?” And I did not examine why this might be for each and every function of regulation it affects.”

Based on what decision criteria and based on what measures or public interest test has this department area been selected for exclusion and others, such as the environment, been omitted?

Considering the reported opinion of the Bill’s proponent Oliver Letwin MP to the NHS it sould seem wise to ask, what kind of National Health Service do our MPs expect to see in future under this new model of statutory requirement to seek profit.

In conclusion:

Is the bill designed to future-proof regulatory common sense or set it up for widespread failure from the start?

In the words of Lord Tunnicliffe:

“The problem is the clauses themselves. Clause 83(2) states that:

‘the person must … consider the importance for the promotion of economic growth of exercising the regulatory function in a way which ensures that … regulatory action is taken only when it is needed, and … any action is proportionate”.

“Those words by themselves seem a pretty high test for a regulator. As I tried to illustrate, our lives are made acceptable and benign by regulators acting pretty well as they do at the moment to protect us. So are these new clauses a licence for regulators to approve regulations that kill people to save money?”

It should be made very transparent what bodies will be affected, why, how the decision making in each function will be carried out and what with? At national or local level ruling authority?

Clearly there is still work to be done to ensure that the implications in the public interest. That ethic seems to have been lost at the back of the vast cupboard of all that the deregulation bill has in store.

Alongside the changes to the sale of liqueur chocolates and weights and measures for knitting yarn we have lost something much greater in the Deregulation Bill.

However this amendment suggests there is new hope coming for the proposed change to regulatory powers and their profit making; that in fact, some significant bodies may be made exempt of this duty on a statutory footing.

Now the case should be made why any public bodies should not be.

Simply, the wider Public Interest must come first, above profit.

Perhaps when one hears calls to ignore criticism of these proposals of deregulation in this bill and in TTIP one would do well to ask why.

Anything else could be as disastrous for society, as the Poll Tax is now accepted to have been for Margaret Thatcher.

But perhaps, some would maintain, there is still no such thing?

*********

For those with more in depth interest:

Further detail; below I continue and review the amendment,  wider implications at local authority level, changes in the future landscape of health and social care and why it could be of significant negative impact on political and social trust.

This is my update on two previous posts; Part one: October 4th, Deregulation Bill Clause 47 and the back door access to journalist sources and Part two: the Deregulation Bill Clause 83 from 6th Nov with additional notes on Nov 21st.

It continues with Part four to follow: The Deregulation Bill: Part IV New Hope for Regulatory powers?

*****

The amendment

Here is what it looks like:

 Page 70, line 29, at end insert—“( )     This section does not apply to the following—
 

(a)   Care Quality Commission,

(b)   Human Tissue Authority,

(c)   Medicines and Healthcare Products Regulatory Agency,

(d)   Professional Standards Authority,

(e)   General Medical Council,

(f)   Nursing and Midwifery Council,

(g)   Health and Care Professions Council,

(h)   General Chiropractic Council,

(i)   General Dental Council,

(j)   General Pharmaceutical Council,

(k)   Human Fertilisation and Embryology Authority, and

(l)   any persons exercising a regulatory function with respect to health and care service that the Secretary of State specifies by order.

( )     An order under this section must be made by statutory instrument.

( )     A statutory instrument containing an order under this section may not be  made unless a draft has been laid before, and approved by a resolution of,  each House of Parliament.”

What would the amendment change, if they become law?

These exceptions are specific to healthcare and, it remains to be seen if they will be adopted.

There is also some provision, to make further special cases for the health and care service more broadly, that the Secretary of State specifies by order.

This addresses some organisations in the regulation of health and care.

But it opens up the question more clearly why should other bodies be included? Where is the benefit – and where is the cost and risk analysis?

That would be a most welcome discussion in the public interest. Some professionals and professional bodies have already flagged their concern.

The Equality and Human Rights Commission is one example, that was discussed in the last debate andthe ECHR response to it. [4]

Nov 21st update:  see Column GC229 < and whilst verbal assurances were made, it appears nothing changed in the Bill, and that the EHRC said in response:

“While we welcome this undertaking we understand that this doesn’t mean that we’ll be removed on the face of the Bill”.

The ECHR clearly sees it as detrimental and asks for change. Will the government ride roughshod over professional opinion without transparent and thorough justifications of the need for this?

If so, it seems an extraordinary dismissal of democracy.

Other bodies should take the lead from the EHRC and make their positions clear in the public domain now, or risk future backlash once the impacts become clear.

What wider impact will this amendment have?

At first the effect appears to be that a significant number of health related bodies could be freed from the duty to make a profit.

At national level this seems a welcome and sensible step.

To decide which bodies should and which bodies should not be exempt it must be very clear exactly what impact these changes will have.

 

For each body involved, an impact assessment table should be drawn up – what do they regulate, how, why and what would change under the deregulation bill and the effects of its clauses, especially 88. Risks and benefits.

 

That would help understand today’s position.

 

The next step is to understand the future implications. Identify which bodies will be deregulated by it in future, why and how they will be affected by other aspects of the bill.

However it’s not the whole story.

How these bodies perform their tasks at national level and how far down their powers reach will affect the organisations below them.

These lower branches of organisational structure also need to be understood for any regulatory implications. How that function is carried out under what powers needs to be clear at what point the removal of the requirement would have an effect.

These ten bodies are in health and social care. The future of health seems to be bound to social care and in Simon Stevens’ vision, with ever more physical, as well as financial mergers.

 

In an interview with the Financial Times: he predicted ‘a blurring of the [lines] that exist between different public services’.He said:

Basing my understanding on CCG meeting attendance, reading ADASS minutes and general media news. it appears pooled budgetary responsibility will call for a shift in more responsibility to local authorities.

 

Is it therefore logical to assume that will include the responsibility for regulatory functions?

 

Any changes therefore at national level in terms of organisational structure or regulatory responsibility will have an affect at lower levels.

 

So for an organisation of the amendment ten, taking the Care Quality Commission for example, it is not unthinkable that change is inevitable regardless whether they are in or out of this clause.

 

The CQC has come in for some criticism in recent months with media stories repeating failings. Mistakes were made, with significant media coverage, on the calculations of quality ratings of GP practices.

Questions were raised in November as to the extent of the reach of the CQC surveillance powers at practice level, reviewing individual patient medical records ‘to assess the quality of care provided by the practice’ without individual consent. Professionals on social media raised their electronic eyebrows and lamented the breach of confidentiality.

What deeper impact will this have?

What happens should the CQC powers be broken up at national level and carried out at local level instead needs to be examined.

The body having been made exempt at national level from this commercially driven clause, may find that the regulatory functions would be required to comply with it again at Local Authority level.

The reasons why the CQC should be made exempt, would therefore be lost in the transition, unless the special orders and special provision were made before any organisational restructure.

The timing therefore of new regulations would need to become integral to any departmental organisational change at any and every level of regulatory governance.

Instead of removing ‘red tape’ and bureaucracy in this bill, I foresee it adding a burden of analysis and requirement to assess and document responsibilities; determining whether or not the clause to promote economic growth should apply or not.

Its definition is so vague and its responsibility to be ‘proportionate’ so open, that in fact it is not assigned to anybody; which everybody knows,  means it ends up being done, by nobody.

Every time some any reorganisation is planned, the impact of this regulatory clause may need considered and not only in health and social care but in every aspect of regulatory function across government.

Every action a regulatory body takes, is by default ‘regulatory action.’ So any time the function should do its job, each and every time, every decision, every ruling, would need to consider the need for economic growth and if they need to act at all.

(a) regulatory action is taken only when it is needed,

and

(b) any action taken is proportionate.

Surely this is what they do already in every decision, and therefore why make it a statutory requirement at all – for any regulatory body?

If we don’t need it, why write it in. And if we do need it, what precisely is it intended to do, how and why?

I would encourage anyone who has not yet done so, to have a good look over the contents of the bill. It’s like an end of year sale and there is definitely something in there for everyone. The likelihood is high that some unforeseen damage will be done to the public interest in the rush to get it through in this term by government, akin to a Black Friday panic. The bills lined up to rush through the  last minute doors of parliament, seem to be queueing in droves.

For bodies which have regulatory functions today in health and social care at Local Authority level already, the hoped for reduction in harm through this amendment affecting their national level body, could fail to materialise.

The high-level  health and social care bodies may get “let off” the duty in explicit terms in the bill, but if the function is performed at another level, “on the ground”,  the requirement of the function will in effect still happen under-the-radar.
  
Here is at least a starting point to go deeper into who regulates what at local authority level. [6] Imagine each and every regulatory function trying to consider the importance for the promotion of economic growth of exercising  the regulatory function in a way which ensures that —

(a) regulatory action is taken only when it is needed,

and

(b) any action taken is proportionate.

How will as another example, the local government ombudsman make a profit but not put that before the people it serves?
In this case their role is managing complaints about councils and some other authorities and organisations, including education admissions appeal panels and adult social care providers. How does one justify exploiting that, for profit?

 

With purdah and the general election drawing near,  this may be a question with an unpredictable answer for many organisations if their future structural model is uncertain.

 

The backdrop

 

There are various other bills in progress to do with regulation, which involve communications and data, and by implication, potentially journalists’ sources. They are also affected by clause 47 in the deregulation bill which the NUJ protested in 2014. [more in my next post].
A press free from political control and undue regulation is something to be held dear, and indeed Guido Fawkes has experienced this week. attempts to control it, by the Electoral Commission:

 

“Guido has no intention of registering with the Electoral Commission or reporting a penny of spending or anything else to them. This authoritarian law is a nonsense. If you read the guidance it should apply to newspapers. We haven’t just rejected statutory control of the printed press by one regulator for political control of digital media by another.”

Here we arrive at the nub of the issue: what is to be deregulated and why and by whom are fundamental to understand what effects these changes will require, and the demands the duty for economic growth will create.

I question: “Can this dramatic change, really be a wise and throroughly thought out course of action, when the only certainty in the affected organisations’ governance duties is that in fewer than five months, it may all change?”
Had all the background and assessments been done already, one would think it could be understandable to press on and complete. But the fact that this significant amendment has been proposed now, surely shows that an adequate cost benefit and risk assessment does not exist. Does it not exist only for these ten, or for all?

 

All sorts of areas of public interest are affected, with questions being asked on private tenancy changes to the very Electoral Commission itself.

 

In the run up to the election, will it be asked to become a profit driven  entity? – instead of prioritising its key focus, the regulation of our democratic processes:

 

“These roles and responsibilities outline much of the work we do in order to meet our objectives of:

  • well-run elections, referendums and electoral registration
  • transparency in party and election finance, with high levels of compliance”

How will the Electoral Commission  maintain neutrality if profit must drive the function as the regulator of political funding and spending?

That decision could have almighty and lasting effect on public confidence and our trust in the wake of the MP expenses scandals.

Without a publicly available clear cost benefit analysis, the overwhelming drive for profit in every sector of UK regulatory reach remains at best unclear.  The intended benefits or whether they will even create any efficiencies, never mind public gain, lacking.

At worst, “are these new clauses a licence for regulators to approve regulations that kill people to save money?”

****

Key references:

[1] Proposed amendment by Lord Hunt of Kings Heath in the Deregulation bill.

[2] The Deregulation Bill

[3] Hansard, February 3 2014, MPs propose removal of clause

[4] Hansard, November 20th 2014, ECHR comments included in Lords’ debate

[5] Public Health functions under Local Authority

[6]  Local Authority regulatory functions

********

List of The National Regulators – the ten bodies  above are those explicitly mentioned in Lord Hunt of King’s Heath’s amendment:

Animal Health and Veterinary Laboratories Agency (AHVLA)

Animals in Science Regulation Unit

Architects Registration Board (ARB)

British Hallmarking Council (BHC)

Care Quality Commission (CQC)

Charity Commission for England and Wales

Civil Aviation Authority (CAA)

Claims Management Regulation Unit

Coal Authority

Companies House

Competition Commission

Professional Standards for Health and Social Care (PSA)

Disclosure and Barring Service (DBS)

Drinking Water Inspectorate (DWI)

Driver and Vehicle Licensing Agency (DVLA)

Driving Standards Agency (DSA)

Employment Agency Standards Inspectorate (EAS)

English Heritage (EH)

Environment Agency

Equality and Human Rights Commission

Financial Reporting Council (FRC)

Fish Health Inspectorate (FHI), Centre for Environment, Fisheries and Aquaculture Science (Cefas)

Food and environment research agency (plant and bee health) and (Plant Variety and Seeds)

Food Standards Agency (FSA)

Forestry Commission

Gambling Commission

Gangmasters Licensing Authority (GLA)

General Medical Council

General Chiropractic Council

General Dental Council

General Pharmaceutical Council

Health and Safety Executive (HSE)

Higher Education Funding Council for England (HEFCE)

Highways Agency (HA)

HM Revenue and Customs (Money Laundering Regulations and National Minimum Wage)

Homes & Communities Agency (HCA)

Human Fertilisation and Embryology Association (HFEA)

Human Tissue Authority (HTA)

Information Commissioner’s Office (ICO)

Insolvency Service including Insolvency Practitioner Unit

Intellectual Property Office (IPO)

Legal Services Board (LSB)

Marine Management Organisaton (MMO)

Maritime and Coastguard Agency (MCA)

Medicines and Healthcare Products Regulatory Agency (MHRA)

Monitor

National Measurement Office (NMO)

Natural England

Nursing and Midwifery Council

Office of Communications

Office for Fair Access (OFFA)

Office for Nuclear Regulation (ONR)

Office for Standards in Education, Children’s Services and Skills (OFSTED)

Office of Fair Trading

OFQUAL

Office of Rail Regulation (ORR)

Office of the Regulator of Community Interest Companies

OFGEM

Pensions Regulator

Rural Payments Agency (RPA)

Security Industry Authority (SIA)

Senior Traffic Commissioner

Sports Grounds Safety Authority (SGSA)

Trinity House Lighthouse Service (THLS)

UK Anti-Doping (UKAD)

Vehicle and Operator Services Agency (VOSA)

Vehicle Certification Agency (VCA)

Veterinary Medicines Directorate (VMD)

***

Please feel free to comment below or find me on twitter @TheABB