Data (Use and Access) Act 2025

As well as the child abuse imagery offences, sharing or threatening to share an intimate deepfake of anyone is now a crime.

The Data Use and Access Act of 2025 made creating one, or asking someone else to create one, an offence too.

The Crime and Policing Act of 2026 also includes measures against the nudification tools themselves.

Although some parts are still being brought into force, the law will keep moving.

Let's see where it goes with this next investigation.

And finally, we're staying with the ICO because, well, actually we're not, because on 30th September, the Information Commissioner's Office will become the Information Commission under the Data Use and Access Act of 2025.

Powers that sat with a single Information Commissioner passed to a board with seven newly appointed non-executive directors.

Its regulatory functions will stay the same and it will still be known as the ICO.

Now, that might seem like a small change, but I'll explain what that means in a second.

So this is as a result of the Data Use and Access Act 2025, which abolishes the corporation sole of the information commissioner's office.

And that is an arrangement that vested every power in one named individual and hands the functions to a board of seven non-executive members appointed back in July.

Regulatory powers and responsibilities carry over unchanged, according to the press release.

I think they work together quite closely on a lot of things and collaborate on a lot of things.

And then you saw that in the Data Use and Access Act with the Annex 1, the Recognised Legitimate Interest Lawful Basis.

That was really interesting for the education sector.

I think, you know, I think we talked about this at the time and I think a lot of the sector civil isn't much to see here, but it was really good news for us in terms of the Recognised Legitimate Interest Act.

Now, the other bit of news in this area this week, the Comms Council UK, or the CCUK, in collaboration with Ofcom, the Home Office, and the ICO, that's the Information Commissioner's Office, has published joint guidance titled Sharing Data to Tackle Fraud, Guidance for Telecoms Providers, and that is designed to establish clear mechanisms for intelligence sharing across the UK communications sector.

Designed for providers of all sizes, the guidance addresses common regulatory misconceptions by emphasising that UK data protection laws including the UK GDPR, the Data Protection Act 2018 and the Data Use and Access Act 2025 do not constitute a default barrier to sharing information as crime prevention is explicitly recognised as a legitimate interest.

publication provides practical decision flowcharts, proportionality tests and operational due diligence expectations designed to encourage providers proactively to share minimised fraud data with law enforcement, financial institutions and specified anti-fraud organisations such as CFAS and the TUFF.

Now let's turn our attention to some market abuse news.

So talk a little bit about what the different parts of it are.

And one of these is the Data Use and Access Act, which if you're involved in data protection or other data type activities you may know about.

And essentially what this does is it replaces the old article 22 of GDPR, which dealt with automated decision making.

And of course, in the context of AI, automated decision making is a really key thing when you're talking about personal data.

Bereaved mother Ellen Room, who lost her 14-year-old son... launched a campaign urging for a change in the law mandating that parents can access their child's social media data for the 12 months before their death.

Her campaign resulted in the passage of the Data Use and Access Act 2025.

Pressure groups can make use of e-petitions.

The End Period Poverty campaign began with an e-petition to scrap the tampon tax and resulted in the scrapping of VAT on sanitary products.