The UK’s new Data (Use and Access) Act (DUA Act) heralds a significant shift in the UK’s data protection landscape, presenting both opportunities and challenges for marketers and potentially even reshaping the marketing sector.
The DUA Act builds upon the groundwork laid by the previous Data Protection and Digital Information Bill (DPDI Bill) and aims to modernise data protection regulations in response to evolving digital landscapes.
Similar to its predecessor, the DUA Act seeks to strike a balance between protecting personal data and fostering growth and innovation. The changes come at a critical time, as industries, including the marketing and advertising sector, navigate a seismic shift in the business environment caused by rapid AI adoption.
The DUA Act promises to offer greater flexibility for marketing teams, particularly when it comes to cookie consent and the use of legitimate interest. However, for brands this means they need to consider how to effectively navigate this evolving regulatory landscape while maintaining a robust, data-driven marketing approach.
Clarifying legitimate interest
One of the most impactful changes in the DUA Act lies in a seemingly minor textual adjustment. Recital 47 of the GDPR, which acknowledges marketing activities as a legitimate interest, will be incorporated directly into the main body of the law. This subtle alteration carries profound implications for marketers.
By enshrining legitimate interest as a lawful basis for marketing within the primary legislation, the DUA Act aims to provide marketers with greater flexibility in engaging with consumers. This effectively reduces the need for repetitive opt-in requests, taking away a significant administrative burden for marketers and allowing them to focus on enhancing consumer interactions.
This new Act provides clear language endorsing legitimate interest as a legal ground for most marketing activities. With this confirmation, organisations can bypass the restrictive consent model, giving them greater clarity when using data for activities like direct marketing and measurements.
Simplifying cookie consent
In addition, the Act also aims to simplify cookie consent requirements, potentially allowing the use of analytics cookies without user consent. This change could streamline the process for marketers, making it easier to collect and analyse data.
Under current rules, brands are forced to switch from an opt-out to an opt-in model for cookies – a change that reduces the collection of third-party data. This Act will provide a more flexible approach, allowing them to reduce disruptive consent pop-ups.
The Act aims to reduce ‘consent fatigue’ by proposing to relax consent for certain ‘low risk’ cookies. This applies to cookies used for collecting statistical information for website improvement, i.e. analytics, as well as cookies used for optimising content display and user preferences.
This will allow marketers to gain valuable insights without the constant friction of consent banners, creating opportunities for more targeted and personalised marketing campaigns. The relaxed restrictions could also enable greater use of AI and machine learning for marketing automation and personalisation.
Competitive advantage over the EU
This legislative shift represents a significant departure from the more stringent consent-based approach favoured by the EU, potentially granting UK marketers a competitive advantage, and potentially positioning the UK as a more business-friendly environment than the EU.
While UK lawmakers see legitimate interest as a viable pathway for marketing, EU regulators appear to be leaning towards a stricter consent-based framework, as evidenced by their latest guidelines.
This divergence could create a competitive edge for UK brands of all sizes. The increased flexibility offered by the DUA Act could enable businesses to implement more targeted and effective marketing campaigns, driving growth and innovation. However, it’s important brands still carefully consider data governance practices, ensuring transparency and accountability in data processing activities.
Brands should also prioritise transparency and accountability in their data processing activities, helping them build trust with consumers by demonstrating compliance with the relevant laws and regulations. Marketers will need to ensure that opt-out mechanisms are easily accessible and user-friendly.
Now that the DUA Act has passed through Parliament, UK marketers need to proactively prepare for the impending changes. This should involve a comprehensive review of existing data governance practices, ensuring that it aligns with the new regulatory framework.
The Act could well reshape the marketing landscape, offering both opportunities and challenges for brands. Embracing the flexibility offered by the new legislation, while maintaining a strong commitment to data privacy and ethical practices, will allow marketers to navigate the latest regulation while still driving sustainable growth in the age of AI.
Sachiko Scheuing is European privacy and AI governance officer at Acxiom.
Read more
Do you know your data protection responsibilities? – Christian Nellemann offers advice to your business on how to stay on top of protecting your data
