UK Data (use & access) Protection Bill 2023

1. Introduction

To update and streamline the laws relating to digital information and data protection in the United Kingdom, the Data Protection and Digital Information(No.2) Bill was introduced in 2023. This legislation has significant provisions regarding the abuse of personal information and its utilisation, such as synthetic media including deepfakes, although it doesn’t specifically deal with deepfakes.

2. Scope of the law

The bill governs the processing of personal data, including biometric visual similarities that are widely used in deepfakes. It addresses indirectly harmful synthetic media, specifically when it involves processing or identity abuse of personal data without consent. It appeals to sharing and creation, where data is being undermined. Exceptions can be processed for academic, artistic purposes, or journalism when it is in the public interest.

3. Key Provisions

• Forbidden Conduct: Under the bill, it is unlawful to apply personal information “unlawfully or unfairly” without justification by law(Clause 3). Use of deepfakes engaged in by identifiable individuals against their will may contravene these terms.
• Consent Criteria: In the absence of another basis for lawfulness, consent is necessary. The Bill sustains GDPR-type consent arrangements whereby people must be made aware and given clear permission for data use.
• Platform Obligations: While not specifically addressing deepfakes, the bill imposes obligations on data controllers for accuracy, transparency, and compliance with data subject access requests.

4. Penalties and Enforcement

The bill is enforced by the Information Commissioner’s Office(ICO). Serious violations, such as GDPR, fines of up to €17.5 million, or 4% of yearly global revenue. For harm brought on by the misuse of personal data, people may also seek civil remedies.

5. Notable Cases or Precedents

There are no guidelines on light UK cases specifically under this Bill of Deepfakes as of early 2025, but there was guidance from the ICO cautioning against synthetic media fulfillment.

6. Global Comparison

The UK bill is less direct than the EU’s AI Act or the U.S. states’ for deepfakes legislation, while having a good data protection template that can indirectly address malicious deepfakes.

7. Operational Implications

Producers need to refrain from using recognizable personal information, such as likenesses, of people without first seeking their permission.

8. Future Outlook

There is still debate about broader legislation, especially about  synthetic media and AI-generated impersonation, especially individual rights and elections.