Three New UK Laws Impacting Autonomous Vehicles, Digital Markets and Personal Data

On 7 November 2023, in the King’s Speech, the UK government announced three draft laws aimed at supporting tech companies’ growth and competitiveness: the Automated Vehicles Bill (AV Bill), the Digital Markets, Competition and Consumers Bill (DMCC Bill), and the Data Protection and Digital Information Bill (DP Bill). Expected to be passed in the next 12 months, these laws, as the government says, are focused on modernising regulation so that innovative firms can thrive in the United Kingdom, while at the same time protecting consumers and enhancing users’ trust in new technologies. The proposed comprehensive legal frameworks aspire to position the UK as one of the global leaders on the tech regulation scene, ostensibly more business friendly than the European Union. As anticipated, and in contrast to the EU, there is no immediate plan to adopt a new wide-ranging Artificial Intelligence law, with existing laws continuing to operate as applicable. Firms that want to invest in, deal with or deploy new technologies across the globe should be aware of the UK legal landscape in order to assess and explore opportunities. We highlight a few pertinent points of the three laws in this alert.

Self-driving Vehicles

The AV Bill will be one of the most comprehensive regulatory frameworks for self-driving vehicles globally, aimed at providing legal certainty and unlocking business confidence for further research, innovation and investment. The AV Bill is likely to implement the Law Commission’s recommendations resulting from its lengthy review of self-driving vehicle legislation and public consultation, which received responses from a wide variety stakeholders, including original equipment manufacturers, developers of automated driving systems and fleet operators, insurance providers, safety and road user groups, academics and other consultancy and professional organisations. The AV Bill was prepared against the background of calls for flexibility in the law, due to the fast evolution of the technologies in self-driving vehicles, as well as clear guidance in a technology-neutral way, focusing on outcomes rather than prescribing how the regulatory requirements should be achieved. The Law Commission’s recommendations also highlighted the need to maintain harmony with international regulations and with other policy areas such as connectivity, cybersecurity and infrastructure.

The proposal is that the AV Bill will include the following:

• Self-driving classification threshold: The AV Bill will establish a threshold for what constitutes a self-driving vehicle, whereby only vehicles that can drive themselves safely and can follow all road traffic rules without the need for a human to monitor or control the vehicle will meet that threshold.
• Meeting safety requirements: A new rigorous safety framework will be established, with obligations on companies in relation to safety requirements. Once authorised, companies will have ongoing obligations such as keeping the vehicles safe and reporting safety related data to the relevant authorities. There will be new sanctions and penalties, including fines, requirements to take corrective action, suspension of operation and criminal offenses in serious cases.
• Liability: Companies that develop and operate self-driving vehicles will have a range of responsibilities, including for the way the vehicle is driving itself. People will have immunity from prosecution when a self-driving vehicle is driving itself.
• Digital map of the road network: Legal orders made by the local authorities, such as on speed limits and close roads, will be sent to a central publication platform, which will be used to create a digital map of the rad network. This is aimed at supporting the safe operation of self-driving vehicles.
• Marketing restrictions: Only vehicles that meet the safety threshold will be able to be marketed as “self-driving”. For all other vehicles, the driver will be responsible at all times.

With the potential that self-driving vehicles have to improve road safety by reducing human error, the adoption of the AV Bill is intended to bring positive economic developments and efficiencies, as well as highlight the UK’s focus on high tech and high growth industries. The significance of the AV Bill is also based on its international impact, as the U.S. Congress has for some time attempted to pass legislation governing self-driving cars without success, resulting in uncertainty and risks for stakeholders who are faced with a myriad of state and local laws. It remains to be seen if the AV Bill, once adopted, would galvanise testing and operations of self-driving vehicles in the UK, and become a model law for other jurisdictions.

Digital Markets

Similarly, the DMCC Bill is aimed at introducing a world-leading regulatory regime in digital markets, focused on preventing anti-competitive activity and boosting innovation.

The draft DMCC Bill seeks to introduce:

• Designation of “strategic market status” and ensuing obligations on a limited number of big digital firms: The Digital Markets Unit (DMU) of the Competition and Markets Authority (CMA) will be given new powers to address what is phrased as the “far-reaching power of a small number of tech companies”. The CMA (through the DMU) will thus be able to designate digital firms, meeting the conditions laid down under the DMCC Bill, with “strategic market status” (SMS) and ensure such designated firms comply with tailored rules/“codes of conduct” on how they can treat consumers and other businesses. Via the introduction of a specific reporting obligation, designated firms will also be required to be more transparent about mergers and acquisitions which could potentially pose risks to competition.
• New penalties for designated firms: The CMA will have powers to make “pro-competitive interventions” and impose targeted remedies (both behavioural and structural) on firms designated as having SMS, to tackle the “root causes” of competition issues in digital markets. The regulator will also be allowed to enforce obligations on SMS firms and impose penalties of up to 10% of a firm’s global turnover, with director disqualifications of up to 15 years also being possible. That being said, the current expectation is that the CMA will first attempt to resolve any concerns through constructive engagement with the relevant firm before it seeks to utilise its enforcement powers.
• Other new powers for the CMA in order to tackle anti-competitive activity: A wide range of new powers for the CMA are proposed, including (i) the power to vary remedies that are not effectively solving problems and other powers enabling more efficient, flexible and proportionate market inquiries; (ii) stronger powers to investigate anti-competitive conduct, ensuring that agreements that harm the UK markets and consumers are prohibited, regardless of where the agreement was implemented; and (iii) greater powers to sanction companies that refuse to comply with investigations and remedies.
• Amending the merger review threshold: The DMCC Bill seeks to introduce a new alternative threshold for merger review (i.e., in addition to revising the existing thresholds), with the aim of ensuring that those transactions with the greatest potential to weaken competition in digital markets in the UK do not escape the CMA’s jurisdiction.
• Tackling growing consumer harms: Consumers will have more rights over subscription contracts which unfairly seek to lock them in. Fake reviews and drip pricing will also be targeted as unfair business practices.

The government states that the UK’s approach to regulating digital markets is more targeted and flexible than the EU’s, focusing on a limited number of firms, prioritising risk-based intervention according to the evidence of harms and creating bespoke remedies, whereas the EU approach is said to risk creating unnecessary burdens for too many firms and imposing a rigid set of rules.

Personal Data Protection

Also ostensibly presenting an alternative to the EU position is the proposed DP Bill, presented as a law which creates a more flexible data protection regime and encourages innovation in technologies such as machine learning.

The DP Bill proposals include the following:

• Protecting personal data in a more proportionate and practical way: The government intends to reduce unnecessary paperwork while maintaining high personal data protection standards, for example by providing greater clarity on what legitimate interests companies can rely on when processing personal data. The rules on automated decision making will also be amended, introducing new restrictions, safeguards and clarifications.
• New rules for “cookie pop-ups”: It is proposed that the rules around electronic communications and cookies will be amended by expanding the list of circumstances where cookies may be placed on devices without the individuals’ consent, thus reportedly aiming to remove unnecessary barriers for businesses.
• Enhancing trust in new technologies: A few proposals focus on enhancing consumers’ trust in new technologies. For example, the government wishes to establish a framework for secure digital verification services, which would aim for digital identities to be used with the same confidence as paper documents. Further, it is proposed that “Smart Data” schemes can be established, which will be designed to offer consumers greater control over their personal and customer data, by allowing them to authorise the sharing of their data to third parties authorised by them. Consumers would be able to share data about their usage patterns for a particular service with a third-party, and in return receive tailored recommendations of products and services which may better suit their needs.
• International data protection: The government is vocal about its desire to maintain the adequacy deal currently in place with the EU, while ensuring it is easier to strike new data bridges with other international partners such as the US.
• Strengthening the data protection regulator: The DP Bill will strengthen the powers of the Information Commissioner’s Office (ICO), including through ensuring it has capabilities and powers to better allocate its resources.

Digital personal data is used by almost all businesses, with 85% of UK businesses reportedly handling some form of digital personal data and 99% of UK business who employ more than 10 people using digitised personal data. The DP Bill is aimed at maximising the economic benefits of utilising personal data in an effective and safe way.

Next Steps

As the three Bills make their way through the UK legislative processes over the next 12 months, businesses interested in investing in high tech industries or already operating in such industries should keep track of these developing laws in order to use any opportunities and prepare in good time for any necessary operational changes. We are providing a suite of products and services in this area, from regular updates and horizon-scanning to granular advice for firms who are likely to become SMS firms (and for their investors and counterparties) in terms of specific obligations and consequences expected to flow therefrom, timing and how these obligations may dovetail with neighbouring jurisdictions, including the EU. Please contact us if you would like to hear more.