Data sits at the heart of the UK’s ambitions for AI, health research, economic growth and better public services. Achieving those ambitions depend on access to data, the technology to analyse it, and confidence in its use. People need to trust that their data is handled appropriately, while organisations need clarity to use it responsibly.
The Information Commissioner’s Office (ICO) has recognised this in its proposed Corporate Strategy, which places trust in responsible UK data use and innovation at its centre. HDR UK supports that ambition. As the UK’s national institute for health data science, we see how data can improve patient care, accelerate research and inform policy. We also see how uncertainty can limit that potential.
Privacy and innovation are often presented as competing priorities, but our experience suggests otherwise. Frameworks such as the Five Safes and SafeGUARDS demonstrate that valuable research can be undertaken while protecting privacy, confidentiality and security. Effective governance enables responsible and practical data use.
Where trust breaks down
Public trust is rightly central to discussions about data use. Trust also depends on organisations having the confidence to make responsible decisions in practice.
Across health research, organisations are increasingly working with new technologies and novel forms of data use. Artificial intelligence, privacy-enhancing technologies, trusted research environments and complex data-sharing arrangements can create situations where the regulatory position is less familiar and harder to navigate.
The principles of data protection remain clear, and organisations are overwhelmingly willing to innovate responsibly. The challenge is applying them in unfamiliar circumstances: where existing guidance may not always provide sufficient certainty on establishing an appropriate purpose, identifying proportionate safeguards and how the outputs can be used.
The ICO plays an important role in providing regulatory support and guidance, which we have seen through our engagement with sandbox and advisory routes, however organisations still require greater operational clarity when assessing unfamiliar uses of data.
Where there is uncertainty about how the rules apply in practice, organisations may reach different conclusions about how best to proceed. This can lead to variation between data custodians. For example, similar uses of NHS data may be assessed differently, not because organisations disagree about the importance of privacy or the principles of data protections, but because there is uncertainty about how those principles should be applied in particular circumstances.
Greater consistency would reduce risk and support responsible innovation. Organisations want to meet their responsibilities and protect the people whose data they hold. The goal is not to lower standards but to provide greater clarity on how existing standards should apply in practice.
What would help
As data use becomes increasingly complex, organisations need practical guidance, and ongoing engagement with regulators to apply regulatory expectations consistently.
One practical step would be a shared library of case studies, co-developed by the ICO and organisations undertaking data-driven research. These could demonstrate how regulatory and governance requirements have been applied in complex scenarios involving health data, Trusted Research Environments, privacy-enhancing technologies and AI, providing practical reference points for organisations facing similar situations.
Alongside case studies, continued engagement between regulators, researchers and data custodians would help build a shared understanding of emerging challenges and support greater consistency across the sector.
The prize
Getting this right would make responsible data use easier, more consistent and more predictable across the health research system.
For researchers and innovators, it would reduce unnecessary uncertainty and make it easier to develop and test new approaches within a clear regulatory framework. For data custodians, it would mean greater confidence when making difficult decisions about new and unfamiliar uses of data. The ICO’s proposed Corporate Strategy provides an opportunity to strengthen that confidence.
Over time, greater consistency could also make the UK’s research environment more attractive. Organisations could learn from one another, good practice could be shared more quickly, and emerging technologies could be adopted without compromising the safeguards that underpin public trust.
Read our full response
