Andy McDonald

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.

The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.

To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.

Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.

The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.

To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.

Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.

The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.

In the case of the Cabinet Office, there has been no consultation between the Cabinet Office and recognised trade unions regarding the introduction or use of automated decision making systems affecting staff.

However, it is acknowledged that the relationship between the Cabinet Office and recognised trade unions is of significant importance and that any potential future consultation on this subject will be conducted fully in line with the principles of the Cabinet Office and trade union partnership framework.

The Cabinet Office maintains a robust data protection governance framework to ensure all personal data, including special category data and data relating to protected characteristics, is processed in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

Following the passage of the 2025 Act, the Department continues to mandate rigorous Data Protection Impact Assessments (DPIAs) for high-risk processing, alongside a standard practice of conducting comprehensive data protection compliance audits across the entire Cabinet Office.

For automated decision making systems that use algorithms, information about these is made publicly available on the Algorithmic Transparency Records Standards (ATRS) hub https://www.gov.uk/algorithmic-transparency-records. This is maintained by the Department for Science Innovation and Technology (DSIT). Otherwise, we maintain no internal or public registers.

The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.

In the Cabinet Office, no automated decision-making systems are used in relation to:

• Recruitment;

• Performance management (for both delegated and Senior Civil Service grades);

• Discipline; or

• The allocation of work.

The information requested falls under the remit of the UK Statistics Authority.

A response to the Hon gentleman’s Parliamentary Question of 11th June is attached.

The Employment Rights Bill will ensure the biggest upgrade to workers’ rights in a generation. This will include the introduction of the Two-Tier Code which will ensure fair and equitable employment conditions for public sector workers who have been transferred and private sector workers who work alongside them on public service contracts.

The National Procurement Policy Statement will set out the Government’s policy priorities, and contracting authorities will have to have regard to it when carrying out procurements. The Policy Statement will consult on introducing a new public interest test to assess whether work should be outsourced or if it could be done more effectively and drive better value for money in-house.

We have begun to assess the areas of Government that could be done more effectively in house, and where there may be compelling reasons for Government to develop their own capabilities and capacity to deliver good value for money and better public services.

The National Procurement Policy Statement will set out the Government’s policy priorities, and contracting authorities will have to have regard to it when carrying out procurements. The Policy Statement will consult on introducing a new public interest test to assess whether work should be outsourced or if it could be done more effectively and drive better value for money in-house.

We have begun to assess the areas of Government that could be done more effectively in house, and where there may be compelling reasons for Government to develop their own capabilities and capacity to deliver good value for money and better public services.

The National Procurement Policy Statement will set out the Government’s policy priorities, and contracting authorities will have to have regard to it when carrying out procurements. The Policy Statement will consult on introducing a new public interest test to assess whether work should be outsourced or if it could be done more effectively and drive better value for money in-house.

We have begun to assess the areas of Government that could be done more effectively in house, and where there may be compelling reasons for Government to develop their own capabilities and capacity to deliver good value for money and better public services.

Given the historic nature of the infected blood scandal, the Government recognises that not all medical records will still be available. The Scheme has been designed to minimise as far as possible the burden on those applying, and as set out in the Infected Blood Compensation Scheme Regulations 2024, eligibility for the Scheme will be determined based on the balance of probabilities. The Infected Blood Compensation Authority will provide assistance to those who believe their medical records have been lost or destroyed.

The Cabinet Office is supporting the Infected Blood Compensation Authority with its aim to design a compensation service that is simple to use, easy to access and securely pays out money as quickly as possible. The Infected Blood Compensation Authority is established in law and work is progressing to put the operational systems in place with the expectation of beginning payments by the end of this year. I will continue to update the House on this matter.

The Department does not currently have tools, products or processes that rely on automated decision-making (ADM).

Individuals are informed about how their personal data is processed through Privacy Notices, which are kept under review and updated where required.

If ADM is introduced, transparency requirements would apply as soon as the Department obtains individuals’ data for solely ADM. Articles 13 and 14 of the UK GDPR require organisations to provide privacy information about the existence of solely ADM. Where decisions are supported by automation but involve meaningful human input that influences the outcome, they would not be considered solely automated decisions.

The Department does not currently have tools, products or processes that rely on automated decision-making. Reforms to the solely automated decision-making provisions in the Data (Use and Access) Act 2025 make clear that such decisions are those made without meaningful human involvement, helping to prevent 'rubber stamping' of decisions. The Information Commissioner's Office guidance states that human involvement must be active and not merely a token gesture to be meaningful. Adoption of that type of approach in the Department would comply with legal requirements and associated guidance through amendments to existing governance processes.

The Department for Business and Trade does not use automated decision-making to make decisions about individuals or businesses that produce legal or similarly significant effects without meaningful human involvement. Where automated tools are used to support decision-making, outputs are reviewed by departmental officials and final decisions remain subject to human judgement.

The Department does not currently use automated decision-making systems and therefore does not maintain a dedicated public or internal register of such systems. Should the Department introduce automated decision-making in future, it would ensure compliance with applicable legal and governance requirements, including the safeguards set out in the UK GDPR and the Data (Use and Access) Act 2025. Public-facing algorithmic tools may be recorded through the Algorithmic Transparency Recording Standard, and the Department maintains internal governance records relating to AI tools and systems.

The Department does not currently have tools, products or processes that rely on automated decision-making. Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. The Department processes a relatively low volume of personal data, and decisions are more commonly made about organisations rather than individuals.

The Department does not currently use tools, products or processes that rely on automated decision making.

Our AI Governance process assesses all AI-related use cases for potential bias and discrimination. Where risks are identified, additional governance and assurance activities are required before approval is granted.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government commissioned ICO guidance has been published on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations. If the department makes use of ADM then it will fully comply with legal requirements and associated guidance.

The use of workplace surveillance has increased due to growth in remote working, advancement in monitoring technologies and changes to employment relationships. This is why the Plan to Make Work Pay set out the government’s aim to put worker voice at the heart of Britain’s digital transition and promote best practice in safeguarding against invasion of privacy.

The government will launch a public consultation on workplace monitoring technologies. This will ensure that business practice and workers’ rights in this area are fit for a modern labour market and support the growth of the UK economy.

Ministers in the Department for Business and Trade and the Department for Science, Innovation and Technology work closely on issues and policy relating to workplace surveillance and emerging technologies. This ensures policy is informed by evidence and reflects both innovation and employment considerations. In March both ministers jointly led sessions with leading experts on technology and the workplace at Wilton Park.

The government will launch a public consultation on workplace monitoring technologies. This will ensure that business practice and workers’ rights in this area are fit for a modern labour market and support the growth of the UK economy.

Creating the Fair Work Agency is a significant step forward in strengthening the enforcement of employment rights. All transfers of staff into the organisation will be carried out in line with the principles set out in the Cabinet Office Statement of Practice regarding such matters.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.

Workers should receive the payments they are entitled to. As part of the Plan for Change we will look at ways of strengthening enforcement options, including the Employment Tribunal Penalty scheme which will move to the Fair Work Agency (FWA) once established.

The proposed powers of the FWA are set out in the Employment Rights Bill and we are committed to ensuring that it has the appropriate resources to discharge its responsibilities. The FWA will work closely with HMRC, Insolvency Service and other relevant enforcement bodies to do this as effectively as possible. This will include considering how to use existing powers to tackle misuse of phoenix companies.