Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, whether the Department maintains a public register or internal inventory of automated decision-making systems.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
For automated decision making systems that use algorithms, information about these is made publicly available on the Algorithmic Transparency Records Standards (ATRS) hub https://www.gov.uk/algorithmic-transparency-records. This is maintained by the Department for Science Innovation and Technology (DSIT). Otherwise, we maintain no internal or public registers.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff.
Answered by Satvir Kaur - Parliamentary Under-Secretary (Home Office)
The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.
In the case of the Cabinet Office, there has been no consultation between the Cabinet Office and recognised trade unions regarding the introduction or use of automated decision making systems affecting staff.
However, it is acknowledged that the relationship between the Cabinet Office and recognised trade unions is of significant importance and that any potential future consultation on this subject will be conducted fully in line with the principles of the Cabinet Office and trade union partnership framework.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, how are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline and allocation of work.
Answered by Satvir Kaur - Parliamentary Under-Secretary (Home Office)
The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.
In the Cabinet Office, no automated decision-making systems are used in relation to:
Recruitment;
Performance management (for both delegated and Senior Civil Service grades);
Discipline; or
The allocation of work.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, how does the Department ensure compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
The Cabinet Office maintains a robust data protection governance framework to ensure all personal data, including special category data and data relating to protected characteristics, is processed in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Following the passage of the 2025 Act, the Department continues to mandate rigorous Data Protection Impact Assessments (DPIAs) for high-risk processing, alongside a standard practice of conducting comprehensive data protection compliance audits across the entire Cabinet Office.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.
Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.
Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.
The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.
The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.
Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.
The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what measures are in place to ensure that human oversight is substantive and effective.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.
Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.
Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.
The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.
The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.
Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.
The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what safeguards have been implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review, and challenge.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.
Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.
Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.
The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.
The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.
Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.
The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, under what statutory authority are significant Automated Decision-Making being made or intended to be made.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.
Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.
Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.
The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.
The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.
Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.
The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, how individuals are informed that decisions affecting them have been taken, in whole or in part, by automated means.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.
Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.
Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.
The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.
The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.
Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.
The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.
Asked by: Andy McDonald (Labour - Middlesbrough and Thornaby East)
Question to the Cabinet Office:
To ask the Minister for the Cabinet Office, what steps has the Department taken to assess and help prevent bias and discrimination following the use of automated decision-making systems.
Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)
Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.
Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.
The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.
The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.
As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.
The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.
The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.
The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.
The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.
To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.
Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.
The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.