Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what safeguards are in place to ensure that automated analysis by private tech companies of the content of private email complies with the UK General Data Protection Regulation and the Data Protection Act 2018.

The UK’s data protection legislation applies to any processing of personal data regardless of the technology being used. Technology companies that screen or analyse personal emails must identify an appropriate legal ground for doing so, such as obtaining user consent. Personal data must also be processed fairly and transparently so that people can make informed decisions about whether to use a service.

The data protection legislation is monitored and enforced independently of government by the Information Commissioner’s Office (ICO). The ICO has published guidance for organisations on automated decision making, profiling and artificial intelligence at: Automated decision-making and profiling | ICO and Artificial intelligence | ICO. It will also consider complaints about organisations that fail to comply with the legislation.