ICO publishes response to the UK Government’s copyright and AI consultation

In December 2024, the UK Government launched a consultation setting out proposals for how the UK’s legal framework for AI and copyright can support both AI development and the creative industry. The consultation acknowledges the need for legal clarity in this area presented by the rapid development of AI, as materials protected by copyright, often obtained through web scraping and data mining, are now widely used to train AI models. On 25 February 2025, the UK Information Commissioners Office (ICO) published its response to this consultation, which acknowledges the intersect between data protection and intellectual property rights, and sets out key considerations and recommendations for policy makers. 

The ICO states that its response aims to provide support and ensuring legal clarity for developers of AI, whilst also balancing the rights of content creators and promoting trust and transparency. The response focuses on a number of key areas, including data mining and web scraping, the data protection implications of AI development and training, and the importance of transparency.

Data mining and web scraping

There has been an increasing prevalence of automated web scraping and data mining practices across the internet in recent years, in part due to the demand for large volumes of data needed to train AI models. Web scraping refers to the extraction of data from websites, whilst data mining is the advanced analysis of extensive data sets, which are often obtained through web scraping. 

Currently, in the UK, the copying (e.g., extracting via web scraping) of works protected by copyright without an appropriate licence to do so is prohibited. There is a limited exception to this prohibition which permits copying for the purposes of non-commercial research. As the practices of web scraping and data mining typically involve collation and processing of data on a mass-scale using automated processes, they are inherently at odds with this legal prohibition against copying of works protected by copyright, as well as data protection law principles such as data minimization.

The Government’s consultation proposes a new, broader, exception to the prohibition against copying of materials protected by copyright, allowing these materials to be used for commercial purposes, unless the relevant content creator has reserved their rights or ‘opted-out’ of such uses. Where a creator has not ‘opted-out’, their works could therefore be freely scraped, mined and used for the training of AI models. This proposal would bring the UK in line with the current approach in the EU pursuant to copyright laws, and also remains consistent with the UK Government’s pro-innovation approach to AI regulation. 

The ICO points out that reliance on this new exception for commercial purposes where creators have not ‘opted-out’ should not be seen as a determination of a lawful basis for the processing of any personal data included in the mined data. The opt-out would allow the AI developers to use the data without infringing copyright law, but it would not constitute a lawful basis under the UK GDPR, which would still need be appropriately determined for any personal data contained therein. Whilst the lack of an opt-out would essentially be ‘consent’ from the creator to copy the material, it would not necessarily constitute consent in a UK GDPR sense from the data subject(s) to which the personal data may relate.

Notwithstanding the proposed carve-out, AI developers will also remain subject to a range of other data protection obligations in relation to any personal data collected and processed by web scraping and data mining, and must establish processes to ensure compliance with these. For example, AI developers will need to reflect such processing in its privacy notices, conduct legitimate impact assessments and data protection impact assessments where appropriate, and ensure that data subjects are able to exercise their rights in relation to their personal data being processed.

Transparency

An element of the Government’s proposals which will aid developers in their data protection compliance is that the proposed commercial exception will be coupled with increased transparency requirements for AI developers. AI developers will need to be more transparent about the datasets used to train their AI models, including providing information on how these datasets are obtained and used. These increased transparency obligations will also assist content creators and publishers to understand the extent of data mining of their content, and help them to make informed decisions on whether the opt-out is the right choice for them.

The ICO unsurprisingly welcomes the focus on transparency in its response, but also notes the need for greater transparency in relation to web scraping and data mining practices in general. The ICO proposes the introduction of technical measures allowing digital publishers to exercise greater control over access provided to web crawlers depending on their intended purpose. Currently, the public opacity with which web scraping and data mining operates adds to the complexity and challenges with ensuring related compliance with both data protection and intellectual property laws. Introducing more robust transparency obligations on web scrapers and data miners should help to improve clarity and encourage legal compliance with laws across the board.

Next steps

The Government’s consultation closed on 25 February, 2025, and although we will not know the outcome for some time, it is already clear that the practical details for implementing the proposals will be critical to trying to find alignment between the creative industries and those looking to further AI technologies through data scraping and data mining. For example, the consultation notes that work will need to be carried out to ensure that appropriate technical tools are in place to allow the opt-out rights to be exercised in practice. Rights holders will be particularly interested in receiving this clarity, including how the opt-out will be enforced in order to ensure that their rights are respected. 

The consultation’s proposals have been met with some criticism from various sides, including both rights holders as well as other interested parties across the creative sector. Sony Music in its submission questioned the possibility of a robust and workable opt-out mechanism in practice; and pointed out the music industry’s existing technical and financial challenges with tackling AI-generated deep fake tracks. Sony Music claimed that the proposed ‘weakening’ of copyright protection will only serve to exacerbate these. 

Only time will tell whether the Government is able to strike the correct balance on copyright, with regulations that can encourage continued AI innovation in the UK market, whilst simultaneously offering meaningful protection for the creative industry.

Subscribe to Ropes & Gray Viewpoints by topic here.