University of Hertfordshire Response to Call for Evidence on Data Regulation in the Age of AI and Other Data Intensive Technologies

This institutional submission critically evaluates the adequacy of current data protection and regulatory frameworks—including the UK GDPR and the Data (Use and Access) Act 2025—in governing artificial intelligence and data-intensive technologies. Analyzing five core themes ranging from data access and quality to cross-organisational supply chains, transparency, and overarching regulatory effectiveness, the submission argues that traditional, static compliance mechanisms are fundamentally strained by the advent of autonomous agentic systems. The authors demonstrate how goal-driven, non-deterministic agentic architectures shatter traditional legal doctrines such as purpose limitation, controller/processor binaries, and notice-and-consent models. To address these systemic governance gaps, the response proposes a robust, multi-layered regulatory model that moves beyond reactive enforcement. Key recommendations include: Architectural Data Minimisation: Mandating Privacy-Enhancing Technologies (PETs)—such as Zero-Knowledge Proofs, zero-retention frameworks, and Federated Learning—to eliminate the risk of raw data stockpiling. Cryptographic Human-Authorization Layers: Implementing real-time biometric verification and strict protocols to prevent automated "rubber-stamping" and preserve genuine human oversight in high-stakes decisions. Dynamic Joint-Controllership and Provenance: Applying rigorous attribution models (informed by CJEU doctrine such as Russmedia) alongside cryptographic content standards (C2PA) to verify uploader identity and maintain data lineage. Protocol-Level Enforcement: Supplementing fault-based liability with structural duties of care—mirroring corporate "failure to prevent" offenses—and deploying protocol-level financial and technical circuit breakers to neutralize automated fraud syndicates and secure biometric integrity. This response was drafted by Dr Mehmet Unver and Dr Felipe Romero-Moreno (Associate Professor in Research), School of Law, Education and Society, and revised by Abigail Fisher, Policy and Community Engagement Officer (Public Health), Research and Enterprise Services, University of Hertfordshire.