Digital Economy Bill - Committee (3rd Day) (Continued)

House of Lords, 6 February 2017.

Lord Collins of Highbury (Labour)

My Lords, I have no doubt that we will constantly return to codes of practice, especially about the need for them to be revised and, I hope, improved. But the purpose of these amendments, particularly Amendment 81, is to ensure that when they are finally agreed they have strength and a statutory basis to ensure that they are properly applied. It is important that the principles and safeguards that we have debated so far are included and statutory. I am concerned that having “regard to” provides too many loopholes that will undermine the very public confidence that we seek in passing the Bill. I hope that the Minister will be able to reassure all sides of the House, once again, about how we can consult broadly on these codes and ensure that they are properly referenced in legislation and properly complied with.

In Amendment 107B, we know that what is important is that corrective action can take place if there is a breach of the code. We know that measures are also in the Bill, including criminal sanctions, where data protection is breached. But what about those areas and cases where public authorities exceed those powers for supposedly public good? Will the Minister tell us what adequate measures would be in place? The Minister in the other place said that the wording “had regard to” already follows common practice in legislation, as illustrated in Section 25 of the Immigration Act 2016 and Section 77 of the Children and Families Act 2014. He argued that as the power covers a range of public authorities and devolved territories, the Government want flexibility about how the powers can be operated so that we can learn what works and adapt the code as necessary. This comes to the crux of the matter once again and why so many noble Lords have concerns about these provisions. It is this open-ended flexibility and uncertainty about where this is going to lead to that raise concerns. We are told that to put these matters into the Bill would hamper the ability to adapt for future purposes. If bodies fail to adhere to the code, the Minister will make regulations that remove their ability to share information under that power.

Part 11 of the code states:

“Government departments will expect public authorities wishing to participate in a data sharing arrangement to agree to adhere to the code before data is shared. Failure to have regard to the code may result in your public authority or organisation being removed from the relevant regulations and losing the ability to disclose, receive and use information under the powers”.

Is that really sufficient? Is that enough? What about the cases that we have heard? As the Minister said in the previous debate, departments are not infallible. I do not think that this is sufficient. We know that the Information Commissioner wants changes; we know that they want these codes not only to be improved but to have proper force. I beg to move.

Baroness Janke (Liberal Democrat)

My Lords, I, too, shall speak to this group of amendments, having put my name to some of them. The noble Lord, Lord Collins, has already raised the issue about the permissive approach in the Bill, which we have rather rejected, and the question of inserting “complied with” rather than “had regard to”. Many of the amendments deal with that issue across the various agencies involved. When you consider that this is operated in relation to various criteria to do with improving people’s physical health, their emotional well-being, their contribution to society and their social and emotional well-being, the breadth of those areas is really rather daunting. You could justify almost anything under those four areas, and I do not really believe that the code of practice could be remotely enforceable if those were the criteria that were used.

Worse still, they could be used in a rather punitive way. For example, it could be argued that it is improving people’s well-being by making them work; and if they are disabled, pursuing people who have disabilities or difficulty in getting work could be used to penalise vulnerable groups. It would affect people who are on benefits or are pensioners—all sorts of vulnerable people. There needs to be somewhat more rigour in the Bill than criteria such as those that we see there now.

Moreover, these amendments deal with a minimum consultation period, which we support. Finally, the code of practice should be laid before Parliament, which, again, would be another safeguard. We must have much more transparency and greater rigour of application, enforceability and consistency across all the agencies and with other rules of disclosure. I would like to hear what the Minister has to say about these concerns. We believe that these matters must be answered and wish to understand the Government’s approach in order to decide whether we need to take this forward at a later stage.

Baroness Hamwee (Liberal Democrat)

My Lords, I, too, support the various amendments in this group. “Having regard to” a matter always seems to leave some wriggle room. If there should be exceptions to compliance—because I think we are talking about compliance here, not about consistency—then those should be spelled out. I accept that having codes of practice outside primary legislation allows for flexibility, which might be useful, for a response to experience of the operation of the code and, perhaps, for changing circumstances. However, there is so much reliance on codes of practice here that an inclusive process for constructing and finalising them is very important, as well as transparency in operation.

The noble and learned Lord will probably have a better recollection than I have of the discussion during the passage of the Investigatory Powers Bill about providing transparency by way of ensuring that people who were affected by the transmission of information knew about it. This was rejected for security reasons, but that would not be the case here. The overall objective has to be transparency and inclusiveness.

Lord Keen of Elie (Conservative)

My Lords, Amendment 81 and the other amendments in this group are intended, of course—and I understand this—to strengthen enforcement of the codes of practice in relation to the public service delivery, debt and fraud, and research powers by requiring authorities who use the powers to “comply with” rather than “have regard to” these codes. The noble Lord, Lord Collins, has sight of a loophole, and the noble Baroness, Lady Hamwee, has encountered wriggle room, but I would take issue with those descriptions.

There is common ground here. We, too, believe that the codes are an important part of the data-sharing powers. However, the Government believe that “have regard to” is the right level of obligation for a code of practice. This is a legal obligation. Such persons when disclosing or using information will be expected as a matter of law to take the codes seriously and follow their requirements in all cases unless there are cogent reasons why they should not do so. It is, of course, common practice for legislation to set out the critical limitations on a power while codes of practice—which are more adaptable, as the noble Baroness, Lady Hamwee, acknowledged—are advisory tools that supplement with regard to best practice, principles and guidance.

The noble Lord, Lord Collins, alluded to a situation in which an authority exceeds its powers for the public good. In such a situation—without going into the detail of it—the authority would be exceeding its powers and it would have to answer for that, whatever the public good might justify in other circumstances.

Key conditions for the disclosure and use of information are set out in the Bill, including what can be shared, by whom and for what purpose. We have followed a common approach taken by government and others, including the Information Commissioner, to provide more detail on how data are to be shared in a code of practice. That does not mean that the code is to be treated lightly. Legal consequences may follow if the code is disregarded, as the Delegated Powers and Regulatory Reform Committee pointed out in its report on the Bill. The relevant Minister can make regulations to remove a body’s ability to share information under the power if it fails to adhere to the code. The noble Lord, Lord Collins, raised the question as to whether that is considered sufficient in the circumstances. We do consider that that is a sufficient safeguard in the circumstances. I also remind noble Lords—in particular, the noble Baroness, Lady Janke—that the first requirement of the Data Protection Act is that processing of data should be fair and reasonable. That underpins in existing legislation the whole approach that should be taken to this Bill.

The noble Baroness, Lady Hamwee, sought to draw a distinction between the provisions here and those in the Investigatory Powers Act about knowledge of data transfers. Of course, although we are not necessarily dealing here with national security, we are dealing with issues such as fraud, where it would be wholly inappropriate to give people advance notice of data-sharing, particularly if one were going to address issues of criminal conduct.

Amendment 107B would require breaches of the code of practice on the public service delivery power to be reported to the Investigatory Powers Commissioner. It also places a duty on the Investigatory Powers Commissioner to investigate serious breaches and, where necessary, to inform the relevant individual of the breach. In doing so, the commissioner would have to ask the person in breach to make submissions before making a decision. With respect, the amendment would impose a considerable additional function on the Investigatory Powers Commissioner, where he or she would be bound to deal with breaches of a code of practice on information sharing which in no way relates to the commissioner’s remit of investigatory powers.

Indeed, placing such duties on the Information Commissioner would effectively be broadening the Information Commissioner’s remit without appropriate consultation. It would, as with Amendment 81B, cut right across the functions of the Information Commissioner, as distinct from the Investigatory Powers Commissioner; the Information Commissioner being responsible for upholding the Data Protection Act 1998, and also the safeguards and procedures for dealing with breaches of the code, which are already set out in various provisions. Such an amendment would blur the lines between the responsibilities of the Information Commissioner and the Investigatory Powers Commissioner and potentially lead to confusion and unnecessary duplication. If, in making those observations, I referred to the Investigatory Powers Commissioner when I meant the Information Commissioner and referred to the Information Commissioner when I meant the Investigatory Powers Commissioner, that simply underlines how easy it is to cause confusion in this area.

Amendments 108, 115, 134 and 151 call for the codes to be subject to approval by Parliament. A similar requirement was also raised by the Delegated Powers Committee in its recent report. We are carefully considering that proposal and I assure noble Lords that we will be responding to it shortly. Amendments 109 and 135 would introduce a requirement for the Minister to consult publicly on the code for a minimum of 12 weeks before issuing or reissuing it. Amendments 110, 152 and 190 would require that the Minister demonstrate that responses to the public consultation,

“have been given conscientious consideration”.

The policy in respect of these powers, and much of the content of the codes of practice, have been developed over two years of open policy development with a range of public authority and civil society organisations. The code sets out procedures and best practice drawn from guidance produced by the ICO and Her Majesty’s Government. We amended Clauses 36, 45, 53 and 61 in the other place to ensure our code will be consistent with the Information Commissioner’s data-sharing code of practice. The clauses contain a requirement that the Minister consults the devolved Administrations, the Information Commissioner and any other person the Minister considers appropriate prior to the issue or reissue of the code. I assure noble Lords that these other persons will include civil society groups and experts from the data and technology areas. It is, indeed, our intention to run a public consultation before laying the code before Parliament. I need hardly add that all consultations are taken seriously by the Government and all responses considered with appropriate conscientiousness.

I understand the interest in the codes and the desire to make sure they are effective. The codes will provide a strong safeguard for the use of the power, backed up by real consequences if they are not adhered to. With that, and while we consider the recommendations of the Delegated Powers Committee further—as I have indicated, we intend to do that in the very near future—I invite the noble Lord to withdraw his amendment.

Baroness Hamwee (Liberal Democrat)

The noble and learned Lord warned us against giving advance notice to potential fraudsters, but I think we are talking in these amendments about notice which may be in retrospect. I am looking at the noble Lord who has tabled the amendments. There are different issues, I think, about giving notice in advance and telling people that you have transferred information. Maybe we need to come back to the distinction between the two at the next stage. On the requirement to have regard but not necessarily to comply, does that not point up the real weakness of a code that is not approved by Parliament? These two bits of fragility seem to me to go hand in hand and undermine the security, as it were, of the regime.

Lord Keen of Elie (Conservative)

I am content that we return to the noble Baroness’s first point if she feels that there is a point of distinction to be made. On her second point, I do not accept that there is fragility in this context. We are well aware, by virtue of past practice, that this formulation is appropriate to the application of codes of practice. Indeed, the noble Baroness herself observed that when applying one’s mind to a code of practice, a degree of flexibility is necessary. One cannot freeze them. That is why we consider that the wording here is appropriate.

Lord Collins of Highbury (Labour)

I thank the Minister for his response. Obviously, the codes of practice are key to giving a sense of security and to building public confidence. They are critical, which is why noble Lords want to see exactly how they will end up. I am very happy with the reassurance that the Minister gave regarding parliamentary involvement and consideration of the report of your Lordships’ committee. That is very welcome and we will return, obviously, to some of the issues, particularly on medical information and other information set out in other groups. We will return to the subject of the Investigatory Powers Commissioner in the next group and I will explain in that discussion why we see, perhaps, a distinct role, arising from the debate this House had on the Investigatory Powers Act. In the meantime, I beg leave to withdraw the amendment.

Amendment 81 withdrawn.

Lord Collins of Highbury (Labour)

Are we dealing with Amendment 81ZA? I would hate to give the wrong speech on the wrong group, although I suspect that noble Lords would notice. I have been in other forums where people have not noticed, but that is another matter.

Amendment 81ZA focuses on the extension of sharing objectives to include the electoral register. A number of amendments in this group address concerns that have been raised about living in cold homes or school meals provision: basically, how we make this sharing of data more effective. I have no doubt that the Minister will say in response that the Bill will allow for this, but we want to raise on the Floor of the House the importance of these extensions of sharing objectives to the overall, broad objectives set out in Part 5.

Focusing on the electoral register, we know that the Electoral Commission has said that up to 1.9 million people could lose their right to vote as we transition to the individual registration of electors. Of course, until 2009 one person in each household completed the registration for every resident eligible to vote. It was a Labour Administration who accepted the principle, and there may be very good reasons, but the way the changes are introduced could be a disaster for our electoral system. That is why it is fundamentally important that we see data sharing as a positive way to address this potential effect on our democratic system. My noble friend Lord Stevenson has tabled an amendment to the higher education Bill that seeks to enhance the responsibility of higher education institutions to remind students of their right to register to vote—and particularly to decide where to vote. In this amendment we are trying to ensure that institutions have proper powers to share data to that end.

It must be understood that this transition to individual registration has put a huge burden on cash-strapped local councils, who need to contact 46 million people instead of 20 million. Some people have been unable to register, many of them because they simply do not have the required access that they would previously have had. This amendment focuses on people who are vulnerable, who need help, or who have not previously taken up their rights, perhaps because they do not have the necessary access or are not fully aware. That comes back to the issues—many other noble Lords will pick up the point—of fuel poverty and access to free school meals. The right to free school meals is important not only for the individual child—for the benefits the child will get—but for the funding of the educational institutions. I hope, therefore, that the Minister will accept these amendments, which are about ensuring that we can do these things and that these issues are addressed, even if he does not think that they should necessarily be in the Bill.

Lord Storey (Liberal Democrat)

My Lords, I shall speak to Amendment 82. This Bill is an opportunity possibly to enhance the lives of the most disadvantaged and vulnerable people in our society. The words of our Prime Minister always come to mind:

“a country that works for everyone”.

This amendment will help the country work for everyone. Currently, the parent of a child wishing to have a free school meal must apply for it. Not only does that provide a free school meal, which is hugely important for children because hungry children are not good learners, but it ensures that the school gets a pupil premium—a substantial sum of money—to help those disadvantaged pupils.

This simple amendment would ensure that local authorities automatically enrol those entitled to receive free school meals. Local authorities currently administer a number of benefits, such as council tax and housing benefit, so they are aware of families that would be eligible to claim free meals and would automatically contact the school. This would ensure that parents who, for a host of reasons, fail to claim would be able to do so.

It is estimated that a family with a child receiving free school meals can save up to £400 a year. Noble Lords may imagine that if the parents have more than one child the saving is quite substantial. As well as the family saving money and the child getting a free school meal it ensures that the school gets a substantial amount of money—the pupil premium—to help disadvantaged pupils.

The Minister will probably reply—as did the Minister from the other place—that the department’s own electronic eligibility checking system means that the clause is not really needed. That, however, is only a system which enables a school to check whether the parent is on the free meals register: it has speeded up the process but does not do the job that this amendment hopes to do.

I make a further point about this, at a time when we are all sensitive about the amount of private data that circulates: there is perhaps a fear that leads people to question why schools should have private data on pupils entitled to free meals. For that reason the amendment clearly states that parents will be notified before this information is made available and that there will be opt-out arrangements. I hope, therefore, that the Minister will be sympathetic to this very important amendment.

Lord Kirkwood of Kirkhope (Liberal Democrat)

My Lords, it is a pleasure to follow my noble friend. I support his Amendment 82 and shall speak to Amendment 92, which is in a similar vein but relates to the warm home discount. I am grateful to the right reverend Prelate the Bishop of St Albans and to the noble Baroness, Lady Massey, who have other duties in the House and would otherwise be here.

It is my pleasure to speak to Amendment 92, which seeks to test the possibilities that Clauses 30 to 32 open up. For years I have been banging away at the Department for Work and Pensions to make proper and better beneficial use, in terms of client well-being, of the vast amount of data that it has on families. That, together with the data held by HMRC, and particularly the data generated when universal credit comes in, will give the Government as a whole immensely enhanced abilities to promote well-being, particularly in our low-income households. I warmly welcome Clauses 30 to 32.

I am listening carefully and correctly to some of the interrogation that is being properly directed at the Government, because we have to get this right; it is very important that the protections are there. Subject to those protections, I am an enthusiast for making use of these provisions. I am slightly surprised that there have not been more attempts—like mine and that of my noble friend—to prise open new opportunities as the Bill goes through. This amendment tries to test the willingness, enthusiasm and ingenuity of Ministers in seeing how they can expand public services to our citizens under Clauses 30 to 32.

Amendment 92 simply seeks to improve the use of data-sharing powers to extend the reach of the warm home discount. The provenance of this amendment is work that I have been doing over months and years for the Children’s Society, and I acknowledge and pay tribute to the work it does with families, particularly with children in fuel-poor households. The Children’s Society has been making the argument to me about the importance and urgency of getting the issue of fuel poverty dealt with more adequately. We need only look at the announcement from npower last week, and indeed some of the wider economic indicators that are showing that this group of fuel-poor households is likely to find things getting a lot worse before they get any better. We need to pay attention to that.

I am told by the Children’s Society that, according to the Government’s own figures, families with children are now the biggest group affected by fuel poverty: 45% of households that can claim the warm home discount are now families with children under 18. The Children’s Society has some valuable survey evidence of a project that it carried out in Bradford and in other places, which indicates clearly the distress caused by fuel poverty. For instance, there is the fact that parents in these households are frightened to turn up the heating in cold winter months because they fear the level of the increased bills it would occasion. Some of those same parents believe that their children’s health is potentially affected by not doing so, so it is a real concern for the parents involved.

The warm home discount, as colleagues surely know, is not a mainstream benefit but is of significant assistance to those who need it. The scheme is currently carried out for two groups. There is a core group, which targets low-income households beyond pensionable age. These are covered under the provision in the Pensions Act 2008 that set up an agreement between the DWP, HMRC and energy companies. It enables people who are beyond retirement age to qualify entirely automatically for the discount. It is taken from their bills and they do not need to apply for it at all. On the other hand the broader group, which is more discretionary and covers vulnerable children in low-income households, does not have that advantage. The Government introduced criteria in 2015 to help with this, which was very welcome, but access to their £140 discount is still patchy and discretionary. It is not automatic. The Children’s Society estimates that only one-third of children in fuel-poor households receive warm home discount at the moment—a matter of concern to it, as I am sure it should be to colleagues here in the Committee.

We need to add fuel-poor families with children aged under 18 to the core group for automatic eligibility for the warm home discount. That can now be achieved because we can get access to the data and share them with the energy companies. Clauses 30 to 32 could unlock the warm home discount for these families, so this amendment asks the Government to ask the DWP to endorse this approach and take the opportunity to make use of these clauses. In particular, will the Government commit to a consultation on how this could be done in the next six months, moving low-income families in fuel poverty to the core group of the existing warm home discount scheme?

Lord Whitty (Labour)

My Lords, like those of the noble Lord, Lord Kirkwood, my three relatively small amendments in this group relate to fuel poverty. I was not at all surprised when my noble friend Lord Collins of Highbury was a bit confused at the beginning of this rather mixed-up group. It covers not only my subjects but voter registration and free school meals; most of the government amendments seem to relate to water and sewerage. I was tempted to say that it covers electoral rolls, bread rolls and toilet rolls. However, my amendments deal with something entirely different and their intention is very much the same as those of the noble Lord, Lord Kirkwood. I will not repeat all that he said.

My aim here is to make the system of data-sharing more effective. I recognise all the concerns expressed around this Committee about the dangers of data-sharing by public bodies and I understand them, because in different circumstances I have been deeply suspicious of the gas and electricity companies, as the Baroness, Lady Byford, clearly was a couple of groups ago. To make identification of the fuel-poor more effective, we need more effective and comprehensive data-sharing, along with the ability of different authorities and companies to share them, but this must be subject to all the safeguards. One safeguard is clearly stated in the Bill: that the information that can be used and shared in this way relates to the health of those affected by fuel poverty because they live in cold, draughty and damp homes. I do not need to spell out the effects of fuel poverty on those people’s health. It is quite important that in addition to the provisions in Clause 30(8) for helping the delivery of services and benefits, the clause should also refer to improving the health of those affected by it. My first amendment would do that.

My second and third amendments simply extend those gas and electricity operators which need to be engaged in it and will be subject to the same safeguards. It is increasingly the case that consumers and householders, including the fuel-poor, have a closer affinity with the distribution networks than with their sensible supplier, which sends them the bill. To improve their situation, they will have to deal with the electricity distributor and, shortly, with the gas network distributor company. These amendments to Clause 31 deal with putting those distributors in the same category as gas and electricity suppliers. These are tidying-up amendments but they will make data-sharing in this important area of fuel poverty more effective. The noble Lord, Lord Kirkwood, spelt out why that is necessary and, in particular, why those not automatically assigned to the warm home discount need to be identified and automatically put on the list of those who receive it. If we achieve that via the Bill, it will be a very important improvement and a step towards eliminating fuel poverty in our society.

Baroness Hamwee (Liberal Democrat)

My Lords, I want to ask a question about government Amendments 83A and 83B, which are about water and sewerage. Will these provisions apply only where there is a water meter? I am struggling to understand how they can work if the customer does not have metered water, and whether the information would be relevant—and how it could be used—if that is not the case. I am quite prepared to be told that I have not understood this properly but if I am right, should the provision not spell out that it is confined to that situation? That would make it clearer.

Lord Hunt of Wirral (Conservative)

My Lords, I declare my interest as a partner in the global insurance law firm DAC Beachcroft and as chair of the British Insurance Brokers’ Association, along with other interests set out in the register.

In speaking to Amendment 196A, I seek to address a small but important point on the operation of the Employers’ Liability Tracing Office, or ELTO. Colleagues may recall that I also raised this when we debated the Enterprise Bill in 2015. Although it has been grouped with amendments to Clause 30—I am happy to accept the grouping—it seeks to insert a new clause after Clause 65 in Chapter 6 of the Bill, which deals with Her Majesty’s Revenue and Customs.

In 2010, the Department for Work and Pensions identified the need for a tracing office, and ELTO was established in the same year. Sadly, former employees continue to contract industrial diseases, including cancer, due to workplace exposure many years earlier. All too often, the employer is no longer in existence by the time the disease is diagnosed. This was considered by our colleagues at the Department for Work and Pensions as a major obstacle to the former employees’ obtaining compensation.

ELTO was established, and the insurers are now required to provide to ELTO details of all employers’ liability policies that have been issued since April 2011. According to the information I have received, ELTO is working well. In the 11 months to the end of November last year, there were more than 178,000 successful searches of the Employers’ Liability Database, but it could be working better.

The piece of the jigsaw that is often missing is the employer’s PAYE reference number. This number is now used to identify an individual employer in the Pay as You Earn system. Each employer is given a unique reference number. If this unique reference number could be applied to the Employers’ Liability Database, it would make searches more accurate, as it would avoid problems of company names’ changing over time. Generally speaking, it would enable the correct employer to be traced.

One major obstacle is that by law ELTO is unable to gain this information under the Commissioners for Revenue and Customs Act 2005, which prevents HMRC from sharing information except in specified circumstances. Alternatives to primary legislation have already been explored with HMRC. Although we often think of employers as large companies, many are sole traders or family partnerships. For them, the reference number could well amount to personal data, which are rightly protected from general disclosure.

The measure, which I now understand is supported by ELTO and HMRC, is proportionate. HMRC has a ready-made database of these unique reference numbers to which ELTO could be given limited access. All ELTO needs is the reference number itself and the name and address of the employer as a cross check. The amendment would permit ELTO and HMRC to set up, at no cost to HMRC, a facility to share this limited information. It will help make the ELTO database fit for the future.

Many noble Lords will know that I have the honour to be an officer of a number of all-party groups, including not only the Occupational Safety and Health All-Party Group but also the All-Party Group on Insurance and Financial Services, so I should also declare those interests because this amendment is strongly supported by my colleagues on those groups.

This amendment would provide great benefit to employees, employers and insurers alike. I hope my noble friend the Minister will feel able to accept it. I beg to move.

Lord Ashton of Hyde (Conservative)

My Lords, I am grateful to all noble Lords who have spoken. It is refreshing that, after the debate that we have had on all the concerns and worries that noble Lords have on data sharing, we now hear proposals on how data sharing can benefit various groups. This is our ambition. This is why we set the Bill up as we did and also why the devolved Administrations are so supportive. The noble Lords, Lord Collins, Lord Kirkwood, Lord Storey, Lord Whitty and my noble friend Lord Hunt all made valuable suggestions. I will come to some of the reasons that we agree or disagree with them, but fundamentally the principle is exactly why we set the system up.

Amendment 81ZA, in the name of the noble Lord, Lord Collins, seeks to require the effective maintenance of the electoral register to be specified as an objective in regulations under the public service delivery power. Electoral registration officers already have extensive powers to seek access to information in public records, providing it is for the purpose of ensuring that electoral registers are as complete and accurate as possible. Under current provisions, they would not be able to seek access to other public records for the purposes of identity verification if an applicant’s details cannot be matched against DWP records or local data sources.

Before considering, however, whether to legislate to enable electoral registration officers to use a wider range of public data sources for identity verification, it is essential that a rigorous examination of the usefulness of the data for these purposes be undertaken.

The public service delivery power allows for objectives to be added via regulations so long as they meet the conditions set out in subsections (8) and (9) of Clause 30. These conditions ensure that any objective for the purposes of which information may be disclosed essentially improves the delivery of services or support provided to a person that improves their well-being. The objective as set out in the amendment is focused on meeting the administrative needs of electoral registration officers rather than necessarily delivering positive outcomes for citizens.

I thank the noble Lord, Lord Whitty, for his interest in ensuring that information can be shared to facilitate improvements in health conditions for those living in cold homes. We believe, however, that his Amendment 81A is unnecessary because this objective is already within the scope of Clause 31. The warm home discount is a support scheme for reducing fuel poverty made under Part 2 of the Energy Act 2010, and these are the schemes specifically referred to in subsection (3)(a) of Clause 31.

Amendments 82A and 82B ensure that, in addition to the gas and electricity suppliers, information may be shared with licensed electricity distributors and gas network distributors for the purposes of requirements which may be made to them by Ofgem in future. Clause 31(4) already provides the power by regulation to add electricity or gas network distributors and fuel poverty support requirements set by Ofgem to the list of schemes covered by this clause if a requirement for the disclosure of personal information to support delivery of such schemes is identified.

Amendment 82, in the name of the noble Lord, Lord Storey, concerns free school meals. Take-up of free school meals is already strong, estimated at about 89%. There are numerous reasons why those entitled to free school meals may not wish to make a claim, such as a preference for their children to take packed lunches. The proposed new clause would not provide a complete solution, as it would not necessarily identify all children eligible for free school meals. For instance, not all eligible parents claim housing benefit. It is ultimately a choice for parents and guardians whether they wish to make a claim. Having said that—naturally I will repeat what the Minister said in the other place; we have joined-up government within the department at least—we want to make it as simple as possible for all parents of entitled children to register for free school meals. That is why the Department for Education provides the electronic eligibility checking system, which allows local authorities to quickly check data held by DWP, the Home Office, and HM Revenue and Customs in order to establish eligibility. The trigger remains, however, that the parents or guardian have to make a claim.

Amendment 92, tabled by the noble Lord, Lord Kirkwood, ensures that information can be shared to provide a warm home discount to certain universal credit or tax-credit claimants, namely low-income families. Although I thank him for his interest in ensuring that information may be shared to enable automatic support for universal credit or tax credit claimants who have children, we believe the amendment is unnecessary, as this is already authorised by Clause 31(1), (2), and (3). That clause enables persons specified in regulations to disclose information to gas and electricity suppliers for the purpose of providing rebates under the warm home discount scheme. The Government recognise that low-income families can face some of the highest costs of keeping warm. In reply to his specific question, I reassure the noble Lord that later this year there will be a consultation on future changes to the warm home discount scheme. The powers in the Bill allow the support to be extended to some working-age vulnerable households without the need for them to step forward and apply. This could be done by using DWP and HMRC data on a wider range of benefits recipients to inform energy suppliers of their eligibility for support.

I now turn to Amendment 196A, which was tabled by my noble friend Lord Hunt of Wirral. I and all noble Lords recognise the importance of helping employees suffering from industrial injuries or diseases to find their employers’ liability insurers where their employer may no longer exist, for example, and I hope I can offer reassurance to my noble friend. Since 2015, when we debated this as part of the then Enterprise Bill, HMRC and the Employer Liability Tracing Office—ELTO—have been collaborating to devise a solution that helps to streamline claims to insurers from employees suffering from industrial injuries. HMRC tells me that a proof of concept has already been devised to investigate the feasibility of this project. It envisages ELTO providing a small sample of employer details to HMRC to determine whether there is a significant matching rate between its database and HMRC’s records. This would help build the case for an information gateway to help populate its database. This amendment anticipates the results of this exercise with the risk of developing a solution that is not fit for purpose in the long run. Any future clause will also need to include appropriate safeguards to protect taxpayers’ confidentiality, in line with the Commissioners for Revenue and Customs Act 2005, which my noble friend mentioned. HMRC has assured me that it will continue working with ELTO to develop a suitable gateway to address the legal, policy and practical perspectives currently being scoped.

I now turn to the government amendments in this group. The noble Baroness, Lady Hamwee, asked whether it is necessary to have a water meter. I am informed that you do not have to have one. I think the best thing would be for me to explain in writing to her how we think this will work without a water meter, and I will put a copy of that letter in the Library of the House for all noble Lords to read. The Government are committed to using the public service delivery powers where a need is identified that improves the lives of citizens.

During the passage of the Bill, we have had representations that more could be done to help citizens in water poverty. The powers in these new water and sewerage clauses have a clear objective: to help improve the take-up of various schemes offered by the water sector that provide assistance to householders in low-income and other vulnerable circumstances. Research by the Consumer Council for Water shows that take-up of such social tariffs is improving, but remains low. This is in spite of considerable effort by the sector to improve awareness of the support available—for example, through its presence in jobcentres, food banks and advice centres as well as through advertising in socially deprived areas. The present system is heavily reliant on eligible households putting themselves forward for help. As a result, large numbers of people are missing out on support, which could include a cap on their bill or a discount on their bill of between 15% and 90%.

These new measures will enable water companies to reach out directly to customers who are likely to be eligible for assistance schemes. This will make it easier for customers in low-income and vulnerable circumstances to access the support to which they are entitled and will improve the accuracy, efficiency and effectiveness of the targeting and delivery of social tariffs. Support for the introduction of such measures has been wide ranging, from the consumer body CCWater, Ofwat—the economic regulator for the sector—and the sector itself. These proposed new clauses will, of course, be subject to the safeguards already in the chapter which provide a strong and safe framework for protecting any information which is disclosed. The clause largely mirrors the provisions in Clauses 31 and 32 for gas and electricity companies, and there are a number of consequential amendments.

I hope the noble Lord will feel able to withdraw his amendment.

Lord Collins of Highbury (Labour)

I thank the Minister for his response. The problem is that these issues are not simply about entitlement but about a system in which people have to choose. The point is how you make that easier. With individual voter registration, which is a new system, there is a possibility that people will be removed from the electoral roll and therefore denied the opportunity to vote. We talk about a positive outcome. It might be one for one particular party. The boundary reviews will be based on registers that will be removing people and therefore on numbers of electors that are not necessarily the real numbers. I find it a bit disappointing that the Minister sees it as simply an administrative step.

This comes back to the fundamental point that everyone who has spoken, whether about school meals or the warm home discount, sees that this is an opportunity to improve governance and outcomes for people, obviously with the required safeguards. I think all of us in this Chamber will want to return to these issues because they are vital for the well-being of our people. In the light of the Minister’s comments, I beg leave to withdraw the amendment.

Amendment 81ZA withdrawn.

Amendment 81A not moved.

Lord Collins of Highbury (Labour)

The Minister gave me some preliminary notice of the Government’s attitude to this amendment and alluded to the potential confusion of different roles and different names. No doubt I might even make the mistake of using the term “Information Commissioner” rather than “Investigatory Powers Commissioner”.

However, there is an important point here on which we want to probe the Government, and that is about the changing world and how we respond to it and make sure that the interests of the individual are properly thought of and protected. The point is about restoring public confidence. We have a legal framework that is structured around the Data Protection Act and a regulatory framework that allows breaches to be investigated and matters to be determined where there has been a breach. It is a system that protects the individual after the event. What we are trying to do here is what the Investigatory Powers Act, which became law at the end of last year, sought to do—that is, it does everything possible to ensure that intelligence agencies and law enforcement use only such powers as Parliament approved after a careful and well-informed debate. We cannot revert to a world in which the Government understand and apply the law in ways that were not foreseeable to the rest of us, still less to a world in which our freedoms depend on the potentially harmful activities of whistleblowers.

This amendment seeks to ensure that, in this fast-changing world, in the plans for the future use of powers identified in the Bill, the rights of the individual are not only safeguarded but are put at the head of the agenda rather than considered as an afterthought. That is why we have used the framework of the Investigatory Powers Act to raise this issue. With regard to future changes or extension of powers, who is thinking of the rights of the individual? It is important that the Government, if they are unable to deal with this consideration in today’s group, return to this subject in future provisions.

This group is also about general safeguards. We have a number of amendments in this group about safeguards and how we ensure that they are maintained. How do we make sure that the regulations that we have seen in draft are proportionate? What about appropriate consultation? How do we guarantee sufficient time for a consultation? We are also ensuring that. I am sure that the Minister will return to the fact that the principles are contained in the original Data Protection Act. However, our concern is about the information being relevant to the individual.

We also have issues with the clause introducing a criminal offence of unlawful disclosure. Why does it not apply to HMRC? This is about being consistent in ensuring that there are proper safeguards. This is another of the issues that has come up.

Again, I note that the noble and learned Lord, Lord Keen, has referred to the Data Protection Act. The Bill sets out the need to comply with the DPA but overrides the common law duty of confidentiality. The BMA has asked what the justification is for that. We are keen to hear from the Minister. We know from the briefing circulated to noble Lords by the BMA that its view is that the provisions of Clause 33(7) could be used to override the existing common law safeguards for health data. The BMA is concerned, as is everyone, about the effect on the important relationship between doctor and patient. We need to ensure that that remains confidential.

We have seen the problems. We thought that we had appropriate data sharing with all the safeguards in place. However, in relation to the NHS using bulk data for research, last June it emerged that nearly a million people had opted out of the database because of their concerns. We know that reviews have examined this. However, this is why we have to understand better the Government’s intention in terms of consistency and ensuring that the appropriate safeguards continue. I am sure that other noble Lords will pick up some of the points that I have not covered. I beg leave to move.

Baroness Janke (Liberal Democrat)

My Lords, our amendments in this group add safeguards. The noble Lord, Lord Collins, referred to some of these: that sharing of information be minimal; that the authorised conduct be proportionate to the object of the exercise; that a privacy impact assessment be conducted; and that proposed measures be subject to public consultation.

In addition, we support the amendments advocated by the BMA. Amendment 89 would remove the subsection through which sharers of information are not bound by the principle of confidentiality. Amendment 93 is a further safeguard preventing an authorised sharer of information from disclosing identifiable health information. I look forward to the Minister’s response.

Baroness Byford (Conservative)

My Lords, in this group I tabled Amendments 100 and 196. Within this group we are debating data sharing and the putting in place of safeguards that make us confident in the next move to make life better for the majority of people. I have one or two direct questions, particularly on the level of data that will be supplied from one authority to another. For example, does the Bill intend that information be supplied on the number of households in a given postal area where child benefit is being claimed and/or where all adults are unemployed? Would it be up to the users of the data to extract a summary picture from details of, for example, names, addresses, whether benefits are received, whether householders are unemployed or any other data?

At any level of inquiry, I presume data will be transferred such as dates of birth and marital status that, were they to fall into the wrong hands, could be used to perpetrate private fraud. No one today has mentioned private fraud, but it can come about as result of lack of security and safeguarding. Again, perhaps the Minister will indicate what relevant provisions there are. I am unsure whether I have missed some. At earlier stages of the Bill I mentioned the amount of fraud going on and it is horrifying. If the Bill can in any way tighten up on that, it would be an advantage.

For example, will personal information cover things such as whether an individual has a diagnosis of dementia or whether a family has been a cause of concern to the social work department in their own area? Who makes these judgments? At what stage are these activated? I may not have read the Bill carefully enough to find the missing answers. I pose these fairly simple questions to make sure that our safeguarding of this information is secure.

Amendment 100 is a probing amendment that seeks to complete the explanation of what information HMRC would disclose, providing examples of the circumstances under which it would be disclosed and a complete list of the groups or persons whose information would be handed over. This relates to Clause 30, of which we spoke earlier. Subsections (9) and (10) specify the well-being of persons or households and define well-being in terms of physical or mental health, contributions to society—which we have covered slightly earlier on and which is difficult; I should be glad of clarification on that—and emotional, social and economic well-being. The latter are easier to understand.

Clause 31 refers to people living in fuel poverty. Again, we debated this previously. Fuel poverty has been defined as,

“living on a lower income in a home which cannot be kept warm at a reasonable cost”.

Clause 32 also refers to people living in fuel poverty. I do not understand what is intended, nor what will be involved for those deemed to be affected. Defining well-being in terms of well-being suggests that definitions of those covered by this legislation could depend on the personal and political stance of those making those decisions. What is “lower income”? Within what limits do homes qualify under these clauses and who will rule that they cannot be kept warm at reasonable cost? What will be the limits of powers of such a decision-maker over, for example, someone who prefers to wrap up for three months of the year so they may enjoy their garden for nine; in other words, somebody who is living in a bigger house that costs more to heat? Will an individual be able to opt not to have personal information shared within local authorities and/or with gas and electricity suppliers?

Turning now to my Amendment 196 in this group, I do not pretend to know anything about the structure, organisation or responsibilities of HMRC. Hence, I do not understand whether an “official” is someone equivalent, say, to a board member in a quoted company. I fear, however, that that is unlikely to be the case. In this era of Facebook, Snapchat and the substitution of public opinion for demonstrable fact, I am unhappy—I do not know whether other noble Lords are—that perhaps a more junior member of HMRC could decide that disclosure would be in the public interest. In other words, where does the buck stop?

Disclosure of personal information, even supposedly non-identifying, should be done only on the authority of the head of the organisation. He or she presumably will have the knowledge, experience and breadth of understanding to be sure that it cannot be combined with other data to name individuals. He or she will also, presumably, be less likely to make errors of judgment, and of course a claim of ignorance of any such disclosure would not stand up to scrutiny, as they would obviously be at the most senior level.

Baroness Hamwee (Liberal Democrat)

My Lords, I will just pick up the noble Baroness’s last point about who is an official. There are examples, in other legislation, of references to “senior officials” and “designated officials”, which might be somewhere between the junior official she has in mind and the Permanent Secretary, but she is right to draw the issue to the Committee’s attention.

On an earlier group, the noble and learned Lord indicated that he was going to speak at greater length—I assume that may be on this group—on the reason for using the term “personal information” rather than “data”. Perhaps I may use my noble friend’s Amendment 213 to ensure that we get to share more of Government’s thinking. I understand the point about corporations, since in the one case, they come within the group covered, and in the other they do not. But I am still puzzled as to why such efforts have had to be made to deal with personal information and then to add in references to the Data Protection Act, rather than starting from the DPA—with any necessary exclusions—which would have taken us straight to the involvement of the Information Commissioner, the data protection principles and so on.

I wondered during the Statement whether to have a go at some alternative drafting for Report, but thought I had better wait for this discussion. But perhaps part of it boils down to a question on Clause 33(8), which says, in wording replicated elsewhere, that,

“nothing in section 30, 31 or 32 authorises … a disclosure which … contravenes the Data Protection Act”.

To look at it from the other end of that telescope, is there any personal information which is the subject of the Bill that would not fall within the DPA and therefore not be protected by that clause?

Lord Clement-Jones (Liberal Democrat)

My Lords, I thought I would intervene to see if it might help the Minister. The code of practice does not make things any clearer. With reference to my noble friend’s very apt point about information versus data, paragraph 4 of the code says:

“The definitions of ‘personal information’ contained in the Bill are intended to ensure that the information shared through these powers is handled carefully”.

That does not sound like a particularly good legal answer to the question. It goes on:

“Though the definition of ‘personal information’ for the purposes of the Bill may differ from the definition of ‘personal data’ in the DPA, all information shared and used under the public service delivery, debt and fraud provisions must be handled in accordance with the framework of rules set out in the DPA”.

Where is that explicitly set out? It would be very helpful if the Minister, in answering, could advert to that as well.

Lord Keen of Elie (Conservative)

My Lords, Amendment 81B seeks to place a duty on the Investigatory Powers Commissioner to ensure that the data-protection rights of citizens are considered and protected under the public service delivery power. The effect of this amendment would be to impose similar duties on the Investigatory Powers Commissioner as are already carried out by the Information Commissioner. It is for that reason that we do not consider that this amendment is necessary. I understand the points that the noble Lord, Lord Collins, has made in this context. We are all concerned to ensure that these powers are ring-fenced as far as is reasonably practicable and that any breach should be policed to the extent required. However, in our view, the Investigatory Powers Commissioner is not the appropriate party to deal with this matter. The Bill is not about investigatory powers, and accepting this amendment would result in a substantial and, as I sought to indicate earlier, confusing addition to the portfolio of the Investigatory Powers Commissioner.

We are of course concerned that there should be public confidence in the provisions of the Bill and in the whole body of data-sharing powers. I understand the observation of the noble Lord, Lord Collins, that the Investigatory Powers Act does everything possible to ensure security is there, so that only the given powers are exercised and that the rights of the individual are put at the head of any agenda, but that is clearly the intention of this Bill as well. That can be achieved by having regard to the position of the Information Commissioner in the context of the present provisions.

I understand and indeed admire the noble Lord’s suggestion that we should in some sense be seeking to future-proof the Bill. There are limits to our ability to do that, but I will return to that point in the context of the regulations that come into force in May 2018. We have already had regard to that in order to try to ensure that the provisions of the Bill will comply with imminent regulations, such as those I have just referred to.

The noble Lord also raised the question of confidentiality and the concerns that have been expressed by the medical profession in that context. Let us be clear that, as noble Lords will recollect, common-law obligations of confidentiality are rarely if ever absolute. We know that various common-law issues of confidentiality tend to be subject to one qualification or another. Concerns have been expressed over the interaction between the provisions of the Bill and medical confidentiality, primarily in respect of the statutory override within the Bill. The provisions of the Bill are clear that sharing data under the powers in the Bill does not breach any existing duty of confidentiality. That includes the common-law duty of confidentiality to the extent that it applies to patient information.

The use and processing of medical information is governed by common law, but also by the Data Protection Act 1998, by the provisions of the Human Rights Act 1998 and indeed by specific legislation which allows, requires or prohibits certain uses of such data. There is no blanket ban on the use of medical information outside the patient-doctor context, and it is not the case that every instance of sharing such information will constitute a breach of confidentiality. Indeed, the General Medical Council’s 2017 guidance expressly states personal information can be disclosed,

“without breaching duties of confidentiality”,

in particular circumstances, one of which is where the disclosure is,

“approved through a statutory process that sets aside the common law duty of confidentiality”.

So it is acknowledged by the General Medical Council itself that this may occur from time to time, and the provisions of the Bill are structured to reflect this. They override duties of confidentiality only in order to ensure that public authorities have clarity in terms of what they can and cannot share under the powers of the Bill. I hope that goes some way to meeting his concerns about confidentiality in that context.

Amendments 84, 87, 119, 138 and 213, which are also in this group and were referred to by the noble Baroness, Lady Janke, cover a broad range of suggested additional safeguards and restrictions on the use of the powers. They seek to introduce, among other things, an express data minimisation rule, a requirement to conduct and publish a privacy impact assessment and provisions extending the Information Commissioner’s powers in respect of enforcement notices. They also introduce a provision enabling data subjects to request that inaccurate personal data disclosed under the powers be amended. We are firmly of the view that while all of these requirements represent important safeguards on the use of our powers, they are already provided for in different ways under the Bill, the codes of practice or existing legislation, including in particular the Data Protection Act 1998. Indeed, under the DPA only the minimum personal data necessary may be shared to achieve the particular objective, and all personal data that is held must be accurate. I hope that that goes some way the meeting one of the points made by my noble friend Lady Byford about excess data being given to public authorities. That is simply not permitted in the existing legislation, particularly the requirements of the Data Protection Act 1998. Over and above that, the Information Commissioner already has a range of mechanisms to enforce compliance with the DPA. Amendment 213, which would insert a new clause on enforcement notices, would not add to those powers in any material way.

Further, Amendment 213 requires certain information to be gathered in respect of the benefits of data-sharing arrangements. Again, that is not necessary: bodies wishing to exercise the powers in these provisions must consider benefits as part of their privacy impact assessment. We acknowledge the importance of privacy impact assessments and, following discussions with the Information Commissioner’s Office, will look to return to this matter on Report to address concerns about public authorities’ adherence to the Information Commissioner’s specific guidance on privacy impact assessments, as well as privacy notices. I hope noble Lords will accept our willingness to return to that matter in due course.

Amendment 213 would bar the processing of personal information under the powers for particular purposes. With respect and understanding of what lies behind the amendment, our approach is simpler and more complete. There are specific limited purposes for which personal information can be disclosed under Part 5 of the Bill. Other than a few limited exemptions, the disclosure or use of personal information for other purposes is not permitted. Tough new criminal sanctions will apply to all unlawful disclosures.

Amendment 87 seeks to introduce a duty to review in the public service delivery power, akin to the existing duty in the debt and fraud powers. All data-sharing arrangements under the debt and fraud powers have to be piloted and reviewed after three years to ensure that the powers deliver demonstrable benefits. The public service delivery powers are different in kind, being more conventional data-sharing powers, constructed specifically to improve the delivery of services to citizens in cases of acknowledged need, such as assisting those suffering from fuel poverty.

On that point, my noble friend Lady Byford essentially raised the question of definitions—what do we mean by “fuel poverty”, “well-being” and “warm home discount”, as mentioned in Clause 31? All this is dealt with in Part 2 of the Energy Act 2010, which contains the schemes referred to in Clause 31(3)(a). I hope further consideration of those provisions of the Bill may go some way to meeting her concerns about those definitions.

On the question of private fraud, of course we are alert to the idea that where there is data sharing there may be data intrusion, and we are determined to guard against that. That is why we seek to ring-fence these powers in the way that we do in the Bill. We have not claimed that any system we introduce will inevitably be infallible; history tells us that where we ring-fence, people will seek to go under, over or through such a fence. However, we shall try to ensure that all data that are shared in this context are kept as secure as we reasonably and practicably can keep them.

Amendment 88 would change the definition of “personal information”, a point raised by the noble Baroness, Lady Hamwee. The point here is that in the current draft “personal information” includes “a body corporate”. The existing definition is intended to capture all persons, including all corporate bodies, to ensure that taxpayer information, including that of bodies corporate, is protected irrespective of the size of the organisation. Narrowing the definition would limit the protections for HMRC data under these powers, which would be likely to affect significantly HMRC’s willingness to make use of the powers. I am sure the noble Baroness is aware that the disclosure of data by HMRC is subject to additional statutory controls quite distinct from the provisions of the Bill, and these have to be factored in. This is where the term “official” comes into use because the existing statutory legislation uses that term in the context of data and disclosure. Therefore, for the purposes of consistency, that term is used in this context. It is not an attempt to suggest that the janitor, or anyone else, should be responsible for disclosing relevant information—certainly not the commissioners of revenue in isolation.

Amendments 87 and 93 are also in this group. Clause 33(7) provides that a disclosure under the public service delivery power does not breach any obligation of confidence or any other restriction on the disclosure of the information. This provision ensures that public authorities can be confident that their disclosure is lawful, provided that they comply with the strict requirements of this legislation. To remove that subsection would undermine a primary objective of providing authorities with the legal certainty required to ensure efficient and effective data sharing under these powers. In other words, where they satisfy the requirements of this legislation, they do not have to go back and worry about any aspect of the common law of confidentiality on individual occasions, which would effectively make the provision unworkable.

Amendment 93 seeks to expressly exclude health data from the public service delivery clauses. I have already touched upon this. The Government believe that this amendment, while well intentioned, is unnecessary and would lead to the kind of legislative barriers that the Bill is designed to overcome. As I have indicated before, the Government recognise the particular sensitivities around identifiable health information, and indeed this was highlighted in the National Data Guardian’s recent review of data security, consent and opt-outs. For this reason, health bodies in England are not included in the draft list of bodies that will be permitted to use the powers in the Bill. Health and adult social care information, however, could potentially be of considerable assistance in bringing benefit to individuals, as this power aims to do. I acknowledge that we may wish to bring such bodies within the scope of these powers in future, but we will form a view on this after the implementation of the National Data Guardian’s recommendations and public consultation on the issue. We believe it would be wrong to rule out that possibility until that debate has been concluded. However, I underline the point that at present health bodies in England are not included in the draft list of bodies that will be permitted to use these powers.

I turn to Amendment 100. Clause 34(8) provides that the prohibition on onward disclosure, and its associated provisions, do not apply to personal information disclosed by HMRC. The amendment seeks to remove that provision. There was a suggestion that someone was seeking consistency here. Throughout Part 5 of the Bill, in order to take account of HMRC’s statutory duty of confidentiality and maintain consistency with the existing statutory framework in respect of HMRC information, the Bill contains separate provisions for the disclosure of information by HMRC. Criminal sanctions apply to the disclosure of HMRC information, but it is all framed slightly differently in order to be consistent with earlier statutory provision. I refer in particular to the Commissioners for Revenue and Customs Act 2005, which already covers these areas. The effect of the noble Baroness’s amendment would be to create two regimes for disclosing HMRC information under this power. We suggest that that would undermine consistency between Part 5 of the Bill and the provisions that already exist under the Commissioners for Revenue and Customs Act 2005. I hope that that goes some way to explaining why HMRC, though not a special case, is dealt with slightly differently within Part 5.

The noble Baroness, Lady Byford, then referred to Amendment 196. Again, in the context of accountability for public interest disclosures of non-identifying HMRC information, the aim of Clause 65 is to enable Her Majesty’s Revenue and Customs to meet requests from external organisations to provide aggregate statistics or general information, which is what other government departments do. Safeguards for disclosure of personal information will continue to apply for the reasons I have already alluded to. This amendment, again, would be inconsistent with HMRC’s existing statutory framework which authorises officials to act on behalf of the commissioners of revenue. It would not be practicable for the commissioners of revenue to have to deal with each of these requests. Indeed, it would be an unnecessary use of public resources if that was the case.

The noble Lord, Lord Clement-Jones, raised a point that appears to have prompted a note from the Box which I have not yet read. I shall scan it now. And I will undertake to write to the noble Lord. On that occasion, I will use typescript.

In those circumstances, I invite noble Lords not to press these amendments.

Baroness Hamwee (Liberal Democrat)

My Lords, the noble and learned Lord may have already answered this, as his response was inevitably very full and quite dense, but on my question about Clause 33(8)—and the words are repeated in other clauses—although nothing in the sections authorises a contravention of the DPA, is there personal information within the Bill that would not be within the DPA and therefore not protected by that subsection?

Lord Keen of Elie (Conservative)

I am obliged to the noble Baroness, Lady Hamwee. Although the definition of personal information differs from the definition of personal data in the DPA, all personal data shared and used under the public service delivery provisions must be handled in accordance with the framework of rules set out in the DPA, and in particular with the data protection principles, because the DPA is not overridden by this chapter. To the extent that the class of personal information is wider than personal data, although the DPA does not directly govern such information, we still expect that information will be handled in accordance with that framework because of the requirements of the codes of practice under Part 5. I hope that answers the noble Baroness’s question.

Baroness Hamwee (Liberal Democrat)

My Lords, I see an amendment at Report coming up.

Lord Collins of Highbury (Labour)

My Lords, I thank the noble and learned Lord for his comprehensive response. Clearly, there is a lot in the codes of practice, so we await the response. I welcome, too, his commitment to come back to report on the issues that the Information Commissioner and we have raised.

Both the GMC and the BMA raised the issue of confidentiality and the common law. They obviously have legitimate concerns about the future impact. Confidentiality is not simply an issue of administration and protection administratively; it is a fundamental issue about the nature of the relationship between doctor and patient, where trust is absolutely vital for medical treatment, ongoing treatment and so on. We may have to come back to this issue at Report. In the meantime, I beg leave to withdraw the amendment.

Amendment 81B withdrawn.

Clause 30 agreed.

Amendment 82 not moved.

Lord Collins of Highbury (Labour)

My Lords, as one of my colleagues in the trade union movement used to say, there may be a sense of déjà vu: we are going to be repeating issues in these amendments. As we have said, transparency is a vital ingredient in building public confidence. If we do not have public confidence we will not have effective data sharing and therefore the aims and objectives of the Bill will not be met. That is why we are very keen to focus on the elements of how we build that confidence, with transparency as the vital ingredient. That is why we are proposing to have an independent review of the collection and use of data by government and commercial bodies. A report of that review would be put before Parliament.

Having spent a considerable part of the weekend reminding myself about the Data Protection Act—I was responsible in the trade union movement for elements of implementation of data protection—I was struck by how complex the law can be and how different elements impact on each other. That is where we need to do more to build public confidence. People are concerned, asking. “Why do they want it? How are they going to use it? Have they used it? Have they done it without my knowledge? Have I given consent? Shouldn’t I be allowed to give consent?” All those issues need explanation. That is why transparency provisions in the amendments are really important. Where there has been a breach it needs to be effectively reported and dealt with. Some of the episodes we have seen in the private sector are scandalous—breaches of data have occurred and nothing has been said for years, let alone weeks and months. Whether we like it or not, those breaches in the commercial and private sector will impact on people’s confidence about the Government’s ability to share data fairly. That is why we need to be open about how we are dealing with problems. I come back to the Minister’s point on infallibility. Of course we are not infallible; but whenever mistakes happen, we want to make sure we learn from them and minimise the risk of them happening again. That is what we seek to do in these amendments.

The more we move towards digital government, the more we need to ensure that all these issues are properly recorded. Again, that is why we are proposing mandatory transparency in the public register of data-sharing agreements. It is about building trust in the process, with people knowing they will have to be accountable for their decisions in this area.

Transparency must be central to the process, alongside privacy and security. It is one of the arguments that we would make strongly in this group of amendments. No doubt we will hear from the Minister about it being mentioned in the code of practice and how that will be vital. I agree that we have seen a lot of movement; what we want to do as we move forward is to receive reassurance that the principle of building confidence will be openness and transparency. I beg to move.

Baroness Janke (Liberal Democrat)

I am drawn to recall the words of the noble Baroness, Lady Buscombe, when she spoke on some of these issues. She said that the technology was moving so quickly that we need to be aware that things are changing—and that it would be important for the public to trust these procedures. A review of these processes is a good thing. Equally, government sometimes changes very slowly, so it may be a better opportunity to revisit some of the issues during a review. We would certainly support that. Again, it has been drawn to our attention by a number of data breaches that have not been notified, ever—so we certainly support the processes that have been outlined in the amendments about putting these on record to have the trust and confidence of the public. Our Amendment 111 in this group is to do with individuals being notified that personal data have been disclosed about them. Again, we feel that this is very important to engender public trust in the processes that we are introducing.

Baroness Finlay of Llandaff (Crossbench)

My Lords, I would like to speak to Amendments 213A to 213C, which explore the Government’s commitment to transparency and how people can know about information-sharing agreements that are in place and, looking to the future, how the equivalent of a subject access request could work, explicitly to assist with fraud detection.

I draw the Committee’s attention to the comment from the Delegated Powers and Regulatory Reform Committee at paragraph 52, which noted that, without even allowing for parliamentary scrutiny, the powers in Clause 39 as drafted are as “inappropriately wide” as those in Clause 30, and seem to be deliberately so. Those very wide powers are of great concern. As an increase in digital technology emerges, the public need to be informed to understand how to use the resources available to them—and they need to know how data on them, as citizens, are being used. They must have confidence in the safeguards in place, otherwise we will have a population that increasingly refuses to engage with any kind of data registration.

It is unclear where health issues sit in this Bill. I declare all my interests in relation to health, as in the register. The powers can include, in Clause 30(10)(a), individuals’,

“physical and mental health and emotional well-being”,

That suggests that health data must fall within the remit of this clause, whether held originally by the NHS or whether they are then held by other bodies. It was in an interview that the Government Digital Service director-general gave as an example the large databases between the NHS and the DWP, commenting that these are large databases of citizens’ records and that we really need to be able to match them, which would suggest a read-across between the two. So while there is a prohibition in the Bill on the use of health and social care data for research, the approach may not have a prohibition in relation to data otherwise disclosed. The NHS bodies, for example, hold the data and, although the Secretary of State is not currently listed in the regulations as published, it is difficult to see how the Secretary of State could not be added to regulations at a later point.

The DWP sometimes requires health data from people that it is dealing with and, effectively, compels them to require the NHS to provide their data. Once the DWP becomes the holder of the data or the data controller, it would fall within the clause as already written. So health information would no longer continue to be excluded from the powers, and the DWP policy, interestingly, although it asks for data from the NHS, does not seem to trust NHS assessments of patients—but I shall not go further down that road at the moment.

When we come to fraud and debt, the powers described in the codes of practice required by Clause 36 provide for partial accountability. The public service delivery powers defined in Clause 30, the single clause that affects most departments, have significantly reduced oversight and, effectively, transparency. Again, the concern was about these being inappropriately wide powers, as reported by the Delegated Powers and Regulatory Reform Committee.

Transparency has to be a fundamental principle when copying citizen’s data—and particularly when copying large portions of citizens’ data en masse. Therefore, it seems strange that it does not appear as a distinct section of the Bill; I ask the Minister to explain why the Government have not put transparency on the face of the Bill. The copying of data between different bodies would be covered by my amendments, as it would require all data-sharing agreements to be included in the public register. As with the NHS digital data release register, this register of data sharing would provide transparency and hence accountability. A code of practice is not enough, and it is not clear how non-adherence to any kind of code of practice would be detected. In Amendment 103, noble Lords have sought detail on a register of data disclosure. On that basis, I ask the Government to confirm that people will have one place where they can find details of the different data-sharing agreements. It is not enough to suggest that people can make a Freedom of Information Act request. Few people would do this, and it will allow organisations wriggle room. The problem is that once vast amounts of data have been shared, they cannot be unshared. A register of agreements would be far more open and would be accessible. After all, it is not how government says that powers will be used but how they could be used in future that causes public concern and hence the need for transparency.

The requirement for people to know their rights leads me to the second point. Can the Government confirm that a digital equivalency of rights will be in place, which will not require burdensome processes for the citizens? Digital equivalency means that government must make sure that people know that their rights are protected, in the same way as currently, in the much more non-digital world. The concern relates to the increasingly complex interdependent data on each person, which can be connected and used, whether to assist that person or otherwise.

My third point relates to the Government’s use of data in the future. It is difficult, or impossible, to foresee the future but we can be pretty sure that the way data are used in 100 months’ time will be similar to the way they will be used in, say, 98 or 99 months’ time. In other words, the best way to know how your data might be used next month is to see how they are being used in the current month or were used in the previous month. What we are talking about is, in effect, a form of subject access request, so I ask the Government to provide the same protections here as the Data Protection Act currently does for other forms of subject access request, and to create digital equivalency.

In health, there has been much concern around the secondary use of medical data, which do not differ fundamentally from the type of data anticipated here. As I explained, there can be a second holder of such data, and they will be desired by other bodies—both public and private. The problems that arose in 2014 with the care.data programme eroded confidence. It is worth noting that the latest Caldicott review calls for a continued, informed conversation with patients about their data. Although I believe the Government have said that Part 5 does not apply to health data, pending the outcome of their response to the review, there is, indeed, concern that health data could be transferred via a third party.

On data that could be used to detect fraud, there seems to be no reason why the standard declaration for this purpose could not cover all lawful anti-fraud activities. Law-abiding citizens could, as with the provision of bank or mobile phone statements, allow transparency here, and this could reduce the opportunity for people to cheat the system. People would then be able to better detect fraudulent activity themselves. Indeed, such an ability would be most helpful for the Office of the Public Guardian which has a large fraud department. It would allow it to directly access data concerning a subject’s finances, which is currently held by a court-appointed or person-appointed deputy, attorney or guardian. This would allow the fraud department to investigate much more effectively as it would not have to seek permission from that appointee, a situation which has allowed fraud to occur in the past. There have been notable examples of difficulties in detecting financial fraud. Amendment 213C may specifically help with such detection.

Lord Keen of Elie (Conservative)

My Lords, the noble Lord, Lord Collins, should make no apology for revisiting the issues of transparency and public confidence because they lie at the heart of what this Bill is attempting to achieve and are contained in Part 5. It may be déjà vu again but that is perfectly justified by the circumstances. We are all concerned to ensure that there is such transparency within these provisions as to maintain, and perhaps even restore, public confidence in the use and sharing of data.

Amendment 82ZA proposes that, within six months of the Act coming into force, an independent review of the collection and use of data by the Government and commercial organisations is conducted. With respect, the scope of the review appears extremely broad and goes much further than the provisions of Part 5. The Royal Society and the British Academy are undertaking a review to consider the ethical and legal frameworks needed in the United Kingdom as data technologies advance. We intend to consider the findings of that review when it is published. In addition, I mentioned that the general data protection regulation will come into effect in the United Kingdom in May 2018. The implementation of that regulation will represent a significant change to the data protection legal framework for both the public and private sectors, including strengthening rights for individuals so that they have more control over their personal data. We intend to work with the Information Commissioner to explore how we can best meet these requirements, as well as to improve transparency in this space. As such, we do not see the value in commissioning a further major review of data ahead of preparing to implement the new data protection framework when the regulation comes into force in May 2018.

Amendment 103 also seeks to improve the transparency of data sharing under the powers in Part 5. As I have indicated, we support this intention as transparency, along with the protection of personal data, is clearly at the heart of all these proposals. There are, however, a number of real problems with the proposed new clause. Setting the requirement and contents in primary legislation would significantly restrict our ability to explore and consider the benefits and consequences of publishing a register. For example, there may be a need to exempt the inclusion of certain types of data sharing for reasons such as national security or commercial confidentiality.

Ahead of the 2018 regulation coming into force, we will work with the Information Commissioner’s Office and other interested parties to explore how we can best meet its requirements and improve transparency. In our view, the statutory codes of practice in the Bill are a more appropriate vehicle for setting out requirements to support greater transparency. We will run a public consultation on the codes of practice as well as the required statutory consultations and we propose, as part of that, to gather views on the type of information about data sharing that should be captured and made public, as well as the risks and benefits. In addition, the draft codes already contain requirements for privacy impact assessments to be prepared and published. Further, we are continuing to explore with the Information Commissioner whether more can be done in this Bill to ensure that his codes of practices on privacy impact assessments and privacy are fully considered when data are shared under Part 5. I hope to return to this point later in the proceedings.

Amendment 104 proposes an obligation for organisations to report data breaches and submit associated audit returns to the Information Commissioner’s Office. As I have indicated, the EU general data protection regulation will apply in the United Kingdom from May 2018. The new regime will introduce tough measures on breach notification, making it a requirement for all data controllers and data processors to report breaches to the Information Commissioner’s Office if they are likely to result in a risk to the rights and freedoms of individuals, and the individuals affected must also be notified where there is a high risk. The new regime will also allow tougher penalties to be imposed on organisations in breach of the rules. I believe these will be penalties of up to 4% of the organisations’ total global annual turnover, or €20 million.

Under current arrangements, the Information Commissioner’s civil monetary penalties guidance says that he can take into account what steps, if any, the person or organisation had taken once they became aware of the contravention, when determining the amount of the monetary penalty to be issued, so there is provision for those who delay or defer the reporting of data breaches. At this stage, we are confident that the Information Commissioner has the necessary powers to take action against those organisations that are in breach of the rules so, while I accept the spirit of the amendment and understand the need for transparency, I do not believe it is necessary as the new tougher rules under the EU regulations will apply from May 2018. As I stated, under the current regime, the commissioner can and does take into account what steps, if any, an organisation has taken in addressing breaches and in deciding penalties under the Data Protection Act.

Amendment 111 would require a secure audit record to be compiled specifying the personal information shared under the public service delivery power. This well-intentioned amendment is also considered unnecessary. The code of practice that has been drafted in support of the public service delivery provisions already requires an audit to be kept by data controllers of information shared under this power, and the Information Commissioner’s data-sharing code of practice similarly requires organisations to keep records of information shared. In addition, the EU general data protection regulation will apply to Part 5 and place further specific legal obligations on organisations to maintain records of personal data shared and of processing activities. Organisations will now make the necessary preparations to comply with that regulation.

For the benefit of the noble Baroness, Lady Finlay, I emphasise that the processing of personal data under the public service delivery power must already be in accordance with the Data Protection Act. The Information Commissioner is responsible for enforcing and promoting compliance with the Data Protection Act. The commissioner undertakes a programme of consensual audits across the public and private sector to assess their processing of personal information. The commissioner also has the power to conduct compulsory audits of public sector entities to evaluate compliance with the data protection principles. The commissioner has powers to obtain access to the information she may need to conduct those assessments.

I turn to Amendments 213A, 213B, and 213C. Amendment 213A would require that any agreement to share data under Part 5 be listed in a register of data-sharing agreements published in digital form. Our position on this amendment is similar to that with respect to Amendment 103. The statutory codes of practice under the Bill are a more appropriate vehicle to develop and set out requirements to support greater transparency. A public consultation on the codes of practice as well as the required statutory consultations will allow us to gather views on the type of information about data sharing that should be captured and made public, as well as the risks and benefits. Amendment 213C relates to the way in which given data sharing ought to be described in any public register. Again, this is a matter to which further thought can be given when a view is taken as to the nature of any such register.

Amendments 213B and 213C seek to confer additional rights on data subjects, not just in respect of these data-sharing powers but more generally, to exercise their rights via digital means, and to object to processing undertaken by a data controller, with an accompanying provision enabling the data controller to disclose certain information in respect of these objections. Again, I remind the noble Baroness, Lady Finlay, of the provisions of the Data Protection Act 1998, which already provides sufficient protections in all these areas, providing mechanisms and remedies for perceived mishandling of personal data, complaints and access to personal data, among other things. These provisions would cut across the existing data protection regime and would be potentially confusing. Such fragmentation could discourage appropriate data sharing for the public benefit.

We are committed to making it as easy as possible for citizens to understand what data are held about them and the purposes for which they are processed. The codes of practice rather than further primary legislation are the appropriate means for doing this. We are working with the Information Commissioner to ensure that our codes provide sufficient guidance to ensure that this approach is effective, and that there will be compliance with the data processing regulation when it comes into force in May 2018. We are aiming for that. That will be reflected in the approach we take to the codes of practice and consultation. For these reasons, we suggest that these amendments are unnecessary and I invite noble Lords not to press them.

Lord Collins of Highbury (Labour)

I thank the Minister for his response. We await the revised and improved codes of practice, which will be a fundamental ingredient in building confidence in data sharing. If there are existing powers with regard to the requirement to report breaches, I think most people in this country will wonder why Yahoo was not picked up for failing for 10 years to report a breach which could have impacted on its confidential financial information. I welcome the fact that we will come back to these issues at later stages following consultation with the Information Commissioner. We know what is in the GDPR and what we are required to do. It will come into force in May 2018 and it is very important that the Government commit to the principles in it. We may have to come back to that issue at later stages of the Bill. In the meantime, I beg leave to withdraw the amendment.

Amendment 82ZA withdrawn.

Clause 31: Disclosure of information to gas and electricity suppliers

Amendments 82A to 83 not moved.

Clause 31 agreed.

Clause 32 agreed.

Baroness Buscombe (Conservative)

My Lords, this group consists of mainly technical amendments to make sure the Bill works in the way it is meant to. Although they are technical, they are important. They fall into four broad subject areas: whistleblowing and journalistic freedoms; the meaning of “anti-social behaviour”; references to the Investigatory Powers Act; and the description and powers of devolved authorities.

In relation to whistleblowing and journalistic freedom, the first series of amendments relates to the new criminal sanctions for unlawful disclosure of personal information disclosed under the powers. Concerns were raised that the clauses as drafted could criminalise disclosures made by whistleblowers and journalists making disclosures in the public interest. This was never the Government’s intention. These amendments make sure that disclosures made by whistleblowers and journalists will not be subject to criminal sanctions.

There is a distinction here in terms of how the amendments address HMRC information and non-HMRC information. In respect of non-HMRC information, the amendments introduce additional exemptions to the general prohibition on further disclosure to cover “protected disclosures” under the Employment Rights Act 1996, which will protect whistleblowers pursuing the proper channels for disclosure. Disclosures made for the purposes of journalism are also removed from the criminal sanctions, provided that the disclosure is in the public interest.

There are already separate provisions in each of these chapters for personal information disclosed by HMRC. These amendments make clear that the criminal sanction for unlawful disclosure applies only to an official who wrongfully discloses HMRC information outside the permitted scope of the information gateways in Part 5 of the Bill at Chapters 1, 3, 4 and 5. This brings the provision into line with HMRC’s statutory regime in the Commissioners for Revenue and Customs Act 2005 and its other statutory information gateways.

I am conscious that the noble Lords, Lord Stevenson of Balmacara and Lord Collins of Highbury, have two amendments that relate to this section, Amendments 138A and 146A. I suggest that I reply to those amendments separately after hearing from noble Lords.

The second series of amendments concerns the definition of anti-social behaviour. Chapters 1, 3, 4 and 5 of Part 5 all contain a general rule restricting the use of information disclosed under these powers to the particular purpose for which it was shared and a general prohibition on further disclosure. There are a number of exceptions to these rules. A previous amendment added an exception enabling disclosures made for the prevention of anti-social behaviour. The definition as currently drafted needs to be adjusted to work in Scotland and Northern Ireland. These amendments provide a revised definition that works across the UK.

In relation to reflecting the enactment of the Regulation of Investigatory Powers Act, the third series of amendments is also minor and technical in nature. The public service delivery, debt, fraud, research and statistics clauses provide that information cannot be disclosed under these powers if that would contravene the Data Protection Act 1998 or if it is prohibited by Part 1 of the Regulation of Investigatory Powers Act 2000—commonly known in your Lordships’ House as RIPA. The Investigatory Powers Act 2016 received Royal Assent last December and will replace RIPA. These amendments replace the references to RIPA with references to the equivalent provisions in the IPA, with a provision for RIPA until that Act is fully in force.

Regarding devolved public authorities, the final series of amendments facilitates information sharing across the United Kingdom, including by and with public authorities in devolved Administrations. The amendments broadly fall into two categories, which I will take in turn. The first category provides personal information disclosed by Revenue Scotland and the Welsh Revenue Authority with equivalent protection to that given by Clause 60 to personal information disclosed by HMRC. In order to protect information relating to taxpayers, these two new clauses provide, as is the case for personal information disclosed by HMRC, that persons who are processing Revenue Scotland or Welsh Revenue Authority information cannot further disclose that information without the consent of Revenue Scotland or the Welsh Revenue Authority, as applicable. Secondly, reflecting the Government’s amendments to Clause 60, the amendments provide that persons who receive Revenue Scotland or Welsh Revenue Authority information under Clause 57(1) also cannot further disclose that information with the consent of Revenue Scotland or the Welsh Revenue Authority, as applicable.

Amendments 171 and 172 are consequential amendments to those tabled separately in respect of preventing unlawful disclosures under the research power. The first of these amendments is necessary to ensure that the separate safeguards regime for HMRC that has been maintained throughout Part 5 also applies to the criminal offence as amended. The second ensures that the separate arrangements for HMRC will be mirrored in respect of Revenue Scotland and the Welsh Revenue Authority.

The second category ensures that the definition of “Welsh body” in Part 5 is consistent with the definition of “devolved Welsh authority”, as will be enacted by the Wales Bill. The amendments will ensure that no devolved Welsh authority will be inadvertently excluded from the relevant Part 5 powers. The amendments also provide for Welsh Ministers to commence the provisions which relate to the disclosure of information by the Welsh Revenue Authority. This reflects the fact that the Welsh Revenue Authority is not yet operational. I beg to move.

Lord Stevenson of Balmacara (Labour)

My Lords, I thank the Minister for a very well-read response to the questions we all had about these technical amendments, although some of them were not quite technical of course. In terms of the four categories, I listened to three very carefully, and I will read what she said in Hansard, but we have no further comments to make on them at this stage.

She touched on the issue in relation to which we have two amendments down. I am grateful to the Government for responding so quickly to the discussion in another place on this issue, because as originally drafted, the Bill would have criminalised disclosures by whistleblowers and investigative journalists revealing matters of legitimate public interest. The point was picked up and discussed at some length, and had attracted interest from a wide range of people such as Sir Peter Bottomley and Helen Goodman, who raised it. The Minister in another place undertook to take it back, and we have now had the amendments put forward.

Those of your Lordships who have bothered to read the amendments in Clauses 50 and 51 will recognise that the wording is very similar in both cases. The difference, narrowly put, is that the amendment that we were advised would take the trick in this area included not just print journalism but also broadcast journalism. I am not certain whether that is necessary or not, but the Government have come forward with a slightly narrower point of view. I think we agree the aim, and it may just be a question of the correct wording, so unless there is any particular issue, we can do this either by correspondence or perhaps in a quick meeting, and I do not think there is anything on this point that need detain the Committee further. We are agreed and are delighted that the Government are making the move. It is just a question of trying to use what time we have to make sure that we have absolutely nailed it down completely.

Having said that, what has proved difficult in other pieces of legislation is how one defines whistleblowers. There is no attempt to do that here; the test is simply whether or not what has been disclosed was in the public interest. Again, there might just be something around that where we might look at other discussions and come back on it. But for the moment, I will leave it.

Baroness Buscombe (Conservative)

I thank the noble Lord for that. The opposition amendment makes specific reference to broadcast transmission when the government amendment on this topic does not. However, the word “publication” in our view can be construed sufficiently broadly to cover broadcast media. Section 32(6) of the Data Protection Act 1998 provides that:

“For the purposes of this Act ‘publish’, in relation to journalistic … material, means make available to the public or any section of the public”.

The ICO guidance on this indicates that publication for these purposes would therefore cover broadcast. As a result these additional changes are not necessary.

Lord Stevenson of Balmacara (Labour)

It is quite an interesting point. The world has moved on since those original drafts, and we have to think a bit more carefully about what happens on YouTube and whether disclosure on social media will be covered by this. I do not dissent from what is being said but would just like to be certain that we have used this opportunity, which may not come again, to make sure we have this nailed.

Baroness Buscombe (Conservative)

I thank the noble Lord for what he has said and absolutely understand where he is coming from.

Amendment 86 agreed.

Lord Arbuthnot of Edrom (Conservative)

My Lords, I draw noble Lords’ attention to my interests in the register, particularly to the fact that I am chairman of the Information Assurance Advisory Council, chair of the advisory board of Thales UK and a member of the advisory board of IRM, among other cyber-interested companies.

This Bill is about the digital economy, but it contains very little mention of security. Yet cybersecurity is essential, both to the proper functioning of the internet, on which we so rely, and to the trust we place in the digital economy. Global research has been done by the Information Systems Audit and Control Association of the United States of America, and I am indebted to it for its help on these amendments. That research has shown that two-thirds of chief executives of major corporations do not have confidence in their workforces to deal with anything beyond the simplest of data breaches. We all know that there has been no shortage of high-profile data breaches on both sides of the Atlantic over the last 12 months. That has damaged the economic performance of companies and their stock price, and has significantly reduced consumer and business confidence.

I congratulate the Government on making real progress in this area. They have introduced Cyber Essentials, which has been helpful in boosting implementation of cyber controls. I suggest, though, that the uptake of Cyber Essentials has been disappointing. It is not always a requirement that companies observe even the relatively low level of assurance that Cyber Essentials suggests. I use the word “suggests” because of course it is not compulsory. Equally, the new cybersecurity strategy has brought £1.9bn into developing a capability across the whole of society to address everything from the biggest companies to individual citizens. The Minister of State for Digital and Culture recently indicated in another place that the Government intend to implement the General Data Protection Regulation in full. That is a good thing, but I very much doubt that businesses—and probably even government departments—are anywhere near ready for the GDPR, nor as far along as they really should be by this stage.

In view of the existential nature of our reliance on cyber nowadays, I therefore suggest that we need to go further. Consumers, investors, executives and government alike all need confidence that businesses are taking appropriate steps to safeguard their data and their IT systems—and those of their supply chains as well—from malicious activity. So, I have decided to be helpful. I propose these amendments, which introduce the notion of a cyber audit. They are probing amendments: their wording creates obligations that are perhaps more imperative than I would like to see, because I believe we should start with encouragement rather than requirement.

Everyone is now accepting of, and accustomed to, the notion of external independent financial audits, which have become the norm throughout the world. I believe that a similar approach now needs to be followed in relation to cybersecurity. My suggestion is that we should undertake cyber audits—perhaps as part of financial audits, or perhaps separately; it does not really matter. Those audits could be based on standards that could be evolved by industry, rather than by government, because government legislation never manages to keep up with the astonishing pace of technological change. These cyber audits should include external stress tests of a company’s cybersecurity in areas such as email, and possibly even in relation to a company’s products.

I think the entire House knows that, in 2013, the Target chain of 1,800 stores in the United States of America was hacked by people who broke into its air conditioning system, which was supplied by a third party. Everybody knows about last autumn’s botnet attack by rogue webcams. So if we did this and went for cyber audits, we could gradually begin to address the issue of cybersecurity, so that over time no longer would it create quite the existential threat that it does now. It would need to start on a voluntary basis and be driven by business, not by government, but, in time, I believe it would spread internationally, so that the United Kingdom would not be disadvantaged in competitive terms. It would also ensure that the United Kingdom was in the vanguard of global best practice. I beg to move.

Baroness Jones of Whitchurch (Labour)

I expected more people to be inspired by the contribution of the noble Lord, Lord Arbuthnot, and to join in the debate. I am rising to give my support to Amendments 105 and 106 and to thank the noble Lords, Lord Arbuthnot and Lord Carlile, for highlighting this simple failure in company policy, which can lead to much bigger dangers and threats. As the noble Lord said, it can have commercial implications, personal privacy implications and, ultimately, national security implications. While we all have a part to play setting the highest standards of data protection, it is true that all too often we put the focus on national Governments without recognising the equal responsibilities of the private sector and private companies to play their part. This is particularly vital, given the number of private sector organisations which access data for government contract work. However, it also extends into other realms of commercial activity, such as commercial personal profiling, in which companies build vast data banks of our shopping habits, our friends, our movements—literally, where we are moving around in cities and towns—and our vulnerabilities, all of which have huge value both in their own hands and in the hands of cyber-thieves. These are issues which we have also flagged up in other amendments tabled today, and we have tried to build in more safeguards. My noble friend Lord Collins has said that we believe that individuals should have the right to know what information is being held about them, for example. They should have the right to be able to withdraw permission for the data to be held, and they should have the right to know immediately if a data breach has taken place.

We welcome the amendments, which would begin to address some of our concerns, by putting a straightforward obligation on companies to prepare a cybersecurity report each year, detailing the measures being taken to ensure that data are being kept safely. It is a simple ask, and it should not really be necessary, but the all too frequent security breaches taking place underline why a legal requirement has to be imposed. An Institute of Directors report last year showed that companies tend to keep quiet when there has been a security breach. As a result, there are no accurate figures on the extent of this crime, or the extent to which companies are being held to ransom. A survey of business leaders found that only half had a formal strategy in place to protect themselves and just 20% held insurance against an attack. Yet we also know that companies are also losing confidence in their encryption systems, their staff capabilities and awareness and the ability of their software to withstand a deliberate assault.

This is a huge issue. Of course, we have a vested interest in sorting this out, as often it is our personal data which are being stolen. But on a wider sphere it impacts on everything from company finances to sensitive market data and research and development. So we very much welcome the initiative set out in these amendments, and agree with the noble Lord, Lord Arbuthnot, that they are helpful. In itself, they will not completely solve the problem, but they represent another small step in getting companies to act responsibly in managing the data that they hold.

Lord Keen of Elie (Conservative)

My Lords, Part 5 of the Bill requires public authorities and specified persons to specify and meet specific legislative conditions and controls on the handling of personal information. As I have said on a number of occasions this evening, these provisions will be underpinned by codes of practice setting out data security requirements, including cybersecurity. A body that fails to meet these could be prevented from using the data-sharing powers. That is the context in which I turn to Amendments 105 and 106.

Amendment 105 would require all but the smallest of companies to conduct audits on their cybersecurity and to report annually on it and their data protection measures. Clearly, the Government recognise that effective cybersecurity risk management is important to the success of the economy and, indeed, to ensuring the safety and integrity of private citizens’ data. The Government conducted the Cyber Security Regulation and Incentives Review in 2016 to consider whether we need additional regulation or incentives to boost cyber risk management in the wider economy and it showed strong justification for regulation to secure personal data.

The Government will seek to improve cyber risk management through our implementation of the EU general data protection regulation in May 2018. Its requirement to report breaches to the Information Commissioner and individuals affected, and the fines that can be issued under it, will represent a significant improvement. These will be supplemented by a number of measures to more clearly link data protection with cybersecurity, including through closer working of the Information Commissioner and the National Cyber Security Centre. However, we will not seek to pursue further general cybersecurity legislation for the wider economy as would be required by Amendment 105.

We believe that mandating the inclusion of cyber risk information in annual reports, or the introduction of legal provisions for cyber audit, is unlikely to be an effective way of encouraging large-scale change in cyber risk management. Instead, the National Cyber Security Centre plans to work with stakeholders to develop guidance for investors. The long-term aim of the organisation is to include cybersecurity in the guidance it provides to businesses on the kind of information it wants to see in an annual report, and in the reports it provides to investors each year on every listed company.

Amendment 106 is very broad in its aims and, as such, could have unintended consequences for the diverse range of grants that the Government fund each year. The supporting audit and insurance regime would be costly and challenging to enforce given the diversity of grant recipients, including those from voluntary and research communities. Furthermore, this amendment is unnecessary as many of these checks are in place as a matter of routine. The level of cybersecurity risk in grants will continue to be monitored and consideration given to how recently launched grant standards could be used to strengthen guidance in this area. This provides a far more flexible and proportionate solution than legislation.

With respect to subsection (2) of the proposed new clause in Amendment 106, the Government are already taking tangible steps to reduce the level of cybersecurity risk in their supply chain. As of October 2014, suppliers of central government contracts that involve the handling of personal data or the supply of IT products and services must demonstrate they have met the technical requirements set out as part of either the government-owned Cyber Essentials scheme or a suitable equivalent. The scheme was developed jointly with GCHQ and industry to support organisations of all sizes and across all sectors in getting a good, basic level of online security in place. In response to my noble friend Lord Arbuthnot I would observe that, as of the end of December 2016, nearly 5,500 certificates had been issued under the scheme, and we have a strategy in place to significantly increase the adoption of the scheme over the coming year. With that explanation, I hope my noble friend will withdraw his amendment.

Lord Arbuthnot of Edrom (Conservative)

My Lords, I am grateful to my noble and learned friend for his comments. From what he says I suspect that the Government are not quite there yet. However, I hope that my amendments will help to encourage them along a path of some form of regulation in this area. I suspect that the arguments my noble and learned friend used were similar to those that were first used when financial audit was suggested. However, I am grateful for what he has said. I am also particularly grateful to the noble Baroness, Lady Jones, for what she said and for the gracious way in which she said it. However, my amendments were aimed not so much at government as at business. I suspect that this will be part of a long-term campaign, so, with those words, I beg leave to withdraw the amendment.

Amendment 105 withdrawn.

Amendment 106 not moved.

Clause 36: Code of practice

Lord Clement-Jones (Liberal Democrat)

My Lords, I wish to speak also to Amendment 116.

This issue is extremely straightforward. My remarks may anticipate some of the points that the noble Baroness, Lady Byford, will make in due course on the clause stand part question, for which we have considerable sympathy. However, we on these Benches and many others outside the House are deeply concerned that Chapter 2 of Part 5 contains no safeguards against bulk copying of civil registration data. We accept the case for a power to disclose civil registration information where an individual has consented. A citizen should, of course, be able to choose to let the registrar inform other bodies of changes. However, new Section 19AA in Clause 39(2) appears to remove any limit to copying registration data in bulk. As regards the draft civil registration code of practice, there appears to be no explicit limit on that sharing of data in bulk, and certainly no requirement for individual consent. Therefore, the essence of this amendment is quite simply to require that there should be express consent of the data subject.

As regards Amendment 116, approximately 1.3 million births and deaths are registered each year under legislation dating back to 1953, which consolidated provisions going back to the start of civil registration in 1837. In 2009, a system was introduced to allow registrars to register births and deaths electronically but it is the hard copy which this generates which is the legal copy that will be used to issue the certificates. Registrars also have to use the electronic system to submit an electronic copy of each event to the superintendent registrar. Primary legislation is required to make the electronic copy the legal copy and to remove the need for paper altogether, although individuals could still order hard-copy certificates should they so choose.

It has been estimated that such a move would save the local registration service and the Home Office around £2.5 million a year, primarily through removing the routine creation of registers containing loose-leaf, watermarked registration documents. Local authorities currently have to pay to store hard copies of all documents, so the change would reduce future storage costs. Provided that sufficient checks are in place, electronic documents are more secure than paper ones, which is particularly important when loose-leaf documents are being moved.

I hope that I have made the case for this amendment, which is very much supported by many in this field, and I hope that the Minister will look favourably on it. I beg to move.

Baroness Byford (Conservative)

My Lords, my opposition to Clause 39 standing part of the Bill forms part of this group. I have listened carefully to what the noble Lord, Lord Clement-Jones, has just said. I come to this from a slightly different angle but the conversation goes round and round in a circle, and here we are trying to introduce protections again.

I tabled my opposition to the clause for probing reasons. I wonder whether it is possible to have examples of when and why a civil registration authority would disclose information. The definition in new Section 19AA(6)(e), introduced in Clause 39, lists as civil registration officials those local authority classifications which also appear as specified public authorities. Do the disclosure powers mean therefore that a civil registration official in, for example, my home county of Leicestershire may disclose information to other personnel employed within the county council, or do they empower him to disclose information to any or all of the other specified public authorities? From my reading of the subsection, that is not quite clear.

Would the regulations be used to divulge information specific to a person or perhaps a family, or could they ever cover everything registered at a particular time or relating to a particular location? For example, why would the NHS have an interest in receiving such information?

Could this chapter result in a large-scale information exchange between civil registration officials and public authorities using the internet? If so, how will such data be protected both in transit and at the receiving end? Do all public authorities use the same methods to guard against data theft and hacking? I shall be interested to hear the Minister’s response.

Baroness Hamwee (Liberal Democrat)

My Lords, perhaps I may ask a couple of questions which arise from the fact sheet on this issue. On civil registration, it says:

“The Bill establishes a framework, with appropriate safeguards, to share bulk registration information where there is a clear and compelling need”.

I wonder whether the Minister can help the Committee in understanding where that is translated into the Bill. The fact sheet also says:

“There are no intentions to share data with the private sector or for data to be used for any commercial purposes”.

It then goes on to say that,

“the powers would not permit this”.

However, I am sure that the Minister will understand my querying the words “no intentions”, because they suggest that there could be a change, and possibly one with which Parliament is not hugely involved. I am going to assume that the points made by the Delegated Powers and Regulatory Reform Committee are in the rather large pile of items that it raised and which the Government will reply to before Report, so I am referring to that only in passing, but it would be very helpful to understand how the points in the fact sheet, which is where many people would start, move over into the legislation.

Lord Keen of Elie (Conservative)

My Lords, the proposals in Chapter 2 of Part 5, which are being addressed here, will ensure that citizens are able to access future—can I have a moment to sort out my own speaking notes?

Lord Maxton (Labour)

While the Minister is doing that, can I ask whether this amendment covers Scotland? He is replying as the noble and learned Lord, Lord Keen of Elie. Registration of births, deaths and marriages was not introduced in Scotland until 1855 rather than 1837—I think—so does this amendment cover Scotland?

Lord Keen of Elie (Conservative)

I believe it was 1836 in England not 1837.

Lord Maxton (Labour)

It was 1855 in Scotland.

Lord Keen of Elie (Conservative)

It does not extend to Scotland. It is a provision pertaining to England and Wales. I am obliged to the noble Lord for giving me time to find my place in my notes. It is greatly appreciated.

As I said, the proposals in Chapter 2 of Part 5 will ensure that citizens are able to access future government digital services efficiently and securely, while removing the current reliance on paper certificates. I will address the two amendments first before addressing the clause stand part aspect of this debate.

Amendment 113 would add a requirement for a civil registration official to be satisfied that the information is required by a recipient to fulfil one or more of their functions before disclosing data and also seeks to add a requirement that an individual must have given valid consent under data protection legislation prior to any disclosure of their personal data. With respect, this amendment is unnecessary because disclosure of personal data under these clauses will already be subject to the provisions of the Data Protection Act. To require explicit consent in all cases would exceed the requirements of the Data Protection Act and the purpose of this clause. Disclosure will take place without consent only if to do so would be consistent with the Data Protection Act, which governs fair disclosure. Examples of how the powers would be exercised in practice include allowing registration officials to disclose information within and across local authority boundaries in order to safeguard children. Being able to share information will ensure that children are known to the local authorities in which they reside and action can be taken to address any needs of the child or the parent. That is what lies behind this matter.

Amendment 116 seeks to amend the Births and Deaths Registration Act 1953 to introduce an electronic register for the registration of births and deaths. However, the proposed amendment to Section 25 of the 1953 Act as currently drafted does not go far enough. The legislation which provides for the registration of births and deaths is based on legislation in place in 1836—or 1837—and very little has changed to the process of registering births and deaths since then. The Act would need more amendment in order to introduce an electronic register. Moving to an electronic register would remove the requirement for hard-copy registers and the electronic register of births and deaths would be the legal record instead of the paper registers. It is certainly an area of reform that the Government are keen to take forward. However, we need more time. I reassure noble Lords that the Government will look in more detail at what changes need to be made to the Act in order to bring in this change and we will consider legislating in due course. We recognise the benefits that the noble Lord, Lord Clement-Jones, suggested could be achieved once that entire process is completed. In light of those points, I hope that noble Lords will agree not to press that amendment.

I turn to my noble friend Lady Byford and her opposition to the clause standing part of the Bill. Unless there is a specific statutory gateway, information from the records of births, marriages, civil partnerships and deaths may not be disclosed by registration officials other than in the form of a certified copy of an entry, such as a birth or death certificate, on payment of the statutory fee. As I have indicated, the system is outdated and based on paper processes from the 19th century. This clause introduces new data-sharing powers that allow registration officials to share data from birth, death, marriage and civil partnership records with public authorities for the purposes of fulfilling their functions. However, only the minimum amount of data will be provided to enable the public authority to fulfil the function.

My noble friend asked for examples of the benefits of sharing such registration data. Being able to share data about deaths with local authorities would assist in combating housing tenancy fraud. The National Fraud Authority estimates that housing tenancy fraud costs local authorities £845 million each year. An example of this is when someone continues to live in a property following the death of the tenant even when they have no right to do so. The sharing of birth data within the local authority would assist social services, for example, if they wanted to engage with one of the parents in the interests of a child. Sharing marriage data would help to target those living together if there were a fraudulent claim to be single for the purposes of claiming benefits. Sharing death data within local authorities would help them to recover medical equipment following the death of an individual.

There are many examples where such data sharing would be of assistance. It paves the way for citizens to access government services more conveniently, efficiently and securely, for example, by removing the current reliance on paper certificates to access services. This will provide more flexibility and will modernise how government services are delivered. An example is where registration officials will be able to share data on births that have occurred in one district, but where those concerned live in a neighbouring district with no hospital. This would allow local authorities more accurately to plan the provision of health care, school planning and other local services. Being able to share death data across boundaries will also help to prevent unwanted mail being sent to the family of a deceased person.

Registration officials will be able to share registration data only with the public authorities defined in new Section 19AB of the Registration Service Act 1953. Any data sharing will of course be carried out strictly in accordance with the requirements of the Data Protection Act. The sharing of registration data will be underpinned by a statutory code of practice as required by Section 19C. One of the requirements in the code will be that the Registrar-General must personally approve any request for the sharing of large amounts of data.

Before data are shared, the code of practice requires privacy impact assessments and data-sharing agreements to be drawn up and agreed with public authorities to include such things as how data are to be used, stored and retained. Data will be able to be used only for the purpose they have been provided and retained only for as long as necessary. Data-sharing agreements will forbid the creation of a database or the linking of registration data in any way. Any breach would be reported to the Information Commissioner, who has the power to impose penalties where it is appropriate to do so. I hope that that deals with the fears expressed about the bulk use of such registration data.

Lord Clement-Jones (Liberal Democrat)

My Lords, I am not sure whether the Minister has dealt with the questions raised by my noble friend.

Lord Keen of Elie (Conservative)

I apologise for omitting to respond to the questions asked by the noble Baroness, Lady Hamwee, by reference to the fact sheet. Rather than poring over the provisions of the Bill, I will undertake to write to her pointing out the cross-reference between the terms of the fact sheet and the relevant provisions in the Bill. I will place a copy of that letter in the Library.

Lord Clement-Jones (Liberal Democrat)

My Lords, I thank the Minister for his response, but I am a little bit baffled. Here we are—and I am talking here particularly with reference to Amendment 116—discussing the Digital Economy Bill. It should be doing what it says on the tin. I put forward, in my name and in the name of my noble friend Lady Scott, who is the inspiration behind the amendment, something that would make sure that it was the electronic copy that was the legal copy. Here is the Minister saying—and I do not think I have ever had a Minister say this to me—that the amendment does not go far enough. That is a very joyous response, but on the other hand he wants more time and “it will all happen in due course”. This is the Digital Economy Bill: what other opportunity are we going to have to ensure that our Registrar-General and so on—the General Register Office and local authorities—are under a legal obligation to hold electronic copies rather than the old, steam-driven paper copies? We have been doing this since 1837 or 1836, as we heard earlier. Is it not about time that we changed our practices, and is it not possible that we have been cooking up an amendment over the last 50 years that might suit the book and be able to appear on Report? That is my response on Amendment 116.

My response on Amendment 113 is a little bit dustier. I have read the code of practice, and I accept the Minister’s assurances; throughout this process he has given a lot of assurances about the impact of the Data Protection Act. There is no doubt about that: either explicit consent or, where no explicit consent is given, it is in accordance with the Data Protection Act and so on. There are some very worthy purposes in terms of data sharing: safeguarding children was an absolutely splendid example for the Minister to produce, and he produced some very good examples to the noble Baroness, Lady Byford, as well. Of course, there are some very good examples, but the code of practice is very opaque in that respect. It really does not get into any of that kind of worthy purpose: it simply talks about disclosing in accordance with the Data Protection Act. I looked through when the Minister was talking to see whether it was the Registrar-General who was the one person who was going to authorise disclosure, and it seemed to me that there were an awful lot more people who were authorised to disclose than simply one person.

There is something defective about these codes of practice. They seem to be far too bland and they do not give the public the reassurance that they should. We have talked about public trust right across the Committee, and the fact is that the reason why so many amendments have come forward from a variety of different sources to this part of the Bill is precisely that lack of trust. I suggest that the Minister and his colleagues look again at whether these codes of practice are doing their job.

That is another reason why, at the end of the day, these codes of practice should be approved by Parliament. That has also been a running theme of the Delegated Powers and Regulatory Reform Committee, which had it absolutely right in every single chapter that it dealt with. These codes of practice should be approved by Parliament. Otherwise, I do not believe that the Government are going to build that public trust in this data sharing, which is absolutely essential. The Minister should look again at that aspect, but in the meantime, having given the Minister a hard time at this time of night, I beg leave to withdraw the amendment.

Amendment 113 withdrawn.

Amendments 114 and 115 not moved.

Clause 39 agreed.

Clause 40 agreed.

Amendment 116 not moved.

Clause 41: Disclosure of information to reduce debt owed to the public sector

Amendment 117 not moved.

Clause 41 agreed.

Lord Stevenson of Balmacara (Labour)

My Lords, in an idle moment, a moment of complete frivolity, I looked up GOV.UK to check facts—I thought that would be a useful contribution to the debate. The date we have all been searching for is 1837: the General Register Office is part of Her Majesty’s Passport Office and contains records dating back to 1837. I thought that would be useful.

I beg to move Amendment 117A in my name. This stems from my period of service as chairman of a wonderful charity called StepChange, which deals with individual debt owed by ordinary people. In the time I was there—I resigned about two years ago—we had about 600,000 people a year contacting the telephone helpline or going online to try to seek solutions to their debt problems, so it is a very significant problem in British society and something we must take a great deal of care about. Most people who came to us were struggling with multiple debts; in other words, they owed money to a variety of different sources, ranging from local authorities, mobile phone companies, debt collection agencies, Revenue & Customs, payday lenders, utility companies and catalogue lenders—there is a very large number of them.

A median client would be aged about 45, female and owing about £20,000 to eight different creditors, so it is a significant problem that people get into. Within that, with a tremendous requirement now for debt advice, with lots of people struggling with debt, one worrying trend has been how bad central and local government have been in dealing with people, particularly those with multiple debts. A recent survey of about 1,000 StepChange clients found widespread aggressive enforcement from local authorities even when people were asking their authority for help. Clients were more than twice as likely to be threatened with court action or bailiffs than to be offered an affordable payment option. This is despite guidance being issued by central government about how debts should be treated.

Of course, what happens when people face strong demands, very often from central or local government, is that they tend to go to people who can lend them money quickly, probably from an existing credit line, almost certainly, until recently—but even today it is still happening—taking out a payday loan. They try to borrow more to try to pay back original debts and get themselves into a worse situation than they were before. The same survey asked clients to rate what their creditors had done to them and whether they treated them fairly or unfairly. I am afraid to say that public sector creditors came out very badly, occupying three of the top six places in the unfair treatment table. It is interesting to note that HMRC, for instance, scored no better than payday lenders, which the Government, through the FCA, have spent a lot of time trying to sort out over recent years.

That is the background of our concern. We welcome the provisions in the Bill to think again about how debts owed to the public sector are collected. In that light, these amendments are put forward for suggestion, they are probing amendments at this stage, and I hope that they will elicit a response, because it is not just StepChange, the debt charity, that has been concerned about this. Citizens Advice has also raised concern about public sector debt collection practices, finding that public sector creditors are,

“mostly out of step with financial services and utilities companies when it comes to setting affordable repayment rates, and that our clients can suffer detriment when public bodies have uncoordinated and inconsistent approaches to debt collections ... central government debt collection lags behind the higher standards expected of other creditors”.

This is focused on individuals who have problems with their debts, but of course there is a wider cost to society as a whole which, through relationship breakdown, homelessness and difficulties with maintaining concentration at work, et cetera, has been estimated at about £8 billion a year. The Bill contains clauses that relate to this and they seem to suggest that central government as a whole—but in this case HMRC—are thinking about how the data-sharing powers that are coming should be used to allow them to collect several debts at once, but also to do it in a slightly different way. I hope that is the case. We are back with our old friend, the code of practice, because what is said in the code of practice will determine whether this will work.

I have, then, four things I invite Ministers to respond to. First, Clause 45 is limited to departments that seek data-sharing powers and says only that they should “have regard to” the code of practice. This has, I think, been picked up in other amendments that we have considered today. It would be good if the code of practice were also embedded in a much stronger statutory provision, to give it a real bite. We have seen examples of guidance—I mentioned one involving central government issuing guidance on council tax collection methods—but such guidance does not work, because it is non-binding and only advisory. If there is a code, it should be embedded in the statute and people affected by it should be able to refer back to it to make sure that it works properly.

Secondly, the public body itself must believe that this is the way in which it needs to operate. Within the amendments are a range of issues that central government bodies might pick up that would match the best practice in utilities, banks, credit cards and store cards—all of which have been through the cycle of trying to get money out of individuals who owe them and other people money, and have recognised that you have to deal with people with multiple debts in a completely different way from those who just owe money directly. That is gradually changing the way people operate. There is further to go, but it is a lesson that should be learned. I hope that the codes can be adapted to reflect that.

Thirdly—this may be too much of an ask, but it should be recognised—this Bill applies only to public bodies, and their creditors, when they are seeking to use the data-sharing powers. The problem is, of course, wider than the data-sharing powers. Problems with central and local government debt collections are widespread: practices need to be reformed and this is not likely to relate only to places where data sharing is used. The Government should think ahead about this and try to set out an understanding for all their agencies that poor debt-collection practices can harm the rate at which they get their money back and the time it takes, and it will also harm the financially vulnerable people. Taking account of that across all their practices would be a very good thing.

These amendments, therefore, try to raise those points, but there is one other thing that the Government should try to do, which is in the first amendment. It is to take a lesson from Scotland—I am sure that the noble and learned Lord from Scotland will wish to pick this up and think harder about it—where, when you have a private or a public debt and seek guidance from the state agency that operates that scheme, you are given statutory protection from excess charges and your interest rates are frozen, providing you stick to your debt repayment plan. That means that people get a breathing space, time to organise their finances, think about their budgets and work out what they are going to do, without the terrible pressure from those who are owed money to start repaying it. It is only when all those issues have been brought together, and an agreement reached between the creditors and the agency, that repayment begins. That has a very much higher rate of success than any other scheme. England lags way behind on this, and it would be no skin off the Treasury’s nose if it took a leaf out of the Scottish Government’s book and brought in their procedures—with a statutory breathing space that gave some hope to people who want to repay their debts but cannot do so because the practices are not as good.

Lord Keen of Elie (Conservative)

My Lords, I acknowledge the point made by the noble Lord, Lord Stevenson, that this is a significant issue, and I understand that this is a probing amendment to allow us to consider some of the wider issues that he has touched on in the debate.

Amendment 117A seeks to include in the Bill an additional purpose: to enable debt information to be shared under the powers provided by Clause 41. It seeks to state explicitly that debt data can be disclosed,

“for the purpose of helping individuals to manage their debts”.

There is also a reference to the breathing space, and I will come back to that point in a moment in response to the questions posed by the noble Lord.

In the first instance, we would venture that the amendment is not necessary. The provisions as drafted enable information to be shared,

“for the purposes of the taking of action in connection with debt owed to”,

a public authority or the Crown. This includes but is not limited to, for example, identifying or collecting debt. The provision is sufficiently broad to enable sharing for the purpose set out in this amendment. That is the position of the Government. The Government are considering the recommendations that have been made following work to look into the merits of introducing a breathing space for customers, which we are aware is available in other jurisdictions. While the Government are considering these recommendations, it would be premature to incorporate a reference to this initiative in the Bill at this time. I hope the noble Lord will accept that the matter is being looked at.

The effect of Amendment 133 would be that any public authority or person providing services to a public authority in identifying or collecting debt, bringing civil proceedings or taking administrative action as a result of debt of that kind would have, in doing so, to comply with the Clause 45 code of practice, regardless of whether they were using the Clause 41 power. A wide range of public authorities and devolved Administrations need flexibility and autonomy to manage their own unique debt portfolios in the most suitable way, and in line with the legislative powers ascribed to them. There are a range of existing procedures and powers specific to particular bodies. We consider that it would be unhelpful simply to cut across these.

Amendment 132 prescribes more detail for the contents of the code. We have already touched upon the codes. Proposed new subsections (3B) and (3C) would require the code to contain provisions requiring specified persons intending to make use of the debt power,

“to have in place procedures to identify vulnerable people and take appropriate account of their needs and circumstances”,

and,

“to assess the affordability of debt repayments by reference to a common standard”.

The code would also have to include provision requiring specified persons, before taking any action following the sharing of information under the debt power,

“to consider the welfare of the people who owe the debt”.

The code of practice already contains fairness principles, which were developed across government and with debt advice charities. These are intended to enable a common approach to fairness when public authorities collaborate to develop pilot activity under the debt data-sharing power. Furthermore, the codes will be put out for further consultation before they are finalised, so we do not want to pre-empt this exercise by inserting requirements at this level of detail on its content at this stage. However, I note what the noble Lord said with regard to the codes. They are still being looked at and will be looked at further in this context.

I understand the desire to ensure that the codes are effective; it is the desire of the Government as well. As the noble Lord observed, you can press so hard in the matter of debt recovery but, as banks and others have discovered in the past, if you press too hard something breaks and nothing is returned. We suggest that the codes provide a strong safeguard for the use of the powers, backed up by real consequences if they are not adhered to. There is a power there to ensure that although the Bill says “have regard to”, it is a legal obligation and suitably flexible in the context of these powers. While we continue to consider the recommendations of the Delegated Powers Committee, which also touched upon this, I invite the noble Lord to withdraw his amendment.

Lord Stevenson of Balmacara (Labour)

I thank the Minister very much for his considered response. I am grateful to him for that. The breathing space proposal has been around for some time, so I was hoping to get a bit of an edge on it but we will clearly have to wait and see. It would provide a very big step forward for how public debts are organised. As I said, how the code of practice is framed is the main issue and I am grateful for the Minister’s thoughts that there might still be opportunities to influence it. What was said today might do that trick but we will certainly look at it carefully. With that, I would like to withdraw the amendment.

Amendment 117A withdrawn.

Clause 42: Further provisions about power in section 41

Lord Ashton of Hyde (Conservative)

My Lords, these amendments apply to the research power, and there is an additional amendment which applies to the statistics power. Together, they add clarity and strength to the set of robust safeguards that have been developed to facilitate the processing and safe disclosure of personal information provided by public authorities for research purposes. To encourage greater use of publicly held data for research in the public interest, it is important that everyone concerned can have confidence that personal information is appropriately protected, while at the same time researchers are able to interrogate the information to produce research findings that further the public interest. These amendments further help strike that balance.

The amendments fall into four categories. First, Amendment 155, to Clause 57(9), makes clear, for the avoidance of doubt, that a public authority that processes another public authority’s personal information must be accredited to do so, as well as to process its own information.

Secondly, Amendments 159 to 180 and Amendment 191 correct defects in the drafting of Clauses 59 and 60. The defect in each clause prevents persons who receive processed information from processors under Clause 57(1) disclosing that information at all if that information meets the wide definition in Clause 57(12), whereas it was always intended that researchers would be able to disclose the information that they receive under the power to other researchers for the purposes of peer review. The amendments also strengthen the unlawful disclosure provisions by adding a new offence which applies to disclosure of a defined category of personal information by a person who has received processed information under Clause 57(1). The information that is protected is consistent with Section 39 of the Statistics and Registration Service Act 2007. The amendments have been drafted in a way that will enable researchers to submit their findings for peer review and for publication in a similar way to current practice under that Act. These amendments have been developed with the assistance of the UK Statistics Authority, which has considerable expertise in this area.

Thirdly, Amendments 183 to 189 and Amendments 192 to 195 tidy up a drafting error by which the code of practice currently applies to the disclosure, holding or use of both personal information and information that is not, or never has been, personal. To apply the code or any other safeguards in this power to information that does not identify or risk identifying individuals would be unnecessarily bureaucratic.

Finally, Amendment 210 to new Section 53A supports devolved statistics by giving the UK Statistics Authority a mechanism to share information with its statistical counterparts in the devolved Administrations. In Northern Ireland, the principal statistical department is the Northern Ireland Statistics and Research Agency, or NISRA. Some of NISRA’s functions are held specifically by its parent department, the Department of Finance. Other statistical functions are held only by the Registrar-General for Northern Ireland. New Section 53A(2) does not currently list the Registrar-General for Northern Ireland as a devolved authority, meaning that UKSA cannot share information with NISRA relating to the Registrar-General’s statistical functions. This amendment resolves this difficulty by adding the Registrar-General for Northern Ireland to the definition of devolved authority in new Section 53A(2). I beg to move.

Amendment 155 agreed.

Amendment 156 not moved.

Clause 57, as amended, agreed.

Clause 58: Provisions supplementary to section 57

Baroness Byford (Conservative)

My Lords, I rise to move the amendment tabled by my noble friend Lord Willetts, who apologises that he could not be here tonight. I have the two other amendments in the same group. Clause 68 makes mandatory the provision of data by Crown bodies to the ONS for defined statistical research purposes. An alternative approach might be for an organisation such as the Information Commissioner’s Office to provide arbitration on contentious requests.

Clear insight into whether the Bill directs Crown bodies to share data from statistics is needed in Clause 68. At the Bill’s Committee stage in the House of Commons, where there was a long discussion on this, Chris Skidmore, Minister for the Constitution in the Cabinet Office, said it would be possible for a Crown body to refuse an ONS request for data and,

“where necessary, have their refusal put before Parliament”.—[Official Report, Commons, Digital Economy Public Bill Committee, 27/10/16; col. 379.]

The Royal Statistical Society’s primary objection to this is that it provides no subsequent mechanism for the ONS to secure access to the data. It is also unclear to it what the process means in practice, which part of the legislature will deal with that correspondence, what it is expected to do with it and what sanctions it can apply for non-disclosure. The RSS has been asking why this is in place and whether it is justified, especially as other countries, such as Canada, operate with less burdensome arrangements. I should say that I am very grateful to the Royal Statistical Society for its briefing, otherwise I would be really lost. The RSS says:

“Including the Minister’s contribution, we have heard two arguments thus far … The Minister explained the different treatments for Crown bodies and other public authorities as being due to conventions: ‘That way of working, set out in sections 45B and 45C, ensures consistency between how a Crown body interacts with another on the one hand, and how a Crown body interacts with a non-Crown body on the other’ … We have also been privy to a different, earlier argument that due to the indivisibility of the Crown, one Crown body cannot give directions to another”.

If we thought earlier discussions were difficult, I think it is getting even more so.

The briefing continues by saying that,

“we have sought and obtained legal advice, which suggests that Parliament could technically direct departments to do what it deems fit. The government’s position, although it is not unprecedented, appears politically or culturally based. It may be that the government has heard objections from some departments to a mandatory approach. We are aware that there could be reluctance on the part of some departments to share data generally, and with ONS and researchers in particular. However, problems of risk aversion to data sharing ought to be addressed without obstructing the proposed right for ONS to access data for statistical purposes, which has been more widely supported and called for, for example, by the Public Administration Select Committee (2013) and the Science and Technology Select Committee (2016), and in other reports described in the House of Commons Library’s analysis”.

There is much more material here but I shall not push the matter further. I hope I have given my noble friend enough to respond to.

My Amendments 208 and 209, which are linked to this, are much simpler and more direct as far as I am concerned, because I am not technically astute on the other topic. Large, well-known charities employ many people using many skills and who are occupied full-time in their jobs. Little charities rely on unpaid volunteers who may not have a wide range of skills and who use their free time to work purely for the charity. I have two examples in mind. The first is Freddie’s Wish, which commemorates a little boy who died in a car crash. His mother set up the charity to help local bereaved families and to raise money for the children’s hospital and the air ambulance. In two years it has raised over £50,000 and trained more than 100 volunteers in paediatric first aid.

The second example is Evelyn’s Gift, which has been a registered charity for less than a year although its founder and volunteers have been working for nearly four years. It is in memory of a seven year-old girl who died of respiratory illness. Its aims are to arrange CPR training and to continue her practice of doing little acts of kindness. The list of acts done in her name and in the name of people and the organisations that support them is inspiring. The charity employs no one and all the work is carried out by unpaid volunteers.

Organisations such as these have no resources to supply the Statistics Board with information. An unpaid voluntary worker would have to give time to filling in forms instead of doing the work he or she has signed up for and dearly wishes to do. It could be difficult to persuade anyone to donate even more time in this pursuit. A small charity with irregular income but making an important local contribution could well be destroyed by a fine levied under new Section 45F(3).

Most people nowadays have heard of charitable shoe boxes. These are sent, filled with practical gifts—hand-knitted hats, scarves and gloves, pens and paper, recycled soft toys, tennis balls and so on—to underprivileged children in Africa and eastern Europe, and, indeed, in our own country. Those who fill them spend their own money and devote much time to making up these boxes. The work is carried out throughout the year and each box going abroad to Africa costs at least £2.50 to transport in November and December. Villages, primary schools, care homes and religious groups donate goods, money, time and effort to reclaiming, recycling and packing huge quantities of otherwise unwanted items. They also raise funds for basic toiletries, small packs of sweets and things such as pens and paper, without which some children cannot go to school. I know of one village that last year sent 1,326 boxes to the central depot.

Who is to fill in the forms for the Statistics Board, and is that really necessary for these very small charities? The boxes come from all over the country. They must not contain liquids, chocolate or sweets dated for expiry before the end of March of the following year. Beyond this, there is no record of contents, value or hours worked. With such charities, my concern is that the figures available to the Statistics Board will be solely to do with the transport of the finished items. That would surely distort the results of any study by the board. I suggest that we should therefore exempt such charities from the Bill. I beg to move.

Viscount Ullswater (Conservative)

I must advise your Lordships that, if this amendment is agreed to, I will not be able to call Amendments 200 to 202 because of pre-emption.

Baroness O'Neill of Bengarve (Crossbench)

My Lords, I rise briefly to support this amendment. There seems to be something quite perverse in obstructing the access of the Statistics Board to datasets that are in the hands of other public bodies. That is a very simplified account, but it is a curious place in which to have an obstacle. I hope that the Minister can consider this clause very seriously.

Lord Keen of Elie (Conservative)

I am obliged to the noble Baronesses for their interest in this part of the Bill. As your Lordships will be aware, Clause 68 gives the UK Statistics Authority the powers to access important data needed to produce official statistics to support decision-making.

On Amendment 199, new Section 45B gives UKSA a right of access to information held by Crown bodies. A Crown body must respond in writing to a formal notice issued by the UK Statistics Authority and explain any refusal to give the authority information. If the Crown body’s explanation is inadequate or it fails to respond or comply, the UK Statistics Authority may lay the request and any response before the relevant legislature. A Crown body must therefore either comply with the notice or explain its refusal in writing. Where the Statistics Authority puts that correspondence before Parliament, then Parliament can judge the body’s actions openly and transparently. We consider that this is the right approach, creating effective, proportionate accountability and transparency.

Of course, my noble friend Lady Byford would argue that the amendment is a more effective means of requiring a Crown body to give the Statistics Authority the information. We cannot accept that it is either necessary or desirable. The Statistics Authority is part of the Crown, as are government departments. As my noble friend anticipated, it would be extremely novel, and possibly unprecedented, to legislate to compel one part of the Crown to obey another. Even the Health and Safety at Work etc. Act 1974 excludes the Crown from being subject to enforcement measures such as prosecution, instead providing long-standing structures to help departments to work with each other administratively. In this context, new Section 45B strikes the right balance. I hope that explanation reassures my noble friend.

On Amendments 208 and 209, there may have been some misunderstanding. New Section 45D allows the UK Statistics Authority to require information from undertakings, excluding micro-businesses and small businesses. It defines small and micro-businesses using Section 33 of the Small Business, Enterprise and Employment Act 2015, and these definitions cover charities along with other voluntary and community bodies. Accordingly, they are excluded, and the examples that my noble friend gave would, on the face of it, be excluded from these provisions.

There is a further point to be made about this, which I shall come to in a moment. The Statistics Authority is committed to using its powers in a proportionate and fair way that minimises burdens associated with producing statistics and has set this out in its draft statement of principles. In the first instance, the UKSA would look to obtain information from large, preferably national, data holders rather than seek it from multiple small data holders. This reflects the policy intention there should be no new burdens on small undertakings, including charities. New Section 45D reflects this principled approach by excluding small undertakings, based on limited headcount and finances. As I said before, that would include charities as well as other voluntary organisations.

One point that I would note is that Section 33 of the 2015 Act has not yet been commenced. We are exploring transitional arrangements to address this, and intend to return to this matter on Report. However, in the present circumstances, I invite my noble friend to withdraw the amendment.

Baroness Byford (Conservative)

I am very grateful to my noble and learned friend for his response. I am unable to really comment properly on Amendment 199, because I would like my noble friend Lord Willetts to have a chance to read and reflect on the Minister’s response to that issue.

On my own two amendments, I thank him for his comments. One thing that has always troubled me with charities is that sometimes you have a small charity that has a large income, but at the other end you have a large charity with a very small income. I am not totally clear, but I shall read very carefully on whether the lay-down that we have at the moment on micro and small is correct for what I am trying to suggest the Government should think about. However, I thank the Minister for his full response, which I shall read carefully in Hansard. In the meantime, I beg leave to withdraw the amendment.

Amendment 199 withdrawn.

Baroness Finlay of Llandaff (Crossbench)

My Lords I declare my interest as chair of the National Mental Capacity Forum, and in that role I have been working closely with the Office of the Public Guardian.

For some time the Public Guardian has wanted to move away from the wet signature requirement for the creation of lasting power of attorney for both health and welfare, and property and financial affairs decisions, as laid out in the Mental Capacity Act 2005. This amendment would allow that process to be purely electronic and carried out online, with the safeguards it outlines. A digital process should now be secure given the advances in technology since the original provision was made, and the amendment would simply allow the Secretary of State to make appropriate regulations rather than creating the process.

As the hour is late I am inclined to ask the Minister, if he has any reservations about this amendment and the powers it would give to the Secretary of State, to curtail the debate by meeting with me and the Public Guardian before Report. However, I am rather pre-empting the Minister’s decision. If he decides to accept my amendment, that would be just wonderful. I beg to move.

Lord Keen of Elie (Conservative)

My Lords, in view of the hour, it occurs to me that it would be appropriate to give a lengthy and detailed analysis of powers of attorney, and, indeed, to take us back to the Powers of Attorney Act 1971 and the subsequent developments of the law. Nevertheless, and despite the enthusiasm from the Opposition Benches, I am perfectly happy to accept the kind invitation advanced by the noble Baroness, Lady Finlay, and to meet with her to explain the Government’s position on this matter. I would be obliged if she could at this stage withdraw the amendment.

Baroness Finlay of Llandaff (Crossbench)

My Lords, in light of the forthcoming meeting—which I am sure the Public Guardian will wish to join—I beg leave to withdraw the amendment.

Amendment 213D withdrawn.

House resumed.

House adjourned at 10.22 pm.