Data Protection and Digital Information (No. 2) Bill
Public Bill Committee, 10 May 2023.
Philip Hollobone (Conservative, Kettering)
Before we begin, I have a couple of preliminary announcements that Mr Speaker has asked me to draw to your attention. Hansard colleagues would be grateful if Members emailed their speaking notes to hansardnotes@parliament.uk. Please switch electronic devices to silent. Tea and coffee are not allowed during sittings.
Today we will first consider the programme motion on the amendment paper. We will then consider a motion to enable the reporting of written evidence for publication and a motion to allow us to deliberate in private about our questions before the oral evidence session. In view of the time available, I hope we can take these matters formally—without debate. The programme motion was discussed yesterday by the Programming Sub-Committee for this Bill.
Philip Hollobone (Conservative, Kettering)
Copies of written evidence that the Committee receives will be made available in the Committee Room and circulated to Committee members by email. We will now go into private session to discuss lines of questioning.
Examination of Witnesses
Philip Hollobone (Conservative, Kettering)
We are now sitting in public again and the proceedings are being broadcast. Before we hear from the witnesses, do any Members wish to make a declaration of interest in connection with the Bill?
Jane Hunt (Conservative, Loughborough)
I am not sure whether this is a declaration of interest, so I will mention it just in case. I have had a meeting with Leicestershire Police Federation and I am interested in an amendment that it would like tabled.
Damian Collins (Conservative, Folkestone and Hythe)
I am not sure whether this is directly relevant to the Bill or adjacent to it, but I am an unpaid member of the board of the Centre for Countering Digital Hate, which does a lot of work looking at hate speech in the online world.
Mark Eastwood (Conservative, Dewsbury)
Given that one of today’s witnesses is from Prospect, I wish to declare that I am a member of that union.
Stephanie Peacock (Labour, Barnsley East)
I am a proud member of a trade union. I refer the Committee to my entry in the Register of Members’ Financial Interests.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
I am a proud member of two trade unions.
Rupa Huq (Labour, Ealing Central and Acton)
Should we declare our membership of any union?
Philip Hollobone (Conservative, Kettering)
My advice is that it is always better to declare.
Rupa Huq (Labour, Ealing Central and Acton)
Okay. I am a member of Unison, formerly the National and Local Government Officers Association.
Christian Wakeford (Labour, Bury South)
I am also a member of a union.
Mike Amesbury (Labour, Weaver Vale)
I am a member of Unison and the GMB.
Philip Hollobone (Conservative, Kettering)
We will now hear oral evidence from John Edwards, the Information Commissioner, and Paul Arnold, the deputy chief executive and chief operating officer of the Information Commissioner’s Office. I remind all Members that questions should be limited to matters within the scope of the Bill, and that we must stick to the timings in the programme order, which the Committee has agreed. For this panel, we have until 9.55 am. Will the witnesses please introduce themselves for the record?
Philip Hollobone (Conservative, Kettering)
May I gently say to the witnesses that this is a big room, so you will need to project your voices so that we can hear your evidence?
Stephanie Peacock (Labour, Barnsley East)
Q Good morning and welcome. The Bill creates a new body corporate to replace the corporation sole. What impact, both in the short and long term, do you think that will have on its ability to carry out its functions?
Stephanie Peacock (Labour, Barnsley East)
I would like to ask about the independence of the ICO as it stands. Do you have any experience of being directed by the Secretary of State in a way that has threatened the regulator’s impartial position?Q
Stephanie Peacock (Labour, Barnsley East)
If the Bill is passed in its current form, the Secretary of State—whoever that might be—will have the ability to approve and veto statutory codes of practice produced by the commission, as well as to set out a statement of strategic priorities to which the commission will have to adhere. Do you perceive that having any impact on your organisation’s ability to act independently of political direction?Q
Stephanie Peacock (Labour, Barnsley East)
If the Secretary of State can veto a code of practice that the commission has produced regarding the activities of Government, will that not mean that they are, effectively, marking their own homework?Q
Stephanie Peacock (Labour, Barnsley East)
I will come on to a slightly different topic now. The ICO will play a huge role in enforcing the measures in the Bill. Is there enough clarity in the Bill to ensure that the commission is able to do that effectively? For example, are you clear on how the commission will enforce the law surrounding terms like “vexatious” and “excessive” with regards to subject access requests?Q
Stephanie Peacock (Labour, Barnsley East)
Linked to that, what about terms like “meaningful human involvement” and “significant decision” with regards to automated decision making?Q
Stephanie Peacock (Labour, Barnsley East)
Parts of the Bill refer to there being “meaningful human involvement” and “significant decisions” within automated decision making. That might be in an application for a mortgage or in certain parts of employment. Do you feel that you can interpret those words effectively?
Stephanie Peacock (Labour, Barnsley East)
That is useful. Thank you.
Damian Collins (Conservative, Folkestone and Hythe)
Q Continuing with that theme, the Bill uses a broader definition of “recognised legitimate interests” for data controllers. How do you think the Bill will change the regime for businesses? What sort of things might they argue they should be able to do under the Bill that they cannot do now?
Damian Collins (Conservative, Folkestone and Hythe)
Q How would you define that clarity that the Bill is seeking? If a data controller thinks, “Well, if I have legitimate business interests, I can make an excuse for doing whatever I like,” that surely is not what the Bill intends. How would you define the clarity that you say the Bill seeks?
Damian Collins (Conservative, Folkestone and Hythe)
Q How would you test it?
Damian Collins (Conservative, Folkestone and Hythe)
Q Does this change things very much? It sounds like you are saying that business may assert it has a legitimate interest, but if you think it does not, you can investigate and take action as the law stands currently, effectively.
Damian Collins (Conservative, Folkestone and Hythe)
Q Is more clarity needed about the use of inferred data? Major social media platforms rely on inferred data to drive their recommendation tools and systems. There are then questions about whether inferred data draws on protected data characteristics without user permission. A platform might say that that is part of its recognised legitimate business interests, but users might say that it is an infringement of their data rights. Is that clear enough?
Damian Collins (Conservative, Folkestone and Hythe)
Q Your predecessor raised the issue of the use of inferred data among users’ protected data characteristics—political opinions, religious beliefs, sexual orientation—and said that, without the user’s informed consent, that could not be legal. Do you agree with that?
Damian Collins (Conservative, Folkestone and Hythe)
Q These are quite important matters because inferred data is such an important part of data processing for major platforms, be it a company assessing someone’s attitude to risk and how that affects the way they might use a gambling product, versus taking someone’s personal, private information, inferring things from it and making them open to suggestions they may not want to receive without their informed consent. That is a grey area, and I wonder whether you think the Bill provides greater clarity, or you think there needs to be more clarity still.
Philip Hollobone (Conservative, Kettering)
It is a really tight timetable this morning and we have nine minutes left. The Minister wants to ask some questions and there are three Members from the Opposition. I will call the Minister now. Perhaps you would be kind enough, Minister, to leave time for one question each from our three Members of the Opposition.
John Whittingdale (Conservative, Maldon)
Q Thank you, Mr Hollobone. Good morning, Mr Edwards. Both the structure and powers of your office are going to change as a result of the Bill. Do you believe that the existing structure and the absence of the powers you will gain under the Bill have in any way impeded the carrying out of your functions?
John Whittingdale (Conservative, Maldon)
In the interests of time, I will ask you one other question. Mr Edwards, you had experience as the New Zealand Privacy Commissioner Q for some time. New Zealand is one of the countries recognised as having data adequacy by the European Union. Can you give us a view, based on your experience of dealing with the European Union, of whether there is any concern about the Bill that might put at risk the UK’s data adequacy recognition from the EU?
Philip Hollobone (Conservative, Kettering)
It is a brutal cut-off, I am afraid, at 9.55 am. I have no discretion in this matter. It is a quick-fire round now, gentlemen. We need quick questions and quick answers, with one each from Carol Monaghan, Chi Onwurah and Mike Amesbury.
Carol Monaghan (Scottish National Party, Glasgow North West)
Clause 40 sets out the criteria by which a data controller can refuse data access requests. Do you think this is appropriate? Are you concerned that it may lead to a situation in which only those who can afford to pay a potential fee will be able to access their data?Q
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q The Bill’s intent is to reduce burdens on organisations while maintaining high data protection standards. Do you agree that high data protection standards are promoted by well-informed and empowered citizens? What steps do you think the Bill takes to ensure greater information empowerment for citizens?
Mike Amesbury (Labour, Weaver Vale)
Q Drawing on your expertise, is there anything missing from the Bill that you would have liked to see?
Philip Hollobone (Conservative, Kettering)
We have a late entry—the last question will be from Rupa Huq.
Rupa Huq (Labour, Ealing Central and Acton)
Q When I was on the Criminal Finances Bill Committee, lots was promised, but the National Crime Agency then claimed that it was not financed enough to pursue all the unexplained wealth orders that were promised. Do you think that a beefed-up Information Commission will be sufficiently well resourced to do all the things it is meant to do?
Philip Hollobone (Conservative, Kettering)
Gentlemen, thank you very much indeed for your evidence. You can now breathe, relax and enjoy the rest of your day.
Philip Hollobone (Conservative, Kettering)
Q We will now hear oral evidence from Eduardo Ustaran, global co-head of the privacy and cyber-security practice at Hogan Lovells, who is appearing via Zoom; Vivienne Artz OBE, who is in the room; and Bojana Bellamy, president of the Centre for Information Policy Leadership, who is also appearing via Zoom. For this session we have until 10.25 am. Will the witnesses introduce themselves for the record, starting with Vivienne Artz?
Philip Hollobone (Conservative, Kettering)
Will Eduardo Ustaran please introduce himself? Can you hear us, Mr Ustaran? No. Can you hear us, Bojana Bellamy? No. Okay, we will start with our witness who has been kind enough to join us in the room.
Stephanie Peacock (Labour, Barnsley East)
Q Welcome. Vivienne, would you be in favour of implementing a smart data regime in your industry? If so, why?
Stephanie Peacock (Labour, Barnsley East)
Q Could you give more detail on who you think would benefit or lose out, and in what ways?
Stephanie Peacock (Labour, Barnsley East)
Q Brilliant. What are your thoughts on giving the Secretary of State the power to amendment data protection legislation further? Do you think it is necessary to future-proof the Bill?
Stephanie Peacock (Labour, Barnsley East)
I have more questions if our other witnesses are with us.
Philip Hollobone (Conservative, Kettering)
We still have not heard definitively whether our other guests can hear us or speak to us, so we are waiting for confirmation from the tech people. In the meantime, I invite the Minister to question Vivienne Artz.
John Whittingdale (Conservative, Maldon)
Q You have a lot of experience in respect of international data transfers. The European Union has a number of data adequacy agreements around the world, but the process to establish them has been slow. How do you think the Bill will make it easier for us to improve international data agreements? What prospects are there for the UK to establish such agreements, and with which countries?
John Whittingdale (Conservative, Maldon)
Q Obviously it is already possible for us to undertake international data transfers to countries with which we do not have an adequacy agreement. Can you set out the advantages of having a general adequacy agreement in terms of data transfer and the benefits to the UK economy?
John Whittingdale (Conservative, Maldon)
Thank you.
Philip Hollobone (Conservative, Kettering)
We can see Mr Ustaran and Ms Bellamy and they can hear us, but we cannot hear them, so we will carry on with questioning Vivienne Artz.
Carol Monaghan (Scottish National Party, Glasgow North West)
A number of organisations have expressed concerns about moving to a situation in which we can refuse subject access requests or indeed charge a fee. Do you believe the thresholds in the Bill are appropriate and proportionate?Q
Carol Monaghan (Scottish National Party, Glasgow North West)
Do you think the threshold for something to be considered vexatious or excessive is well understood?Q
Carol Monaghan (Scottish National Party, Glasgow North West)
How frequently do we expect such requests to be refused off the back of this legislation?Q
Philip Hollobone (Conservative, Kettering)
Q Ms Bellamy and Mr Ustaran, we can now hear both of you. Would you be kind enough to introduce yourselves?
Philip Hollobone (Conservative, Kettering)
Thank you. Chi Onwurah and Damian Collins are lined up to ask questions, but I want first to ask the shadow Minister whether she has any further questions, followed by the Minister. Because we have one witness in the room and two online, please will whoever is asking the question indicate whom you are asking it of?
Stephanie Peacock (Labour, Barnsley East)
Q Good morning to our guests joining us via Zoom. Ms Bellamy, in your opinion has it been difficult for businesses to adapt to the EU GDPR? If so, do you think the changes in the Bill will make it easier or harder for businesses to comply with data protection legislation?
Stephanie Peacock (Labour, Barnsley East)
Q Mr Ustaran, what do you perceive the value of EU adequacy to be? What would be the consequences for your businesses and other businesses and the UK market of losing such an agreement?
Stephanie Peacock (Labour, Barnsley East)
Q You have answered my next question—thank you—but I will pose it to the other witnesses, who may have something to add. In the previous session, the Information Commissioner said that he did not think the Bill was a threat to adequacy. That is comforting, but it is not confirmation, because the only people who have the power to decide whether adequacy stands are the European Commission. Do you think any of the measures in the Bill pose a risk to the adequacy agreement?
Philip Hollobone (Conservative, Kettering)
We have 12 minutes left and two Members are indicating that they wish to ask questions after you, Minister.
John Whittingdale (Conservative, Maldon)
Q I will be very quick, Mr Hollobone. Ms Bellamy, you have suggested that in some ways the regime that the Bill puts in place is superior to that of the existing GDPR and that it certainly does not risk our adequacy recognition in any way. Given the development of technology and the increasing use of things like AI, to what extent do you think the EU might follow the same sort of path that the Bill sets out to try to create a more flexible and a state-of-the-art regime?
Philip Hollobone (Conservative, Kettering)
Five minutes left. This will be the quick-fire round. I have two Members indicating that they wish to ask questions—Chi Onwurah.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Thank you, Mr Hollobone. We have heard that the intent in the Bill is in part to reduce the burden on organisations from data protection. We heard you set out what some of those burdens might be. The organisations affected by this Bill, and the organisations with which you work in different ways, operate in different jurisdictions. I think you, Ms Artz, set out quite well the challenges of having—or trying to have—the same regime in different jurisdictions. If forced to make a choice between following the European Union regime and following a divergent UK regime, what choice would the organisations with which you work make?
Philip Hollobone (Conservative, Kettering)
Please choose one witness.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Mr Ustaran, please.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Could I—
Philip Hollobone (Conservative, Kettering)
Sorry. It must be one quick question and one quick answer. We must finish at 10.25 am. Damian Collins.
Damian Collins (Conservative, Folkestone and Hythe)
Q Ms Artz, one of the complaints about the current GDPR regime has been, for example, that oligarchs use it aggressively to target investigative journalists conducting legitimate investigations into their business activities, to bombard them with data access requests. Do you think that the provisions in the Bill around vexatious requests will help in that situation? Do you think that it will make any difference?
Philip Hollobone (Conservative, Kettering)
I thank all three witnesses for their time this morning and their extremely informative answers to the questions. Our apologies from Parliament for the tech issues that our two Zoom contestants had to endure. Thank you very much indeed. We will now move on to our third panel.
Philip Hollobone (Conservative, Kettering)
Q Welcome. We will now hear oral evidence from Neil Ross, Associate Director for Policy at techUK, and Chris Combemale—I hope I pronounced that correctly—the Chief Executive Officer of the Data and Marketing Association. Gentlemen, this session, as you have seen from the previous two, has to end no later than 10.50 am. I will be grateful if you could be kind enough, please, to introduce yourselves to the Committee for the record.
Philip Hollobone (Conservative, Kettering)
I apologise for getting your surname pronunciation wrong, Mr Combemale.
Stephanie Peacock (Labour, Barnsley East)
Q Welcome to the witnesses. TechUK’s response to the withdrawn Bill last autumn stated that it
“could go further in seeking the full benefits of data driven innovation”.
Does this amended Bill go further?
Stephanie Peacock (Labour, Barnsley East)
Q How have your members found adapting to GDPR? Will the Bill make it easier or harder for those that you represent to comply?
Stephanie Peacock (Labour, Barnsley East)
Q On the changes to requirements to report suspicious activity related to unsolicited direct marketing, do the telecoms companies among your members have the technical capability to identify instances of mass unsolicited direct marketing in order to report as required?
Stephanie Peacock (Labour, Barnsley East)
Q On that point, do the telecoms companies feel that they have been consulted properly in the making of the legislation?
Stephanie Peacock (Labour, Barnsley East)
Q I was asking about that. Chris, will the changes to the cookies set out in the Bill benefit, first, the consumer experience and, secondly, your members or businesses?
Stephanie Peacock (Labour, Barnsley East)
Q Is the technology available to centralise cookies by browser?
Stephanie Peacock (Labour, Barnsley East)
Q Is there a concern that centralising cookies by browser will entrench power in the hands of the larger tech companies that own the browsers?
Stephanie Peacock (Labour, Barnsley East)
Q Is the risk in centralising cookies by browser that we could confuse liability, for example who is responsible for a breach of cookie regulation?
Stephanie Peacock (Labour, Barnsley East)
Thank you.
John Whittingdale (Conservative, Maldon)
Q Mr Ross, I know that techUK has been supportive of a number of elements of the Bill, particularly around the opportunities created by the use of smart data. Will you set out your view of the opportunities, and how the Bill will help to attain them?
John Whittingdale (Conservative, Maldon)
Q Which particular sectors offer the most opportunity?
John Whittingdale (Conservative, Maldon)
Q Thank you. Mr Combemale, will you set out some of the obstacles for your organisation, and how you would like the Bill to reduce them?
Carol Monaghan (Scottish National Party, Glasgow North West)
Q We have heard already this morning that a number of words and phrases could have some ambiguity associated with them, such as the word “excessive”, and the Bill allowing certain cookies that are “low risk”. Do you think that the phrase “low risk” is well enough understood?
Carol Monaghan (Scottish National Party, Glasgow North West)
Would that then be the definition of low risk?Q
Carol Monaghan (Scottish National Party, Glasgow North West)
I might come back to that in a second, but I think Neil wanted to add somethingQ .
Carol Monaghan (Scottish National Party, Glasgow North West)
Chris, you said that you are not a lawyer and cannot define what low risk is, but there will of course have to be some sort of definition. Have we captured that well enough?Q
Carol Monaghan (Scottish National Party, Glasgow North West)
The potential difficulty here is that the responsibility is being put on the company. You have described a responsible company that categorises levels of risk and takes action accordingly. Without a clear definition, if it were a less scrupulous company, would there be a grey area?Q
Philip Hollobone (Conservative, Kettering)
There are five minutes left and there are two Members seeking to ask questions.
Damian Collins (Conservative, Folkestone and Hythe)
Q With regards to children’s data rights, do you think the Bill will have any implications for the way in which the age-appropriate design code has been implemented by companies working within it at the moment? It is not expressly written into the Bill, but do you expect there to be change?
Damian Collins (Conservative, Folkestone and Hythe)
Q Can you give any examples of that?
Damian Collins (Conservative, Folkestone and Hythe)
Q Could you give an example more directly related to children?
Mike Amesbury (Labour, Weaver Vale)
Q The Bill enables the commissioner to impose a fine of £1,000. Is that a reasonable deterrent?
Mike Amesbury (Labour, Weaver Vale)
Q For non-compliance.
Mike Amesbury (Labour, Weaver Vale)
Q For some companies, £1,000 will be small fry.
Philip Hollobone (Conservative, Kettering)
There are two minutes left. Chi Onwurah has the last question.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Mr Combemale, you set out some of the challenges of having centralised cookie management, and how that would give more power to the browsers. What you did not set out was how we could give more control and power to customers—citizens—over how they use their data. What are you doing to ensure that consumers have more control over how their data is used? You talked about the little thing that you can click to stop our personal data being used—that has been in place for some time now and it is great. If we have the time, Mr Ross, what is your sector doing as well, because the technology should be there to help and empower people?
Philip Hollobone (Conservative, Kettering)
Q Mr Ross, you have 30 seconds.
Philip Hollobone (Conservative, Kettering)
Gentlemen, you have been brilliant. Thank you very much indeed for your time this morning. We will now move on to the fourth panel.
Philip Hollobone (Conservative, Kettering)
Q We will now hear oral evidence from Dr Jeni Tennison, founder and executive director of Connected by Data; Anna Thomas, co-founder and director at the Institute for the Future of Work; and Michael Birtwistle, associate director of AI law and regulation at the Ada Lovelace Institute. For this session we have until 11.25 am. Will the witnesses, from right to left, please be kind enough to introduce themselves to the Committee for the record?
Philip Hollobone (Conservative, Kettering)
Welcome. Stephanie Peacock will start the questions.
Stephanie Peacock (Labour, Barnsley East)
Q Good morning. To go first to Dr Jeni Tennison, do you think the general public and workers have a good level of trust and understanding in terms of how their data is being used? What does the Bill do, if anything, to help build or improve on that trust and understanding?
Stephanie Peacock (Labour, Barnsley East)
Q Do you believe the Government have consulted the public and data subjects such as workers appropriately during the process of formulating the Bill?
Stephanie Peacock (Labour, Barnsley East)
Q What value do subject access requests hold for citizens, and how will changing the threshold for refusing a request or changing a request to “vexatious or excessive” impact citizens’ ability to exercise their rights?
Stephanie Peacock (Labour, Barnsley East)
Q Thank you. I have a couple of questions for Anna Thomas now. Do the current laws around automated decision making do enough to protect workers and citizens from harm?
Stephanie Peacock (Labour, Barnsley East)
Q Linked to that, do you believe that the safeguards outlined in the Bill—having a right to human review, for example—are enough to protect workers from the potential harm of automated decision making?
Stephanie Peacock (Labour, Barnsley East)
Q My final question is to Michael. Do you believe that the current regulation does enough to govern the use of biometric technologies?
Damian Collins (Conservative, Folkestone and Hythe)
You make a very interesting point there, Mr Birtwistle. With automated decision making, a lot of that could be done anonymously. The user is just the end product. They are being targeted through systems and do not need to be identified; the systems just need to know what their data profile is like in order to make a decision.Q
I am interested in the views of the other members of the panel as well. Do you think there needs to be a greater onus on data controllers to make clear to regulators what data they are gathering, how they are processing it and what decisions are being made based on that data, so that, particularly in an automated environment, while there may not be a human looking at every step in the chain, ultimately a human has designed the system and is responsible for how that system is working?
Damian Collins (Conservative, Folkestone and Hythe)
On that point, just to be clear, as long as what someone is doing is not clearly and purely illegal, legitimate interest means you can do whatever you want.Q
Damian Collins (Conservative, Folkestone and Hythe)
Dr Tennison?
Damian Collins (Conservative, Folkestone and Hythe)
I just want to make sure I have understood that point correctly. Let us say that someone is a recipient of an advert, not because they have been personally targeted, but because they have been targeted through data-matching tools such as lookalike audiences on Facebook. Would that be the sort of thing you are referring toQ ?
Damian Collins (Conservative, Folkestone and Hythe)
Q Is the gig economy an example of where the systems are biased towards workers who are always available for jobs, or biased towards people based on their proximity to a particular location for work?
Damian Collins (Conservative, Folkestone and Hythe)
Q Effectively a form of constructive dismissal.
Philip Hollobone (Conservative, Kettering)
I can see Anna Thomas chomping at the bit.
Philip Hollobone (Conservative, Kettering)
Mr Birtwistle?
Carol Monaghan (Scottish National Party, Glasgow North West)
Q Jeni, can I come back to you on automated decision making? You have suggested that a requirement to notify people when an automated decision is made about them would be a useful inclusion in the Bill. Do you think enough consideration has been given to that?
Carol Monaghan (Scottish National Party, Glasgow North West)
Q We can probably broadly split these decisions into two categories. Decisions are already being made by algorithms online, according to what we are looking at. If I look up a paint colour online, and then start getting adverts for different paint companies, I am not too worried about that. I am more concerned that decisions could be made in the workplace about me, or about energy tariffs, as we have heard. That is more serious. Is there a danger that if we notify individuals of all the automated decisions that are made, it will end up like the cookie scenario—we will just ignore it all?
Carol Monaghan (Scottish National Party, Glasgow North West)
Q And you are not comfortable that those have been considered properly in the Bill.
Carol Monaghan (Scottish National Party, Glasgow North West)
Q The subject, rather than the decision maker.
Carol Monaghan (Scottish National Party, Glasgow North West)
Anna, did you want to come in on that?
Carol Monaghan (Scottish National Party, Glasgow North West)
Q Is there a danger that automated decisions could impact the Equality Act, if biases are not properly accounted for?
Mike Amesbury (Labour, Weaver Vale)
Q Anna, how would you strengthen the Bill? If you were to table an amendment around employees and AI, what would it be?
Rupa Huq (Labour, Ealing Central and Acton)
Q It is good to see the Ada Lovelace Institute represented; she was a pioneering woman computer scientist who lived in my constituency, so it is a bit ironic that the one man here is representing the institute.
Rupa Huq (Labour, Ealing Central and Acton)
I want to touch on the equality issue again. A 2019 UN report on the digital welfare state made the point that algorithms repeat existing biases and entrench inequalities. How do we get around that? There are a lot of issues around trust and people’s rights and protections when it comes to this data. On top of those, there is this issue. Does the legislation address that? How can we overcome it?
Rupa Huq (Labour, Ealing Central and Acton)
Can I add one yes/no question?
Philip Hollobone (Conservative, Kettering)
Yes.
Rupa Huq (Labour, Ealing Central and Acton)
Q If we have an already overburdened regulatory framework, and we put AI on top of it, will it just fall through the cracks? Is there a danger that AI gets forgotten?
Philip Hollobone (Conservative, Kettering)
The last question is from Chi Onwurah.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Dr Tennison, could you give an example of the kind of abuse that you are most concerned about taking place if this Bill is passed unchanged, so that we can better understand your concern? And do I have time to ask—
Philip Hollobone (Conservative, Kettering)
You have four minutes.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Great. Ms Thomas, presumably all the automated decisions will be subject to employment law. Would employees have the information they need to appeal decisions and take them to an industrial tribunal?
Philip Hollobone (Conservative, Kettering)
I thank our three witnesses very much indeed; you have all been fantastic. We are very grateful to you for being here. That brings us to the end of our morning session. The Committee will meet again at 2 o’clock, here in the Boothroyd Room, to continue taking oral evidence. We heard from 10 witnesses this morning and will hear from 13 this afternoon.
(Afternoon)
Examination of Witnesses
Philip Hollobone (Conservative, Kettering)
Welcome back. We are now on to our fifth witness panel and we will hear from Tom Schumacher, chief privacy officer at Medtronic, who has kindly joined via Zoom, and Jonathan Sellors, legal counsel and company secretary at UK Biobank, who is in the room. We have until 2.25 pm for this panel. Could the witnesses please introduce themselves for the record?
Philip Hollobone (Conservative, Kettering)
Thank you both for joining us. Stephanie Peacock.
Stephanie Peacock (Labour, Barnsley East)
WelcomeQ 82 to you both. My first question is to both witnesses. How easy is it currently for service users and care teams to access and share all of their relevant health and care data?
Stephanie Peacock (Labour, Barnsley East)
Q Will the new definition in the Bill of what constitutes scientific research help people in your field to conduct more or better research? If so, what impact would this research have on citizens and healthcare?
John Whittingdale (Conservative, Maldon)
Q Perhaps I could ask you both to elaborate on how the existing definition and the current lack of clarity have impeded you in carrying out the research you would like to do and how this will change as a result of the Bill.
John Whittingdale (Conservative, Maldon)
Q Can you say a little about the extent to which you have been a contributor to the design of the new provisions in the Bill and whether you are happy with the outcome of that?
Damian Collins (Conservative, Folkestone and Hythe)
Do you think the definition of what public health means in the context of the BillQ is clear?
Damian Collins (Conservative, Folkestone and Hythe)
What do you mean by that?
Damian Collins (Conservative, Folkestone and Hythe)
Q What do you think it means? What is the scope of it?
Damian Collins (Conservative, Folkestone and Hythe)
Q Yes. What I would be interested in is that there could be medical research linked to physical ailments. It could also include mental health, which could, in this context, open up quite a wide range of different fields of research for commercial application as well—understanding people’s stimulus response to fear, anxiety and so on, some of which could have medical application and some of which could be purely commercial.
Damian Collins (Conservative, Folkestone and Hythe)
Q I think that is right. I would welcome it if you were able to write to the Committee with some further thoughts on that. My point, I suppose, is that we have a pretty good idea of what we think public health research could be in this context, whether it is for commercial or non-commercial reasons. However, we want to be certain about whether that opens up other channels of research that others may regard as being not about solving public health problems, but just about the commercial exploitation of data.
Damian Collins (Conservative, Folkestone and Hythe)
Q I have a final question. We have this legislation, and then different tech companies and operating systems have separate guidelines that they work to as well. One of the issues the Government faced with, for instance, the covid vaccine app, was that it had to comply with the operating rules for Google and iOS, regardless of what the Government wanted it to do. Thinking of the work that your organisation has been involved in, are there still significant restrictions that go beyond the legal thresholds because different operating systems set different requirements?
Rebecca Long-Bailey (Labour, Salford and Eccles)
In relation to medical research, concerns have been raised that the Bill might risk a divergence from current EU adequacy and that that might have quite a significant detrimental impact on collaboration, which often happens across the EU on medical research. Are you concerned about that, and what should the Government do to mitigate it?Q
Chi Onwurah (Labour, Newcastle upon Tyne Central)
I know that you are very supportive of the Bill, but I wonder whether you see risks to patients and service users from facilitating a greater sharing of health and care data. Could you each answer that question?Q
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q So it has to be de-identified. We will return to that. But you do not see any other risks?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q I agree with you. Sorry, I did not quite hear what you said—approval by whom?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Right. Is it a requirement of the Bill that the research should have the approval of the relevant ethics committee?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q But not all research, surely, because the definition of research is something that can
“reasonably be described as scientific”
research. You would see concerns, then, if data was to be shared for research that was carried out outside of ethics committee approvals. I do not want to put words into your mouth, but I am just trying to understand.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q On the point of de-identifying or pseudonymisation, do you recognise that there have been examples of pseudonymised data that has been re-identified, and that, particularly given the rise of huge datasets, artificial intelligence and so on, there is a risk of un-de-identifying pseudonymised data?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Yes, I certainly agree with that—it is almost impossible—but I do think it is possible to re-identify data without spending millions of pounds, especially when it is correlated with other large datasets. Would you recognise that?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Currently.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Let me ask a follow-up question. I recognise that your intent in research is ethical—there are ethics committees involved. Given the definition of scientific research to be anything that can be reasonably described as scientific, what is to stop data being shared for the purposes of, for example, justifying anti-covid vaccination conspiracy theories? Do you recognise that there are purposes that could be described as research but which many people would not want their data to be used for?Q
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Yes, but people might not want their data to be used for that. They would have no control over it in this case.
Philip Hollobone (Conservative, Kettering)
If there are no further questions, may I thank both of you gentlemen very much indeed for your time this afternoon and for giving us your evidence. It is hugely appreciated. We now move on to the sixth panel.
Philip Hollobone (Conservative, Kettering)
Welcome, gentlemen. We will now hear from Harry Weber-Brown, chief engagement officer at ZILO, and Phillip Mind, director of digital technology and innovation at UK Finance. We have until 2.50pm for this session. I now invite the witnesses to please introduce themselves to the Committee for the record, starting with Mr Weber-Brown.
Stephanie Peacock (Labour, Barnsley East)
Q Good afternoon to both witnesses. I have a broad opening question. What are the main implications of the Bill’s provisions for the finance sector?
Stephanie Peacock (Labour, Barnsley East)
Q That is great. You both mentioned smart data. For the benefit of the Committee, could you outline some of the progress that the banking and finance industries have made in developing smart data initiatives?
Stephanie Peacock (Labour, Barnsley East)
Q To develop that point, do you think there are enough safeguards in the Bill to ensure that Ministers assess the commercial sense and the impact of any new smart data regimes before regulating for them?
John Whittingdale (Conservative, Maldon)
Q Would you say a little about the international position? You referred to the UK’s position as a leader in this field. To what extent is that the case? What are the benefits, and what is the risk to the UK’s position if we do not make the changes proposed in the Bill?
John Whittingdale (Conservative, Maldon)
I will come on to digital verification. Let us focus on smart data, to begin with.
John Whittingdale (Conservative, Maldon)
Q Moving on to the digital identity provisions, clearly some people are already familiar with this, but there is still a degree of suspicion. To what extent do you think that the consumer needs persuasion about the security and the benefits of digital identity services? Do you see that as being addressed by the provisions in the Bill?
Damian Collins (Conservative, Folkestone and Hythe)
Q Mr Weber-Brown, you in particular have spoken about the consumer benefits of data sharing—having a wider choice of products and services. What do you see as the principal business benefits for financial service providers? How wide would you like the scope of their access to data to be?
Damian Collins (Conservative, Folkestone and Hythe)
Q Can you understand that there might also be concerns on the consumer side about data profiling consumers based on risk? That would make a lot of sense for financial services. You have described certain financial products, but equally there are people offering loans, mortgages, insurance and things like that who will be very keen to understand more about their customers before pricing their products accordingly.
Damian Collins (Conservative, Folkestone and Hythe)
We talked in the previous session about the undoubted benefits, which you have set out clearly. Equally, however, consumers will still want to know what sort of data about them is being used and who has access to it. For example, if a video games maker is profiling the attitudes of players to risk, in order to stimulate them with risk-and-reward opportunities within a game like Fortnite, consumers might understand how that makes their gameplay more interesting. They might consent to that, but they might not necessarily want a financial services provider to have access to that information, because it could create a picture of them that is not flattering.
Damian Collins (Conservative, Folkestone and Hythe)
I think the Estonian digital ID model works in a very similar way.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q You have both spoken very passionately, if I may say so, about the importance of citizens being in control of their data, particularly with open banking. We all take very seriously our financial data and the importance of trust and empowerment in these services. Can you say how the Bill will improve trust and control for citizens, or how it should do so?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Thank you very much for those points.
You mentioned data verification services. Briefly, can you help the Committee to understand who would be providing those services and who would be paying for them? You gave the example of tethering my property or other ownership. Who would be paying in that case? Would I be paying for the rest of my life to keep that data where it is? How do you see it working?
Philip Hollobone (Conservative, Kettering)
We have time for a very quick question from Rupa Huq, with very quick answers.
Rupa Huq (Labour, Ealing Central and Acton)
UK Finance’s members are all the big banks—is that right?Q
Rupa Huq (Labour, Ealing Central and Acton)
Q Okay. The dealings that I have had with you have been about the bank card phenomenon. We know that there is public mistrust in the consumer banking sector about how our data is controlled. How will you ensure that the Bill does not leave behind those people who are not online? That is what the banking hubs are aimed at, is it not? There is a whole loneliness agenda, as well as issues relating to the elderly.
Philip Hollobone (Conservative, Kettering)
You have 30 seconds to answer.
Philip Hollobone (Conservative, Kettering)
Thank you very much indeed for your evidence this afternoon and for giving us the benefit of your time. We appreciate it.
Examination of Witness
Philip Hollobone (Conservative, Kettering)
Welcome, Mr Rosser. We have just 15 minutes, until 3.05 pm, for this session. Would you kindly introduce yourself to the Committee for the record?
Stephanie Peacock (Labour, Barnsley East)
Q Good afternoon. What are the main implications of the Bill for employers? Specifically, how will enabling greater use of a digital verification service help employers to make hiring decisions?
Stephanie Peacock (Labour, Barnsley East)
Q Do you think the provisions in the Bill will help to improve public trust in digital identities?
John Whittingdale (Conservative, Maldon)
Q Perhaps I could ask you to expand on that now. To what extent would you say that some providers that are not certified are not meeting the standards necessary, or in some cases even promoting fraud?
John Whittingdale (Conservative, Maldon)
Q So would you expect that as a result of the Bill, the bar to obtain certification will be higher?
Damian Collins (Conservative, Folkestone and Hythe)
Q I want to follow on from the Minister’s questions. Looking at other legislation that is going through Parliament, particularly the anti-fraud provisions in the Online Safety Bill, one of the important areas is the extent to which regulators should expect companies to have good upstream solutions in place to combat fraud. Rather than chasing every example that they come across, they need things that block it in the first place. Do you see the provisions in this Bill as being helpful? Would you expect regulators to act on that and to direct companies to use systems that are known to be safe?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Thank you very much for your evidence so far. It is going to be informative about the use of digital ID in recruitment. You said earlier that it helps to separate away from geography, which implied that the digital ID did not reference the location or the home address of the person who was being ID’d. What does the digital ID ID? Part of the reason behind that question is this: is it simply providing identification, or could it also be used as part of the triage process? Can that be done algorithmically, with some of the dangers that we see in algorithmic, automated decision making?
Philip Hollobone (Conservative, Kettering)
Mr Rosser, thank you very much indeed for your evidence this afternoon. We are grateful for your time, sir.
Examination of Witnesses
Philip Hollobone (Conservative, Kettering)
Welcome, ladies. We have until 3.30 pm for this session. Will the witnesses please be kind enough to introduce themselves to the Committee for the record? Let us start with Helen Hitching.
Philip Hollobone (Conservative, Kettering)
Welcome and thank you. Aimee Reed?
Stephanie Peacock (Labour, Barnsley East)
Q You are both very welcome. My first question is to Aimee. Currently, police are required by section 62 of the Data Protection Act 2018 to log their justification for accessing specific data records; this Bill, of course, changes that. How time consuming is that requirement currently for officers?
Stephanie Peacock (Labour, Barnsley East)
Q Helen, how, if at all, will listing as a recognised legitimate interest
“detecting, investigating or preventing crime”,
to quote the new definition, aid the tackling of serious crime in the UK?
Stephanie Peacock (Labour, Barnsley East)
Sure. My understanding of the legislation in front of us is that if the Bill becomes law,
“detecting, investigating or preventing crime”
will be listed as a recognised legitimate interest and therefore be subject to separate, or slightly amended, data rules. How will that change help tackle serious crime in the UK?
Stephanie Peacock (Labour, Barnsley East)
Q I have a connected but slightly separate question. Would being able to apply for a joint designation notice with the intelligence services aid competent authorities in targeting serious and organised crime, and if so, how?
John Whittingdale (Conservative, Maldon)
Q Can you say a little bit more about the implications of personal data sharing between countries, the extent to which that might lead to a lowering of standards of protection and how we safeguard against that?
John Whittingdale (Conservative, Maldon)
Q You need to be satisfied that the third country maintains the same level of data protection standards that exists in the UK. To what extent has that been an impediment for data sharing?
John Whittingdale (Conservative, Maldon)
Q On a separate issue, at the moment we have a range of bodies responsible for different aspects of surveillance, such as the Biometrics Commissioner, the Investigatory Powers Commissioner and the Surveillance Camera Commissioner. Those are being brought together into either the Information Commissioner or the Investigatory Powers Commissioner. To what extent do you think that will improve the overall oversight of surveillance?
Damian Collins (Conservative, Folkestone and Hythe)
Q How easy do you find it to gather data as part of investigations at the moment, particularly if you are working with companies that provide services to individuals? Do you think the provisions in the Bill will make that any easier?
Damian Collins (Conservative, Folkestone and Hythe)
Q In terms of criminal investigations, practically how easy is it to get hold of data and information that you consider to be important, particularly if it is from private companies?
Mark Eastwood (Conservative, Dewsbury)
I have been on the parliamentary police and fire service scheme, so I have spent a lot of time with the police. One of the big frustrations from the police’s point of view is the lack of free flow of information, particularly when it concerns charging decisions, along with redaction, which potentially causes some antagonism between the two. I know this is not strictly covered in the Bill, but would it be beneficial to both parties if you were able to share unredacted information before a charging decision is madeQ ?
Mark Eastwood (Conservative, Dewsbury)
Q So it would be an advantage for the Government to look into including that.
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q I think you implied that there was data that you would like to have access to but currently do not have access to. Can you elaborate on what data you do not have access to in terms of data sharing and the barriers? What would be helpful for investigations?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Is it about the speed of exchange with other Government agencies or with local government agencies?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Do you think it should be available to you? Are there reasons why it is not available to you?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Q Just to follow up on the questions about the different types of regulation, do you feel that the balance has been struck appropriately when it comes to biometric data, particularly for facial recognition, for example?
Chi Onwurah (Labour, Newcastle upon Tyne Central)
Has the balance between sharing and the regulation of biometric data, particularly facial recognition data, been struck in the right way?