Data (Use and Access) Bill [Lords]

Public Bill Committee, 11 March 2025.

(Morning)

Clause 66 - The 2018 Act and the UK GDPR

Chris Bryant (Labour, Rhondda and Ogmore)

It may assist the Committee to know that, when there is no great controversy about a clause and all I am doing is reminding people what is in the clause and the explanatory notes, I will move that the clause stand part formally. We are now starting to discuss part 5 of the Bill, which relates to GDPR. This clause is completely and utterly self-explanatory.

Ben Spencer (Conservative, Runnymede and Weybridge)

It is a pleasure to serve under your chairmanship again, Mr Turner. This part of the Bill relates to GDPR. Although there are some amendments that we will debate later, it makes sensible and long-overdue clarifications with regard to GDPR and the interaction with data protection, particularly through some updates to the use of secondary data for scientific research, which I suspect we will discuss when we come to the next clause.

Clause 67 - Meaning of research and statistical purposes

Chris Bryant (Labour, Rhondda and Ogmore)

I beg to move amendment 13, in clause 67, page 75, line 26, leave out

“and that is conducted in the public interest”.

This amendment removes words from new paragraph 2 of Article 4 of the UK GDPR (meaning of processing for the purposes of scientific research). The words were inserted at Report stage in the Lords.

The UK has a proud tradition of innovative research. Our researchers are at the forefront in fields from quantum computing to medicine—for example, leading on pioneering vaccine development during the covid-19 pandemic. Scientific research can bring life-changing benefits to our society and economy. Given that importance, the UK data protection framework contains certain accommodations for processing personal data for research purposes while maintaining key safeguards. The clause, as proposed by their lordships, would require an up-front public interest test for processing to be considered as scientific research and eligible for these accommodations. We disagree with that.

We agree with wanting to avoid misuse of the term “scientific research”, but as the Royal Society has said clearly, the reasonableness test that is now in the Bill provides adequate protection against that. The new test, provided by the Lords, would also be at odds with the internationally recognised Frascati definition, which does not mention an up-front public interest test.

Such a test would be a new burden on many researchers. The Royal Society is concerned that that could have a negative effect on the conduct of research. The Government agree and are especially concerned about the impact on basic and curiosity driven research. The public benefits from such research may not be known at the time, yet with hindsight may be overwhelming. Many of the great discoveries in scientific history, from penicillin to the electron, originated from research that had no anticipated public interest benefit. No one could know how valuable they would be to us now. Even the mRNA-based vaccines that saved millions of lives during the covid-19 pandemic drew on curiosity-driven research that for years had had no practical applications.

That is research that we should be supporting, not stifling. An up-front public interest test could have a chilling effect on it, which is not in the long-term public interest. Our amendment would therefore remove the public interest test inserted by their lordships.

Ben Spencer (Conservative, Runnymede and Weybridge)

I listened carefully to the Minister’s remarks on the Government’s position on the public interest test, which was extensively debated in the other place. I have a great deal of sympathy with what their lordships were trying to achieve in parts of that amendment. We are talking about the secondary use of data for scientific research and, as I understand it, the public interest test is used in other types of scientific research tests—for example, with public health data. Therefore this is not something which is completely alien to the concept of defining scientific research. However, I do concede there is an issue with how one can define scientific research.

I think what people are nervous about—particularly in some of the conversations I have around this new definition of scientific research for use for secondary data processing—is this being hijacked by artificial intelligence data companies as a way of getting around some of the challenges with using big datasets for which they do not necessarily have licensing arrangements. I know we are going to come on to that later in the Bill. I would be grateful if the Minister could explain his thoughts and considerations about removing this public interest test. How would that interact with some of the concerns about AI and data use?

From a personal perspective, my concept of scientific research has an altruistic component to it. At least with the scientific research with which I was involved, the whole point was that it was information that is shared freely. Clearly there are challenges and considerations on which one needs to focus when it comes to research being done for commercial benefit. I know part of the debate in the other place was about commercial versus non-commercial research. It is important that scientific research can be commercial. In fact, it must be. However, I appreciate that there is a sentiment that their lordships were putting forward as part of the test.

I would be grateful if the Minister could address, first, some of the concerns around AI companies and secondly how we can capture the essence of scientific research so that when people are do secondary data analysis it is done properly. When it comes to the audit component, a lot of this data analysis is people marking their own homework. Some of the data is not going through human rights committees and being scrutinised in that sense. What assurances can the Minister give that the process will operate properly and that research that is scientific will be legitimately so once these clauses are passed?

Chris Bryant (Labour, Rhondda and Ogmore)

First, the hon. Gentleman is right that there are other areas where there is a public interest test. In those other areas it is actually very narrow, however. The public interest test is currently only applied to research using special category data under schedule 1 to the Data Protection Act 2018 and public health data. It is quite specific. This is why we are nervous about extending the test across the whole of data protection. It is appropriate, we think, to have that extra protection for those particularly sensitive areas, but we think it would be disproportionate to make all researchers meet that standard, regardless of the type of data they are using.

The hon. Gentleman mentions AI companies, and the matter was of course raised in the Lords. It is worth reminding the Committee that the clause narrows rather than expands the definition of scientific research. As the provisions of the Bill make clear, web scrapers seeking to reuse personal data for purposes such as training AI models must have a lawful basis. Before even considering the meaning of scientific research, a web scraper would need to pass the balancing test to use the legitimate interest ground. The Information Commissioner’s Office outcomes report, published last year, emphasised that:

“Web scraping for generative AI training is a high-risk, invisible processing activity. Where insufficient transparency measures contribute to people being unable to exercise their rights, generative AI developers are likely to struggle to pass the balancing test.”

In other words, AI companies should not be doing precisely that which he is concerned they would.

Ben Spencer (Conservative, Runnymede and Weybridge)

The Minister says that the changes in the clause narrow the scientific test. That certainly was not my understanding and I would be grateful if he could clarify. Currently, under scientific research, only three criteria can be used under GDPR: statistical purposes, archiving, and genealogical-type purposes. The clause expands secondary data use under GDPR quite substantially.

Chris Bryant (Labour, Rhondda and Ogmore)

If an area of research does not currently count as scientific research, it will not do so under the Bill. Researchers will benefit from having a clearer definition in legislation that reflects the language buried in the recitals and the current ICO guidance. We believe that improving clarity will reduce uncertainty, the risk of misinterpretations and misapplication of the law. The Government will of course monitor the reform’s impact and how researchers navigate the data protection framework. We think that will help us better understand if further changes are required.

The fundamental point is that their lordships inserted a public interest line that we are seeking to take out. They inserted it because they believed it would mean that no data would be used in a way that did not lead to eventual good outcomes. The truth is that when someone starts a piece of research based on curiosity they might have no idea what the final outcome will be. That is an important part of how most researchers work, whether in a commercial or non-commercial setting. That is why the Royal Society has unambiguously stated that if we retain their lordships’ public interest provision, it will have a chilling effect on research in the UK. That is why I commend the amendment to the Committee.

Ben Spencer (Conservative, Runnymede and Weybridge)

The matter turns on how we define public interest. I appreciate the concerns about the clause. Being a scientific purist, I could argue that even blue-sky research could be justified as in the public interest, provided that we all benefit from the fruits of that knowledge when it is shared. Notwithstanding that point, I will go back to the Minister’s comment. I understand that the point of the clause is to expand the definition of scientific research from the currently narrow criteria under GDPR, so there will be research that is currently not scientific research that will be permitted as a consequence of the clause.

Chris Bryant (Labour, Rhondda and Ogmore)

I will try one more time to persuade the hon. Member, but I will be repeating myself. The Government are not expanding the meaning of scientific research. The Bill’s definition is completely in line with present ICO guidance, which states that commercial organisations can also carry out scientific research. Scientific research conducted by commercial organisations can have a life-changing impact, as many hon. Members have noted, but the definition does not cover any commercial activity: it only includes activities that could reasonably be viewed as scientific research.

Clause 70 - Lawfulness of processing

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to move amendment 49, in clause 70, page 78, leave out lines 15 to 19.

This amendment would remove subsections (2)(b) and (c) from the Bill which would create a new lawful ground for processing personal data by way of inserting a new Article into the UK GDPR.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Amendment 53, in clause 70, page 78, line 17, after “interest” insert “, excluding personal health data”.

This amendment would exclude personal health data from being a recognised legitimate interest.

Amendment 50, in clause 70, leave out from line 24 on page 78 to line 32 on page 79.

This amendment omits subsection (4), (5) and (6) which make amendments to UK GDPR to define certain data processing activities as “recognised legitimate interests”.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

Clause 70 introduces “recognised legitimate interests” as a new basis for processing personal data. Although the Liberal Democrats recognise the potential of the benefits of data, we have serious concerns that clause 70, as it stands, grants excessive and unchecked power to the Secretary of State, risking the erosion of fundamental rights. Our key message is that trust and innovation go hand in hand. For us to advance and share the benefits of innovation, we must foster trust.

In the name of constructive opposition, I will talk about the several amendments that we have tabled—amendments 49, 50, 53, new clause 5 and new clause 22, which was also tabled by colleagues in the other place. These amendments are crucial to ensure vital safeguards, ensure proper parliamentary oversight and demand greater transparency. They respond directly to concerns raised on Second Reading. Moreover, they echo the concerns of new civil society organisations, including—

Karl Turner (Labour, Kingston upon Hull East)

Order. The hon. Lady can only speak to amendments 49, 53 and 50 at this point.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

In the interest of time, I would like to talk about all the amendments together.

Karl Turner (Labour, Kingston upon Hull East)

You cannot talk about them all at once because of how they are grouped.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I shall talk about amendments 49, 53 and 50, which would remove the core of clause 70 that allows the direct establishment of “recognised legitimate interests”. Clause 70 risks bypassing essential parliamentary scrutiny, a point underscored by the Delegated Powers and Regulatory Reform Committee and the Constitution Committee, which expressed concerns about the lack of parliamentary oversight. The amendments are essential to ensure that the Data (Use and Access) Bill fosters innovation responsibly without sacrificing fundamental data protection. I urge Government to look over the proposals, which would help improve the adoption and inclusion of growing technology and its benefits. I would also welcome any proposals to improve this scrutiny when we reach Report.

Chris Bryant (Labour, Rhondda and Ogmore)

The new lawful ground of recognised legitimate interest in clause 70 and schedule 4 have been designed to give organisations greater confidence when processing personal data for important public interest objectives, such as preventing crime, safeguarding vulnerable individuals and protecting national security. They also ensure that non-public bodies can share information with public authorities where it is necessary and proportionate to do so without having to conduct a complex balancing test in situations where timely action is essential.

Amendment 49 would remove that provision, making it harder for organisations to share data confidently and swiftly for those public interest purposes. I recognise that the hon. Lady might be concerned that the removal of the need to do a detailed legitimate interest balancing test in this narrow set of circumstances could reduce protections, but strong safeguards remain in place, as was recognised in the House of Lords, which did not approve such an amendment. Any processing must still be necessary and proportionate and comply with data protection principles under UK GDPR to ensure that individuals’ rights continue to be protected.

Amendment 50 would remove the Secretary of State’s ability to amend the list of recognised legitimate interests using regulations, and delete the list itself from schedule 4 of the Bill. We believe that the ability of the Secretary of State to amend the list is a necessary safeguard to future-proof the framework. This power is not unrestricted. It is subject to strict safeguards, including parliamentary approval by the affirmative resolution procedure and the requirement that any additions must serve public interest objectives under article 23(1) of the UK GDPR. Removing the power would make it more difficult to adapt the framework over time.

I have also considered amendment 53, which would prevent health data being processed under the new lawful ground, and I would argue that it conflicts with amendment 49. Health data would be processed under this new ground only in so far as that was necessary for one of the specified recognised legitimate interests in schedule 4 to the Bill. Any processing of health data would also have to meet one of the relevant criteria for processing specific category data in article 9 of UK GDPR and schedule 1 to the Data Protection Act 2018. On that basis, I hope that the hon. Lady will feel able to withdraw her amendments.

Steffan Aquarone (Liberal Democrat, North Norfolk)

I rise to speak to amendment 53. I thank the Minister for his comments, and it is a pleasure to serve under your chairship again, Mr Turner. I support the words of my hon. Friend the Member for Harpenden and Berkhamsted. I am concerned not by the unchecked power of the Secretary of State under this regulation—we of course have precedents to go with under GDPR—but it is the specific and extremely high-grade personal health data that remains a concern for me.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to ask leave to withdraw the amendment.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Chris Bryant (Labour, Rhondda and Ogmore)

Clause 70 and schedule 4 introduce a new lawful ground for processing personal data under article 6 of UK GDPR, allowing organisations to process data for recognised legitimate interests without conducting a balancing test. The aim is to provide legal certainty and facilitate faster data sharing for key public interest purposes such as crime prevention and safeguarding.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

New clause 5 sets out that any future changes to data safeguards, including those related to recognised legitimate interests, automated decision making and special category data, must be subject to greater scrutiny in Parliament. It is essential that significant changes to our data protection go through that democratic process. New clause 22 would require the Secretary of State to publish a statement explaining the purpose, scope and timeline of any additional variations to recognised legitimate interests, again supporting greater transparency and accountability.

The new clauses are there to help improve public trust around data and improve the adoption and inclusion of the growing range of technology and its benefits. They are for the Government to look at when thinking about how we ensure that we bring people along with us. They will help to maintain trust and ensure that we have safeguards in line with recognised legitimate interests. If we are to accept clause 70, the Government must again assure us that robust checks and balances are truly in place.

Chris Bryant (Labour, Rhondda and Ogmore)

New clause 5 seeks to strengthen parliamentary oversight of regulations that could amend the recognised legitimate interest list or the provisions on automated decision making and special category data, which we will debate in detail later. The regulation-making powers in the clause are already subject to appropriate safeguards, and have been designed with retaining our EU adequacy decisions at the forefront of our mind—we will return to the topic of EU adequacy in more detail when we reach new clause 2. It is important to respect the European Commission’s processes and its discretion in how its adequacy assessment is undertaken.

New clause 22 would require the Secretary of State to publish a statement explaining the purpose of any changes to the recognised legitimate interest list, to whom they would apply and for how long. As I think I explained earlier on a previous amendment, any draft regulations laid before Parliament under these provisions will be accompanied by an explanatory memorandum, which would lay out precisely the things the hon. Lady seeks. On that basis, I hope she will not push her two new clauses to a vote.

Clause 77 - Information to be provided to data subjects

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss clauses 78 and 79 stand part.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

Clause 77 strongly risks bypassing individual data rights by watering down transparency of the processing of personal data for reasons such as research, archiving in the public interest or statistical purposes. Although we welcome efforts to modernise data law, modernisation should not come at the cost of transparency—a cornerstone of public trust. Clause 77 risks seriously watering down rights regarding how our data is collected and processed.

Organisations such as Justice, the British Medical Association and the National Data Guardian share our concerns that this clause erodes transparency regarding the use of patient information. The National Data Guardian has specifically warned that weakening transparency obligations could negatively impact people’s trust in how our health and social care data is used for research, potentially impairing important data initiatives. Those concerns are also shared by the British Medical Association.

While we still face a crisis in the provision of health and social care, I strongly welcome all possibilities to unlock innovation to achieve healthcare benefits, as already discussed today. I welcome that innovation for my constituent Catherine in Harpenden, who was diagnosed with ovarian cancer, which is often overlooked in women; for Andy and Sarah in Redbourn, who lost their daughter at a painfully young age to a brain tumour; and for the families and others across Harpenden and Berkhamsted who are awaiting diagnosis and treatment. It is also for them, and to ensure that we unlock those healthcare benefits by ensuring that more data is used, that I caution against clause 77.

The clause introduces exemptions from providing information to data subjects where that would require “disproportionate effort”. However, it is hard to see how that can improve transparency. That failure to be transparent risks that loss of public trust—a message I will repeat again and again. I urge Ministers to listen to those concerns and to remove clause 77 to ensure that we have genuine public trust and crucial data protection standards, as already discussed today.

Chris Bryant (Labour, Rhondda and Ogmore)

I am afraid I do not accept the characterisation the hon. Lady has put on the clause. There is currently an exemption from notifying data subjects if it would constitute a disproportionate effort to do so or prove impossible—obviously, there are cases where it is impossible to notify somebody. At the moment, that exemption can be used only when data was not collected directly from the data subject. Clause 77 will create a new exemption for when data was collected directly from the data subject. It will be limited to processing only for research purposes, and only when there is a change of purpose.

We believe that that will help longitudinal studies that originally obtained data from data subjects but that would struggle to notify them about a change in purpose of the study—for instance, due to having lost contact over years or due to a deterioration in the data subject’s condition. The clause is therefore essential to our research facilities in the UK, and I urge Members to support it.

Clause 80 - Automated decision-making

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to move amendment 51, in clause 80, page 95, line 19, at end insert—

“(3) To qualify as meaningful human involvement, a review must be performed by a person with the necessary competence, training, authority to alter the decision and analytical understanding of the data.”

This amendment would make clear that in the context of new Article 22A of the UK GDPR, for human involvement to be considered as meaningful a review must be carried out by a competent person.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss new clause 23—Definition of meaningful human involvement in automated decision-making—

“The Secretary of State must, in conjunction with the Information Commission and within six months of the day on which this Act is passed, produce a definition of what constitutes meaningful human involvement in automated decision-making or clearly set out their reasoning as to why a definition is not required.”

This new clause would require the Secretary of State to produce a definition of meaningful human involvement in automated decision-making, in collaboration with the Information Commission, or clearly set out reasoning why this is not required.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

Amendment 51 directly addresses the ambiguity around meaningful human involvement in automated decision making. Clause 80 raises significant concerns around the future of automated decision making. Although the Liberal Democrats recognise the potential of data to drive innovation, we must remember that, behind those automated decisions, are people’s lives. Amendment 51 directly addresses that ambiguity and seeks to ensure that any human review is

“performed by a person with the necessary competence, training, authority to alter the decision and analytical understanding of the data.”

That would help to clarify the crucial definition of “meaningful”.

Chris Bryant (Labour, Rhondda and Ogmore)

: I am grateful to the hon. Lady because automated decision making and the precise definition of “meaningful human involvement” were a key issue in previous versions of the Bill, and she will know that we have changed this version from the previous one.

Our reforms make it clear that decisions

“based solely on automated processing”

are ones that lack meaningful human involvement. The terminology we have introduced in this version of the Bill goes beyond the current UK GDPR and Data Protection Act wording to prevent cursory human involvement being used to, effectively, rubber-stamp decisions that have been made by automated decision processes.

The point at which human involvement becomes meaningful is of course context-specific, which is why we have not sought to be prescriptive in the Bill. The Information Commissioner’s Office already sets out in its guidance its interpretation that meaningful human involvement must be active. Someone—a human being—must review the decision and have the discretion to alter it before it is applied. The Government’s introduction of the term “meaningful” to primary legislation does not change that definition, and we are supportive of the ICO’s guidance in this space.

As such, the Government agree on the importance of the ICO continuing to provide its views on the interpretation of terms used in the legislation. Our reforms do not remove the ICO’s ability to do that or to advise Parliament or the Government if it considers that the law needs clarification. Broadly speaking, I agree with the hon. lady, which is why I do not think her amendment is necessary.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I thank the Minister for those points. I am happy to withdraw the amendment, but it is important to highlight that that person needs to have the necessary competence, training and authority around those decisions, so that that meaningful human involvement is very clear.

Karl Turner (Labour, Kingston upon Hull East)

Before seeking permission to withdraw the amendment, do you want to speak to new clause 23?

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

New clause 23 mandates that the Secretary of State, in conjunction with the Information Commissioner, must produce a clear definition of meaningful human involvement within six months or justify why a definition is not required. Again, that is to ensure that the term “meaningful human involvement” is not just a hollow gesture. I welcome the Minister ’s remarks clarifying the issue, but it is crucial, if we are to get automated decision making right, that these things are defined and clear for everyone involved.

Chris Bryant (Labour, Rhondda and Ogmore)

I will briefly add that the Information Commissioner already provides guidance in this sphere. We do not want to prevent the Information Commissioner from doing that in the future. The hon. Member is absolutely right: it has to be meaningful human involvement, and we think we have the balance right in the Bill.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to ask leave to withdraw the amendment.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Schedule 6.

Chris Bryant (Labour, Rhondda and Ogmore)

As we have several provisions here, it might be worth me making some comments. Clause 80 strikes the right balance between helping organisations to make the most of emerging technologies that drive up economic growth and productivity, while maintaining public confidence. Organisations will be able to make decisions that have significant effects for individuals based solely on automated processes in wider circumstances than presently, but they must implement stringent safeguards.

Those safeguards include individuals’ right to challenge and obtain human intervention if they are not satisfied with the decision. Where law enforcement agencies process personal data for a law enforcement purpose, they will be able to apply an exemption to the safeguards in very limited circumstances, such as to safeguard national security. Where that happens, a human must reconsider that decision as soon as reasonably practicable after it is taken, and that review must be meaningful. For the intelligence services, where entirely automated decision making is used, we are making clarifications to provide greater confidence to controllers and the public.

Schedule 6 contains minor and consequential amendments to UK GDPR and the Data Protection Act. Those amendments repeal and replace references to the current rules on automated decision making with the reformed rules in clause 80 of the Bill to provide legal clarity.

On new clauses 1, 4 and 24, the Government’s algorithmic transparency recording standard, or ATRS, enables public authorities to publish information on how and why they are using algorithmic tools. That includes a description of the human role in the wider operational process of which the tool is part. More than 50 ATRS records are now published in the repository, with more to follow shortly. Where these amendments seek to ensure that such tools are evaluated, the blueprint for modern digital government, which was laid in Parliament in January, makes it clear that part of its role will be to offer specialist assurance support, including a service to rigorously test models and products before release. I hope this provides reassurance to the hon. Member for Harpenden and Berkhamsted.

I will address new clauses 7 and 26 together, as they intend to achieve the same effect. I would again like to reassure hon. Members—I am trying to offer a lot of reassurance to the hon. Lady and to the hon. Member for North Norfolk—that the data protection framework has stringent safeguards in place for solely automated decision making. The UK GDPR transparency obligations already require organisations to notify individuals about the existence of solely automated decision making and to provide meaningful information about the logic involved.

Under our reforms, after a decision has been made, organisations must also provide data subjects with information about that decision. These information requirements enable individuals to exercise the safeguards I mentioned earlier, and are in addition to the wider transparency requirements of the framework. The safeguards in the reformed article 22 are unnecessary for partly automated decision making, since these decisions already include meaningful human involvement by definition.

When it comes to high-risk decisions, there are already additional requirements for processing that can result in a high risk to the rights and freedoms of individuals, including automated decision making. Controllers must carry out an impact assessment for such processing activities and consult the Information Commissioner’s Office where such an assessment indicates a high risk to individuals in the absence of effective measures. That process ensures that potential risks are identified and addressed. I therefore hope that the hon. Members for Harpenden and Berkhamsted and for North Norfolk feel that they do not need to press their new clauses to a vote.

Ben Spencer (Conservative, Runnymede and Weybridge)

This is a really interesting set of clauses. The debate that we are having, and that they had in the other place, on automated decision making is particularly interesting.

Of course, automated decision making is here. It is everywhere in every part of our lives. I was just looking at the Spotify app on my phone, and my daylist suggested that I start off by listening to Front Line Assembly, which is an industrial metal band. It is probably because, going into the data Bill Committee on a Tuesday morning, I need something to get me started.

Chris Bryant (Labour, Rhondda and Ogmore)

Don’t get me started.

Ben Spencer (Conservative, Runnymede and Weybridge)

Ah, the temptation.

The point about automated decision making is that decisions can be made about people without their involvement, which can have substantial consequences, particularly when decisions are made in the public sector. Of course, automated decision making takes place all the time, day in and day out. We saw it on a huge scale during the covid pandemic when people had to sign up to universal credit, as there were checks on people’s basic characteristics and assets to assess their eligibility. Those decisions had quite a substantial impact on people, but the data points were actually quite simple and straightforward. As I understand it, no particular concern was raised about automated decision making in that context, apart from a few examples where people’s circumstances were remarkably unique.

The purpose of the Bill is to scale up, particularly when it comes to AI and more sophisticated decision making. We think the new clauses seek to place onerous and unnecessary obligations on Government bodies and public authorities. New clause 1, among other things, would require public bodies to give notice on a public register for each and every function they perform where automated decision making is used. New clause 4 would oblige the Secretary of State to put in place and maintain a public register of all semi-automated or fully automated decision-making tools used by public authorities in relation to individuals, with public bodies being precluded from using such tools in advance of their registration.

New clause 7 would provide service users with a range of powers to request information from data controllers in relation to the workings of wholly or partly automated decisions, and to purportedly high-risk decisions. I am amazed by the provisions suggested in new clauses 7 and 26 by the hon. Members for Harpenden and Berkhamsted and for North Norfolk. They seem to give quite extensive discretionary powers to the Secretary of State to define high-risk decisions and regulate them accordingly. I was surprised to see the extent of the powers handed over to the Secretary of State by these new clauses.

The new clauses are especially burdensome and unnecessary, given the widespread use of automated decision making for initial assessments in the Department for Work and Pensions, as I alluded to earlier. Automated decision making is a subject of significant debate, and clause 80 includes more safeguarding measures in proposed new article 22C of the UK GDPR. Those safeguards include requirements on data controllers to provide information to data subjects about significant decisions being taken through solely automated processing, the right to contest those decisions and the right to seek human intervention at the request of the data subject.

Our view is that clause 80, as drafted, provides a proportionate approach to the protection of individual rights, and that these tools will help with potential speed and, importantly, efficiency gains, which I mentioned earlier with regard to the use of automated decision making for universal credit in the response to covid. The basic functions of Government and public authorities rely on widespread automated decision making.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I like to think that the Liberal Democrats are aligned on automated decision making and AI being an exciting opportunity for this country, but it is a fundamental shift. It is our job as a constructive Opposition to put forward proposals for consideration, so that there is proper scrutiny and ideas to ensure we take the public with us. All our proposals are made in that light.

Behind these decisions are real people’s lives. I have a family in Wheathampstead who are desperate for a social home to fit their family life. I have someone from Tring—I will call him John—who says he has been systematically failed since high school. His universal credit claim was closed because he did not upload the correct documents, and he feels that a lack of human understanding of why he was unable to do so was a barrier to getting the help he needed. Another case involves HMRC, with a constituent being taxed on pension income he is not actually receiving—it was only after hours of support from my team and the Department that we were able to turn his case around.

The point is that it will be very difficult for people to fix errors that result from automated decision making if there is not enough transparency. We have to get that balance right. The Secretary of State’s power to define crucial terms such as “meaningful human involvement” and “similarly significant effect” creates uncertainty and the potential for watering down protections.

Clause 80 seeks to update the safeguards around automated decision making, but organisations such as Justice and the Open Rights Group have real worries that it weakens those vital safeguards by broadening the scope for purely automated decisions. Furthermore, the considerable powers granted to the Secretary of State to amend or set aside the safeguards through secondary legislation create a concerning lack of parliamentary oversight.

It is with these reservations in mind, and as a constructive Opposition, that we tabled these new clauses. New clause 1 would place a clear requirement on public sector organisations regarding the use of algorithmic automated decision making. It would demand public notice of their use and the provision of meaningful and personalised explanations to affected individuals about how and why a decision was made. I have already raised some cases that the provision would impact, and I am sure we all have similar cases in our inboxes. New clause 1 directly tackles the concerns about transparency and the right to an explanation—a principle that the Liberal Democrats firmly believe in.

New clause 4 proposes the creation of a publicly accessible register of AI and algorithmic tools in the public sector. New clause 7 seeks to empower individuals by granting them the right to request comprehensive information on decisions based wholly or partly on automated processes that have a legal or similarly significant effect on them. This aligns with the Liberal Democrats’ commitment to ensuring accountability and redress.

New clause 24 proposes the establishment of a public register of all automated or semi-automated systems used by public authorities to make or materially influence decisions. These measures would help to promote transparency and enable public scrutiny, which is something that this House and its Members are here to do, either through legislation or for our constituents on a daily basis. It is important that we ask questions about these increasingly influential technologies.

Finally, new clause 26 would reinforce the right to an explanation by requiring data controllers to provide, on request, clear explanations of high-risk AI decisions. We need to ensure that meaningful human involvement remains central.

The new clauses are not intended to stifle innovation, but to ensure that the evolution of data use is guided by principles of fairness, transparency and accountability. We must ensure that data truly is the new gold for everyone, and that individuals’ rights and protections are not devalued in the process. Indeed, innovation is often better promoted by guidelines. The new clauses represent our commitment to ensuring that clause 80 truly modernises our data laws without sacrificing the fundamental safeguards that protect everyone, including the people behind those decisions. I thank the Minister for his consideration.

Chris Bryant (Labour, Rhondda and Ogmore)

I am not sure that I have a great deal to add. I feel caught between the rocks of “You are going too far” and “You are not going far enough,” which suggests to me that what we are advocating is probably proportionate and sensible, so I resist the new clauses and support clause 80.

I simply add that I do not have Spotify on my phone because I choose not to stream—I prefer to pay for my music—but I note that my ministerial podcast is available on Spotify.

Clause 81 - Data protection by design: children’s higher protection matters

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to consider new clause 21—Age of consent for social media data processing—

“(1) The UK GDPR is as amended as follows.

(2) In Article 8 of the UK GDPR (Conditions applicable to child’s consent in relation to information society services)

After paragraph 1 insert —

‘(1A) References to 13 years old in paragraph 1 shall be read as 16 years old in the case of social networking services processing personal data for the purpose of delivering personalised content, including targeted advertising and algorithmically curated recommendations.

(1B) For the purposes of paragraph 1A “social networking services” means any online service that—

(a) allows users to create profiles and interact publicly or privately with other users, and

(b) facilitates the sharing of user-generated content, including text, images, or videos, with a wider audience.

(1C) Paragraph 1B does not apply to—

(a) Educational platforms and learning management systems provided in recognised educational settings, where personal data processing is solely for educational purposes.

(b) Health and well-being services, including NHS digital services, mental health support applications, and crisis helplines, where personal data processing is necessary for the provision of care and support’”.

This new clause would raise the age for processing personal data in the case of social networking services from 13 to 16.

Chris Bryant (Labour, Rhondda and Ogmore)

I think the hon. Member for Runnymede and Weybridge thinks I was trying to calumniate him earlier by suggesting that he does not pay for his music, but I was not making that suggestion at all.

Clause 81 amends article 25 of the UK GDPR to strengthen the obligations for providers of information society services likely to be accessed by children, such as social media platforms and streaming services, by requiring them to actively consider the protection of children’s data when designing their services, and to ensure that appropriate organisational and technical measures are in place to safeguard young users.

The clause sets out the higher protection matters that ISS providers must consider when designing their services, including how best to protect and support children when processing their personal data. The duty also requires data controllers to consider the fact that children merit specific protection because they may be less aware of the risks and their rights, and the fact that children’s needs vary with age and development. When considering how to comply with the new duty, ISS providers will be greatly aided by the age-appropriate design code issued by the Information Commissioner’s Office, which sets out comprehensive guidance for ISS providers on using personal data in a way that complies with data protection principles and respects the best interests of children.

New clause 21, in the name of the hon. Member for Harpenden and Berkhamsted, would in effect increase the age of consent for social media from 13 to 16. I am happy to listen to her comments, but much of this was debated in Friday morning’s private Member’s Bill debate—I think that is partly what led her to table the new clause—and in the Westminster Hall debate a few weeks ago. I am happy to respond to her comments, but we will be resisting her new clause.

Ben Spencer (Conservative, Runnymede and Weybridge)

At the heart of new clause 21 is the aim to restrict access to certain social media platforms by children under the age of 16. I am very sympathetic to the motivations of the hon. Member for Harpenden and Berkhamsted.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I just want to clarify that the new clause is about the age of data consent, not access to social media. I will cover that in my speech, but I want to ensure that is clear.

Ben Spencer (Conservative, Runnymede and Weybridge)

I thank the hon. Lady for that clarification. Nevertheless, I think there is an overlap with the debate that took place in the Chamber last Friday on the ballot Bill introduced by the hon. Member for Whitehaven and Workington (Josh MacAlister), which has been dubbed the safer phones Bill. We all took part in that debate.

During Friday’s debate, I highlighted the mounting research and evidence on the harm to adolescents’ mental health from social media platforms. Policy in this area needs to be developed based on the best data and evidence. In that regard, we also need to learn from the roll-out of the Online Safety Act 2023 and the implementation of Ofcom’s guidance on putting in place age assurance in relation to particular types of content and data.

I welcome reports that the Government intend to commission the chief medical officer to review the harms associated with this area. It is disappointing that the Minister did not give a firm commitment on that from the Dispatch Box last Friday. Will he take the opportunity to do so today?

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I start with the young people at the heart of this. We have indeed debated this time and again, and it is important that we keep that going. I have been on a Safe Screens tour, speaking to young people across Harpenden and Berkhamsted—from Ashlyns school in Berkhamsted to St George’s school in Harpenden, and beyond. Girl guides have spoken to me of their concerns about online bullying and harmful content. When I visited local schools on my Safe Screens tour, young men told me that social media has shown them extreme content that they do not want to see, and despite their efforts to block or ban it, the algorithm brings it back. Young women have told me of their worries about the growing misogyny in online content. Together, young women and men alike have talked about the impact on their body image, bullying and the amount of time sucked up by social media—time they want to spend doing other things.

There is mounting evidence of the negative effects of our children’s exposure to an unsafe online environment. Every day, we hear the concerns of parents, the anxieties of teachers and, crucially, the voices of young people themselves, all crying out for action to ensure their safety online and calling for stronger regulation of their online experience. I realise that the Online Safety Act is moving forward, but it will not go far enough.

This is a matter of profound importance for the wellbeing of our nation’s children and young people. The digital world is now the fabric of our lives and the lives of young people—it is where they learn, connect and seek entertainment—and yet, as the digital landscape expands, so do the risks they face. As 5Rights highlights,

“the enormous potential of technology can only be realised when it is designed with children in mind”.

Parliament now has an opportunity, perhaps even an obligation, to help shape that technology. It is disappointing that the safer phones Bill was watered down, so we have tabled new clause 21 as a crucial step to strengthen protections for young people in the digital age. It seeks to bring UK data law in line with many of our European neighbours, by raising the minimum age at which internet companies can collect, process and store a user’s data without explicit parental consent to 16.

New clause 21 is not about banning children under the age of 16 from accessing social media. It is important that the responsibility lies with the social media companies to ensure that online spaces are age-appropriate, and to manage content and features. This new clause is a targeted and proportionate measure to require online services to change fundamentally how they handle children’s data. This crucial change will necessitate restricting the pervasive and often harmful influence of algorithms to make the platforms inherently less addictive and ultimately foster a more child-friendly digital environment.

It is imperative that digital technology is designed with the best interests of our children and young people at heart, ensuring that their rights and privacy are upheld—not as an afterthought, but with safety by design and by default. Furthermore, new clause 21 underscores the fundamental principle that the responsibility for managing content and features must remain firmly with the social media companies. We call for the establishment of robust digital standards to ensure that platforms prioritise child safety and privacy as their default setting, rather than as an optional extra.

Our duty to protect children online, however, cannot end with new clause 21. We call on the Government to take further action, such as explicitly recognising and treating children’s use of social media as a critical public health issue, thoroughly examining international best practice, identifying innovative solutions to the challenges we face, and developing evidence-based policies that will demonstrably improve online safety for children. I welcome the Government’s proposal last week to introduce a cross-Government safer screens taskforce to look at research into the multifaceted impact of social media on children’s wellbeing.

This is not an overnight phenomenon. Last year marked 20 years since Facebook was created and 18 years since the smartphone was launched. We now face mounting calls from young people, parents and teachers. Now is the time for greater action on the gaps left by the Online Safety Act. I urge the Government to recognise the urgent need for decisive action and to support new clause 21. This is a pivotal opportunity to strengthen protections for young people online and to cultivate a digital world where they can thrive, not merely navigate potential harms. Let us work together across party lines to ensure a safer and brighter digital future for all our children.

Joe Robertson (Conservative, Isle of Wight East)

It is a pleasure to speak under your chairship, Mr Turner.

I have some sympathy with what the hon. Lady is trying to do with new clause 21. I invite the Minister to address, as I am sure he will, her very specific point that it is not about restricting access to social media for people aged between 13 and 16, but about further restricting how social media is targeted at those age groups. After visiting schools in my constituency, I am minded to support her argument. At Ryde academy, I heard the reaction of young people to their school restricting access to their phones, which a school can only do during the school day.

I am interested to hear the Minister’s response to the quite reasonable proposition on how to restrict social media companies from targeting children aged 13 to 16. Restricting the way they collect their data sounds like a small, but meaningful, step that the Government could take.

Chris Bryant (Labour, Rhondda and Ogmore)

I thought the debate might stray a little from the precise point my hon. Friend just made to into broader issues about young people’s use of smartphones and social media in general, and inevitably it has. This is a very live issue, of which the Government are painfully aware, as I tried to say in the debate last Friday. We are trying to work out the best way forward to a place where the rules that were implemented in the Online Safety Act, some of which only come into force in the spring—some have yet to get parliamentary approval; that will probably come in April—bed in properly and are adhered to before we take further action. That is simply because it is difficult to know otherwise whether the Online Safety Act has gone far enough. I wish that the Online Safety Act had been not the Online Safety Act 2023, but the Online Safety Act 2021 or 2019. Had it been, we might now be in a position to assess its effects.

In the debate on Friday I referred to the feasibility study commissioned by the Department for Science, Innovation and Technology from the University of Cambridge, which is working with other researchers. Work on that will finish in May, so I hope to have further information then. There is already a lot of guidance out there for parents, teachers and schools, but if we need to provide more informed guidance in the future, we will certainly look into that.

The precise targeting of young people by algorithms and so on is, at least theoretically, already dealt with by the Online Safety Act. That is why I do not think that new clause 21 is an appropriate measure to take forward at this time. Whether the age limit should be 13 or 16 was decided by the previous Government and agreed by Parliament after quite extensive consultation during the passage of the Data Protection Act 2018. All these matters have to be kept under review, and we are doing so in an urgent way, not least because a lot of Members are bringing up concerns raised by their constituents, families and so on.

I sometimes worry that the concentration solely on schools is to the detriment of the wider issues we are facing, not least because, as teachers readily admit, they only ever see children for about 20% of their time, and we need to set this in a wider context. I understand the motivation behind the new clause, but I will still resist it.

Clause 89 - Joint processing by intelligence services and competent authorities

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Clause 90 stand part.

Chris Bryant (Labour, Rhondda and Ogmore)

I rise mainly to speak to new clause 8, which was tabled by the hon. Member for Harpenden and Berkhamsted. It would require the Information Commissioner to review and publish an annual report on data sharing by law enforcement and the intelligence services. Any processing of personal data by law enforcement and the intelligence services must, by definition, be lawful, which inherently includes the requirement that the processing be necessary and proportionate.

The Information Commissioner is obliged to provide an annual report to Parliament under the Data Protection Act 2018, and may also produce additional reports as they see fit. The commissioner has powers of investigation, monitoring and enforcement that they may exercise as appropriate to oversee law enforcement agencies and intelligence services. Given the current system of oversight, and the fact that the commissioner is already required to provide reports annually, I hope the hon. Member for Harpenden and Berkhamsted will not press her new clause to a vote.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I am sure members of the Committee will be pleased to hear that I have a very short speech. Clause 89 permits the processing of personal data jointly between law enforcement and intelligence services for the crucial purpose of safeguarding national security. While the Liberal Democrats recognise the necessity of such collaboration in specific circumstances, the inherently sensitive nature of the data demands the highest level of protection and scrutiny. New clause 8 is designed to ensure that ministerial changes to the data safeguards on this joint processing cannot be enacted without proper scrutiny by Parliament. We would also welcome hearing from the Government on Report proposals to uphold and ensure that parliamentary scrutiny.

Clause 92 - Codes of practice for the processing of personal data

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Chris Bryant (Labour, Rhondda and Ogmore)

I rise to speak primarily to new clause 27. The Government are committed to the independence of the regulator, which will continue to be accountable to Parliament. The Bill does not introduce a statement of strategic priorities, as the hon. Member for Harpenden and Berkhamsted seems to suggest in her new clause, nor does the Secretary of State issue discretionary guidance to the regulator. Neither the Bill nor existing legislation provides for the Secretary of State to amend or reject a code of practice. I therefore do not see that this new clause is necessary.

Ben Spencer (Conservative, Runnymede and Weybridge)

I have a specific point on the text of new clause 27. We do not support this curtailment of powers, particularly in this context. I am sure that the Secretary of State will consult as a matter of course in carrying out his duties, whatever they are, and a specific requirement to consult the Science, Innovation and Technology Committee, notwithstanding its prowess and stature, would be inoperable.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

For us, the amendment is again in the spirit of ensuring proper scrutiny. However, I welcome the Minister’s comments and am happy not to press it.

Clause 95 - Regulations under this Part: Parliamentary procedure and consultation

Chris Bryant (Labour, Rhondda and Ogmore)

I beg to move amendment 22, in clause 95, page 120, line 31, leave out subsection (1).

This amendment removes a subsection which was inserted at Report stage in the Lords.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Clause stand part.

Clauses 135 to 139 stand part.

Chris Bryant (Labour, Rhondda and Ogmore)

Clause 95(1) relates to artificial intelligence and copyright and the related reporting requirement on the Information Commissioner. I will set out our fuller reasoning on copyright shortly, but for now, I merely state that we believe that now is not the right time to place an additional reporting obligation on the Information Commissioner in the Bill. Government amendment 22 would therefore remove subsection (1), which was added to the Bill on Report in the Lords.

Subsection (2) requires the Information Commissioner to publish key performance indicators. The Government take the performance and accountability of UK regulators seriously. Regulators undertake important functions across our economy and society, and the Information Commissioner’s Office is no exception, so it is important that Parliament and other stakeholders have the right means to hold them to account. Publishing such metrics is best practice and a transparent way of providing measurable analysis of the ICO’s performance year on year. This forms part of a package of additional reporting requirements, alongside those in clause 91 and the report on regulatory action in clause 102, which we will discuss later. Together, they will increase understanding and transparency about priorities, performance and enforcement activities.

Clauses 135 to 139 are in this group, although we will vote on them later. They set out further requirements regarding copyright and AI, and I urge that they do not stand part of the Bill. These clauses require regulations to be made to ensure compliance with copyright law by web crawlers and general AI models, and transparency about the use of web crawlers and the works they scrape. There is also an enforcement requirement for the Information Commissioner, and provision on a review of technical solutions.

The Committee well knows, because I have mentioned it several times, that I agree with many of the points raised in debate on the clauses and the importance of transparency for rights holders in the creative industries. It was one of the key principles in the consultation we published on copyright and AI that closed on 25 February. We want genuine transparency about what is used in training AI, alongside rights holders’ control of their work and appropriate access to training material for AI. However, although I accept the intention behind the amendments—that is, clauses 135 to 139, which were added in the Lords—we do not believe that the Bill, which is a data measure, is the right vehicle for action.

We received more than 11,000 detailed and heartfelt responses to our public consultation on AI and copyright. Many set out specific views on transparency, technical standards and a range of the questions that we asked in the consultation. We are taking care to read each response. Although we believe that action needs to be taken on transparency and web crawlers, as well as other issues relating to AI and copyright, it is only right that we carefully consider all the viewpoints and evidence before acting. We have heard loud and clear the message that stakeholders do not want us to rush to legislate on this topic, and we intend to heed this message. Yesterday the Secretary of State met representatives of the creative industries and repeated that point.

The engagement will not end with this consultation. I have already stated our intention to create working groups to move the conversation forward, including on technical solutions. Industry often comes up with the best ideas, so I want to harness that, whether it is greater transparency about AI training or standards on web crawlers, metadata and watermarking. Whatever the solution, we want to be confident in its efficacy and, critically, in its simplicity and accessibility. We have said repeatedly that we will not move forward in this sphere unless we are confident we can give rights holders greater control over the use of their works. Once we have analysed the responses to the consultation, we will publish proposals. Clauses 135 to 139, which were added to the Bill on Report in the House of Lords, should not stand part of the Bill.

Opposition new clauses 17 to 20 also relate to AI and copyright. I am grateful for the way in which the shadow Minister, the hon. Member for Runnymede and Weybridge, has advanced these suggestions. These new clauses would require the Secretary of State to issue a statement on the application of UK copyright law to the activities of web crawlers and artificial intelligence models. One of the new clauses sets out the possibility of this being a copyright notice, issued by the Intellectual Property Office. They also require the Secretary of State to produce two reports, one of which should include a plan for transparency regarding the use of copyright materials with AI; the other should be on access to data and how to reduce market entry barriers for start-ups and smaller AI enterprises. Finally, they would require the Secretary of State to publish a technical standard for a machine-readable digital watermark, which would allow rights holders to label their content for the purposes of licensing.

As the House is aware, these amendments relate to matters that are at the heart of the government’s approach to AI and copyright. Indeed, the recently closed consultation sought views precisely on these issues. I commend my Conservative colleagues on the spirit of these amendments, but ask that they not be pressed at this time. I hope we can have further discussions on how we move forward on Report. While the amendments may indeed offer useful steps for the Government to take in solving issues of AI and copyright, proper analysis and policy development is likely to take longer than the proposed timeframes included in the clauses, given the 11,000 responses we received to the consultation. In addition, we would not wish to pre-empt the consultation, which some of these proposed clauses may do.

That said, I hope that I can discuss the issues raised by the amendments further with Members from both Opposition parties, to discuss whether we might be able to agree on similar proposals as we move forward. As I say, we take these issues seriously. As I am the Minister for Creative Industries and a Minister in the Department for Science, Innovation and Technology, I take a special interest in this and agree with the spirit of what these amendments seek to achieve, but I ask that new clauses 17 to 20 not be pressed at this stage.

Ben Spencer (Conservative, Runnymede and Weybridge)

Equally I thank the Minister for the spirit in which he has conducted this debate. It is an important one, which has captured the focus of a great many people, not only those in the creative and AI sectors whose livelihoods absolutely depend on us getting this right, but all of us who love and benefit from the products of the UK creative industries.

I will discuss clauses 135 to 139, which the Government are seeking to remove, before I speak to the new clauses that stand in my name and those of other Opposition Members. While there are problems with clauses 135 to 139, they do reflect the creative industries’ well founded and much publicised concerns about the manner in which AI developers conduct data mining activities to train their models and for generative activities. I should declare an interest; I recently attended the Brit awards with my wife with support from the British Phonographic Industry, so I received hospitality in the last couple of weeks.

I want to recognise the tremendous efforts of the noble Baroness Kidron in the other place in bringing this incredibly important issue to the forefront of the minds of lawmakers and the public. My right hon. Friend the Leader of His Majesty’s Opposition has been clear about the importance of growing our domestic AI industry. These technologies have the potential to improve our lives and stimulate economic growth. That need not and must not come at the expense of our creative industries. Music, especially live music, is one of my passions. I know that the Minister shares my passion for our creative industries; indeed, his efforts to incorporate a thespian flourish into the debates we have had over the past few months do not go unappreciated —by some.

Chris Bryant (Labour, Rhondda and Ogmore)

And are hated by others.

Ben Spencer (Conservative, Runnymede and Weybridge)

The Minister can interpret that how he wishes. We must ensure that our creative industry is supported to thrive while harnessing the technological and economic benefits of growing our domestic AI capability. The amendments in this area from the other place touch broadly on a number of important principles, which we support. They include the application of copyright law to data mining and AI-generative activity, which is covered in clause 135; the need for high transparency in how AI models are trained and the materials used for that purpose; and the importance of identifying sound technical solutions so that copyrighted content can be identified by web crawlers and AI models excluded from training and generative activity.

However, these matters and their solutions are complex from technological, legal and societal perspectives. We totally recognise the challenges of legislating in this area. Our international counterparts face the same challenges in trying to strike an effective balance between supporting our AI industries and supporting our creative sector. It is not a zero-sum game. There is clear scope for collaboration and mutual benefit if we get this approach right. As the shadow Secretary of State for Science, Innovation and Technology, my hon. Friend the Member for Havant (Alan Mak), stated in the Chamber, creative industries are telling us that the Government’s solution—set out in their consultation as their preferred option—is “not fit for purpose”. We need to engage carefully with the feedback received from industry stakeholders to come up with the right solutions in this area.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I have found these discussions among Members across the House about AI and copyright to be a delightful exchange about the creative industries that we love. I understand the Minister’s comments about there being different spaces for that debate and that this may not be the place for that, but I would like to speak to the new clauses that were proposed in the other House.

To highlight one of the creative industries that I love, this weekend I went to The Rex cinema in Berkhamsted, one of the best cinemas in the world—if any Members want to come, they are all very welcome. Sitting there, watching “A Complete Unknown”— about Bob Dylan and his songs—in a local movie theatre reminded me just how important it is to ensure that the creative industries can maintain their creativity, because it speaks to our soul and our society. They are beyond machine learning. They are humans who actually understand us and help to tell our stories in different ways.

That is why the Liberal Democrats welcomed new clauses 135 to 139 that were tabled in the other place. We also welcome the consultation from the Government and are pleased to hear that there have been over 11,000 responses. Members will find responses from us in there, because we wanted to make sure that the Liberal Democrats made representations at every stage. It is disappointing that the change that the Government have set out means there is an “opt in by default” provision, and the message has come across from the creative industries that they are calling for an open consultation, so we can make sure that their views are heard. We support their voices being heard and, indeed, striking that balance where the creative industries can work with innovation, as they have been. This is about getting that right. We are proud of those industries in the UK. We must work together and truly listen to those thousands of voices up and down this country. That is what we stand for, and we will support the Government moving forward in that way.

Chris Bryant (Labour, Rhondda and Ogmore)

First of all, I commend both hon. Members on their contributions. Let us face it; this is very difficult. It is a classic case of difficulty for the Government because, as the previous Government found, two sectors are really important to UK growth. The creative industries are one of the fastest-growing sectors in the UK and are representative of our future growth. Somebody put it to me the other day that there was a time when our economy relied on selling industrial products, then it was services, and, in the new era, perhaps one of the things that we are exceptionally good at is selling experiences, and a large part of that is through intellectual property from the creative industries.

As part of our industrial strategy, we have identified the creative industries as one of our key sectors and we definitely want to build on that. But, at the same time, we are one of the biggest markets in the world for AI. We have some of the best AI small start-ups and developers, and we want to build on that, not just as a key part of our economic growth, but as part of delivering productivity and efficiency within so much of our public services, within industry, and within so much of the way we live our lives.

As the hon. Member for Runnymede and Weybridge says, we do not believe that this is a zero-sum game; we believe that it is possible to get to a situation in which the AI companies can flourish in the UK, and the creative industries can do so at the same time. Indeed, I would argue that to say anything other than that would be, in the words of the Sugababes,

“a one-way ticket to a madman’s situation”.

I want to make a few points that I think are important here. First, on new clause 20, yes, we are very keen to get to a place where there are technical solutions. As I said when I introduced the consultation in December, there are some very clever people out there who know how to do some extraordinary things with IT, and there must be some very clever people who know how to ascertain the copyright of the material that they are using.

If we could get to a technical solution to rights reservations, so that AI companies have the security of knowing what material they are using—that they are scraping or ingesting—and creative industries know that their work is being used and can either say, “No, you can’t use it,” or, “If you are going to use it, you are going to remunerate me,” whether that is individually or as part of a collecting society, that would be a significant advance for us. That is one of the key things that the Secretary of State has repeatedly said we are trying to do. I am not sure that the precise way in which new clause 20 suggests we should bring forward a technological standard is the right way of doing it, but I am very happy to have further conversations with the hon. Member for Runnymede and Weybridge before we reach Report.

One thing that I think has been significantly difficult for everybody is trying to make a proper economic impact assessment of what each version of these outcomes would look like. How do you assess the value of future growth in AI in the UK against future growth in creative industries in the UK? It is very difficult to judge, and that is one of the things that I think that we need to address.

It is also true that many creative industries use AI all the time, either as part of their business processes or as part of the actual creative process, whether by editing a song so that it can use voices of people who are no longer with us, through CGI, by dubbing films, or through a whole series of different things. Indeed, I was really struck when I went to Stratford last week to see a magnificent production of “Edward II” at the Royal Shakespeare theatre. They are talking there about creating a new video game that is based on “Macbeth”, called “Lili”, and, of course, that will use a lot of artificial intelligence. A lot of tech companies are part of the creative industry, so I honestly do not think that these are two worlds that are completely apart.

Ben Spencer (Conservative, Runnymede and Weybridge)

I am tempted, because we both clearly share a love for the Sugababes, to just draw a reference to that. Of course, the creative industries also have quite a lot of experience of using other creative materials licensed from other producers. For the Sugababes song “Freak Like Me”, I am fairly sure that the sample is directly taken from Gary Numan’s “Are ‘Friends’ Electric?”, and presumably they came to some sort of arrangement in organising that. This sharing of data is not unusual for the creative sector.

Chris Bryant (Labour, Rhondda and Ogmore)

I have often wondered whether Kylie’s song “Padam Padam” is a reference to Edith Piaf’s “Padam padam…” because they are also quite similar. This is, of course, a well traversed space for people working in the copyright sphere: trying to make sure that people are not passing off or using other people’s work without permission. The economic and moral rights of rights holders are well established in UK law. We started the process of legislating for that in 1709, under Queen Anne. Dickens had an ambition to make sure that people could not just take copies of his books to America and sell them for free without any payment to him, which is part of why we ended up with an international copyright regime. We do not want to undermine that.

Transparency is key, and it was one of the elements that we put into our consultation. We need to be careful about precisely how that transparency works out. The hon. Gentleman referred to proposed new clause 18, which he wants us to do something on within three months. As ambitious as he may be for me, that is a remarkably short period of time for parliamentary drafting. After all, a version of the Bill was first introduced four years ago, yet it still does not have Royal Assent. He refers to the terms “proportionate and effective” in that proposed new clause. To go back to “Hamlet”, aye, there’s the rub. What do proportionate and effective mean, and how do you balance the two? Different sectors will have difficult and competing sets of agendas and we may, in some shape or other, have to arbitrate.

The hon. Gentleman is right to say that no one, anywhere in the world, has come to a proper settled position on this issue. In the United States of America, for instance, a lot of AI companies have been relying on fair use, under the slightly different copyright system there, but the most recent federal case found in favour of Reuters against an AI company—the court said that scraping material was not fair use. The EU has not yet fully developed its proposals and has not decided how to implement its transparency requirements. It could be argued that that is one reason why there has not been much additional licensing, which was one of the EU’s declared goals.

There is also the question of how to enforce transparency. The clause—in a provision tabled by the admirable Baroness Kidron—specifically gives that enforcement power to the Information Commissioner. I am not sure that is the right place to put that power, or that the Information Commissioner has the expertise or resources for it. Undoubtedly, if there are to be new transparency requirements, we must have some form of enforcement.

All those things suggest to me that it is not right to put this power as an addendum to this Bill. The matter should be seen in the round, after a consultation, and there should be a proper primary legislation process, which may not happen for another 12 to 18 months, or even two years. I do not know.

The Secretaries of State for Culture, Media and Sport and for Science, Innovation and Technology, and myself, are keen to get to a place where there is more licensing of copyrighted material by AI companies. I do not think anybody expects that the labour of others should be handed over to third parties without recompense or control. That, in itself, is not simple. It might be simple for the Design & Artists Copyright Society to do all the licensing for artists and photographers, but how could that be done for people who works as individuals, rather than as part of a collecting society? That is another set of issues that need to be addressed.

I know there are places in the world where one can buy an AI-generated book, and it might be perfectly readable. We might all have authors who we think have worked in that way in the past. But when I read a book, watch a film, or listen to a piece of music, I want to know that it has a human involved in it. Human creativity is a vital part of what renders that process of creativity so important. I think of humans as fundamentally social beings. One of the worst things that can be done to a human being is to put them in solitary confinement, because that denies our fundamental social being. What is so special about all the creative industries is that they enable a connection from human being to human being. I am passionate about not losing that or the value inherent in that.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

On a point of order, Mr Turner. I want to make a point about new clause 30, which I know was not selected for debate. Many will be familiar with the story of the constituent of my hon. Friend the Member for Cheltenham (Max Wilkinson), Ellen Roome, who lost her 14-year-old son Jools in 2022. Jools was a happy boy. He died in tragic circumstances. In her search for answers about the circumstances leading up to Jools’s death, Ellen has come up against outdated laws and social media giants taking an intransigent approach to sharing data that should naturally be hers as a bereaved parent. We are talking about things that, in the past, she would have been able to find out by looking through her child’s bedroom—things that might have been in wardrobes, stored under the bed or in scrawled notes. These days, those bits of data could be on multiple social media accounts, but parental access is denied.

That is the subject of new clause 30, tabled by my hon. Friend the Member for Cheltenham (Max Wilkinson), Ellen’s Member of Parliament. The change to the law would be known as Jools’ law, in his memory. It would give parents access rights to their deceased child’s data automatically, with certain safeguards to respect third parties, so that other grieving parents will never face the challenges and the huge legal costs that Ellen has had to endure. I know that this new clause has not been chosen for discussion, but I would welcome a meeting with the Minister and my hon. Friend the Member for Cheltenham to discuss the issue further.

Chris Bryant (Labour, Rhondda and Ogmore)

Further to that point of order, Mr Turner. The reason new clause 30 has not been selected is not that anybody has wanted to rule it inadmissible; it is simply because we are cracking through the Bill at such a speed that, although it was anticipated we would still be sitting on Thursday, it seems likely we will finish today, and new clause 30 therefore cannot be reached today because of its late tabling.

I know that Ellen is in the room, and I am very happy to facilitate a meeting with her, which I think is still outstanding with the Department. We will make sure that happens before the Bill gets to Report stage. If the hon. Member for Cheltenham or other Members want to be present at that meeting, I will make sure that happens. This is not a slight of any kind; it is just an accident of fortune in terms of the tabling of amendments.

Karl Turner (Labour, Kingston upon Hull East)

I am grateful to the hon. Lady and the Minister for their points of order.

Clause 117 - The Information Commission

Steffan Aquarone (Liberal Democrat, North Norfolk)

I beg to move amendment 21, in clause 117, page 149, line 11, at end insert—

“(5A) In Schedule 13, paragraph 1(1), at end insert—

‘(j) advise the Government on measures relating to data ownership, and individuals’ rights and freedoms, in the delivery of its Data Vision and Strategy.’”

This amendment amends the functions of the Information Commission to allow it to advise the Government in the delivery of a Data Vision and Strategy.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Steffan Aquarone (Liberal Democrat, North Norfolk)

New clause 10 requires the Government to bring forward a data vision and strategy within six months of the passing of the Bill, and amendment 21 would add a new function to the Information Commission to allow it to support the Government in the drafting and delivery of that data vision and strategy. New clause 11 seeks to ensure that all departmental boards and NHS bodies have senior staff with data and technology expertise at the highest level. Finally, new clause 16 would require the Government to publish annual reviews of the use of data in the delivery of public services, including updates on the progression of a number of key goals.

I turn first to new clause 10. In previous speeches in the House, I have tried my best to emphasise the transformative power of data in our era. It can be seen as similar to the discovery of fire, gold or oil, such is its value and ability to totally reshape how we approach the world. I think the most accurate comparison is with Edison’s harnessing of the power of electricity. I invite you, Mr Turner, and the Committee to imagine that Government is like a 19th-century factory. Prior to electricity generation, a factory had to be organised around a single power source—usually a steam engine—with every machine that needed power connecting directly to the central driveshaft above. Components could be made but then had to be transported elsewhere to be assembled, usually by hand. By harnessing electricity, it was possible to pipe power anywhere on the factory floor. That meant the machines could be placed wherever they were needed, becoming more precise, more efficient and more specialised, and it led to mass manufacturing of the product as the central organising principle of industry.

What does this have to do with modern government? The data revolution that has been under way since the 1990s means that the structures and organisation of government can themselves be transformed in the same way that industry was in the 1890s. We can use data to shift from archaic practices and government functions, some of which occasionally feel like they might still run on steam power, and shift towards public services that make the citizen experience their central organising principle. With the true free flow of data through government, we can bring services to people, make them easier and more efficient to use and radically improve how people interact with government. However, to do any of that, the Government need to develop key principles to enable them to seize that opportunity. Creating a data vision will show what the future could be for data use across government, setting out where we want to get to, how we want services to run and what the ideal citizen experience will be. From that vision, which I hope would be ambitious and wide-ranging, the Government could design a strategy to deliver on it, outlining how they are going to seize data’s transformative power to improve the state’s workings and ultimately deliver a better experience for all our constituents when they come into contact with government or the state.

A national data strategy was, in fact, published under the last Government. It was consulted on during 2019 and published in 2020. It is clear that the world is very different from the world in 2019. The pandemic made Government rapidly re-evaluate and improve their relationship with available data to handle a national emergency and there are lessons to be learned from that. It also forced a change in many people’s habits and expectations. We are prepared to act far more digitally now, but also expect that businesses and corporations and Government will be more adept in the experiences they provide for us. Although much of what was in the last data strategy was on the right track, I am sure that, with a new world, this new Government would want to make their own mark and fully harness the data revolution.

A comprehensive data vision and strategy also empowers the Government when they need to move quickly, to adapt and react to the ever-changing technological landscape. When we need swiftly to harness new technologies or developments, we risk missing out and needlessly delaying, if we drive ourselves back to the legislation table each time. Although I am greatly enjoying the Bill Committee, if we go through a full set of legislative processes every time we want to use the latest innovation, we will move far too slowly. An overarching vision gives confidence to the Government in how to react to new developments by assessing how they can match up with the long-term strategic goals that they want to achieve.

Our slow adoption of the power of data has allowed many other countries to be leaps and bounds ahead of us, despite not having the resources, the expertise or the talent that our country has heaps of. Let us make sure that, for the next step of digital transformation, people look to us as leaders and trailblazers.

I hope that the Government will take inspiration for the data vision and strategy from the last 25 years in Estonia. As I told the House on Second Reading. Estonia has made the astonishing transformation from a poor post-Soviet state to a leader in digital government and data leadership. Its national drive to improve digital literacy and access, along with pulling their public services into the digital age, is an example that many other nations, including ours, should seek to follow. It has made 100% of public services available digitally, developed the fantastic X-Road data-sharing platform and delivered millions of euros in efficiency savings. It is a completely realistic goal to make the UK a digital leader in digital government and data efficiency, just like Estonia. That is the goal that I would write in the Government’s data vision. I hope that the Minister, if he were authoring it, would be just as ambitious.

I also think the Government could take lessons from Denmark, which has come top of the UN’s e-government rankings. It has embedded core principles of digital inclusion into its data and digital transformation journey. Those principles include being aware of the consequences of digitisation, providing usable alternatives and designing solutions for all citizens. This quote from its “Principles for Digital Inclusion” publication is particularly pertinent:

“It is a democratic problem if the digital transformation becomes a barrier to participating in the welfare society.”

The Minister and I have spoken about and shared concerns about digital exclusion. It is something that our constituencies and constituents both have in common. I hope he would be as keen as me to see that inclusion principle made a key tenet of the future of digital governance and data use.

Amendment 21 also ensures that, in drafting and delivering the strategy, the Government can rely upon the expertise of the Information Commissioner. The rights and freedoms of citizens and their data ownership must be core to a future data vision and strategy. The amendment enshrines the ability of the Information Commissioner to act as a source of advice and guidance in bringing that forward. The Government and Departments will need to be ready to implement the data vision and strategy, and the radical transformation that it will require.

I have therefore tabled new clauses 11 and 16. New clause 11 would require the NHS and Government to ensure the appointment of someone with a senior data, information or technology role to their boards. A helpful inspiration in the drafting of the new clause was the Government’s own “State of digital government review”, published only a couple of months ago. It is nothing short of excoriating in its assessment of the state of digital government, as well as the Government’s digital talent and culture. The review states that

“non-digital public sector leaders with sizable delivery responsibilities have insufficient technical expertise or training”,

and that

“Digital leadership is not a consistent priority.”

My new clause 11 would ensure that a chief digital and information officer, a chief information officer, a chief technology officer or a service transformation lead is present on the boards of all Departments. As it stands, none of those roles is present on the executive committee at any of the following Departments: Business and Trade; Housing, Communities and Local Government; Health and Social Care; Education; the Home Office; the Cabinet Office; NHS England; and the Treasury. I could keep going, but I think everyone gets the point.

That is in the Government’s own review, published by the Minister’s Department, and I am using it to draw attention to the problem. It criticises the problem that new clause 11 seeks to remedy. I invite the Minister to accept the new clause to fix something that his own Department has highlighted and that I would not have known about without its helpful review. I do not blame him one bit, of course, because his party inherited this situation from the Conservatives, who were guilty of failing for almost a decade to address the problem, but I hope that he can put it right by accepting new clause 11.

Turning back to the review by the Minister’s Department, it also states that 47% of central Government services and 45% of NHS services still lack a digital pathway. The report says:

“The UK is under digitised”,

and I wholly agree. I hope that new clause 16 could take steps to fix that. I would look forward to the Secretary of State coming to Parliament with his review each year to tell us about the great leaps that the Government are making towards improved data use in public service delivery and improving their digital talent and culture.

If the Government are serious about pushing forward digital transformation with the power of data, new clause 16 provides them with an annual victory lap. If things are falling behind, if the problems that the “State of digital government review” identified are not being rectified, this measure would ensure that they can be scrutinised and held to account. We cannot let the Government fall again into the state that their review found them to be in. I hope that my new clauses could fire the starting gun for a Government that is ambitious and innovative about their data use and digitisation in future.

The Minister heard me make many of the same arguments on Second Reading. I was pleased with the warmth of his reception then, as well as the broad understanding of his Department that we need to do more and do it better. I hope that he can provide me with some commitments today on the issues that I have raised, for the benefit of the citizen’s experience and of everyone we represent. I will end by quoting from the conclusion of his Department’s review—I am grateful to the Government for publishing those findings—which sums up the points I have made excellently:

“Digital is one of the most powerful forces for public service reform, and when it is successful, it changes lives and the public experience of government…However, our approaches to leadership, structure, measurement, talent and funding do not yet do justice to this potential: it is time to transform and reform the way we do digital.”

Chris Bryant (Labour, Rhondda and Ogmore)

I note that before the break we had the Sugababes, and that now we have “The Tempest”—I think the hon. Gentleman managed to get in a very brief quote, or I guess his version of it: O brave new world that has such data in it.

The hon. Gentleman excoriates the Government for moving too slowly and for not taking enough powers to be able to move faster, and yet several of the amendments that the Liberal Democrats have tabled have been ones that insist that we should have more accountability to Parliament and a slower process, and should not have such regulation-making powers. It is often difficult to decide between those two because we want enough parliamentary scrutiny, but in an area of rapid technological change it is important that legislation is able to move fast enough to adapt. The hon. Gentleman rightly refers to digital inclusion as a key aspect of the Bill. If we are going to take forward a digital nation and a digital Government plan, we have to factor in the fact that some people will simply not be able to take part unless we take radical action to include them digitally.

Amendment 21 places a duty on the information commission, new clause 10 sets out a data vision and strategy, new clause 11 insists that Departments must have somebody who is able to bring forward a data vision and strategy, and new clause 16 insists that the Secretary of State produces an annual review. I have not counted the number of annual reviews for the Secretary of State to produce in amendments that the Liberal Democrats have tabled, but it is quite a large number already. It may be a good idea if we produce just one annual review for the whole sector.

The blueprint for modern digital Government, which we laid before Parliament on 21 January, addresses some of the concerns raised by the amendment and new clauses. It aims to unify public services, strengthen digital and data leadership, create a national data library and ensure transparency. A key commitment is the publication of a Government digital and AI road map this summer to drive public sector reform. It will probably look remarkably like a data vision and strategy, so I think the hon. Gentleman is going to get what he wants; it will just not have his title on it—I mean his title, not his name. We are basically doing what he wants us to do, so if we were to add his proposal to the Bill, it would simply duplicate the work.

We have also committed that the road map will be developed in the open, and that we will seek input and collaboration from colleagues across central Government, the wider public sector, civil society and tech companies. That will include engaging with the information commission, as amendment 21 proposes. We therefore believe there is no need to create a statutory obligation on the new information commission to provide advice.

On new clause 16, the Government are dedicated to delivering data-powered public services that are built around users. Privacy notices and data-sharing agreements ensure transparency, protecting individual rights while enabling efficient public services. The Digital Economy Act 2017 gives the Government powers to share data across organisational boundaries to improve delivery of public services, subject to privacy safeguards. There are many transparency measures that support this framework.

The hon. Gentleman is right that we have gone far too slowly. It would be good if a data Bill had been on the statute book several years ago, although we nearly managed to get one over the line just before the general election. I am just not sure that an annual review of the use of the public service delivery data-sharing power, presented to the board and Ministers for endorsement, would be particularly valuable.

I hope I have shown that this addition to the Bill is unnecessary, so I hope the hon. Gentleman will not press his amendment to a Division.

Steffan Aquarone (Liberal Democrat, North Norfolk)

I beg to ask leave to withdraw the amendment.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Amendment 52, in schedule 14, page 242, line 33, at end insert—

“(1A) The appointment of the Chair of the Information Commission must be subject to approval by a resolution of each House of Parliament.”

This amendment seeks to strengthen the regulator’s independence by subjecting key appointments to Parliamentary approval.

Schedule 14.

Clauses 118 to 120 stand part.

Ben Spencer (Conservative, Runnymede and Weybridge)

I rise to speak to clause 117, the first clause in part 6, on reforming the information commission. Part 6 sets out provisions to abolish the Information Commissioner’s Office and transfer its functions to a new body, the information commission, with a chief executive and board of directors. His Majesty’s Opposition welcome the fact that the Government are substantially taking forward some measures on reform of the ICO envisaged in previous iterations of this Bill, including the previous Government’s Data Protection and Digital Information Bill. Indeed, the ICO has said that the changes under the Bill will bring its governance structure into line with that of comparable regulators. Given some of the challenges and opportunities that our data-driven economy will present, the new information commission must be set up in the right way to perform its regulatory functions as effectively as possible.

There is no doubt that the scope of the information commission’s role will grow, commensurate with the changes brought in by the Bill—for example, the obligation to have regard, in the performance of its role, to factors such as promoting innovation and competition. We are supportive of those aims, but it would be helpful if the Minister could briefly address some of the concerns raised by my noble Friend Lord Holmes of Richmond in the other place, particularly the Minister’s strategy for ensuring that the information commission is provided with clarity as to its responsibilities and obligations when it comes to economic growth, and how he will ensure that that remains consistent with the information commission’s primary functions relating to data protection.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I will speak only briefly about amendment 52, but I would like to think that after all the Liberal Democrat interventions today, no one will have any doubt that we take data very seriously. I realise that we have outlined a lot of proposals, but they are all in the spirit of helping to shape the data vision and of saying how important we feel it is. Amendment 52 is about the questioning of scrutiny. I am happy not to press the amendment, but again it is important to make sure we have trust in line with innovation.

Chris Bryant (Labour, Rhondda and Ogmore)

The Government are, of course, committed to the independence of the ICO. As the hon. Member for Runnymede and Weybridge said, the recommendations about changing the structure were entirely ones that were advanced in the previous version of the Bill and supported by the previous Government. We think that it will just make it more efficient, more effective and more transparent.

As I have said, we are committed to the ICO’s independence; it is a vital part of its role. That is why the new role of the chair of the information commission will be appointed by His Majesty, by letters patent— the same approach taken for the current Information Commissioner role. Furthermore, the Secretary of State has agreed with the Chancellor of the Duchy of Lancaster that the role of chair will be listed as a significant appointment with the Commissioner for Public Appointments and be subject to pre-appointment scrutiny by the Science, Innovation and Technology Committee.

The shadow Minister’s questions about how the Information Commissioner can balance those two requirements are perfectly legitimate. I think that they are questions for the Information Commissioner, and they are the kind of questions that could legitimately be asked in a pre-appointment session with the Select Committee. I do not, therefore, believe that the amendment from the hon. Member for Harpenden and Berkhamsted is necessary.

However, I would like to put on record that the Government intend to maintain the title of the Information Commissioner in respect of the chair of the information commission, acknowledging the fact that the identity and brand of the Information Commissioner is valued and recognised domestically and internationally. We do not want to lose that, so we intend to preserve it.

Clause 121 - Information standards for health and adult social care in England

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Chris Bryant (Labour, Rhondda and Ogmore)

Clause 121 and schedule 15 make clear that information standards published under section 250 of the Health and Social Care Act 2012, as amended by the Health and Care Act 2022, will include standards relating to information technology or IT services used, or intended to be used, in connection with the processing of information related to the provision of health and adult social care in England.

For the health and adult social care system to work effectively, data needs to be processed in a standardised way using common specifications, which goes to some of the points made by the hon. Member for North Norfolk in quoting Government publications. These provisions are an important step towards creating a modern health and adult social care service, where systems are integrated and staff have quicker access to patient data, freeing up time that can be spent with patients.

In previous debates, several Members have referred to physical records, and I have referred to one hospital in Doncaster that employs 42 members of staff solely to carry around physical records. There are still departments in many parts of the NHS in England that are producing more physical, handwritten notes every day of the week. That must be nonsense; it must make it more difficult for us to deliver connected services in future and it cannot be in the interests of the patient, because we would want the patient to be able to hold in their hand an app with everything that relates to their own medical health, almost like a medical passport of their own. That simply is not possible if all the different bits of the NHS in England cannot work together. Government amendment 14 is a technical change to ensure that any personal data processed in the exercise of the public censure power, set out in schedule 15, is subject to the relevant existing data protection legislation.

New clause 3 would require researchers to keep and publish records about the health and social care data that they have processed for research. There are already extensive transparency requirements for health data, and the Information Commissioner’s Office provides detailed advice to the public on their data rights. The law only allows confidential patient information to be used for research without consent when it has been approved by the Health Research Authority. There are detailed arrangements for this approval, based in law, and the transparency arrangements include published registers of approved applications showing what data is used for what purpose and by whom. I hope therefore that the hon. Member for Harpenden and Berkhamsted will accept that this means her new clause is not necessary.

Ben Spencer (Conservative, Runnymede and Weybridge)

This part of the Bill is a concatenation of different provisions relating to data, which is one of the reasons why I think the Bill is so glorious; it covers such a wide scope of things to sort out. I will speak to some of the deeper debates that we will have later, but I am quite glad to start off by speaking to clause 121. As a former doctor—my wife is a doctor too—I particularly welcome these provisions and the opportunity they provide to ensure that health data can be shared properly.

I would say to the Minister that the issue is not merely carrying around patient notes; certainly, in my experience the issue is whether patient notes turn up in the first place at all. As somebody who does not work in the health service any more, I see the other side, where the burden is quite often on the patient to provide their notes or to give information repeatedly that different parts of the system already have. That is a wholly inefficient way of doing things. One of the benefits of having the NHS set up as it is must surely be the ability to have coherent approaches to the sharing of data, so that we do not have this situation with notes.

It is not merely an inconvenience. Patients can be exposed to repeated tests and repeated imaging, all of which have a degree of iatrogenic harm and risk, plus delays to progressing. My former field of work was psychiatry, and the places where I worked were very quick to adopt electronic patient records, noting not only the importance of data sharing, but the risk of retraumatising people when repeated disclosures of traumatic events are required—in part, I worry, because that data is not shared as effectively as it could be.

I raised the point on Second Reading that changes in this area will need to be supported by ensuring that hospitals and healthcare settings have access to IT of sufficient quality to support the new systems. Can the Minister provide an update on his strategy—although I recognise it is not precisely his strategy; it is shared with the Department of Health and Social Care—on renewing NHS IT infrastructure and ensuring that the necessary kit is put in place so that the provisions can be rolled out to maximum advantage? This is about not merely the sharing of data, but the fact that faxing information is no longer required, and we must have the computer infrastructure necessary for data sharing.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I will speak specifically on new clause 3. On the question of trust, I know that even the British Medical Association has highlighted concerns over transparency and ensuring that we unlock that innovation and bring that data—in other words, that people are willing, ready and happy to be part of this. New clause 3 therefore highlights that health and social data, when used for research, should have clear data categories that are properly recorded, and that individuals have a right to understand how their data is used. However, I appreciate the comments from the Minister, and I am happy not to press the new clause.

Chris Bryant (Labour, Rhondda and Ogmore)

The hon. Member for Runnymede and Weybridge nearly caught me out because I had to look up “iatrogenic”. Basically, I think it means that when someone is being treated for something, it can lead to harmful effects. I am worried about that, because I have a PET CT scan tomorrow afternoon and an MRI scan on Saturday, so I am worried that I am being subjected to more risk because of all this imaging.

The truth of the matter is that a patient wants to be able to access as many of their records as possible—whether it is their blood tests or whatever else. That is a significant change that has happened in the last few years. It is about putting the patient back in a key role in the NHS, and them being able to manage their own data, but that simply cannot happen unless we pass this legislation and roll out changes across the whole of the NHS.

The hon. Gentleman asked me a specific question, although he admitted that it is not really my plan to develop these things; I might have to get the Department of Health and Social Care to write to him to lay some of that out. That is part of the work that we need to do at the moment. This is not in the Bill, but as a Welsh MP, I would like us to have shared standards across the whole of the United Kingdom, because there are people using different parts of the NHS across the different nations. That would make simple, common sense.

I also worry sometimes about cyber-security, with every different part of the NHS buying its own systems, and whether those systems all have the necessary cyber-security to make sure that data is preserved safely. I believe that the Bill will enable us to get a much more secure set of data provisions on the way health information can be shared between different parts of the NHS in England.

Schedule 15 - Information standards for health and adult social care in England

Clause 124 - Retention of information by providers of internet services in connection with death of child

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss new clause 29—Compliance with Section 124 of this Act and Part 3, Chapter 2 of the Online Safety Act 2023—

“(1) The Secretary of State must, within 12 months of the passing of this Act, publish a report on provisions of Section 124 of this Act.

(2) A report published under subsection (1) must include an analysis of the level compliance to notices requiring social media companies, including Category 1 services under the Online Safety Act 2023, to preserve data relating to the use of specified regulated services by children where that information may be needed to respond to an information notice issued under s.101 or to produce a report under s.163 of the Online Safety Act.”

This new clause would require the Secretary of State to publish a report assessing compliance with Section 124 of this Act and Part 3, Chapter 2 of the Online Safety Act 2023.

Chris Bryant (Labour, Rhondda and Ogmore)

Clause 124 delivers on the Labour manifesto commitments to further support coroners, and procurators fiscal in Scotland, to access information held by online services after a child’s death. This is a very sensitive issue, and we have tried to address it as such. The provision will require Ofcom, when informed by a coroner, to issue a data preservation notice to specified online service companies. That will help to ensure that those online service companies retain all the relevant data they have on a child so that it will be available on request should a coroner later require it as part of an inquest into a child’s death. The clause demonstrates the Government’s commitments to keeping children safe online and supporting families that have endured unimaginable losses. I am conscious that some might want us to go further; further to the conversation we had earlier, we might be able to have a fruitful discussion on that before we reach Report.

On new clause 29, I reassure the hon. Member for Harpenden and Berkhamsted that there are already strong powers to ensure that companies comply with data preservation notices. Those include the power to issue fines for non-compliance of up to £18 million, or 10% of qualifying worldwide revenue, and the ability to hold senior managers criminally liable for non-compliance. Those sanctions will help to ensure that online services comply with any notice issued under section 101 of the Online Safety Act 2023. Under a provision in that Act, the Secretary of State must already review the effectiveness of the Act’s regime, including the data preservation measures, between two and five years after it comes into force and must produce a report detailing his findings, which will then be laid in Parliament. I therefore hope that the hon. Member will not feel the need to press her new clause to a vote.

Ben Spencer (Conservative, Runnymede and Weybridge)

This is not the appropriate place to discuss new clause 30, but I hope that there will be ample opportunity on Report for further discussion of the broader issue, which is of great importance.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

Clause 124 concerns the retention of information by internet service providers in the deeply tragic event of a child’s death. It rightly acknowledges the potential need to access such data for crucial investigations and to understand the circumstances surrounding such a loss. However, mere provision for data retention is insufficient without a mechanism to ensure its effective implementation in line with broader online safety efforts. That is why we have proposed new clause 29, which ensures Government oversight by requiring the Secretary of State to publish a compliance report within 12 months. The report will assess whether social media platforms, including category 1 services under the Online Safety Act 2023, are preserving data when needed for investigations, regulatory actions and legal proceedings. I appreciate the comments from the Minister.

Although it is not in this Bill, this is an opportunity to highlight the Liberal Democrat’s belief that category 1 services should not be linked to the size of online platforms alone and that platform functionality and other characteristics should determine whether a regulated provider is classed as category 1 or 2. We know that harmful content, abuse and illegal activity leave a digital footprint but, without enforcement, key evidence may be erased before authorities can act. The new clause ensures that platforms are held accountable, preventing data from being lost if needed. It is about not just policy, but ensuring that social media companies meet their legal obligations and that enforcement is transparent and effective. Once again, I appreciate the open discussion of these issues that the Minister has put forward.

Clause 126 - Retention of biometric data and recordable offences

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Amendment 54, in clause 127, page 161, line 36, at end insert—

“(6A) An authority which retains biometric data under this Part must—

(a) review the necessity and proportionality of retention every 12 months, and

(b) erase the biometric data unless continued retention is strictly necessary for a lawful purposes, the reasons for which must be recorded and reviewable by the Information Commission.

(6B) The Secretary of State must publish an annual report on the retention and use of biometric data under this Part, including statistical data on the number of records retained, the time period of retainment, and the purposes of retainment.”.

This amendment would introduce mandatory periodic reviews of retained biometric data, requiring erasure unless the authority can demonstrate ongoing necessity. It also would mandate annual transparency reporting to Parliament on biometric use and retention.

Clauses 127 and 128 stand part.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I did not realise that we would be debating all these amendments today. I appreciate that my voice is probably being heard loud and clear, which was not the original intention, but these are important issues. Clause 126 addresses the sensitive issue of biometric data retention, particularly for law enforcement purposes. Amendment 54 strengthens safeguards by requiring judicial review methods before data can be retained beyond a defined period. That is where we are raising the alarm to ensure that there is a defined period, and that there is cause to ensure that data is not kept beyond that. It is a crucial protection to prevent undue encroachment on civil liberties.

The use of biometric data must be carefully regulated to prevent misuse and overreach: while we acknowledge the role of such data in tackling crime, we must ensure that retention policies are both proportionate and necessary. Amendment 54 aligns the UK’s approach with best practices, ensuring that security does not come at the cost of fundamental rights.

Chris Bryant (Labour, Rhondda and Ogmore)

The hon. Lady has tabled another amendment that calls for the Secretary of State to report to Parliament. I hope that I am proving that the requirement to put those reports in the Bill is unnecessary.

The amendment would introduce a new duty on the police to review the retention of biometric data under clause 127, and a duty for the Secretary of State to report to Parliament on the use of that data. Clause 127 does not alter the existing duty in the Data Protection Act 2018, which ensures that the police retain only personal data, including sensitive personal data such as biometrics, as long as it is considered “necessary and proportionate”—precisely the terms that she advocated.

The biometrics commissioner already has independent oversight of biometric data retained under the Counter-Terrorism Act 2008, and has a statutory duty to report to Parliament annually. The independent reviewer of terrorism legislation also has statutory oversight of all the powers in the 2008 Act, and reports annually to Parliament. For those reasons—without doubting the hon. Lady’s intent—I hope that she will not press the amendment to a vote.

Clause 135 - Compliance with UK copyright law by operators of web crawlers and general-purpose AI modelsClause 135

Clause 136 - Transparency of crawler identity, purpose, and segmentation

Clause 137 - Transparency of copyrighted works scraped

Clause 138 - Enforcement

Clause 139 - Technical solutions

Clause 140 - Data dictionary

Chris Bryant (Labour, Rhondda and Ogmore)

I propose that the clause does not stand part of the Bill. Clause 140, which was tabled in the House of Lords, is a regulation-making power that would enable terms relating to core personal data attributes to be defined consistently across data held by public authorities. The intention behind this measure is that the power could be used to define the term “sex”. We seek to overturn this clause for the following reasons.

The Government believe that public sector data, including data about sex and gender, should continue to be collected based on the specific data requirements of those collecting the data, and their users, which differs across contexts. That is in line with the data minimisation principle set out in the data protection legislation. We do not think it is appropriate to have core personal data attributes defined in regulations in the way that is proposed.

Furthermore, setting out such definitions using secondary legislation could create confusion where terms are already defined in legislation, and so—depending on the approach taken—could cut across the existing definitions. For example, defining sex could cut across the existing legal framework and undermine protections in the Gender Recognition Act 2004 and the Equality Act 2010.

I am, however, keen to reassure the Committee that the Government recognise the importance of harmonising data and have already commenced important work on standards across Government—via a cross-Government working group led by the Data Standards Authority—to define the core attributes of a person. Last year, the Office for Statistics Regulation published guidance on collecting and reporting data about sex and gender identity, and in December 2024 the Government Statistical Service published a work plan for harmonised standards in this space.

The Government’s belief is that such matters are crucial and more appropriately considered holistically outside the Bill. The intention of the Bill is not to define or remark on the definitions of sex and gender, or other core personal data attributes. I therefore recommend that the clause does not stand part of the Bill.

Ben Spencer (Conservative, Runnymede and Weybridge)

As the Minister noted, the clause is a provision that was introduced in Committee in the other place, along with clause 28(3) and (4), and clause 45(6), which have now been removed from the Bill pursuant to our decisions in Committee.

Clause 140 aims to ensure the accuracy of data underpinning digital forms of verifying identity, and more broadly. To a degree, it is ironic that we live in a world where we have to debate data dictionaries when it comes to the definition of sex, but I think the point about data dictionaries more generally, over and above the focus on sex data in this debate, is nevertheless sound.

We are aware of the Government’s argument that the clauses inserted in the other place pertaining to data accuracy—in particular, clause 45(6)—are not compatible with certain provisions of the European convention on human rights and the Gender Recognition Act 2004. I am grateful to the Minister for writing to the Committee on that, among other matters, but I do not think that his explanation gives any rationale for the removal of clause 140.

We strongly disagree with the Government’s position for the reasons I set out last week, but I will not rehash those arguments now. Rather, I want to make a simple argument in favour of retaining the clause on data dictionaries that the Government intend to remove. Clause 140 grants the Secretary of State the power to make regulations establishing the definitions and associated metadata for core personal data attributes. The Secretary of State may require that those definitions are used for, among other things, personal data recorded by public authorities, under subsection (1)(d), and the digital verification service, under subsection (1)(a).

My noble friend Lord Lucas compellingly stated the case in support of his data dictionary amendment in the other place, saying that

“if we are to live in a data-rich world, we really need a set of well-understood, good definitions for the basic information we are collecting.”—[Official Report, House of Lords, 28 January 2025; Vol. 843, c. 237-238.]

It really is that simple: giving the Secretary of State the power to define those core personal data attributes so that a consistent approach can be taken across the board by public authorities and entities engaged in digital verification services.

My question for the Minister is, therefore: what is the objection to the Secretary of State having that power to clarify the meanings of those essential terms, which we need to define data attributes? A clear definition of data attributes, and in particular the meaning of sex, is a foundational building block that will help to ensure that the data we collect can be harnessed for good-quality research on which sound public policy decisions can be based.

In the other place, the DSIT Minister, the noble Lord Vallance of Balham, acknowledged the need for data to be “based in truth” and “consistent and clear”. However, he opposed this clause on the basis that the Government would prefer to consider the matter of data accuracy and consistency holistically, outside the scope of the Bill. In that regard, he pointed to ongoing research in the field, including the Sullivan review of data, stats and research on sex and gender, which was commissioned by the previous Conservative Government, and the findings of which this Government would like to take into account in developing their policies in the area.

Chris Bryant (Labour, Rhondda and Ogmore)

Mr Turner, I have confidence in confidence alone; I have confidence in you—if we are going to do Julie Andrews.

This is obviously a serious matter. The clause pretends to be just a regulation-making power that would allow the Government to publish a data dictionary by regulations. It is framed as a means to promote data consistency, but its actual intent is to push the Government to set a single definition of the term “sex” through a public authority data dictionary that public authorities would need to have regard to when processing data. As I have said several times in debates already, that is inappropriate. The whole purpose of data is that it is set within a context and that that context changes. For instance, the data that is required for the running of a hospital or prison is different from that required for the hiring of a car or the purchase of a property. That is why we think it is important that we do not go down this route.

The Opposition are again trying to give the Secretary of State more powers to do things by regulation, but it would be completely inappropriate to develop this data dictionary by secondary legislation, which would be unamendable and therefore subject to only minimal debate. I completely agree with the noble Lord Vallance that data has to be consistent and accurate, but it also has to be in the context for which it is being used. That is the key determinant that some Members have not understood in the Government’s argument. I still suggest that clause 140 does not stand part of the Bill.

Clause 141 - Creating or soliciting the creation of purported intimate image of adult

Chris Bryant (Labour, Rhondda and Ogmore)

I beg to move amendment 28, in clause 141, page 173, line 27, leave out

“or soliciting the creation of”.

This amendment is consequential on Amendment 29.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Government amendments 29 to 48.

Clause stand part.

Chris Bryant (Labour, Rhondda and Ogmore)

The amendments are the result of considerable discussion between officials, who have suddenly joined me as my inspiration, and the noble Baroness Owen. As promised in the other place, we have tabled further amendments relating to the offence that was included in the House of Lords. Recognising how crucial time limits are in this sensitive area, we made a commitment that is fulfilled by amendment 38, which would extend the statutory time limits to enable prosecutions to be brought at any date that is both within six months from when sufficient evidence comes to the prosecutor’s knowledge to justify prosecution, and within three years from when the offence was committed. By doing that, perpetrators will not be able to get away with creating a deepfake just because no one knew about it in time for the prosecution to commence within six months.

Amendment 31 will ensure that the law comprehensively criminalises asking someone to create a deepfake, regardless of where they are based or whether the image was made. We absolutely agree with the policy rationale put forward by Baroness Owen, which is why we did not oppose the amendment on solicitation. Our amendments replace the term “solicitation” with a new requesting offence, which has been drafted to ensure that it is comprehensive and functions as it should, and that it is clear to the courts how it should be understood and applied in practice within the wider criminal law framework.

Amendment 30 reinstates a defence of reasonable excuse to the creating offence. That was part of the original Government amendment, and part of the noble Baroness Owen’s original amendments. We believe that a defence is necessary for both the creation and the solicitation or requesting offence. We are clear that we do not wish abusers to be able to evade justice by using spurious excuses, but the definition of images in this offence includes wider intimate images, such as those showing someone in underwear or using a toilet, even where these are not pornographic or sexual in any way and were not created to abuse a victim.

This is a new offence, tackling relatively new behaviour, and this defence is needed to ensure that only culpable behaviour is criminalised and where it is in the public interest to do so. I assure hon. Members that the defence of a reasonable excuse is a common aspect of many criminal offences. Offenders will not be able to use it to escape justice. They cannot simply assert an excuse, and that will be deemed reasonable. They will need to prove, with evidence, that they had such an excuse. The courts will then interrogate that to decide whether, in fact, the excuse was reasonable. Furthermore, it is our view that a defence of reasonable excuse is important to ensure compliance with freedom of expression principles.

Clause 141 already ensures that in civil courts, deprivation orders will be available in respect of intimate image deepfakes where their creation constitutes an offence under proposed new section 66E of the Sexual Offences Act 2003. Amendment 40 ensures that this will be the case within the service justice system.

Clause 141 delivers our manifesto commitment by ensuring that those who create a deepfake intimate image of an adult without their consent or a reasonable belief in their consent can be prosecuted. There is no need to prove any motivation. This offence will carry a maximum penalty of an unlimited fine, six months imprisonment or both. The clause will also ensure that the courts have the power to deprive offenders of the images they have created and the devices containing them. Creating intimate image deepfakes is a truly demeaning and disgusting form of chauvinism. We believe that clause 141, as amended, will tackle that behaviour. We are sending a very clear message to the perpetrators, putting them on notice that they will face the full force of the law. I command the clause and the amendment to the Committee.

Ben Spencer (Conservative, Runnymede and Weybridge)

I start by congratulating my noble Friend Baroness Owen of Alderley Edge for her hard work and tenacity in raising the profile of the harms caused to victims of sexually explicit deepfakes, and ensuring that clauses criminalising that activity were inserted into the Bill in the other place. We very much welcome the Government’s engagement in this important area, and we broadly support their amendments, which substantially deliver the changes to the Sexual Offences Act 2003 that Baroness Owen sought in the other place.

In particular, we welcome Government amendment 31, which substantially reflects the offence of solicitation under clause 141, but could the Minister put a bit more flesh on the bones of the reasoning and necessity behind substituting the term “requesting” for “solicitation”? Does he regard those terms as having equivalent meaning in this context? If not, what is the material difference in the approach to terminology?

I am thankful for the Minister’s comments on the “reasonable excuse” defence, but I have some questions about what exactly a reasonable excuse looks like in this context. Does he have any examples to aid our understanding of what constitutes a reasonable excuse in these circumstances? Based on that, do the Government intend to publish guidance on the scope of this defence and its explanation?

We are pleased to see the inclusion of Government amendment 38, inserting among other things an extended limitation period of three years from the date of creation, or request for creation, of a purported intimate image for bringing criminal charges. This will increase the scope for victims to seek justice where these images come to light some time after creation.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

The Liberal Democrats very much welcome clause 141 and action taken on violence against women and girls in particular, including online. However, the clause talks about creating or soliciting the creation of purported intimate images of adults, but it does not necessarily deal with the sharing of them. How do we hold to account those who are sharing intimate images that they should not be?

Chris Bryant (Labour, Rhondda and Ogmore)

I should have put on the record, as the shadow Minister did, my gratitude and congratulations to Baroness Owen for her tenacity; that point was absolutely right.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

Hear, hear.

Chris Bryant (Labour, Rhondda and Ogmore)

Excellent: we all agree that Baroness Owen has done a great piece of work for us, and we are grateful. Incidentally, I am also grateful to Ministry of Justice officials who worked with DSIT officials on the amendments before us today, which provide a more comprehensive version of what was originally argued for.

The hon. Member for Runnymede and Weybridge asked me about the difference between solicitation and requesting. Often, it is considered that solicitation would require some form of exchange of money. Obviously, that would not necessarily be the case in this context, which is why we have “requesting”, a broader category than solicitation. A request includes doing an act that could reasonably be taken to be a request—for example, nodding or otherwise indicating agreement in response to an offer or complying with conditions of an offer. It also includes both making a request directed to a particular person or persons and making a request available to one or more people, or people generally, without directing it to a particular person or people. In other words, that is broader than what solicitation would have required. I think Baroness Owen agrees with us that this is therefore a more comprehensive offence.

The hon. Gentleman asked about the “reasonable excuse” defence. Let us say that a software developer wants to ensure that he or she—probably “he” in this case—has developed the right safeguards in his software to stop people generating intimate deepfakes without the consent of the person depicted. In some circumstances, he will have a reasonable excuse where, in the course of the testing to ensure that the software does not create such images, he creates a purported intimate image. That might be an instance of a reasonable excuse. I do not want to lay out what reasonable excuses might be, because the courts are so used to dealing with the concept of a reasonable excuse. There are many offences to which it applies, and the courts, as I have said, are used to dealing with them.

The hon. Member for Harpenden and Berkhamsted asked me about sharing—is sharing a deepfake an offence? Sharing a deepfake intimate image without consent is already an offence under section 66B of the Sexual Offences Act 2003. I hope that, without further ado, we can agree the amendments and the clause.

Clause 142 - Power to make consequential amendment

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Clauses 143 to 146 stand part.

Government amendment 16.

Clause 147 stand part.

Chris Bryant (Labour, Rhondda and Ogmore)

I will speak only to Government amendment 16, which is highly technical—there will be a test on it afterwards. It removes the privilege amendment inserted at Lords Third Reading to clause 147, which was necessary given the Bill was introduced in the Lords.

Clause 144 - Extent

Clause 147 - Short title

New Clause 2 - Impact of this Act and other developments at national and international level on EU data adequacy decision

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to move, That the clause be read a Second Time.

It will be no surprise that the Liberal Democrats support greater collaboration with our European partners. Local people and businesses across Harpenden and Berkhamsted, as well as up and down the country, continue to highlight the importance of working with the EU and for ever closer union.

New clause 2 seeks to ensure that any changes in our data laws or international commitments do not jeopardise our data adequacy, which is due to be reassessed by the EU in June this year. The Minister may be pushing through the Bill to ensure that we get our adequacy in line with that requirement, which is crucial, because the UK’s ability to transfer data internationally underpins business, research and security partnerships.

Data adequacy is what allows personal data to flow freely between the UK and the EU without the need for costly and complex additional safeguards. A report by the New Economics Foundation put the cost of data inadequacy with the EU at between £1 billion to £1.6 billion for British businesses, highlighting the importance of aligning with our European neighbours on this. The UK is also party to various international agreements and conventions relating to data protection.

New clause 2 ensures that we assess how our international commitments may impact the EU’s view of our data protection framework. If we fail to maintain strong data protections, we risk losing our EU data adequacy status, an outcome that could cost billions in compliance burdens, disrupt cross-border operations and hinder UK businesses from accessing global markets. That would be a hammer blow to the UK businesses, particularly small and medium-sized enterprises, that rely on seamless data exchange with our European partners.

Supporting new clause 2 is about ensuring that Britain continues to lead on data governance, innovation and global collaboration. Data adequacy is not just a legal issue; it is a fundamental element of maintaining economic growth, international trust and our competitive edge. We welcome assurances—and indeed the discussions I have already had with the Minister—on data adequacy with Europe being maintained.

Ben Spencer (Conservative, Runnymede and Weybridge)

I just want to make two points. I was a bit confused by the timings in this new clause. I think we all agree on the importance of data adequacy, but my understanding is that, by three months post Royal Assent, we will already have to have a data adequacy agreement in place, given the time that it will take to achieve Royal Assent.

The other point I wanted to make was that I think this might be the last time that I get to speak on behalf of His Majesty’s Opposition in this Bill Committee, so I want to thank Members, officials and the Chairs for taking part in our proceedings. I look forward to further debate on Report.

Chris Bryant (Labour, Rhondda and Ogmore)

First, I should have also thanked the Under-Secretary of State for Justice, my hon. Friend the Member for Pontypridd (Alex Davies-Jones), because she has been intimately involved in bringing forward the measures that we debated in the last group. My apologies for forgetting that, Mr Turner.

On new clause 2, I completely agree that EU data adequacy is vital, but I completely disagree with the new clause, because I think it is technically deficient. One reason for that is the timeline that it lays out of three months, by which time I hope we might be able to have made progress. I also think that it undermines the independence of the process that the European Commission has to go through. The European Commission has already confirmed that its review of its two adequacy decisions for the UK are currently under way—ahead of the deadline, which is good. As Lord Vallance stated in the House of Lords, DSIT and the Home Office have dedicated teams supporting the European Commission’s technical review, as required.

I acknowledge the unilateral nature of the adequacy assessment made by the European Commission. For that reason, it is important to provide the European Commission with the discretion needed to complete its process, which I am afraid new clause 2 would undermine. So, for that reason, I am resisting the blandishments of the Liberal Democrats.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to ask leave to withdraw the motion.

New Clause 6 - Public-interest data trusts and communities

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to move, That the clause be read a Second time.

Karl Turner (Labour, Kingston upon Hull East)

With this it will be convenient to discuss the following:

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

This is my last intervention, which I am sure the Committee will all be very sad about, and it is on data. I know that we have talked a lot about public trust, but I also want to highlight that, as Liberal Democrats, we are also excited about unlocking the opportunities from data. These new clauses speak to that.

New clauses 6, 25 and 28 together would ensure that we harness the benefits of data while upholding fundamental rights. Too often, data is seen as something that happens to people rather than something that they have a say in. We have an opportunity here to unlock even more opportunities, not just in Government data systems but in how data is used across research, public services and wider society.

New clause 6 calls on the Government to develop a clear strategy for public-interest data trusts and community data governance. That means allowing individuals and communities to contribute their data for socially beneficial purposes while retaining meaningful control. Imagine if patients suffering from rare diseases could securely share their data for medical research, knowing that it would be used solely for public good, not commercial gain; that is a future we can build.

New clause 25 would ensure that the Government take a proactive role in shaping public-interest data governance, setting clear ethical guidelines for how data can be shared securely and fairly. This is about moving beyond reactive regulation. Instead, we should actively create frameworks that allow innovation to flourish while protecting those rights. If we want the UK to be a leader in responsible AI and data stewardship, we need clear structures that allow businesses, researchers and civil society to work together with confidence.

New clause 28 would establish a framework for data altruism, ensuring that those who wish to donate their data for public interest projects can do so safely and transparently. Consider a family in my constituency of Harpenden and Berkhamsted who want to contribute to a dementia research project. Right now, there is no clear framework guaranteeing that their data will be protected from misuse. By formalising ethical data-sharing models, we can enable research and innovation without compromising trust. These new clauses share a simple principle: data must serve people, not the other way around. We must strike the right balance, harnessing data to drive innovation while ensuring that public confidence and ethical standards remain at the core of our approach.

We have a huge economic opportunity. The UK has led the way in setting high regulatory and Government standards in sectors such as fintech, law and insurance, where trust, transparency and compliance are critical. We should build on those strengths and apply the same principles to emerging fields such as AI, healthtech and responsible data sharing. By learning from what works and setting clear guidelines now, we can unlock investment, support start-ups and ensure that the UK becomes a hub for innovative, data-driven businesses. That is why I urge colleagues to consider new clauses 6, 25 and 28, as well as the principles put forward in them, to ensure that we build a data-driven future that is transparent, accountable and a gold standard for responsible innovation and public involvement.

Ben Spencer (Conservative, Runnymede and Weybridge)

I listened carefully to the hon. Lady’s comments, and I want to reflect on one point. She presented, or at least seemed to present, a tension between public interests and the commercial use of data. It is really important that we recognise that a lot of health research, particularly pharmaceutical development, is for commercial purposes, with a huge amount of benefits for health as a consequence.

I do not think it is to right to try to sabotage the use of data for commercial purposes, because it has huge benefits for the care and treatment of people. We depend on pharmaceutical companies to spend the risk money, for which a state organisation would never have the appetite, to develop the new drugs of the future. It is important to be quite careful when one is thinking about commercial interests versus non-commercial interests for scientific research.

Chris Bryant (Labour, Rhondda and Ogmore)

The hon. Member for Harpenden and Berkhamsted said that this is her last contribution to the debate, so in the words of the “The Little Mermaid”, I suppose we are poor, unfortunate souls. I thank her for tabling these new clauses, and she raised issues that were also discussed in the other place.

On new clause 6, as my noble Friend Baroness Jones noted in the House of Lords, the Government support giving individuals greater agency over their data and a robust regime of data subject rights. We have already announced our intention to publish a call for evidence on the potential role of data intermediaries. It is important that we establish a firm evidence base before we make any changes to people’s data rights, so I hope that that makes new clause 6 unnecessary.

On new clause 25, as I have just said, we have already published a call for evidence on the potential role of data intermediaries, which is why we need to proceed carefully before going down the route offered by the new clause. Finally, on new clause 28, the Government acknowledge that there are various models of data intermediaries, including those that manage voluntarily contributed personal data for the common good, such as data co-operatives and trusted research environments.

We have already announced our call for evidence, which will seek views on various aspects relevant to data intermediaries, including the delegation of data subject rights to third parties, barriers preventing data intermediaries from operating at full capacity and risk factors associated with significant growth in their activities. This will also include views on different models of data intermediaries, including those focused on data altruism, as the hon. Lady mentioned. Given that we have already announced our intention to act in these areas, I very much hope that the hon. Lady will be content to withdraw the motion.

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I beg to ask leave to withdraw the motion.

New Clause 9 - Right to use non-digital verification services

New Clause 17 - Statement on application of the Copyright, Designs and Patents Act 1988 to activities by web-crawlers or artificial intelligence models

New Clause 18 - Report on regulation of web-crawlers and artificial intelligence models on use of creative content

New Clause 19 - Report on reducing barriers to market entry for start-ups and smaller AI enterprises on use of and access to data

New Clause 20 - Publication of a technological standard

New Clause 21 - Age of consent for social media data processing

Title

Victoria Collins (Liberal Democrat, Harpenden and Berkhamsted)

I thank the Clerks, as well as you, Mr Turner, and other Chairs who have been on this Committee. I also thank the Government and Committee members for working together to get through the Bill very quickly.

Written evidence reported to the House