Data Protection and Privacy

Monday 5th February 2018 Lords Chamber

Question

14:44

Asked by

[Lord Holmes of Richmond]

To ask Her Majesty’s Government what action they are taking, or plan to take, to ensure that people are aware of their rights and obligations in respect of data protection and privacy.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, I am grateful to my noble friend for the opportunity to highlight the fact that the GDPR takes effect on 25 May this year. To that end, the Government are working closely with the Information Commissioner’s Office to ensure that individuals and organisations are increasingly aware of their rights and obligations before new data protection laws come into effect. In addition to supporting the commissioner’s work to update and publicise the guidance provided through the ICO website, the Government will deliver an awareness-raising marketing campaign targeted at those organisations and sectors most in need of support.

[Lord Holmes of Richmond (Con)]

My Lords, we are in the midst of the fourth industrial revolution: a revolution fuelled by data—our data. Does my noble friend agree that much good work has been done but that we need a public debate on a grand scale to enable everyone to understand the potential, and indeed the pitfalls, when it comes to the use of their data?

[Lord Ashton of Hyde]

My Lords, I completely agree with my noble friend. That is why we are establishing the Centre for Data Ethics and Innovation, which will advise on the measures we need to enable and support safe, ethical and ground-breaking innovation in artificial intelligence and other data-related technologies. I remind noble Lords of this House’s Select Committee on Artificial Intelligence, chaired by the noble Lord, Lord Clement-Jones. As for where we are with the centre, the process of appointing a chair for the interim centre is under way and expressions of interest for the role are currently live. More information is available on GOV.UK.

[Lord Clement-Jones (LD)]

My Lords, I thank the Minister for the earlier namecheck. Thanks to the noble Baroness, Lady Kidron, there will now be a statutory code of practice on age-appropriate website design, which will set standards required of websites on privacy for children. Will the Government make sure that young people and their parents are clearly and effectively told what these standards are at an early date? That is especially important given that the ICO’s draft children and the GDPR guidance has already been overtaken by this major amendment to the Data Protection Bill.

[Lord Ashton of Hyde]

The noble Lord is right to mention the Kidron amendment—I think it is called that now, by universal approval—which the Government are pleased to support. It is early days, to the extent that the Data Protection Bill has not even had its Second Reading in the other place. However, the ICO is aware of what it will be required to do if this amendment remains in place and is working on that. In the meantime, it is concentrating on the GDPR coming into effect on 25 May, and the work that has to be done to get people up to speed before that date.

[The Earl of Clancarty (CB)]

My Lords, following the question of the noble Lord, Lord Clement-Jones, does the Minister believe that the best place to start is in schools, with personal data taught as part of a statutory PSHE course?

[Lord Ashton of Hyde]

It is very important that all young people are aware of both the opportunities and the dangers associated with the internet and data-driven technologies. To that extent, I agree with the noble Lord.

[Baroness McIntosh of Hudnall (Lab)]

Further to the previous two questions about young people, does the Minister accept that many children are being given access to mobile devices well before their 13th birthday, which is the point at which most websites and providers are supposed to limit the availability of certain kinds of content? While there is a certain amount that legislation can do about this, it is really an issue of public information, particularly as many of these young people are being enabled by their own parents, who need to understand the dangers. What are the Government doing to further the public education that would help that?

[Lord Ashton of Hyde]

The new general data protection regulation specifies that children are a special case and have to be protected more than adults. I completely agree with the noble Baroness that education is important, and that is education for parents and not just for young people. Across all age groups, a lot of people have things to learn about the dangers of the internet. One thing that the Centre for Data Ethics and Innovation will do is show that it is not just Government who are involved in this but the industry, education, regulators and charities. All sectors in society have to come together to make sure that this tremendous opportunity is used safely by everyone.

[Baroness Browning (Con)]

Is my noble friend able to confirm that no government agencies now sell on or disclose to third parties personal data without the explicit agreement of the individual concerned?

[Lord Ashton of Hyde]

I do not believe that that is the case although I cannot give an absolute guarantee because I am not sure of my facts. One thing that the Digital Economy Bill did was to outline what Governments can do with their own data. They can use it within government. The general data protection regulation makes the issue of consent much more explicit. Consent has to be genuine consent.

[Baroness Hayman (CB)]

My Lords, will the Minister add the National Health Service to the list of organisations that need to be involved? Does he agree that within the National Health Service there is an enormous amount of data that could be of fantastic benefit to medical research? It can be anonymised. It may be, for example, that in cohort studies people have already given their consent to that data being used. I declare my interests, as set out in the register. Will he agree that there can sometimes be a misunderstanding of the extent of data protection, which could act as a real obstacle to the sort of research that we all want to see?

[Lord Ashton of Hyde]

That is the subject of the amendment to the Data Protection Bill of the noble Lord, Lord Mitchell. It gives a good example of the sort of thing that the Centre for Data Ethics and Innovation could consider. On the one hand, the National Health Service has an unparalleled amount of medical information that could be used to advantage. On the other hand, if it is monetised and sold on, which has the superficial attraction of providing money for the NHS, it could prevent researchers using that information in the same way that pharmacological organisations do. It could actually prevent health benefits occurring. It is a classic example of an ethical dilemma that the centre will be able to look at.