Personal Data

Tuesday 17th April 2018 Lords Chamber

Question

15:01

Asked by

[Lord Kennedy of Southwark]

To ask Her Majesty’s Government what action they propose to take to regulate platforms that hold personal data.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, the UK’s forthcoming data protection laws will empower people to take control of their personal data and ensure that all businesses, including platforms, take necessary steps to protect the information that they hold. This is a crucial step in giving the public confidence that their data will be managed securely and safely. Beyond this, the digital charter that we are developing in the UK sets out the principles for our approach to agree the norms and rules of the online world and put them into practice. In some cases this will be through shifting expectations of behaviour, in some we will need to agree new standards, and in others we may need to update our laws and regulations.

[Lord Kennedy of Southwark (Lab Co-op)]

I am sure that, like me, the Minister saw the media reports of Mr Mark Zuckerberg’s appearance on Capitol Hill last week. He seemed to accept that some form of regulation was now inevitable. Will the Government look at what can be done in that respect? Does the Minister think the solution may be to regulate the people working in the industry, giving them clear obligations and clear standards to adhere to?

[Lord Ashton of Hyde]

My Lords, as I mentioned in my Answer, legislation is coming. The combination of the GDPR, which comes into effect on 25 May, and the Data Protection Bill, which should be in place by then, will make a real difference. Other things need to be done. One of the biggest changes in the last few months has been the acceptance that these social platforms have some responsibility for their content. That does not mean to say that they are publishers as such but Mr Zuckerberg accepted responsibility for content on Facebook. The Prime Minister, in her Davos speech, made much the same point.

[Lord Clement-Jones (LD)]

My Lords, I wonder if the Minister was as concerned as many of us by the inability of the Information Commissioner to gain access to the premises of Cambridge Analytica for five whole days. It is quite ridiculous that the commissioner should have her hands tied in this way. Will the Government pledge to give the ICO powers of entry similar to those of the competition authorities by an amendment to the Data Protection Bill?

[Lord Ashton of Hyde]

The noble Lord makes a very valid point. We have been talking to the Information Commissioner on exactly the subject of her powers. Report on the Data Protection Bill comes up in the other place soon. I believe that there is widespread sympathy for her point of view, and we are looking at that. If that is the case, and if the House of Commons decides to amend the Bill, I hope that this House will give it a favourable wind when it comes back at ping-pong.

[Viscount Ridley (Con)]

My Lords, I commend to my noble friend the work of Genomics England and the 100,000 Genomes Project, where 100,000 people are willingly and enthusiastically giving their consent to the use of their data because of extremely well-designed guidelines on how that data will be treated. Is this not an example of how, if we get these things right, as set out in the ad hoc Select Committee on Artificial Intelligence report published yesterday, the UK can show the world how to proceed in this matter?

[Lord Ashton of Hyde]

My noble friend makes a good point. I have not read the report yet, of course—it has been out only a day—but I know that it makes the point that data is essential if we are to ensure adequate competition. Data itself is of the greatest use and we have world-beating companies able to take advantage of it. We have to balance the protection of individuals’ data with the use that can be made of it. That is one reason why we are setting up the centre for data ethics and innovation—to look at exactly those points.

[Baroness McIntosh of Hudnall (Lab)]

My Lords, I shall build on the noble Viscount’s question. Does the Minister agree that one of the most difficult things for most people who are trying to understand how their data might be used—even perfectly legitimately—is that terms and conditions and other kinds of regulation are extremely opaque? What more do the Government intend to do to encourage companies who require us to give them our data to do so in a way which we can understand?

[Lord Ashton of Hyde]

One of the requirements of the GDPR, which will come into force on 25 May, is that you have to give informed consent. That means, for example, that there cannot be a pre-ticked box; you have to make an active and sensible decision on whether you give your consent. Companies are required to make it understandable and cannot just put a consent box at the bottom of page 25. Secondly, the amendment of the noble Baroness, Lady Kidron, made age-appropriate design a feature, which I am sure will be developed, so when people produce apps and other things they have to take account of the age of the people who are likely to use them.

[Lord Forsyth of Drumlean (Con)]

My Lords, I watched the Zuckerberg testimony and I have to say that I thought that a number of Members of Congress were perhaps not awfully au fait with internet technology. Given that he said that he took responsibility for the content, can my noble friend explain to me why Zuckerberg is not a publisher?

[Lord Ashton of Hyde]

This is a big change in the attitude towards how these sites operate. He is not a publisher because he does not commission the content. If he commissioned the content, he would be a publisher. There is a difference between that and taking no responsibility for it. As I said, social media sites are beginning to realise that they have to take some responsibility. People put content on his site. He and other social media have to monitor their sites to make sure that illegal and disturbing content is taken down as quickly as possible, but they do not put it on the site.