Higher Education and Research Act 2017 (Cooperation and Information Sharing) Regulations 2018
Lord Watson of Invergowrie
That this House regrets that the Higher Education and Research Act 2017 (Cooperation and Information Sharing) Regulations 2018 create significant powers for the Office for Students to grant access to students’ confidential data to a single commercial provider, and calls on Her Majesty’s Government to carry out a privacy impact assessment on the Regulations (SI 2018/607).
Lord Watson of Invergowrie (Lab)
My Lords, I welcome the opportunity to draw the regulations to the attention of the House, although it is unfortunate, to say the least, that this debate is taking place five weeks after they came into force. However, there is greater cause for concern because, without consultation or public announcement, this negative statutory instrument was laid on 23 May, less than three weeks before coming into effect, with one of those weeks being taken up by the Whitsun Recess. Perhaps the noble Viscount can explain why such timing was employed by the Government, rather than exposing the regulations to proper scrutiny both in Parliament and more widely.
The regulations have caused considerable concern in respect of the significant powers that they create for the Office for Students to grant access to students’ confidential data to a single commercial provider. Further, it has to be said that the Explanatory Memorandum does not do what it says on the tin, because the purposes for which the data may be used remain open and vague.
We have a number of concerns, not least that, as I said, there has been no parliamentary debate or public consultation. It almost beggars belief that students and universities, those directly involved, were excluded from the decision to create these invasive powers. Last month, in a Written Question, my Front Bench colleague Gordon Marsden MP asked whether the Department for Education had consulted universities, student bodies or UCAS on the powers relating to confidential data conferred under the regulations. He did not receive a suitable answer, so he tried again when the regulations were debated in another place three weeks ago. This time, the Minister, Mr Gyimah, admitted:
“No specific contact was made with UCAS and the NUS”,
adding vaguely,
“but the OFS regulatory framework consultation asked the sector for views on the principles of how the OFS engages with other bodies”.—[Official Report, Commons, First Delegated Legislation Committee, 2/7/18; col. 10.]
Of 37,000 students who responded to a UCAS survey in 2015, 90% said that they did not want their data to be handed to commercial companies without their consent, yet the Government ignored that decisive view.
The Minister will recall that significant concern was raised during the passage of the Higher Education and Research Bill in another place. Indeed, Mr Marsden warned of the risk, stating that the proposal,
“would give the state access to all university applicants’ full data in perpetuity for users who would only be defined as ‘researchers’ and without ‘research’ being defined at all.—[Official Report, Commons, 2/7/18; col. 4.]
UCAS also raised the risks and concerns in evidence at that time. The then universities Minister, Jo Johnson MP, responded:
“Only named and approved individual researchers within Government and from approved bodies will have access to the data. All data will be de-identified before being received by these accredited researchers”.—[Official Report, Commons, 13/10/16; col. 457.]
I can say with some certainty that neither Members of both Houses nor the general public would have inferred from that comment by the Minister that the commercial company, Pearson, would fall into the category of accredited researchers. Yet, it is specifically named in the regulations and indeed, it provides powers for the data to be passed to an unlimited number of persons not named and approved individual researchers.
As the campaign group Defenddigitalme has argued in submissions to noble Lords and MPs, the power to shape the education sector and course content derived from the knowledge that this kind of data holds about students’ personal backgrounds, their own and their parents’ income, courses, attainment and ongoing activity, will give the holder unprecedented influence.
In January 2017, during a debate in your Lordships’ House on the Higher Education and Research Bill, the noble Lord, Lord Kerslake, highlighted his concern at the fact that,
“the Bill allows the Secretary of State to frame the guidance given to the OfS by reference to particular courses. As this House will know, that contrasts sharply with the current legislation—the 1992 Act—in which the Secretary of State is specifically forbidden from setting guidance to HEFCE in this way”.—[Official Report, 9/1/17; col. 1802.]
It is unclear in the Explanatory Memorandum why Pearson was the most prominent of the designated receiving bodies, although the debate in another place on 2 July revealed that the company was included because it awards HNC and HND qualifications. That hardly makes it unique, and there is no transparency regarding the detailed purposes for which this data will be passed to Pearson, HMRC, the Student Loans Company or indeed others.
There is no clear limitation of purpose or restriction on how the data may be used or distributed further after being handed over to Pearson. Risks include Pearson selling the data directly or as part of a company asset, as that company has done in the past in the USA, with the data of 15 million students. The knowledge gained from the data must give any single company—in this case, Pearson Ltd—a sizeable and some would say unfair commercial competitive advantage over others in the sector. Can the Minister say whether Pearson, or indeed other commercial organisations, will be allowed to sell on the student data that they are given under these regulations? I hope the answer will be in the negative, but if it is not then will the Minister explain to noble Lords why he thinks such action would be appropriate?
The General Data Protection Regulation recognises that any data that is not anonymous, including de-identified or pseudonymous data, is still personal data and falls under its obligations. But there is no assurance that no historical data would be handed over, collected without explanation to the applicants or students, or that personal data would be given to Pearson and the other new bodies in future. Such processing of historical personal data could therefore be without a lawful basis, given the failure to fairly process it during its original collection.
During the passage of the Higher Education and Research Bill, noble Lords and MPs raised concerns about the powers in the regulatory function of the Office for Students and questions of institutional autonomy. Legitimate questions arise as to the powers that these regulations confer on the relationship between the OfS and Pearson, given the former’s regulatory function. The appointment of Sir Michael Barber as the chair of the OfS was widely welcomed and there is no intention to impugn his reputation in any way. However, there exists at least the potential for a perceived conflict of interest, given that prior to taking up his new post, Sir Michael had been chief education adviser at Pearson for more than five years.
We believe that it is a significant weakness in the preparations for these regulations that the DfE has not carried out any privacy impact or human rights assessments. The department will not be accountable for the consequent impact on privacy, but the Explanatory Memorandum states that the OfS has the responsibility for any privacy impact assessment. This presumably refers to the privacy impact of individual instances of information-sharing, and that is both perfectly understandable and reasonable.
But I am referring to the bigger picture, to the whole system of data sharing. It is surely irresponsible for a government department to create powers and bring them into operation before fully understanding their likely effects. Creating rights of access to the entire student population’s personal confidential data for Pearson Ltd, as well as other listed third parties, is an act of national significance with potential long-term implications for individuals and the sector as a whole. Once personal data has been transferred to commercial bodies such as Pearson, the state and civil society lose oversight and transparency, together with the right to question policy and practice over its processing, yet the DfE does not believe it should be questioning these implications. Perhaps the Minister can explain why not.
This motion calls on the Government to carry out a privacy impact assessment of these regulations. If the Government believe that it is for the OfS to carry out such an assessment, so be it, but they must ensure that the OfS does so because, despite these regulations being in force for more than a month, there are too many unanswered questions surrounding them, and that is not acceptable. I beg to move.
Lord Lucas (Con)
My Lords, I am grateful to the noble Lord, Lord Watson of Invergowrie, for bringing this Motion forward. I completely share his disquiet at the way in which these regulations have been framed. I am grateful to the Minister—his department has been in helpful correspondence with me since—but the fundamental problem is in the drafting. The idea that data should be given to a commercial company, one so much at the centre of education as Pearson, for purposes connected to its memorandum and articles—which are written, as you would expect, to allow Pearson to do anything; there are not even any restrictions on illegality, as is conventional—is a fundamental defect in the drafting of the regulations.
There are some good precedents that could have been followed. The one I like, because I know it best, is Schedule 1 to the Freedom of Information Act. Typical expressions might be:
“The Competition and Markets Authority, in respect of information held otherwise than as a tribunal”,
or:
“Any person providing local pharmaceutical services … in respect of information relating to the provision of those services”.
My understanding from the Department for Education is that, actually, Pearson’s requirement to be given information is very limited. It is only in respect of a minor part of Pearson’s activities and then not regularly, but only if a problem occurs. That could easily have been set out in these regulations, so that it is clear in what circumstances Pearson could be given information, but it has been stated in the broadest possible terms and quite rightly raised a lot of alarm in people who care about the privacy of information and the privileging of a particular commercial enterprise.
The fault at the root of this is bad drafting and I very much hope that the Minister says that this will not happen again, that we will not use this wide phraseology again, and that the Government recognise that it is entirely inappropriate that they have used it. Given that they have, the Government are relying on data-sharing agreements to protect the data against misuse. Those data-sharing agreements are, naturally, not entirely public documents because, to some extent, they are commercial documents and commercial in confidence. Since they are so central in this case to the protection of public and individuals’ information, I hope that my noble friend confirms that all these data-sharing agreements will be made public, redacted if necessary to remove commercial things but so that we can see exactly how explicit and proportionate they are; that the information that is being released is clearly and fully described, so that we can understand that, in practice, the way the department is behaving is something we can live with; and that the department publishes information on what data releases have been going on, so that we can pick up that we need to take an interest in the data-sharing agreements.
This is a very unsatisfactory situation that we have got ourselves into. From my conversations with the department, I think that we will be able to put on an adequate sticking plaster in this case—but I really hope that it is something that we do not do again.
Lord Adonis (Lab)
My Lords, I agree with almost every word that the noble Lord, Lord Lucas, has said. My noble friend Lord Watson is to be commended for pursuing this issue with terrier-like commitment. Having now read the debates in the House of Commons, I can say that the gravity of the issues is extremely serious. My one point of difference with the noble Lord, Lord Lucas, is that he said we should learn lessons for the future. We are a Parliament and these are regulations going through Parliament. If we are deeply unhappy with them, on something as fundamental as the sharing of individuals’ data, my view is that we should not agree the regulations. The regulations should be redrafted and the Government should be required to resubmit them, and we should not pass them until they have gone through the process again of being examined by the Delegated Powers and Regulatory Reform Committee and we are satisfied that there is no significant invasion of people’s individual liberty taking place.
I cannot think of a good reason why we would not do that, except for the fact that we are always steamrollered in these things. We are debating this in what may be—I should not give away my negotiating position—the final moments of the sitting of the House before the summer. But it need not be like that. I do not know whether my noble friend Lord Watson is thinking of pressing this to a vote, but there is a very strong case for him to do so—not just because of the gravity of the issues at stake but to send a very clear message to the Government that we are not prepared as a Parliament to be treated like this when we are representing the people on something as fundamental as data.
The issues that the noble Lord raised are extremely serious. Pearson is the largest single commercial education provider in the country, and these regulations give the Government unfettered power to share data with it. The explanation given by the Minister for Higher Education in the House of Commons was that it would be in respect of HNDs and HNCs where it was believed that illegality was taking place. But that is not codified anywhere in the regulations. As the noble Lord, Lord Lucas, said, the data-sharing agreement is not published, and I understand that it is not even finalised yet—although perhaps the Minister could tell us that in his remarks. That is a completely unsatisfactory situation.
Pearson has huge potential commercial interests in this information. What guarantees do the Government have about Chinese walls operating inside Pearson? What guarantees is he in a position to give to Parliament for us to give to students that their data will not be shared with an organisation that is then going to start trying to sell them other services or use it to target them for promotional activities—or any range of activities that could take place under this?
On sharing, the Minister for Higher Education in the other place said:
“On students’ right to know”—
this is where students will actually be informed that their data is being shared with other bodies, so it is about whether they even know, let alone consent—
“the OFS will tell them before it shares data, where appropriate”.—[Official Report, Commons, 2/7/18; col. 10.]
What does “where appropriate” mean? This is the crucial thing. Where would it conceivably be appropriate for the Office for Students not to consult students on the sharing of their data with other bodies? That includes public sector bodies. There is big concern about how the Department for Education has been sharing information with the immigration control agencies, which I am informed has apparently been part of the hostile environment. This information has been shared in respect of school governors and, indeed, children, from other databases held in the Department for Education. So it is absolutely essential that students know where their data is being shared. My own view—and I do not think that this is too demanding—is that they should be required to give their consent to the sharing of that information. I see very big scandals coming down the line if that does not take place.
I have two other points. Could the noble Viscount tell the House why these regulations took effect before they were approved by Parliament? I understand that it was because it was done under the negative procedure. However, commitments were given in debates during the passage of what the Higher Education and Research Bill, which many of us spent many hours taking part in, that because of the significance of the issues at stake here, this would be done under the affirmative procedure. I see all kinds of precedents for this on the raft of regulations that will come our way when the noble Lord, Lord Callanan, gets going on transposing the European legislation into the British statute book. If the procedures that have taken place on these three regulations are replicated elsewhere, there will be major breaches of parliamentary oversight.
It is also immensely concerning that student bodies, including the National Union of Students, were not consulted in the construction of these regulations. That became clear in the debate in the House of Commons. The Government tried to elide that fact by saying that they are in regular consultation with them—but they were not consulted. The National Union of Students has formally protested to the Government about the fact that it was not consulted on these data-sharing regulations, which will have an immense impact on students and young people.
This is a sorry tale. Every word the noble Lord, Lord Lucas, and my noble friend Lord Watson said is valid in this case. I do not believe that Parliament should consent to these regulations in their current form. A major scandal could come down the line from them, and if my noble friend is minded to push this matter to a vote, I shall certainly vote with him.
Baroness Garden of Frognal (LD)
My Lords, we on these Benches share the concerns expressed by the noble Lord, Lord Watson, and so eloquently expressed by the noble Lords, Lord Adonis and Lord Lucas. Will the Minister say what data the OfS is likely to share with Pearson? We note that Pearson is the only for-profit organisation on the list; the others are public bodies or registered charities. What is the commercial value of the data that it will be sharing, and will the OfS be charging the awarding bodies for access to this commercially sensitive data?
To pick up on the concerns expressed by the noble Lord, Lord Adonis, will data by which students can be individually identified be sent to the OfS by awarding bodies, and, if so, how will the consent of students to this transfer of data be obtained? It is surely important that that should happen. In summary, how will the OfS comply with the Data Protection Act in this, and can the Minister offer us any reassurances on these very disturbing aspects?
Viscount Younger of Leckie (Con)
My Lords, I thank the noble Lord, Lord Watson, for tabling this Motion. The noble Lord has raised concerns that these regulations create significant powers for the Office for Students to grant access to students’ confidential data to a single commercial provider. He also calls on Her Majesty’s Government to carry out a privacy impact assessment on the regulations. Before addressing the noble Lord’s concerns, I reassure noble Lords that these regulations are very much in the interests of students and taxpayers. They enable the OfS to work appropriately with other bodies to address any potential wrongdoing or concerns about quality, students’ experience, and the management and governance of the higher education system. These regulations are essential for the OfS to do its job well, and will be accompanied by strong safeguards around data protection and privacy.
The noble Lord, Lord Watson, asked about the timing of the laying of these regulations and proper scrutiny. I reassure him that these regulations are absolutely subject to proper scrutiny, as is any other statutory instrument laid under the negative procedure. They are important to the OfS being able to operate effectively as a regulator.
Lord Watson of Invergowrie
I thank the Minister for that answer, but it does not get to the root of the problem. He talks of scrutiny, but the point is that these regulations came into force some five weeks ago. How does that square with scrutiny? It does not with me.
Viscount Younger of Leckie
They have been scrutinised as part of the scrutiny process. That is where we are—there is no issue to discuss here.
Viscount Younger of Leckie
They have gone through the scrutiny procedure, as mentioned.
Let me continue. These regulations and the enabling primary legislation provide greater protection, scrutiny and control over information sharing than before. The regulations replicate, and in some cases improve on, the arrangements that HEFCE, OFFA and the DfE had in place for sharing information with other bodies. As HEFCE’s and OFFA’s enabling legislation did not place controls around co-operation and information sharing in the same way as the Higher Education and Research Act 2017 does for the OfS, the legal framework around information sharing has actually been strengthened. The parliamentary process for the regulations, including this very debate, also means that there is more scrutiny and oversight of the information sharing than before.
I should now like to address the concerns raised by the noble Lord, Lord Watson, in turn, starting with his question about the consultation with UCAS and universities, and, in particular, students’ concerns regarding access to their data. As the noble Lord may know, officials and Ministers have regular meetings and interactions with universities, and they work closely with UCAS. On student concerns regarding access to their data, I reiterate that personal data would be shared only if there were serious concerns and if it were necessary to share that data.
Lord Adonis
The noble Viscount always uses these weasel words. He says, “if it was necessary to share that data”. What does that mean? In what circumstances would it be necessary to share that data?
Viscount Younger of Leckie
I think that it would be wise if I continued with my remarks and then, if there are further concerns, I shall be happy to listen.
First, the noble Lord, Lord Watson, referred to the “single commercial provider” within the regulations, which is Pearson Education Ltd. To reassure him and the noble Baroness, Lady Garden, I emphasise that Pearson is included in these regulations solely in its capacity as the awarding body for HND and HNC qualifications. This is in the same way as other awarding bodies have been included in the regulations—namely, the Scottish Qualifications Authority, Gateway Qualifications Company Ltd and the Vocational Training Charitable Trust.
The OfS would share with Pearson only information that related to the provision of HNDs and HNCs. For example, as happens now between the DfE and Pearson, the OfS might wish to alert Pearson to an issue around the quality of this provision or suspicions of wrongdoing relating to HND or HNC provision. This sharing would be done in the interests of students and the taxpayer. Any data sharing would be underpinned by a data-sharing agreement stating that Pearson could not use that data for any other purposes. This is just one of a range of strong safeguards and protections that will be in place, as I will set out shortly.
The noble Lord, Lord Watson, raised a question about Sir Michael Barber and his potential conflict of interest. There are already information-sharing agreements between the DfE and Pearson. Sir Michael Barber no longer works for Pearson and, in any case, he was not involved in the drafting of the regulations. Therefore, I reassure the noble Lord that there really is no conflict of interest. In addition, if it emerged in the future that the OfS wished to share information or co-operate with any other organisation not currently included in these regulations, and this was to fulfil a function of that other body, I make it clear that this would be possible only by amending the regulations.
The noble Lord, Lord Watson, and my noble friend Lord Lucas asked why Pearson is included and whether awarding the HNC and HND makes it unique. They also asked about transparency surrounding what they can do with the data. I reiterate that Pearson is included only because it owns, designs and awards HNDs and HNCs. The collaboration agreement with Pearson will be published—there is transparency. Data-sharing agreements will not be published, as they may contain commercially confidential information about the circumstances that have led to the concerns that are being shared with the other party.
The noble Lord, Lord Watson, asked whether Pearson can sell on data. The answer is: absolutely not. The information sharing will be underpinned by data-sharing agreements which will specify the purposes of the data sharing, and these purposes will not include selling data. If Pearson did so, it would be in breach of the data-sharing agreement and subject to sanctions by the Information Commissioner—a serious matter.
The noble Lord, Lord Watson, asked about parliamentary scrutiny, and I would like to add to the words that I used. The regulations were scrutinised by the JCSI before they came into force, and there was a debate in the Commons in Committee on this very matter. The inclusion of any new body in the regulations would therefore be subject to the same parliamentary scrutiny and oversight as these regulations have received.
Secondly, the noble Lord, Lord Watson, was concerned about the sharing of students’ confidential data. Data privacy is a particularly pertinent topic in the current climate, and this is precisely why the Government have strengthened the legal framework underpinning data sharing by the OfS compared to the previous regime. I emphasise, however, that the main purpose of these regulations is to enable information sharing at a provider or course level. Personal data would be shared only if there were serious concerns—for example, around fraud or malpractice—and there was a specific need to share personal data to investigate a specific issue.
The noble Lord, Lord Watson, also raised concerns that students’ confidential information will be shared without the consent of those to whom it refers. I reassure noble Lords that any data sharing will be subject to data protection legislation. While consent is one lawful basis on which information may be shared, there are other bases for data sharing; the circumstances will dictate which is most appropriate. The OfS will always seek consent where it is appropriate to do so. However, where data sharing is to investigate wrongdoing or fraud, for example, and seeking consent would jeopardise the investigation, the OfS may rely on another lawful basis for information sharing.
In addition, I reassure noble Lords that these regulations do not oblige the OfS to share any information or to co-operate with any of the bodies in the regulations, including Pearson. They simply make this possible where appropriate. It will be for the OfS, or in some cases the Secretary of State, to decide when to do this, and this will be decided in the context of the general duties and functions of the OfS as set out in primary legislation.
I would like to go further. I reassure all noble Lords that there will be strong safeguards for any data sharing that is carried out with all bodies included in the regulations, including Pearson. For example, any information sharing will be subject to strict data protection laws governing its use, as stipulated by the primary legislation. These regulations do nothing to undermine data protection law. The OfS will also publish its collaboration agreements with other bodies online, including stating where data sharing agreements are in place.
It might happen, for example, that the OfS needs to share information with another body as part of a joint investigation. In this case, the OfS would also create a bespoke data sharing agreement. This agreement would state what data will be shared, with whom and why, on what legal basis, and how it will be processed and kept secure. This would also set out individuals’ rights in relation to their data. The OfS would only ever share data with precisely who needed to see it and only ever precisely what they needed to see to resolve the issue. A data sharing agreement is binding: if any organisation breaches this, the OfS as the data controller would stop this arrangement and, where appropriate, inform the Information Commissioner, who could then take action. Make no mistake: this would apply to every organisation in the regulations, and Pearson would be no exception to this.
I now turn to the final point from the noble Lord, Lord Watson, in which he called on Her Majesty’s Government to carry out a privacy impact assessment on the regulations. I thank the noble Lord for raising this point, because data privacy impact assessments are indeed a useful tool. Under GDPR, however, the Government are not obliged to conduct such an assessment. Furthermore, it would not be appropriate to do so. While the Government, in writing these enabling regulations, have identified the overall situations and reasons where the OfS may wish to share information, the need for a data privacy impact assessment should properly be considered by the organisation that will be sharing the data, once the specifics are known. Much of the data sharing would be in response to emerging concerns: for example, where there are suspicions of wrongdoing. It is only at this point that the nature and extent of privacy risks can be properly assessed and fully effective solutions put in place. The OfS is aware of the sensitivities around the sharing of personal data and takes its responsibilities to safeguard personal data extremely seriously. It will consider whether a data privacy impact assessment is needed, and will carry this out where appropriate, before sharing information that could impact on personal privacy.
I hope that, having put a lot of emphasis on these safeguards, I have reassured the House that data sharing—in particular with non-government bodies, including Pearson—will be undertaken in an appropriate way and for the right purpose, with strong protections in place.
Baroness Garden of Frognal
I apologise to the Minister, but could he answer my question as to whether the OfS will be charging Pearson for the data that it shares with it?
Viscount Younger of Leckie
I will write to the noble Baroness with that information. It may not only be a charge; there may be an agreement in place and I would prefer to get the full information to her.
Lord Lucas
My Lords, I do not believe my noble friend has answered either of the questions I posed. If the Government are content with drawing a wide power in regulations for a narrow use of personal data, we as a House should react to that by greatly strengthening our scrutiny of such secondary legislation. This got through our scrutiny without being picked up. If this is to be regular practice—if the Government do not say, “Sorry, we will not do it again”—then we must take it seriously. It is entirely inappropriate that we should draw such wide powers for such a narrow purpose when it concerns a sensitive matter.
Secondly, I heard my noble friend say that data-sharing agreements would not be published. I would be grateful if he could write to me to say how in that case we, as Parliament, can exercise proper scrutiny of the way in which data sharing is being carried out; and, secondly, how that attitude fits with the Freedom of Information Act, which I understand requires the reduction of the commercially sensitive elements of a data-sharing agreement. Surely a great deal of what is in there—particularly the detail of what kind of information is being shared and what sort of terms and conditions have been placed on it—cannot be commercially confidential in any real sense.
Viscount Younger of Leckie
I take note of my noble friend’s broader points about the scrutiny of secondary legislation—I am simply taking note of that—and I will write to him on his points about data-sharing agreements and their publication. I hope that that will satisfy him.
Lord Watson of Invergowrie
My Lords, I thank all noble Lords who have participated in the debate. I thank the noble Lord, Lord Lucas, for his support, which I welcome, and for sharing our concern about the privacy of the information which is to be shared. I noticed that while he was characterising the fact that the Government have got this wrong he referred, I think, to the Minister saying, “Sorry, we will not do it again”. I did not hear those words, or anything that approximated to them, and there is a great likelihood that the Government will, in another setting, do something similar again. That is why we felt it appropriate to table this Motion to Regret.
The noble Lord, Lord Lucas, also referred to the bad drafting and wide phraseology. I concur with him—it is a part of the hole that the Government have dug for themselves.
I appreciate the support of my noble friend Lord Adonis, who spoke about the significant invasion of people’s liberty, which we believe this is. Our doubts are not assuaged by the Minister’s comments that these regulations will be in the interests of students. He mentioned the issue of quality—we will give him that—but that is not what we are talking about today; we are talking about privacy. I welcome two points made by the Minister. He said that the collaboration agreement with Pearson will be published and that Pearson will be prohibited from selling data that students have given it, as we know it did in the USA.
I have to come back to the Minister on the question of scrutiny. He maintains that this SI has been scrutinised adequately. However, it is all about timing. Yes, the JCSI looked at it, as it does, and the noble Viscount mentioned a debate in the House of Commons. However, that debate took place on 2 July and these regulations came into force on 18 June. I do not call that scrutiny by any standards and it is disingenuous to suggest that these regulations have been scrutinised.
The Minister also said that data sharing would conform to the data protection law. Only weeks after the Government made quite a bit about the new Data Protection Act which is supposed to give people more control over how their data is used, they are passing—I would say pushing through—regulations into law that could ride roughshod over students’ data rights, a point we have heard being made by many noble Lords. There is an inconsistency and a disconnect in this which I do not think the noble Viscount has dealt with.
I was rather surprised when the Minister went on to say that the OfS is not obliged to share data. I do not think that any suggestion was made that it is obliged to do so, but the fact that it is merely possible when appropriate is the issue. The sharing of information, including personal details, will clearly take place at some point, but of course the unknown is how often, in what circumstances and what information will be involved. I suggest that many students and their families will be uneasy and I doubt whether their fears will be assuaged by the statement made by the noble Viscount that the regulations will provide greater protection with more security control and transparency than has been the case in the past. That is certainly not the impression which noble Lords have gained in this debate.
It is interesting to note that the Benches opposite have filled up in the past 10 minutes or so, perhaps in anticipation of the denouement of this debate. I have to disappoint them because while I would like to press this issue, given how the debate has unfolded, and although we remain concerned about the lack of adequate assessment of the impact on privacy for those whose data will be made available under these regulations, at this point we will monitor their effect in the immediate period following. I am sure that noble Lords can read between the lines and for now I beg leave to withdraw the Motion standing in my name.