Product Security and Telecommunications Infrastructure Bill

(Limited Text - Ministerial Extracts only)

Lords Hansard - Part 2 & Committee stage
Tuesday 21st June 2022 Lords Chamber

[Baroness Merron (Lab)]

My Lords, I am grateful to the noble Lords, Lord Clement-Jones and Lord Fox, for tabling these amendments, which seek to clarify how the new measures in the Bill will interact with existing consumer legislation. In a practical sense, they are about how comfort can be given to the consumer and redress made available where necessary.

We in your Lordships’ House know that consumers have had to fight hard over many years to secure important statutory protections, including rights of redress when products do not live up to the standards that people rightly expect of them. I say to the Minister that the new measures in the Bill are certainly welcome and will improve certain aspects of the consumer experience, but it is also right to probe how this new regulatory regime interacts with consumer rights and protections enshrined elsewhere.

I feel that Amendment 14 seeks to update the state of play to refer to compliance with security requirements, but that needs to be an area where consumer protection is enshrined in legislation. To me, it goes with the sweep of the Bill, which is to bring us into today’s world and able to cope with the new and constantly evolving situation. Amendment 14A is also interesting, in that it seeks to maintain the right of individual consumers to seek redress in relation to defective connectable products rather than leaving these matters to a particular enforcement body or to collective legal action.

We would appreciate it if the Minister could clarify some of these matters in the Bill itself. If that does not prove possible, this is another area where we would very much like rather more information to be made available by the department so that we can seek to protect the rights and interests of consumers.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Parkinson of Whitley Bay) (Con)]

I am grateful to the noble Lord and the noble Baroness for probing through Amendments 14 and 14A as tabled by the noble Lords, Lord Clement-Jones and Lord Fox. The amendments seek respectively to amend consumer protection legislation and clarify the relationship between this Bill and consumer protection legislation.

The Consumer Rights Act 2015 requires goods and services to be of a satisfactory quality, and the Consumer Protection Act 1987 imposes liability for defective products. Breaches of this Bill that meet the criteria of these Acts already entitle consumers to the protections they provide. This Bill focuses on the supply chain and what it needs to do to protect and enhance the security of products and their users. The security requirements will relate to processes and services, not just to the hardware of a product as the product safety framework does. It is not appropriate to retrofit the security requirements of this Bill’s regime into the existing framework of consumer protection legislation, which was generally designed to ensure that consumers have rights when products are unsafe—although, as I said, I appreciate the probing nature of these amendments.

Some security requirements will require ongoing action from manufacturers after they make a product available. It would be inappropriate to require traders to confirm one-off compliance with such requirements before contracts become binding. I acknowledge that existing consumer rights legislation will not always enable consumers to seek redress for breaches of the security requirements. I reassure noble Lords that this is not a gap. The evolving technological landscape means that the threats to consumers change, and we need flexibility to protect and compensate customers where that is necessary. The Bill, together with existing consumer rights legislation, already offers this.

--- Later in debate ---

[The Earl of Erroll (CB)]

The Minister said earlier that the whole point of the Consumer Rights Act was about unsafe goods. I think that he means “unsafe” as referring to physical harm. Actually, a major security breach could render serious physical harm to someone because having all their money removed from their bank account could affect their mental state and result in the breakdown of their marriage, suicide, failure of business, all sorts of things. Therefore, it may have just as damaging physical effects on someone, though not immediately apparent. Although they are different they are equally unsafe, so this has more merit than he is suggesting.

[Lord Parkinson of Whitley Bay (Con)]

At the risk of a philosophical debate on the nature of security versus safety, I accept some of the points that the noble Earl makes. There are distinct differences between our approach to product security and existing product safety as set out in consumer legislation, but I will address myself to that philosophical point in the letter, if I may. For now, I ask the noble Lord to withdraw Amendment 14.

[Lord Fox (LD)]

I hope that the Minister will take some time to read my speech in Hansard and address the issues that I have raised, because there are some specific points that have not been touched.

A lot of this has come from Which? whom I thank for its help. Which? is an extraordinarily experienced organisation, with some of the country’s most experienced consumer lawyers dealing with the sharp end of customer consumer problems. The fact that it has gone to the trouble of raising these issues should raise a red flag. It is not doing it out of mischief or political intrigue, but because it cares about the future of consumers. For that reason, the department needs to take this seriously.

If the Minister requires a meeting with Which? I am sure that I, the noble Lord, Lord Bassam, or the noble Baroness, Lady Merron, will be very happy to broker one. We could then go through some of these consumer issues. This is an organisation dedicated to protecting the needs of consumers. It has gone to the trouble of flagging up this and several other issues. For that reason, for the future of this Bill, it would be very sensible to take Which? seriously.

That said, I beg leave to withdraw Amendment 14.

--- Later in debate ---

[Lord Bassam of Brighton (Lab)]

No, I give credit where it is due. I congratulate the noble Lord, Lord Arbuthnot, on his amendment because the issues that he raised and the questions posed by the noble Lord, Lord Fox, in particular, are legitimate ones.

Although this is not the place to amend or change the Computer Misuse Act 1990, as the noble Lord, Lord Fox, said, it certainly is the place to raise concerns. After all, we are talking about product security and safety. It is vital that we have appropriate safeguards in place to prevent and, if need be, punish cyberattacks and other forms of hostile behaviour online.

However, as we seek to make smart devices safer, clearly there is a role for researchers and others to play in identifying and reporting on security flaws. They need to be able to do this within the safe zone of concern, knowing that they are not themselves going to be captured by those who are responsible for cybersecurity. As I understand it, exemptions exist in similar legislation to ensure that academics and other legitimately interested parties can access material relating to topics such as terrorism. The amendment before us today raises the prospect of granting a similar exemption and defence in this particular field.

I am conscious that the noble Lord, Lord Fox, raised the spectre of auras in the form of the noble Lords, Lord Vaizey, Lord Clement-Jones and Lord Holmes of Richmond—as well as the intent of the noble Baroness, Lady Neville-Jones, who is of course very knowledgeable about the business of security and has had both professional and political responsibility in that field. However, I think that, when those auras and his own say that this is an issue of concern, we as the Official Opposition reflect that concern.

I hope that the noble Lord will engage with the noble Lord, Lord Arbuthnot, and others following Committee on this—I am sure he will—because it is a very important subject. A campaign backed by such an esteemed cross-party group of colleagues in the Committee and in another place cannot be entirely wrong. The Computer Misuse Act 1990 is the framework we have got, but it is right that it is reviewed and that something fresh is brought before us to protect us from cyberattacks in the future.

[Lord Parkinson of Whitley Bay (Con)]

I am very grateful to my noble friend Lord Arbuthnot of Edrom for representing the other three signatories to this amendment. I was glad to meet him and the noble Lord, Lord Clement-Jones, to discuss this yesterday.

The role of security researchers in identifying and reporting vulnerabilities to manufacturers is vital for enhancing the security of connectable products. The good news is that many manufacturers already embrace this principle, but there are also some products on the market, often repackaged white label goods, where it is not always possible to identify the manufacturer or who has the wherewithal to fix a fault. The Bill will correct that.

As noble Lords have noted, there are legal complexities to navigate when conducting security research. The need to stop, pause and consider the law when doing research is no bad thing. The Government and industry agree that the cybersecurity profession needs to be better organised. We need professional standards to measure the competence and capabilities of security testers, as well as the other 15 cybersecurity specialisms. All of these specialists need to live by a code of professional ethics.

That is why we set up the UK Cyber Security Council last year as the new professional body for the sector. Now armed with a royal charter, the council is building the necessary professional framework and standards for the industry. Good cybersecurity research and security testing will operate in an environment where careful legal and regulatory considerations are built into the operating mode of the profession. We should be encouraging this rather than creating a route to allow people to sidestep these important issues.

As noble Lords have rightly noted, the issues here are complex, and any legislative changes to protect security researchers acting in good faith run the risk of preventing law enforcement agencies and prosecutors being able to take action against criminals and hostile state actors—the goodies and baddies as the noble Earl, Lord Erroll, referred to them. I know my noble friend’s amendment is to draw attention to this important issue. As drafted, it proposes not requiring persons to obtain consent to test systems where they believe that consent would be given. That conflicts with the provisions of the Computer Misuse Act, which requires authorisation to be given by the person entitled to control access. As the products that would be covered by this defence include products in use in people’s homes or offices, we believe that such authorisation is essential. The current provisions in the Computer Misuse Act make it clear that such access is illegal, and we should maintain that clarity to ensure that law enforcement agencies do not have to work with conflicting legislation.

The amendment would also limit the use of such a defence as testers would still be subject to the legal constraints that noble Lords have described when reporting any vulnerability that the Government have not banned through a security requirement. If a new attack vector was identified that was not catered for by the security requirements, the proposed defences would have no effect. The amendment would not protect those testing products outside the scope of this regime, from desktop computers to smart vehicles. If we consider there to be a case for action on this issue, the scope of that action should not be limited to the products that happen to be regulated through this Bill. None the less, the Government are listening to the concerns expressed by the CyberUp Campaign, which have been repeated and extended in this evening’s debate.

The Home Secretary announced a review of the Computer Misuse Act last year. As my noble friend noted, the Act dates back to 1990. I do not want to stress too much its antiquity as I am conscious that he served on the Bill Committee for it in another place. His insight into the debates that went into the Bill at the time and the changes that have taken place are well heard. The evidence which is being submitted to the review is being assessed and considered carefully by the Home Office. It is being actively worked on and the Home Office hopes to provide an update in the summer.

I hope, in that context, that noble Lords will agree that it would be inappropriate for us to pre-empt that work before the review is concluded and this complex issue is properly considered. With that, I hope my noble friend will be content to withdraw his amendment.

[Lord Arbuthnot of Edrom (Con)]

My Lords, I was six at the time. It has been a useful debate and I thank all those who have taken part. I am particularly grateful to my noble friend Lady Neville-Jones, who made it quite plain that we understand the problems in the way of the Government in legislating on this but we are getting impatient. With everything that is going on in the world, out-of-date cybersecurity legislation is becoming more dangerous day by day. That said, I beg leave to withdraw the amendment.

--- Later in debate ---

[Baroness Merron (Lab)]

My Lords, this is of course the first of a number of amendments that deal with Part 2 of the Bill. The amendment refers to telecoms infrastructure. This is far from the only debate that we will have on broad issues around property rights, operators, access to land and so on but, as a general point, it is worth restating our belief that this country needs access to better digital infrastructure. Our concern is that the Government have not been hitting their targets for the rollout of gigabyte-capable broadband. There have also been issues around the rollout of 5G technology. Although we want to see decent infrastructure, we also want to see fairness in the system, and that is what this amendment speaks to. It seeks to ensure a degree of continuity and fairness as new agreements are made to replace existing ones.

The principles cited by the noble Lord, Lord Fox, and in the amendments tabled by the noble Lord, Lord Clement-Jones, are reasonable. Again, they are principles that I am absolutely sure we will return to next week, as we have ever-more detailed discussions about rents, dispute resolution and so on.

As has been outlined in this debate, the court is not currently bound to consider the terms of an existing agreement. This feels like a significant oversight. Perhaps the Minister can inform us about what actually happens in practice and what will happen in practice. Both operators and landowners have, or should have, certain rights and responsibilities within this process. I look forward to the Minister’s response to Amendment 17 and to moving some of our own amendments during day two of Committee.

[Lord Parkinson of Whitley Bay (Con)]

As the noble Baroness says, this begins to anticipate some issues to which I know we will return on the second day of Committee, but it is useful to begin them tonight.

Amendment 17 seeks to insert a new clause after Clause 57 of the Bill. Its purpose is to add an extra element to the test at paragraph 21 of the code, where an operator enters into a new agreement because of the provisions in Clause 57. This is likely to be in circumstances where an operator in occupation of the land on which its apparatus is installed has an existing agreement but wishes to seek an additional code right. The code currently provides that operators in exclusive occupation of land are unable to obtain additional code rights until their existing agreement is about to end or has ended. This is because the code currently provides that only an occupier can grant code rights, and the operator clearly cannot enter into an agreement with itself.

Clause 57 remedies this position and allows an operator to obtain code rights where it is in exclusive occupation of the land. The test at paragraph 21 of the code is often referred to as the public interest test and sets out what a court must consider when deciding whether to impose a code right on a landowner. Paragraph 23 then sets out how the court should determine the remaining terms of the code agreement. Clause 57 simply gives an operator the ability to obtain a new code right or rights that they do not already have. The clause does not allow an operator to force changes to its existing code agreement or to compel the other party to modify any of its terms—for instance, to attempt to reduce the amount of rental payments. Furthermore, the clause does not enable an operator to bring an existing agreement to a premature end in order to take advantage of more favourable terms. Any existing code agreement that the operator has will be expected to continue and operate alongside the agreement relating to the new code right.

Amendment 17 seeks to expand the test at paragraph 21 so that the court also has to consider the terms of any existing agreement and any other method of statutory renewal available. We are, however, of the view that the court can already take such matters into consideration when deciding whether to make an order under paragraph 20 of the code, and again when applying the test at paragraph 23 to determine what terms the code agreement should contain.

This is a topical issue. Clause 57 rectifies an issue in the code that currently prevents operators who are in exclusive occupation of the land being able to obtain new code rights. As I said, three cases have touched on this issue, all of which were heard in the Supreme Court earlier this year, and the Supreme Court is due to hand down its judgment tomorrow.

At present we believe that Clause 57, as drafted, achieves its intended objective, but we recognise that this is a complex and technical area, on which the noble Lord, Lord Fox, valiantly conveyed the expert view of the noble Earl, Lord Lytton, and it is imperative that any unintended consequences are avoided. We will of course look closely at the Supreme Court’s judgment and carefully consider whether further amendments are needed, engaging with interested parties as required to ensure that the aim of the clause is fully realised.

I too am very conscious that the noble Earl, Lord Lytton, with whom we have already had some discussions on this and broader aspects of the Bill, will want to join those discussions, so I am sure he will be following the official record. But I am very happy to meet the noble Lords who have spoken, as well as the noble Earl, to discuss this issue in further detail, particularly once we have seen the judgment. For now, I urge the noble Lord to withdraw the amendment.

[Lord Fox (LD)]

I thank the Minister for his response, during which he said that the department is of a view. When I was speaking for my part, rather than for the noble Earl, I made it clear that there were quite strong opinions that that view might not be correct. Three cases are to be judged tomorrow, before this Bill is enacted, so although it may have some relevance, it will potentially —and in the views of the people we have spoken to, almost certainly will—end up back in the courts.

We share the objective of the noble Baroness, Lady Merron, that the rollout be accelerated, not inhibited. We also share the view, as expressed in the not very veiled threat in the part of my speech on behalf of the noble Earl, Lord Lytton, about what the 1963 rent Act did, which was clog up the system. We do not want to do that—we cannot afford to clog up the rollout. There are strong suspicions that, without giving the legal certainty we need to avoid getting tangled up in the courts, we will be back there again, notwithstanding the judgments of tomorrow. That said, I beg leave to withdraw Amendment 17.