Automated Vehicles Bill [HL]
Wednesday 10th January 2024
(10 months, 2 weeks ago)
Lords ChamberAutomated Vehicles Act 2024 View all Automated Vehicles Act 2024 Debates Read Hansard Text Watch Debate Read Debate Ministerial Extracts Amendment Paper: HL Bill 1-I(b) Amendment for Committee (Supplementary to the Marshalled List) - (10 Jan 2024)
Lord Liddle
Member's explanatory statement
This is to probe consultation provisions.
Lord Liddle (Lab)
My Lords, the amendments I am speaking to are basically about the process of external scrutiny and oversight of what the department is doing. In the previous discussion, we had a perfect illustration of why this is necessary, because the Minister said, “No—you can’t put the critical issue of safety in the legislation. It’s got to be left to the department”. That is what he was saying. Is that what we want in the public interest? Does it satisfy the concerns that people have?
I speak as a supporter of automated vehicles, but I believe that if we do not exercise the highest standards of safety in their introduction, we will get a public backlash which will put all this back for years. I say to the Minister: if he is so adamant that he is not prepared to accept my noble friend Lord Tunnicliffe’s amendment on safety standards, how is it also logical for him to reject all the amendments in this group, which are designed to improve stakeholder involvement and ensure that there is the widest possible consensus about what changes are to be proposed?
All the amendments in this group that are in my name are basically on this theme. Again, it is not the detail of the wording that matters at this stage—I am sure there are errors and faults in that—but the principle. Are the Government prepared to accept the principle that there should be widespread stakeholder involvement in this evolving issue of what regulation is necessary? As we know, there will not be a sudden change to automated vehicles. It is going to be a long process of evolution and change, as I think one of the noble Baronesses here said. We are going to have hybridity for a long time, so we have to face these questions of how we adjust our regulation in the light of experience.
The first amendment I put down was on the business of the statement of safety principles. The Government, unless they accept my amendment, are not even prepared to recognise the point in their legislation that there should be representative consultation on what the safety standards should be before they table them. That seems to be fundamental, so I am moving that as Amendment 11 and then speaking to the others.
On Amendment 33, we have the case that there will be reports, but there is absolutely no provision that they will be laid before, and provide an opportunity for discussion in, Parliament. Is that not pretty fundamental?
Amendment 49—let me find this part of the Bill; I do not want to mislead the Committee—would come after Clause 93. Its principal proposal is for the establishment of an advisory council, which would bring together stakeholders and people who are relevant to this debate. At one end, it would include trade unions, because if you are talking about automated delivery vehicles and automated bus services—that may be one of the first areas where automated vehicles will be used fully—then you have to carry the representatives of working people with you. It is only right that trade unions and employers should be involved.
When we are talking about an advisory council, these things cannot just be driven by the industry and the producer interest. We have to look at the views of people such as cyclists. Cyclists are probably more at risk in a hybrid situation, alongside pedestrians, than any other group. The cycling association has thought about this quite hard and has quite sensible views, so I would like to think that the department was institutionally obliged to consult it and take its views into account.
That is the very valid point of this group of amendments. I would like to hear from the Minister why he cannot accept them, because it seems self-evident that if we are not prepared to put things in law which require high safety standards, then we will have to find some other mechanism by which the public can be reassured.
Baroness Brinton (LD)
My Lords, I want to make a brief intervention on this group of amendments. I thank the noble Lord, Lord Liddle, for raising the important issue of an advisory council. The disabled community talks about the importance of co-production right from the start to make sure that there is not consultation at the end when it is really too late to do things. I hope that the Minister will take that on board. The Government have finally begun to understand the importance of co-production with disabled people. You can never have just one representative and it is important to understand all the issues. But as the noble Lord, Lord Liddle, said, that also applies to other users, so an advisory council is going to have to cover a fairly broad range of interests. As the Minister reminds us continually during the course of the Bill, we are in new territory and design is inevitably going to have to change, so I hope that he will support these amendments.
Lord Berkeley (Lab)
My Lords, I will intervene very briefly and apologise for being late. I support my noble friend Lord Liddle in his comments on Amendment 49 and the need for an advisory council. We have come across this before in many other Bills and Ministers always seem to say, “We don’t want to list those people who might be on it, because they might change”. I just draw the Committee’s attention to the news, which I think came yesterday or today, about the new board for Channel 4. The comment was made that the only person who had any experience in diversity had been rejected. Whether it was because of that or because she was female we do not know, but everybody else—except for one—was a white male. The Government may say these things, but they do not always appear to do it.
Baroness Randerson (LD)
My Lords, I support the amendment in the name of the noble Lord, Lord Liddle, to which I have added my name. I added my name because, as a member of the Secondary Legislation Scrutiny Committee, and a previous member of the Common Frameworks Scrutiny Committee, I am used to looking at what different departments consider to be proper consultation. This Government have a very poor record on recognising what is really inclusive consultation. I cannot think of a topic with a broader range of organisations to which the Government should be offering consultation than safety on roads. Almost everyone in our nation uses the roads in one way or another and has the right to a viewpoint and to have it considered.
It is probably a very little-known fact that the Secondary Legislation Scrutiny Committee keeps a record of the progress of individual departments on issues such as this. The Department for Transport does not have a wonderful record on consultation and reporting. Consultation cannot be only with the organisations, for example, producing the automated vehicles. It has to be with a whole range of organisations representing people who use the roads and directly with the people who use the roads themselves. I support the noble Lord, Lord Liddle, in his views.
Amendment 55, which is in my name, would require the Secretary of State from time to time to review the rules for driving tests to ensure that the public can safely drive both automated and non-automated vehicles in places where there are many automated vehicles on the road. It would also allow the Secretary of State to update the rules on driving tests. It is blindingly obvious to me that, over time, people’s driving skills will wither and die if no effort is made at keeping them refreshed.
This is an issue that the Transport Committee of the House of Commons addressed directly in paragraph 63 of its report:
“Greater automation will reduce time spent driving. Over time drivers may become less practised and therefore less skilled. Conversely, the demands on drivers will grow as they will be called upon to retake control of vehicles in challenging circumstances with little notice. The Government should set out a strategy for the future of human driving in a world of self-driving vehicles. This should include possible changes to driving tests and a plan to ensure that all drivers fully understand self-driving vehicles and both acquire and maintain the necessary skills for taking control of a vehicle in all circumstances”.
Looking at the circumstances in which you would retake control of a vehicle, it seems it would be when it has become too complex for the automated vehicle to cope. You would be sitting there, quite relaxed, and suddenly you would be in an emergency situation. That requires new and different skills and a new and different approach. It is essential that the Government look at the driving test and the issue of refreshing skills. This is going to be possibly most acute as an issue for older drivers and for young and inexperienced drivers. Skills can become stale very quickly.
The noble Lord, Lord Liddle, has one approach to this in Amendment 47; I have a slightly more urgent approach in Amendment 55. The principle of the two amendments is the same. The issue needs to be looked at and it needs to be looked at now, so that everyone is prepared for when this situation comes into existence—which people tell us could be in the next few years.
I urge the Minister to give us a positive response on the issue of consultation and to reassure us that the Government are considering the issue of skills.
The Parliamentary Under-Secretary of State, Department for Transport (Lord Davies of Gower) (Con)
My Lords, the amendments in this group concern external oversight of the operation of the self-driving regulatory framework. This includes duties to report and consult.
On the opening remarks of the noble Lord, Lord Liddle, it is a mischaracterisation to suggest that the issue of safety is simply being left to the department, and I said nothing of the sort. Indeed, it is on the face of the Bill that the statement of safety principles is to be developed in consultation with stakeholders—a point I will return to shortly—and subject to proportionate parliamentary scrutiny.
Turning to the noble Lord’s Amendments 11, 46, and 49, the Government are clear that we will consult with representative organisations on the proposed use of the Bill’s powers before they are used. Following government best practice, we anticipate this will bring in the views of the public, academia, trade unions and other representative bodies for affected groups. Notwithstanding the comments of the noble Lord, Lord Berkeley, it remains the case that this is a particularly uncertain policy area with a rapidly developing industry, and any statutory list of consultees risks falling out of date rapidly. Additionally, I note the consultation that has already taken place as part of the Law Commissions’ four-year review, which included road safety groups, trade unions and businesses. Many of the concerns raised during this process have already been reflected in the Bill. Examples include the introduction of the incident investigation function and the embedding of accessibility into the automated passenger service permitting process. On Amendment 49 specifically, we also believe an external advisory council of the type proposed would risk duplicating the vital functions of the statutory inspectors conducting independent safety investigations.
On Amendment 55D, an extensive public engagement programme has already been conducted over the course of the many years spent developing this legislation. That work is not stopping. For example, in 2022 we funded an unprecedented study called The Great Self-Driving Exploration. This award-winning public engagement exercise was explicitly designed to allow people from all walks of life to understand and give their views on how self-driving vehicles might affect their lives. The learning from this research is being used to develop future engagement plans, including ones that will inform our programme of secondary legislation. We also run the AV-DRIVE group, which focuses on how we can all engage consistently about self-driving vehicles. The group brings together vehicle manufacturers, software developers, vehicle leasing representatives, insurers, road safety groups and others. Work to date has focused on education, communication and building public understanding of the technology. This will also be supported by Pave UK, a new resource hub and education group launching this spring, with government support. I hope this offers my noble friend Lord Holmes of Richmond sufficient reassurance.
Amendments 32 and 33 look to attach additional requirements to the general monitoring duty set out in Clause 38. This clause requires that reports be published on the performance of authorised automated vehicles, including assessments of the extent to which this performance is consistent with the statement of safety principles. Since the principles are required to be framed with a view to securing an improvement in road safety, any assessment against them is already an assessment of safety. The exact format of these reports is yet to be determined and will likely vary depending on the number and types of relevant deployments in any given year. However, I can confirm they are expected to include some fleet-level reporting on safety incidents. Finally, the existing publication requirement in subsection (3) will ensure that reports are available for all interested parties, including parliamentary colleagues. For these reasons, Amendments 32 and 33 are unnecessary.
I turn now to Amendment 30. Clause 43 specifies that authorisation and licensing fees may be determined by any costs incurred, or likely to be incurred, in connection with any function under Part 1 of the Bill. This includes the cost of controlling data collected through information notices. Part of these fees may therefore be used in relation to this function. However, to require separate reporting on these specific costs could add an additional administrative burden and therefore additional costs to the in-use regulatory scheme. It would therefore be disproportionate.
On Amendments 47 and 55, the Government recognise the importance of keeping driver skills up to date in a self-driving world. However, this needs to be done on an ongoing basis rather than to arbitrary reporting cycles. The foundations of that work are already well under way. We have commissioned research on how authorised self-driving entities can best educate those who use their vehicles, and we expect appropriate user training and support to form part of authorisation requirements. We have already updated the Highway Code to explain the difference between driver assistance and self-driving. Just as satnav use is now part of the driving test, driver training will continue to evolve with the arrival of new technology. For example, the Driver & Vehicle Standards Agency is already drawing on research from the RAC which proposes the new CHAT procedure, thereby teaching users of self-driving vehicles to “Check”, “Assess” and then “Take over” control.
I hope that this goes some way to reassuring the noble Lord, Lord Liddle, and the noble Baroness, Lady Randerson, that these issues are at the forefront of the Government’s mind and will continue to be tackled on an ongoing basis over the coming months, years and even decades. In answer to the noble Baroness’s specific point, a user-in-charge is not expected to retake control at a moment’s notice. There are safeguards in place in the Bill to promote safe transition, including requiring multisensory alerts and sufficient time to resume control. Vehicles must also be capable of dealing safely with situations where the user-in-charge fails to resume control.
In conclusion, I hope that the noble Lord, Lord Liddle, and the noble Baroness, Lady Randerson, see fit to withdraw the amendment.
Baroness Randerson (LD)
I return to the point the noble Lord made about taking over control and not taking over at a moment’s notice. From what I have read, 10 seconds seems to be the period specified for taking over control. Is that the Government’s accepted view? What research have the Government used in order to home in on that particular period, because 10 seconds is actually a fairly short period in which to get oneself from relaxed to fully in control of emergency situation mode.
Lord Davies of Gower (Con)
The noble Baroness makes a fair point. I cannot give her an absolute answer on that one, but it is something I will certainly look into and come back to her on.
Lord Liddle (Lab)
My Lords, I agree with what the noble Baroness, Lady Randerson, said about the 10-second question. We need more explanation of that.
I would make three points. I did not detect in what the Minister said any great sympathy for the amendments that I have put down—for three reasons. First, the Government seem to want to minimise future parliamentary involvement in this question of what the safety standards are as well as involvement in being able to discuss reports on the progress of the rollout of automated vehicles. That is point one: Parliament should be involved, and there is no reason why that should not be in the Bill.
Secondly, with automated vehicles there are clear implications for existing, well-established industrial sectors—buses, lorries and delivery vehicles—where many people are employed. It may be that there will continue to be new jobs in these areas; that is generally the experience of technological change, and it may get rid of the labour shortages that exist in some of these areas. That may well be true, but why not try to take the trade unions with you, as well as the employers, when you discuss the regulation of these things? That seems to me to be self-evident.
Lord Davies of Gower (Con)
I am grateful for the point that the noble Lord makes, but I come back to the point that the Government are very clear that we will consult representative organisations on the proposed use of the Bill’s powers before they come into force. The noble Lord seems to imply that these bodies are not onside. As I have said previously, we anticipate that we will bring in the views of academia, trade unions and other representative bodies, so I do not really accept what the noble Lord says.
Baroness Brinton
“(6) A person may not be an authorised self-driving entity unless they meet the following requirements—(a) they have obtained a certificate of compliance with data protection legislation from the Information Commissioner’s Office for their policy in regard to the handling of personal data,(b) their policy in regard to the handling of personal data clearly outlines who has ownership of any personal data collected, including after the ownership of a vehicle has ended, and(c) they are a signatory to an industry code of conduct under the UK General Data Protection Regulation.”Member's explanatory statement
This amendment seeks to probe a number of concerns around data protection and ownership and seeks to prevent authorisation of companies as self-driving entities unless robust personal data practices are in place.
Baroness Brinton (LD)
My Lords, we move to a group that looks at data protection issues, which were covered at Second Reading. In this group, I have Amendment 21, the Clause 42 stand part notice and Amendments 35 and 36. I have found the Information Commissioner’s Office response to the joint consultation from the Law Commission and the Scottish Law Commission on automated vehicles, dated March 2021, extremely helpful. That response set out the legislative landscape and said, in paragraph 6:
“The consultation refers to Directive 2002/58/EC, known as the ePrivacy directive (‘ePD’), however, reference should be given instead to PECR, which is the UK law that gives effect to the ePD … Section 17.54 notes that the legislator ‘clearly did not have AVs … in mind’ when the Directive was enacted, and that ‘At the time, the typical terminal equipment was a telephone handset’ … Therefore, care must be taken when interpreting the legislation, so that its underlying rationale, and technology neutral approach is fully understood and any proposals accord with its objectives. The ICO has produced guidance”
on this. It is saying that GDPR rules are clearly not enough on their own.
I was grateful at Second Reading for the Minister’s clear response on the protection of personal data— I may disagree with what he said but I was grateful for the clarity of the response. He said:
“However, data must remain properly protected. Self-driving vehicles will be subject to existing data protection laws in the UK. Our proposed Bill does not alter that, so manufacturers and government will have to ensure that data is protected”.—[Official Report, 28/11/23; col. 1072.]
I remain concerned that the Bill, especially Clause 42, sets out a very high level, a top level, of legislation—whether primary or secondary, of which we know nothing yet—by which information will be protected, but it does not put in place the mechanisms by which individual people could rest assured that their personal data was being appropriately protected. The ICO further commented on personal data in its response to the Law Commission, at paragraph 12:
“Automated vehicles pose particular challenges in relation to personal data, as often they will process the personal data of several individuals: owners, drivers, passengers and even pedestrians. If the personal data of these users is processed inappropriately, there is a heightened risk of intrusion into individuals’ work and private lives. The Government and technology providers should therefore adopt a data protection by design and default approach, ensuring that privacy protections are built into the design and development of automated vehicles”.
To return to the Bill, Clause 42(4) sets out the offence of breaching data protection, but then Clause 42(5) gives a very wide range of defences, which is, frankly, quite worrying. It says:
“But it is a defence to prove that—(a) the person from whom the information was obtained as described in subsection (1) consented to the disclosure or use, or (b) the recipient reasonably believed that the disclosure or use was lawful”.
I have been trying to think through what this might mean in practice. Let us say that you call an AV—it could be yours; it could be a neighbourhood vehicle; it could be a taxi; it could even be getting on a bus—and when you call it, it will ask you, probably in your app, to confirm the terms and conditions. We all do this every day when we go online; we just tick “Yes”, but do we know what the operating licence holder might be doing with our personal data? Worse, the licence holder or a future recipient of that data, somebody else in the chain of information, might think that disclosure was lawful. Amendment 21 sets out the baseline good practice for any organisation that is dealing with personal data, especially data that the individual is not necessarily aware of.
I want to give the Committee an example I experienced when a number of people and organisations were involved in handling personal data. My dentist—please do not laugh; it is relevant—requires patients to sign online, before they are seen every time, that they are content with their personal, medical and other personal data being held, so that the surgery can better look after patients, with an assurance that it will be held appropriately. That is fine. A couple of years ago, the regular online form changed, and after page one I was asked to sign a different set of Ts and Cs from a specialist data processing company. I clicked through, read the 17-odd pages and discovered that in the small print this multibillion-dollar company wanted my permission to be able to pass my data, medical and personal, on to other interested parties in its group and for other associated services. This included insurance companies, providers of healthcare and pharmaceuticals. I was not happy.
When I raised it with the dental surgery, it was really shocked. It had not clocked the detail because it had not clicked through two or three times, as I had to do, and it dealt with it straightaway, but I am making a point: we are not expecting a single authorised organisation to process all the data. There will be many different tracks coming down the line, and the problem here was that this was an American company using American law, not GDPR. The defence in Clause 42(5) would have succeeded, because one would have automatically ticked on the Ts and Cs thing on the app. That is one of the reasons that, at Second Reading, I probed on protection for data. I hope that my amendments will strengthen what the Government are planning to do.
Amendment 21 sets out the criteria that would have to be met before a person or a body would be permitted to be authorised as a self-driving entity. First, they must
“have obtained a certificate of compliance with data protection legislation”
from the ICO for their policy of handling of personal data. Secondly, their policy relating to handling personal data of clients, passengers et cetera must clearly outline
“who has ownership of any personal data collected, including after the ownership of a vehicle has ended”.
Thirdly, they must be
“a signatory to an industry code of conduct under the UK General Data Protection Regulation”.
Because I remain concerned about Clause 42, I have laid that it should not stand part, partly as a probing issue to get the issues out and bring a response from the Minister. I hope the Minister can provide the Committee with stronger reassurance than that given at Second Reading, given the 10 pages of response from the ICO to the Law Commission consultation.
I have two further amendments in this group. In every debate so far—and in meetings with the Minister—the Government have made it plain that the Bill is charting new territories and new technologies that not one other country has yet managed to do. Much of the focus on the Bill is understandably on vehicles, but the other element of newer and untested technology is how data will be used. We know just from the advances in AI over the last few months, let alone year, how fast it changes. Amendment 35 sets out for an annual report to Parliament on the use of personal data in relation to automated vehicles. This way, when the sector responds it can see how many breaches there are and how new technology as yet unseen and unknown—not even thought of—will affect individuals. Equally importantly, we will be able to see trends in data collection so that Governments and Parliament can consider whether further legislation is needed to further regulate the collection of data. Amendment 36 sets out the requirement for the Secretary of State to consult with the ICO in relation to the collection of personal data prior to the Secretary of State making any regulations in relation to personal data collection.
I know that the noble Lord, Lord Liddle, made the point about the Secretary of State making these decisions, and I just want to add at this point that this Government have had a habit of pushing an enormous amount of information into secondary legislation. I think we all understand that some of it needs to be there but, particularly with new technologies and new areas, Parliament is very concerned about giving permission for things that are not yet even understood, let alone explicit.
I also want to add that I support the other amendments in this group from my noble friend Lady Bowles and from the noble Lord, Lord Holmes of Richmond, all of which strengthen the protections needed for a technology that will have even more access to people’s personal data than we know now, whether it is commercial or third-party data. All the amendments in this group are following the ICO’s principal concern.
I say again that AVs pose a risk to individual rights if they have insufficient control over their data and their data protection rights. The ICO says that data systems for AVs should have a data protection system by a design and default approach. After all, it is a new technology.
I really look forward to hearing the Minister’s response. I beg to move.
Baroness Bowles of Berkhamsted (LD)
My Lords, I have four amendments in this group. I am looking more at the commercial interest side of things, partly because “information” is a very broad word that can mean all kinds of things. My Amendment 29 adds to the end of Clause 14 that information sharing
“must respect rights of ownership and privacy, including with a view to compensation in respect of any commercial rights”.
I will talk more on compensation in connection with later amendments as well, but there is a significant issue here.
Under Clause 14, authorisation requirements may state that there has to be information sharing with the Secretary of State, public authorities and private businesses. Clause 14(4) says that the purpose of the shared information must be disclosed, which is fair enough as far as it goes, but says nothing about privacy or commercial rights. Further, the information may not belong to the body being authorised. It may belong to individuals. Even in an anonymised state, it may belong to others than the authorised entity. I accept that there may be instances where sharing is needed—accidents and failures come immediately to mind—but there will still need to be ways to make sure that neither individual nor commercial rights are undermined.
Baroness Randerson (LD)
My Lords, I support the amendments in the names of my noble friends Lady Brinton and Lady Bowles. I start by emphasising the importance and strength of the Information Commissioner’s Office’s response to the Law Commissions’ report. Amendment 36 is therefore essential because it involves the ICO in setting the rules and standards.
It seems to me that the issues are twofold: first, the issue of the protection of personal privacy and personal data, and, secondly, the issue of national security. On national security, these vehicles will have an entire knowledge of every part of the UK and the details of the traffic arrangements for the whole of the UK. Can you imagine the impact on the economy of a major cyberattack that could paralyse traffic over a considerable area? I am trying to avoid the idea of some kind of updated version of “The Italian Job”. Any kind of hacking into the system would have national security implications.
Turning to personal privacy, I will pose a couple of simple examples. Imagine that I own a car and I sell it to someone else. The car has collected my data; it knows where I visit on a daily and regular basis. Whose data is it when I sell the car to someone else? The data is an essential part of the operation of that car. It has learnt its way around my city using my favourite routes; it has amended how it operates according to my preferences. At what point does that data cease to be mine and start to belong to the car or its manufacturer? Do I have a right to say, “Wipe it, start afresh and reinstall”? If that is the case, there is the whole issue of public awareness to be tackled.
My second example is of a taxi company. I hire a taxi, so the company concerned therefore knows where I picked it up and where I left it. Does that data belong to the taxi company or to me? I realise that a taxi company now has data on things such as this, but it is in a very much less systematic way.
Turning to whether Clause 42 should stand part, I will quote a couple of sentences from the clause. It says:
“The Secretary of State may make regulations authorising the recipient to … use the information for a purpose other than the purpose for which it was obtained”.
That is a pretty bald phrase and therefore pretty risky. It adds:
“It is an offence for the recipient to … disclose the information … except as authorised by regulations under subsection (3) or any other enactment”.
That is remarkably broad. It also says that
“it is a defence to prove that … the recipient reasonably believed that the disclosure or use was lawful”.
That is a very weak position. It seems to me that in neither respect does the Bill adhere to data protection norms. I urge the Minister to take it back and look at tightening up the data protection aspects of the Bill, in relation to both data protection for the individual and, as my noble friend Lady Bowles emphasised, the commercial aspects of the rights to data.
Lord Tunnicliffe (Lab)
My Lords, we on these Benches have no amendments in this group, largely because the area is so complex and we cannot rustle up anybody bright enough to understand it—I wish I had got a good lawyer. Hence, I would like to thank the noble Baronesses, Lady Bowles, Lady Brinton and Lady Randerson, for making the subject so interesting and explicit. The closest I got to this area was trying to read the whole Bill, which I staggered through over Christmas. I kept coming across these various little phrases, including the one about such a weak defence for giving away my data. I really feel that the three Baronesses have a very strong point. I look to the Government not to dismiss it because they were told to give no points away but to take it back and discuss with the noble Baronesses how this Bill can be improved. It is a horrible precedent to see data handled so loosely and in such a cavalier manner.
Lord Davies of Gower (Con)
My Lords, once again I thank noble Lords for their contributions. I begin with Amendments 29, 34 and 42, tabled by the noble Baroness, Lady Bowles of Berkhamsted. The protection of personal and commercial data is of course a critical issue and one that requires careful consideration. On Amendments 34 and 42, all information collected and shared under Clauses 42 and 88 is subject to restrictions on unauthorised use, breach of which constitutes an offence. Where personal data is collected, this is also subject to data protection legislation. This information can be disclosed or used only for the purposes specified in the regulations made under each respective clause.
As set out in our policy scoping notes, this is a novel policy area, and it is not yet known exactly how information may need to be used or shared. However, as the examples in the notes illustrate, this is likely to be for public interest purposes such as road safety or improved passenger services. On the basis that information sharing will be proportionate and in the public interest, a requirement to pay commercial compensation would be inappropriate.
To further support data protection, the Government will be considering the recommendations by the Centre for Data Ethics and Innovation, in its report Responsible Innovation in Self-Driving Vehicles. These include a recommendation to work with the Information Commissioner’s Office to issue guidance on how data protection obligations apply to self-driving vehicles.
On Amendment 29, all information required to be shared under Clause 14 will be subject to the requirements and safeguards of data protection legislation. The Bill does not change these protections. This information will be used for regulatory purposes to ensure the safe and legal operation of self-driving vehicles. It will also be used to determine criminal and civil liabilities associated with the use of these vehicles. Again, these purposes are proportionate and in the public interest. Businesses will be aware of the regulatory requirements for information sharing prior to seeking authorisation or licensing, and the information will be subject to these obligations from the outset. There would therefore be no expectation that it could be treated as commercially confidential information which holds a market value.
I turn to Amendment 31. The department does not notify entities when using information obtained under an investigation and used in the public interest— for example, to improve road safety. In the case of Clause 22(2), the information would be used for
“any of the investigative purposes in relation to any regulated body”.
These purposes aim to ensure the continued safe and legal operation of self-driving vehicles, and are therefore in the public interest.
The amendment would place an additional administrative burden on the Secretary of State that brought minimal benefit to the regulated body in question, as the investigative purpose would continue none the less. In the case of a regulatory issue being identified, the body would be notified by the appropriate regulatory action, such as a compliance notice. This would then allow the regulated body to challenge the use of information by representations under paragraph 5 of Schedule 1.
On Amendment 21, tabled by the noble Baroness, Lady Brinton, I recognise that she made a characteristically incisive series of detailed points on these issues. I will be happy to meet with her, in addition to the separate meeting we have scheduled on accessibility, to have a fuller discussion on her questions, and I extend the same invitation to other noble Lords.
We believe it is right that the protection of personal data will be considered alongside the detailed development of authorisation requirements—it is an important issue. These requirements will be set out in secondary legislation and will be subject to consultation and impact assessment. The schemes referred to in the amendment are industry led and therefore not within the control of government. There is therefore a risk that they would not achieve the intended result.
On Amendment 35, it is the role of the Information Commissioner’s Office to regulate on data protection issues. The ICO has an existing obligation to report annually to Parliament on the commissioner’s activities. Any report by the Department for Transport would risk duplicating this work. The Department for Transport is also not the data controller for information collected by regulated bodies, which means that such reporting would be inappropriate. Further, the Secretary of State already has a duty under Article 36(4) of the UK GDPR to consult the ICO on proposals for legislative measures. Amendment 36 therefore duplicates an existing requirement.
On Amendment 55B, the Information Commissioner’s Office is the independent regulator responsible for upholding information rights in the public interest. Given its role as a whole-economy regulator, it would be unnecessary and duplicative to establish a separate third-party body, with the same expertise, to oversee the use of personal data by self-driving vehicles.
I turn to the proposal that Clause 42 be removed. Clause 42 contains provisions that constrain the use and disclosure of information obtained through the regulatory framework. The removal of these provisions would open up the possibility of personal data being processed in a much wider manner, such as for reasons of “legitimate interest”. This would amount to a weakening of the data protections in the Bill.
On the points raised about national security, whole-life cyber resilience will be tested as part of the approval processes. The UK has co-chaired the UNECE group developing standards in this area, and government is working with colleagues in the National Cyber Security Centre and the National Protective Security Authority on these issues.
Finally, on the point regarding the protection of personal data when selling a vehicle, in cases where manufacturers and supporting services store data outside the vehicle, all relevant data protections will need to be met. If a vehicle user has given access rights and connections to personal information, it is the responsibility of the user to delete the data from the vehicle. Indeed, this is the same approach as that applied to devices such as mobile phones, which contain similarly large quantities of sensitive data. I ask noble Lords not to press their amendments on this.
Baroness Bowles of Berkhamsted (LD)
Can I just clarify something? I accept what the Minister says. In most cases there may be a public interest provision and there are not statutory protections on the information that the public interests can win. But where there are—I will take the statutory protection of a patent—that is essentially exerting a Crown user provision with no compensation, which would offend against international treaties.
Lord Davies of Gower (Con)
I thank the noble Baroness for that. She raised a number of important points that I have perhaps not addressed fully, and I would be very happy to go back and write to her comprehensively on a couple of them.
Lord Tunnicliffe (Lab)
Will the Minister copy that to those who have been involved in the debate?
Lord Davies of Gower (Con)
I omitted to say that I will copy in all those noble Lords.
Baroness Brinton (LD)
My Lords, I thank all the contributors to this debate. We are delighted that others have been so supportive of our amendments, which cover a considerable range of data protection issues. I am grateful to the Minister for his response and thank him, because, yes, I think a meeting is particularly important. He said in response to my noble friend Lady Bowles’s first amendment that the Government are not yet sure how data will be used or shared. That is the reason that the ICO is so clear that there needs to be extra provision, because otherwise, if everyone just assumes that it will be the way we have always used GDPR, we—being the Government and the public—are going to come a cropper pretty quickly, not least because technology has changed, is changing and will change again so fast. I hope that, as we have our meeting and progress towards Report, the Government will seriously consider following the ICO’s advice and make very clear, designed-by-default arrangements for this sector, which will be like none that we have seen so far. With that, I withdraw my amendment.