Automated Vehicles Bill [HL]

Baroness Bowles of Berkhamsted Excerpts

Report stage
Tuesday 6th February 2024 Lords Chamber

Moved by

[Baroness Bowles of Berkhamsted]

29: Clause 95, page 68, line 33, leave out “does” and insert “must”
Member’s explanatory statement
This amendment seeks to change a presumption that a provision relating to information disclosure does not contravene data protection legislation into an active requirement that it should not.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I have tabled four amendments which constitute this group. There are two interacting issues: public interest and commercial interest. It is clear that where safety, human lives or participation are at risk, that has to win over commercial interest. This is what we are dealing with in these amendments. I have made some suggestions because I do not really understand what the legislation is saying. Instead of a speech, and because my voice is dodgy, I am just going to read out the subsection and explain what I do not understand.

Clause 95(2) says:

“The provision does not require or authorise any disclosure, obtaining or use of information that … contravenes data protection”


or is prohibited under something to do with the Investigatory Powers Act. What does “the provision does not” mean? I have changed it to say that the provision —which would come forward from regulations—“must” not authorise things that would contravene data protection legislation. This might be similar to what we used to call a “notwithstanding” clause—notwithstanding what the provision says, it actually means something else, or it does not mean what it says. I think it would be better if it said “must”.

If it is a contravening provision—a notwithstanding type—meaning that the regulation might say one thing but that thing is not allowed because it is forbidden in another piece of legislation, at what point does this come to light in the request for information? Is the requester of the information obliged to make it clear: “Oh well, we do not need this bit”, or does the person who is requested to give the information have to plead: “Oh, I do not have to answer that”? I do not know the answer to those questions. I do not know whether this is a notwithstanding clause or whether the constraint will be clear at the point at which the evidence or information is being sought. I wait to hear what the Minister tells me it means.

Amendment 30 would add intellectual property rights to the list of legislation which must not be contravened. As Clause 95 deals quite a lot with commercial rights and the use of data and things that can be asked for under investigatory powers, why can we not put in intellectual property rights, which is another part of the family, if you like? I am still having some interesting discussions with the officials as to whether or not it is needed. I think it is, they think it is not. Maybe we can get some clarity by Third Reading. That is the basis of my second amendment.

My third amendment is to Clause 95(3), which says:

“But the provision is to be taken into account in determining whether the disclosure, obtaining or use of information would contravene the data protection legislation”.


I do not quite know what it means when a provision starts with “But”. It might be another notwithstanding—in which case this is a notwithstanding clause on a notwithstanding clause. I am not quite sure where two notwithstandings leave us.

Does this mean that the provision can have in it new things that it then deems can be taken into account? Is it without limit or does it regard a provision that is cast within an obligation there might be under some other legislation, as there is in data protection legislation —that is, you can have new reasons in the public interest as to why something might be needed? Does the constraint apply or not? From what it says here, I cannot tell. It looks to me as if a provision can be made and then taken into account when interpreting it. I just do not see how that works.

I cannot construe this any better than I have attempted to do—and I am not quite a beginner in construing legal things. I may wish to test the opinion of the House on this clause because it is really quite confusing. If it verges on that broader side, we would be better off without it. Provisions can be made in the public interest under all kinds of legislation; you can do it under data legislation and intellectual property legislation. There are times when the public interest will prevail. So I do not see why we need this clause there at all.

My final amendment simply suggests that Clause 95, which is titled “Disclosure of information: interaction with external constraints”, should be inserted into the list at the start of Clause 96, which is headed “Crown application” and says that the provisions in Sections 42, 73 and 88 “bind the Crown”. To some extent, Clause 95 is mainly relevant to Sections 42, 73 and 88; it therefore seemed logical to me that it should also be listed in Clause 96.

This is not the grand speech that I was going to make, it is just why I cannot understand what is written here. What I think about it will now depend entirely on what the Minister is able to tell me—in particular, about these clauses, which may or may not be “notwithstanding” clauses. I beg to move.

[Lord Liddle (Lab)]

My Lords, these are important issues that the noble Baroness, Lady Bowles, has raised. She has, with her characteristic acuity, asked lots of penetrating questions about what the proposed legislation actually means. For the part of the Official Opposition, we will listen carefully to what the Minister says in reply but, if we are not satisfied, we will support the noble Baroness in her testing of the opinion of the House.

--- Later in debate ---

I am conscious that these are highly technical matters in which the noble Baroness has particular expertise. Once again, I am grateful for her engagement in this area and hope these explanations offer her some reassurance.

[Baroness Bowles of Berkhamsted (LD)]

I thank the Minister for his explanations. I am a little further forward, in that I understand Clause 95(2). I am not sure that I agree with what he said would be the effect of adding “intellectual property” to a new paragraph (c), but, for now, I am prepared to continue conversations with officials so that, between us, we can thrash out whether we understand one another on the point, or, if I am right, the Minister would have an opportunity to do something about it. I think we both want it to be right, it is just that I have different interpretations there.

I think the Minister said about Clause 95(3) that, where it says the provision itself

“has to be taken into account”,

it will be a provision that is subject to the constraints under the GDPR, and so would have to fulfil the tests in the GDPR, if I have understood that correctly. The Minister is nodding. Therefore, it is not a free-for-all, and new ones cannot be invented without that anchor. In general, I am satisfied with that. I am sure that, maybe, this will have a little more investigation as the Bill goes further in the other place, just to make sure that is the correct interpretation. On that basis, I will withdraw the amendment.

Amendment 29 withdrawn.

Automated Vehicles Bill [HL]

Baroness Bowles of Berkhamsted Excerpts

Committee stage
Wednesday 10th January 2024 Lords Chamber

Moved by

[Baroness Bowles of Berkhamsted]

1: Clause 1, page 1, line 14, at end insert—
“(3A) Vehicle testing must include substantial real testing on roads in the United Kingdom in addition to simulation testing.”Member's explanatory statement
This amendment would probe the intention with regard to real as well as simulation testing for UK road situations.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I think that this is the first time I have had an Amendment 1, but, in any event, it gives me pleasure to start the Committee stage of the Bill. For the purposes of Committee, I declare my interest, in that a family member works in the vehicle connectivity sector, but I have no financial interests.

I have three amendments in this group: Amendment 1, and Amendments 20 and 27, which are the same text appearing in different clauses. Amendment 1 is very much a “does what it says on the tin” amendment, and states that vehicle testing must include substantial real testing on roads as well as simulation testing for UK road situations. As well as for initial licensing, this may also have relevance when vehicles licensed in other countries are brought here, especially when driving on different sides of the road and road signs are differently placed. I was prompted to put in this rather obvious statement because among the various things that I read in the documents it was pointed out that simulation testing for UK road situations would be allowed—and I can accept its usefulness as an element when converting from well-proven automation on roads in other countries, for example. However, what I cannot accept is simulation on its own being sufficient, and I wish to ensure that that is not the case.

A further reason for this amendment is that I am aware of how, in the US, there have been issues moving from one city location to another, because of different road widths, despite those having been simulated. Noble Lords who do transport all the time can probably identify what I have read, but I am sure that moving from Los Angeles to the UK would have even more issues, including, for example, more narrow, ancient, humpback or bendy traffic bridges without traffic lights where it is possible only to go one way at a time.

Despite having come up with amendments, I take the approach across this legislation that I understand it is an enabling framework and will not contain detail and, further, that with consultations and so on, a broadly sensible approach will result. Nevertheless, when we have been given documents that explain current thinking and direction, they also explain that they are not fixed promises—presumably because there is still quite a lot of work to do and we do not yet know what the priorities will be. From looking at other amendments generally, it seems that other noble Lords also think we need a few more fixed promises on things that we can be certain will not be left out, and therefore seek to have them in the Bill. For me, real UK road testing, rather than only simulations, is one of them. Obviously, within that, I would expect the road testing to apply to the roads on which the vehicles will be licensed for automated use: on motorways for motorway driving, in towns for town driving, and country lanes with single-lane passing places—if you are lucky—for country lane driving. Will the Minister confirm that this will be the approach, and can we have assurance by some text in the Bill?

My other two amendments, Amendments 20 and 27, relate to adding insurance and captive insurance into the provisions that establish the financial soundness of an authorised self-driving entity. The Law Commission referenced insurance as being able to provide part of the financial soundness, and I would like to see that included, rather than it being thought an additional measure on top of everything else.

I also raised the issue of captives with the Minister at Second Reading, and I thank him for his reply. In the Bill, I would like to see captives acknowledged alongside mainstream insurance as an acceptable form of insurance in the context of ASDE financial stability. Call me cynical or pedantic, or probably both, but I have had too much involvement in financial services and insurance not to think that it needs specific elaboration to ensure that captives, as well as independent insurance, can be considered as an element of the financial stability package.

As I said, I found insurance mentioned in the Law Commission documents as a possible part of the financial stability assurance, so can the Minister say whether there was any specific reason for not following suit and not mentioning it in the Bill? If there were no specific reasons, will the Minister be inclined to recognise my warning, as there might be quibbling if it is not specified? I beg to move.

[Lord Lucas (Con)]

My Lords, I have a number of amendments in this group. I begin by asking my noble friend the Minister to encourage his team to get me a reply to what I call my Eastbourne email. I hope to use that as a means of understanding exactly where the Government find themselves with a practical example of an early-stage project. It would be helpful to have that by the second day in Committee. If I have already received it, I have missed it, so I would be grateful to him for pointing that out to me.

What binds the amendments in this group together is, first, that I do not expect these things to appear in the Bill because I think that they are covered. But they are covered in a way that does not make it clear what the Government will actually do, so I hope to draw out of them some information on what their intentions are.

Secondly, the amendments encourage the Government to take the standards-setting process seriously. I have some long experience observing the telecommunications industry. That has faded from my early days in the City, when we were one of the dominant world players, to now, when we are nothing. Part of that decay has been because we let standards-setting slip. If you want to be a place where a new technology is establishing itself and where companies want to come and be part of what you are doing, being part of the standards-setting is absolutely key. You have to assign good people to it—people who will be internationally respected for their views and insights in the industry—and give them the time to make a really serious contribution to the process. It is then independent of what is happening in the UK; they become part of the wavefront of what is happening, because the whole standards-setting process involves understanding the way things are going, what is happening and who is doing what. That information then flows back into the structures in the UK, and you get a local understanding of where the opportunities are and how the UK might take advantage of them.

If we had had that with telecommunications, we would not be in the dire state we are in now. We started with huge advantages, but they have all gone. Here we are with a new industry and a very clear need for international standards, so we absolutely must take that seriously and put our backs into being part of that process.

I will pick up on the individual amendments. The vehicle identification system—the way in which vehicles will say, “Hi, this is me”—will clearly be electronic. The whole business of using number plates has broken down, and there are 10 million or so unauthorised vehicles on British roads, for all sorts of reasons—vehicles that are just not known to the DVLA, are not taxed and have strings of outstanding parking tickets. Nobody knows whether a number plate they see is real or cloned. We do not need this happening in a new industry, where it will be really important to establish exactly which vehicle was doing what and at which time. It has to be an electronic system, it has to be something that is embedded in hardware, and it absolutely has to be consistent internationally. A vehicle coming over from the continent has to use the same system. This is an example of something that we have to develop and a direction we have to go in, and we absolutely have to be part of setting that standard.

Amendment 15 looks at the question of a passenger alarm. If you are in a vehicle that is travelling totally autonomously and something is wrong and you want to raise the alarm, how do you do it? What is the system? What should you expect to find in the vehicle? Are we going to restrict travelling to people who happen to have mobile phones on them at the time? I hope not. What is the system to be? Again, we ought to be part of establishing international standards, because we want to be able to admit vehicles to the UK. This should be about not just our own domestic expectations; there should be something running internationally.

We want vehicles to be able to communicate where they are and, if they are part of some kind of lending, taxi or other scheme, whether they are available. Again, this needs to be done in a standard way, so that different owners and manufacturers are all sending this information out in a consistent way, and on the back of it can be built the sort of systems consumers will need to know whether or not an autonomous vehicle is available to them. We should not reach a block or allow this to become balkanised, with different companies owning little bits; the information available to consumers ought to be clearly available to everybody.

Amendment 17 looks at the process of reporting on the condition of vehicles, as there are various bits of the Bill that make it clear that automated vehicles are expected to be well maintained. If a vehicle detects that it is not in the state that it ought to be in, that needs to be reported. It needs to be reported not just internally to the system but in a way that makes that information, and the fact that it was reported, available to investigating authorities. Again, we need a standard for that, and it needs to be an international one.

Amendment 18 looks at the question of waymarkers: how a vehicle knows exactly where it is in a relatively autonomous landscape. Are we going to be totally reliant on the navigation satellites working or are we going to have a more ground-based reference system? Some manufacturers clearly think that they will have within their vehicles an image of the routes that they are taking and that the vehicles will recognise where they are. That is a darned hard thing to do on some motorways—you just do not know which bit you are on, or indeed which country you are in: “Am I in Germany or am I still in the UK?” There is a system on motorways where, in the physical sense, you can look at the waymarkers—if you are not travelling too fast—and see where you are; if you break down, it allows you to read the sign and say what distance from it you are. Are we thinking of building that into automated vehicles?

Lastly, how will vehicles communicate with the emergency services, whether it is a fire engine coming up from behind asking the vehicle to pull over and let it through or a policeman standing at the edge of the road, waving down the vehicle to stop? How will that be achieved? Again, we will want there to be an international standard; we do not want to find that vehicles coming in from abroad are unable to speak English. There has to be a common system in there somewhere. However, we absolutely want it to happen—we do not want our police to be powerless and for the automated vehicles to sail past them because they do not understand a hand wave. There has to be some communication system. There are lots of options, but we have to specify it.

--- Later in debate ---

[Lord Davies of Gower (Con)]

I am sorry if the noble Lord took that view of it, but that was not my intention.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I thank the Minister for his responses. At this stage, of course, everything is probing. I possibly still entertain a hope that we can have some little light-touch mentions that are not overbearing somewhere in the text. Maybe we will return to some of these issues on Report.

There are one or two things other noble Lords have said that I would like to touch on. The noble Lord, Lord Lucas, mentioned connectedness. We are falling into a bit of a trap if we start talking about the connectedness of automated vehicles, because the big prize is the connectedness of all vehicles—those which are driven and those which are automated. That is where the real benefits to traffic management and the economic benefits reside. That is a much bigger scheme of interconnectedness, and we are doing ourselves a disfavour by almost sidelining the connectedness and connected car issues as if they are something small and of less importance than the big goal of automated vehicles. In the near term, connectedness is a lot more relevant and moves into what is happening with automated vehicles. We should try to think of it as more of a whole.

I am aware on the simulation aspects, which were addressed, and that we cannot have millions of hours of road driving. Simulations are important and it is an iterative process between simulated tests and road tests. I am perhaps reassured that that is what is in mind. I still do not like the vision that, sometime in the future, it might happen that there are absolutely no road tests—even small ones. Maybe it is wrong to try to insert “substantial”, implying that—this is not what I intended—it would be more than the simulated tests. I still think there should be a significant amount in there for a very long time into the future.

The noble Lord, Lord Liddle, said that his main interest is safety. Certainty is quite fundamental to safety. There is lots more to get to, so I will not say any more now. With the notion that I might return with this in a gentler form on Report, I beg leave to withdraw my amendment.

Amendment 1 withdrawn.

--- Later in debate ---

When we come to Report we will almost certainly pursue these two points—the careful and competent driver as the test, and having affirmative secondary legislation so we can be fully involved.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I have two amendments in this group, which add to the safety principles. Amendment 7 would add “road environs” to Clause 2(2) so it reads that

“The principles must be framed with a view to securing that road”


and road environs

“safety in Great Britain will be better”.

I had two broad points in mind—one that it is relevant what happens next to the road, on pavements, driveways or anywhere else that a vehicle might stray if navigation goes wrong. It would be relevant, for example, if a consequence of some event meant that the vehicle swerved off road instead of stopping. The swerve might be safer for the road, but the vehicle might hit people not on the road, so it would not be safer for the road environs. I accept that the general standard is to stop not swerve, but that was an easy example to give. It is an obvious point, but something relating to the environs needs inclusion and the statistics that are analysed need to take those kinds of things into account.

I happened to come across a paper today—it was actually published yesterday—entitled Unreliable Pedestrian Detection and Driver Alerting in Intelligent Vehicles, by Professor Mary L Cummings, a senior member of the IEEE and a professor of mechanical engineering, electrical and computer engineering and computer science at George Mason University, and Ben Bauchwitz from Duke University. They have done some testing to try to detect pedestrians and, as the title might indicate, it did not work out all that well. Among the suggestions are that

“intelligent vehicles … detected the pedestrian earlier if there were no established lane lines, suggesting that in well-marked areas, typically the case for established crossings, pedestrians may be at increased risk”

because of the road markings. Obviously, these are all kinds of things that we have to take into account: it just shows that we have to look at what is happening in the whole environment.

There are other things that are going on in, around and among roads that are not part of whatever connected systems are developed, whether it is pedestrians, cyclists, animals that can be ridden or animals in the wild. Of course, we have plenty of such roads, where sheep graze in the Dales and ponies in the New Forest: they are not going to be part of the connected systems, so we need to be sure that the actions of those are taken into account. Less picturesque than those but omnipresent—I flagged them in my reasons—are delivery vehicles. Delivery vehicles already have a big and frequently annoying effect on roads. I doubt that I am the only person who has experienced near misses caused by bad or inconsiderate driving, or an inability to see the road ahead due to dangerous stopping by delivery vehicles, and there is no doubt that the tight scheduling of drivers bears some of the blame for that. Of course, we are hoping that automated driving will be more observant of legalities, but several noble Lords mentioned delivery vehicles at Second Reading. There are papers that explain how little robots are going to be coming up your drive, so what is the situation there? What testing will there be with delivery vehicles that are going to be partly on the road and partly going into private driveways?

An interesting point here is that, when I submitted my amendment, my explanatory statement had to be truncated to remove reference to private driveways because that was out of scope. It seems to me that the Bill is only about public highways, but we cannot get away from the fact that private driveways and private roads are pretty abundant, so what is the legal situation there going to be? Because that is out of scope, is it abandoned? Presumably, regulations cannot be being made, and I cannot help feeling that this is a little bit of a hole. The closest I could get to it was by “road and road environs”, which at least seemed to pass the sniff test in the Bill Office. Thus, in connection with both these amendments, my question to the Minister is: how much will testing and licensing take account of effects that are beyond the highway? What is actually included within the “highway” definition, so far as the Bill is concerned, and what is left out?

I have quite a lot of interaction with the highway, because I live with one going all the way up alongside me, and it is quite remarkable, from time to time, what the local authority thinks is part of the highway but is actually a 130 year-old ancient hedge that they wanted to chop down. Anyway, the corollary to all this is that, if testing and authorisation is done only in the context of highways and what happens there, what is the legal framework for these private and residential roads and driveways? If they are left out, are we going to have something in addition?

[Lord Berkeley (Lab)]

My Lords, this is a very interesting and incredibly important group of amendments. My noble friend Lord Tunnicliffe’s introduction was masterful in setting out all the problems. Before I comment on them, however, I would like to comment on a remark by the noble Baroness, Lady Bowles, just now about which bits of the country, whether they are highways or not, are covered by this legislation. A few years ago, it was nothing personal but I had to investigate whether somebody who was driving a vehicle under the influence of alcohol on an unmade road—in other words, a private road—could be guilty of drink-driving offences. The answer was that they would not be guilty of just about anything apart from drink-driving, because of course that comes under the Health and Safety at Work etc. Act, which covers a much wider scope in this country than roads. It is worth asking the Minister what would happen if someone in control of these vehicles was actually found to be under the influence. Under what legislation would they be prosecuted, if they were liable?

The question of safety, as noble Lords have said, is fundamental. What worries me is that the Bill defines safety as meaning only

“to an acceptably safe standard”.

Acceptable to whom? What about the risk? Is there an acceptably low risk of committing a traffic infraction? Again, acceptable to whom? I am very concerned about the need, in all this legislation, to achieve a step change in road safety for all people who are affected by vehicles or what happens. At present, the risks of death or injury on our roads are significantly higher than for life in general or, indeed, on other transport networks, such as rail. Pedestrians and people who cycle —we have debated scooters before—bear a disproportionately higher risk of injury. If we add in children, old people and people with disabilities, who are particularly vulnerable, this is something that we do not really seem to take very seriously.

One issue that came up in a debate on the last group of amendments, which the noble Baroness, Lady Bowles, raised, quite rightly, was the question of testing on the road, but it is a question of “Which roads?”. Most people think that the first location for testing these vehicles will be on a motorway, because there are no pedestrians—or there should not be any pedestrians or cyclists there—and that is quite simple, really. But then, when we drill down, apart from motorways or dual carriageways, what other groups of roads would one have to test these vehicles on? It becomes very much more difficult and very subjective. I do not have an answer to this, but I am absolutely certain that the noble Baroness is right to say that it needs doing, and in a comprehensive way across all the different types of roads and tracks, in the countryside as well as in the towns. I am not quite sure where we are going to end up, because the amendments in this group on safety are fundamental. I do not have a detailed preference for which ones, but I am absolutely certain that we need to tighten up the definition of road safety to something that is not just acceptable but very acceptable, to a high standard, safely and legally.

Automated Vehicles Bill [HL]

Baroness Bowles of Berkhamsted Excerpts

Committee stage
Wednesday 10th January 2024 Lords Chamber

[Baroness Brinton (LD)]

My Lords, we move to a group that looks at data protection issues, which were covered at Second Reading. In this group, I have Amendment 21, the Clause 42 stand part notice and Amendments 35 and 36. I have found the Information Commissioner’s Office response to the joint consultation from the Law Commission and the Scottish Law Commission on automated vehicles, dated March 2021, extremely helpful. That response set out the legislative landscape and said, in paragraph 6:

“The consultation refers to Directive 2002/58/EC, known as the ePrivacy directive (‘ePD’), however, reference should be given instead to PECR, which is the UK law that gives effect to the ePD … Section 17.54 notes that the legislator ‘clearly did not have AVs … in mind’ when the Directive was enacted, and that ‘At the time, the typical terminal equipment was a telephone handset’ … Therefore, care must be taken when interpreting the legislation, so that its underlying rationale, and technology neutral approach is fully understood and any proposals accord with its objectives. The ICO has produced guidance”


on this. It is saying that GDPR rules are clearly not enough on their own.

I was grateful at Second Reading for the Minister’s clear response on the protection of personal data— I may disagree with what he said but I was grateful for the clarity of the response. He said:

“However, data must remain properly protected. Self-driving vehicles will be subject to existing data protection laws in the UK. Our proposed Bill does not alter that, so manufacturers and government will have to ensure that data is protected”.—[Official Report, 28/11/23; col. 1072.]


I remain concerned that the Bill, especially Clause 42, sets out a very high level, a top level, of legislation—whether primary or secondary, of which we know nothing yet—by which information will be protected, but it does not put in place the mechanisms by which individual people could rest assured that their personal data was being appropriately protected. The ICO further commented on personal data in its response to the Law Commission, at paragraph 12:

“Automated vehicles pose particular challenges in relation to personal data, as often they will process the personal data of several individuals: owners, drivers, passengers and even pedestrians. If the personal data of these users is processed inappropriately, there is a heightened risk of intrusion into individuals’ work and private lives. The Government and technology providers should therefore adopt a data protection by design and default approach, ensuring that privacy protections are built into the design and development of automated vehicles”.


To return to the Bill, Clause 42(4) sets out the offence of breaching data protection, but then Clause 42(5) gives a very wide range of defences, which is, frankly, quite worrying. It says:

“But it is a defence to prove that—(a) the person from whom the information was obtained as described in subsection (1) consented to the disclosure or use, or (b) the recipient reasonably believed that the disclosure or use was lawful”.


I have been trying to think through what this might mean in practice. Let us say that you call an AV—it could be yours; it could be a neighbourhood vehicle; it could be a taxi; it could even be getting on a bus—and when you call it, it will ask you, probably in your app, to confirm the terms and conditions. We all do this every day when we go online; we just tick “Yes”, but do we know what the operating licence holder might be doing with our personal data? Worse, the licence holder or a future recipient of that data, somebody else in the chain of information, might think that disclosure was lawful. Amendment 21 sets out the baseline good practice for any organisation that is dealing with personal data, especially data that the individual is not necessarily aware of.

I want to give the Committee an example I experienced when a number of people and organisations were involved in handling personal data. My dentist—please do not laugh; it is relevant—requires patients to sign online, before they are seen every time, that they are content with their personal, medical and other personal data being held, so that the surgery can better look after patients, with an assurance that it will be held appropriately. That is fine. A couple of years ago, the regular online form changed, and after page one I was asked to sign a different set of Ts and Cs from a specialist data processing company. I clicked through, read the 17-odd pages and discovered that in the small print this multibillion-dollar company wanted my permission to be able to pass my data, medical and personal, on to other interested parties in its group and for other associated services. This included insurance companies, providers of healthcare and pharmaceuticals. I was not happy.

When I raised it with the dental surgery, it was really shocked. It had not clocked the detail because it had not clicked through two or three times, as I had to do, and it dealt with it straightaway, but I am making a point: we are not expecting a single authorised organisation to process all the data. There will be many different tracks coming down the line, and the problem here was that this was an American company using American law, not GDPR. The defence in Clause 42(5) would have succeeded, because one would have automatically ticked on the Ts and Cs thing on the app. That is one of the reasons that, at Second Reading, I probed on protection for data. I hope that my amendments will strengthen what the Government are planning to do.

Amendment 21 sets out the criteria that would have to be met before a person or a body would be permitted to be authorised as a self-driving entity. First, they must

“have obtained a certificate of compliance with data protection legislation”

from the ICO for their policy of handling of personal data. Secondly, their policy relating to handling personal data of clients, passengers et cetera must clearly outline

“who has ownership of any personal data collected, including after the ownership of a vehicle has ended”.

Thirdly, they must be

“a signatory to an industry code of conduct under the UK General Data Protection Regulation”.

Because I remain concerned about Clause 42, I have laid that it should not stand part, partly as a probing issue to get the issues out and bring a response from the Minister. I hope the Minister can provide the Committee with stronger reassurance than that given at Second Reading, given the 10 pages of response from the ICO to the Law Commission consultation.

I have two further amendments in this group. In every debate so far—and in meetings with the Minister—the Government have made it plain that the Bill is charting new territories and new technologies that not one other country has yet managed to do. Much of the focus on the Bill is understandably on vehicles, but the other element of newer and untested technology is how data will be used. We know just from the advances in AI over the last few months, let alone year, how fast it changes. Amendment 35 sets out for an annual report to Parliament on the use of personal data in relation to automated vehicles. This way, when the sector responds it can see how many breaches there are and how new technology as yet unseen and unknown—not even thought of—will affect individuals. Equally importantly, we will be able to see trends in data collection so that Governments and Parliament can consider whether further legislation is needed to further regulate the collection of data. Amendment 36 sets out the requirement for the Secretary of State to consult with the ICO in relation to the collection of personal data prior to the Secretary of State making any regulations in relation to personal data collection.

I know that the noble Lord, Lord Liddle, made the point about the Secretary of State making these decisions, and I just want to add at this point that this Government have had a habit of pushing an enormous amount of information into secondary legislation. I think we all understand that some of it needs to be there but, particularly with new technologies and new areas, Parliament is very concerned about giving permission for things that are not yet even understood, let alone explicit.

I also want to add that I support the other amendments in this group from my noble friend Lady Bowles and from the noble Lord, Lord Holmes of Richmond, all of which strengthen the protections needed for a technology that will have even more access to people’s personal data than we know now, whether it is commercial or third-party data. All the amendments in this group are following the ICO’s principal concern.

I say again that AVs pose a risk to individual rights if they have insufficient control over their data and their data protection rights. The ICO says that data systems for AVs should have a data protection system by a design and default approach. After all, it is a new technology.

I really look forward to hearing the Minister’s response. I beg to move.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I have four amendments in this group. I am looking more at the commercial interest side of things, partly because “information” is a very broad word that can mean all kinds of things. My Amendment 29 adds to the end of Clause 14 that information sharing

“must respect rights of ownership and privacy, including with a view to compensation in respect of any commercial rights”.

I will talk more on compensation in connection with later amendments as well, but there is a significant issue here.

Under Clause 14, authorisation requirements may state that there has to be information sharing with the Secretary of State, public authorities and private businesses. Clause 14(4) says that the purpose of the shared information must be disclosed, which is fair enough as far as it goes, but says nothing about privacy or commercial rights. Further, the information may not belong to the body being authorised. It may belong to individuals. Even in an anonymised state, it may belong to others than the authorised entity. I accept that there may be instances where sharing is needed—accidents and failures come immediately to mind—but there will still need to be ways to make sure that neither individual nor commercial rights are undermined.

--- Later in debate ---

[Lord Davies of Gower (Con)]

My Lords, once again I thank noble Lords for their contributions. I begin with Amendments 29, 34 and 42, tabled by the noble Baroness, Lady Bowles of Berkhamsted. The protection of personal and commercial data is of course a critical issue and one that requires careful consideration. On Amendments 34 and 42, all information collected and shared under Clauses 42 and 88 is subject to restrictions on unauthorised use, breach of which constitutes an offence. Where personal data is collected, this is also subject to data protection legislation. This information can be disclosed or used only for the purposes specified in the regulations made under each respective clause.

As set out in our policy scoping notes, this is a novel policy area, and it is not yet known exactly how information may need to be used or shared. However, as the examples in the notes illustrate, this is likely to be for public interest purposes such as road safety or improved passenger services. On the basis that information sharing will be proportionate and in the public interest, a requirement to pay commercial compensation would be inappropriate.

To further support data protection, the Government will be considering the recommendations by the Centre for Data Ethics and Innovation, in its report Responsible Innovation in Self-Driving Vehicles. These include a recommendation to work with the Information Commissioner’s Office to issue guidance on how data protection obligations apply to self-driving vehicles.

On Amendment 29, all information required to be shared under Clause 14 will be subject to the requirements and safeguards of data protection legislation. The Bill does not change these protections. This information will be used for regulatory purposes to ensure the safe and legal operation of self-driving vehicles. It will also be used to determine criminal and civil liabilities associated with the use of these vehicles. Again, these purposes are proportionate and in the public interest. Businesses will be aware of the regulatory requirements for information sharing prior to seeking authorisation or licensing, and the information will be subject to these obligations from the outset. There would therefore be no expectation that it could be treated as commercially confidential information which holds a market value.

I turn to Amendment 31. The department does not notify entities when using information obtained under an investigation and used in the public interest— for example, to improve road safety. In the case of Clause 22(2), the information would be used for

“any of the investigative purposes in relation to any regulated body”.

These purposes aim to ensure the continued safe and legal operation of self-driving vehicles, and are therefore in the public interest.

The amendment would place an additional administrative burden on the Secretary of State that brought minimal benefit to the regulated body in question, as the investigative purpose would continue none the less. In the case of a regulatory issue being identified, the body would be notified by the appropriate regulatory action, such as a compliance notice. This would then allow the regulated body to challenge the use of information by representations under paragraph 5 of Schedule 1.

On Amendment 21, tabled by the noble Baroness, Lady Brinton, I recognise that she made a characteristically incisive series of detailed points on these issues. I will be happy to meet with her, in addition to the separate meeting we have scheduled on accessibility, to have a fuller discussion on her questions, and I extend the same invitation to other noble Lords.

We believe it is right that the protection of personal data will be considered alongside the detailed development of authorisation requirements—it is an important issue. These requirements will be set out in secondary legislation and will be subject to consultation and impact assessment. The schemes referred to in the amendment are industry led and therefore not within the control of government. There is therefore a risk that they would not achieve the intended result.

On Amendment 35, it is the role of the Information Commissioner’s Office to regulate on data protection issues. The ICO has an existing obligation to report annually to Parliament on the commissioner’s activities. Any report by the Department for Transport would risk duplicating this work. The Department for Transport is also not the data controller for information collected by regulated bodies, which means that such reporting would be inappropriate. Further, the Secretary of State already has a duty under Article 36(4) of the UK GDPR to consult the ICO on proposals for legislative measures. Amendment 36 therefore duplicates an existing requirement.

On Amendment 55B, the Information Commissioner’s Office is the independent regulator responsible for upholding information rights in the public interest. Given its role as a whole-economy regulator, it would be unnecessary and duplicative to establish a separate third-party body, with the same expertise, to oversee the use of personal data by self-driving vehicles.

I turn to the proposal that Clause 42 be removed. Clause 42 contains provisions that constrain the use and disclosure of information obtained through the regulatory framework. The removal of these provisions would open up the possibility of personal data being processed in a much wider manner, such as for reasons of “legitimate interest”. This would amount to a weakening of the data protections in the Bill.

On the points raised about national security, whole-life cyber resilience will be tested as part of the approval processes. The UK has co-chaired the UNECE group developing standards in this area, and government is working with colleagues in the National Cyber Security Centre and the National Protective Security Authority on these issues.

Finally, on the point regarding the protection of personal data when selling a vehicle, in cases where manufacturers and supporting services store data outside the vehicle, all relevant data protections will need to be met. If a vehicle user has given access rights and connections to personal information, it is the responsibility of the user to delete the data from the vehicle. Indeed, this is the same approach as that applied to devices such as mobile phones, which contain similarly large quantities of sensitive data. I ask noble Lords not to press their amendments on this.

[Baroness Bowles of Berkhamsted (LD)]

Can I just clarify something? I accept what the Minister says. In most cases there may be a public interest provision and there are not statutory protections on the information that the public interests can win. But where there are—I will take the statutory protection of a patent—that is essentially exerting a Crown user provision with no compensation, which would offend against international treaties.

[Lord Davies of Gower (Con)]

I thank the noble Baroness for that. She raised a number of important points that I have perhaps not addressed fully, and I would be very happy to go back and write to her comprehensively on a couple of them.

Automated Vehicles Bill [HL]

Baroness Bowles of Berkhamsted Excerpts

2nd reading
Tuesday 28th November 2023 Lords Chamber

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I declare my interest, as a member of my family works in the vehicle connectivity sector, but I have no financial interests. I have migrated to this Bill from my usual territory of financial services, business and intellectual property, and it is those aspects which I will mainly cover.

At present, there is a thriving ecosystem in the automated and connected vehicle sectors, including small and innovative businesses, especially on the software side, and whose protection and income streams are based on intellectual property and data. While I understand and appreciate the work that has been done by the Law Commissions and the legal framework in the Bill, I have questions about its impact on that ecosystem for small businesses in particular, and for the preservation of intellectual property rights and rights to monetise data.

My concern is heightened by the already prevalent tendency to default to big-name providers, including large overseas technology companies winning government contracts. There is already an unlevel playing field caused by “play safe” selection of dominant companies, and that dominance is further reinforced by the acquisition of data for themselves when they are selected for important UK projects. Government has a role to play here if it wants to emerge with any UK champions. That includes government having the expertise to analyse bids from less obvious sources, and without forcing commercial disclosures of a type not normally sought from large entities. I have also noted the announcement that the Government may be amending the National Security and Investment Act regarding mergers and acquisitions, which may also further benefit big-name companies from abroad.

Turning to the Bill, I wonder how the present ecosystem will be affected by the conditions surrounding the new regulated entities. This is a point where information requirements could force disclosures or distort contracts, essentially stripping supply chain companies of their commercial, IP and data exploitation opportunities. It would be unfortunate for smaller companies to be forced into a choice between ultimate liability and massive insurance costs, or contract and licensing provisions that leverage away their own data exploitation possibilities.

I now turn more specifically to insurance. At the commercial level, the London market is well placed to develop cover for the UK and elsewhere, so I noted with interest that the Government announced a consultation on captives: that is, an insurance company which is a wholly owned subsidiary providing insurance to its non-insurance parent company or companies. Somewhat ironically, London has the best experts for this underwriting, but we do not have any captives within the UK. Captives might be attractive for the automated vehicle sector, with their associated commercial considerations, including as a part of providing “good financial standing”. However, will the UK regulator, the Prudential Regulation Authority, take exception to the monoline nature of captives and make life difficult? Has the Minister any information in that regard, and have there been cross-departmental discussions?

The other insurance aspect is for the consumer, with a particular point of interest being when a driver becomes liable after a transition from automated driving. Naturally, insurance companies are interested in data on those transitions, including how many times those instances happen and in what circumstances and where, as well as driving patterns and so on. That is commercially useful to insurance companies for the purposes of assessing risk, getting the prices right and ascertaining whether someone is liable, and who. My question is: should they get it all for free? Some insurance companies are already involved in funding developments; others are not. Should their positions be the same? Over time, information will derive naturally from actual claims, but, more generally, this is an area where the entitlement to benefit from or monetise data resides elsewhere.

Some of this kind of information may also be delved into for other investigatory purposes, including authorisation and licensing. For the consumer, there is the dangling threat of insurance companies having to analyse whether the response at handover was what a competent driver would do.

Putting a simple time limit for the liability switch is making light of a difficult situation. Fighter pilots are trained in handovers—and I doubt that they are doing crosswords in the meanwhile; but that is the position envisaged in the documents I have read. I have spent a lot of time being driven around, rather than driving, as a safety precaution. Many times, I have looked up from reading a brief to wonder where on earth I was and felt quite disoriented—and that was in a constituency I was supposed to know and was representing. Regrettably, we will need statistics before we know the interval after handover that is fair to compare with a competent driver in ordinary circumstances—even if we can define that—because it will be different on a straight road with no manoeuvring expected, compared with a much more complex layout or circumstances when the AV cannot cope any more. Potentially, this puts a lot of uncertainty on the consumer, as well as insurance companies, and there may be a role for a levy and compensation model around the transitions, at least initially.

Clause 14 allows access to data for insurance purposes, but it is not clear to me whether that is intended to be free, so perhaps the Minister could shed some light on that. Already, there is lobbying to make the wording mandatory. That is relevant because provisions in the Bill acknowledge commercial rights—in this context, Clause 42(7), which applies to the whole of Part 1 —but that does not protect commercial rights where the disclosure and use by third parties is considered necessary. Clause 14 already seems to imply that information disclosure to insurers and others may be necessary—regulations might make it so—and the industry lobby wants to make it so in the Bill. Either route to mandating puts it outside the commercial harm provision in subsection (7). That needs more examination, and I suggest something along the lines of fair and reasonable compensation for the commercial use of information.

Finally, I have some interest in proof of safety and proof of concept, as it takes a vast amount of data to prove statistically that something is safer than something that exists already. Road fatality in the UK is 5 per billion miles driven. If you were to compare that with, say, a statistically significant number, you might have to look at the number of driven miles per 50 deaths. However, that would be 10 billion miles driven, which could be 100,000 AVs driving 10,000 miles, or 10,000 AVs driving 100,000 miles. That is an awful lot of miles, and we only have about 100 to 500 vehicles that could do that, so that converts to 20 to 100 years, depending on which end we are at.

I am interested to know how we are going to get this kind of mileage done. Will it be all in the UK? Will we accept evidence from other countries? Will it be for each AV, because why should you have your statistics marred by a bad apple? If we are going to accept evidence from other countries, can we be sure that it will be from similar driving conditions? A lot more could be discussed around that, but it is a very big statistical job to prove that something is safer than something else.

I recognise that the Bill is the start of constructing a framework and not the end, so I look forward to exploring its effects and some of the things that I have raised further at Committee stage.