Automated Vehicles Bill [HL]

Baroness Brinton Excerpts

Committee stage
Wednesday 10th January 2024 Lords Chamber

[Lord Liddle (Lab)]

My Lords, the amendments I am speaking to are basically about the process of external scrutiny and oversight of what the department is doing. In the previous discussion, we had a perfect illustration of why this is necessary, because the Minister said, “No—you can’t put the critical issue of safety in the legislation. It’s got to be left to the department”. That is what he was saying. Is that what we want in the public interest? Does it satisfy the concerns that people have?

I speak as a supporter of automated vehicles, but I believe that if we do not exercise the highest standards of safety in their introduction, we will get a public backlash which will put all this back for years. I say to the Minister: if he is so adamant that he is not prepared to accept my noble friend Lord Tunnicliffe’s amendment on safety standards, how is it also logical for him to reject all the amendments in this group, which are designed to improve stakeholder involvement and ensure that there is the widest possible consensus about what changes are to be proposed?

All the amendments in this group that are in my name are basically on this theme. Again, it is not the detail of the wording that matters at this stage—I am sure there are errors and faults in that—but the principle. Are the Government prepared to accept the principle that there should be widespread stakeholder involvement in this evolving issue of what regulation is necessary? As we know, there will not be a sudden change to automated vehicles. It is going to be a long process of evolution and change, as I think one of the noble Baronesses here said. We are going to have hybridity for a long time, so we have to face these questions of how we adjust our regulation in the light of experience.

The first amendment I put down was on the business of the statement of safety principles. The Government, unless they accept my amendment, are not even prepared to recognise the point in their legislation that there should be representative consultation on what the safety standards should be before they table them. That seems to be fundamental, so I am moving that as Amendment 11 and then speaking to the others.

On Amendment 33, we have the case that there will be reports, but there is absolutely no provision that they will be laid before, and provide an opportunity for discussion in, Parliament. Is that not pretty fundamental?

Amendment 49—let me find this part of the Bill; I do not want to mislead the Committee—would come after Clause 93. Its principal proposal is for the establishment of an advisory council, which would bring together stakeholders and people who are relevant to this debate. At one end, it would include trade unions, because if you are talking about automated delivery vehicles and automated bus services—that may be one of the first areas where automated vehicles will be used fully—then you have to carry the representatives of working people with you. It is only right that trade unions and employers should be involved.

When we are talking about an advisory council, these things cannot just be driven by the industry and the producer interest. We have to look at the views of people such as cyclists. Cyclists are probably more at risk in a hybrid situation, alongside pedestrians, than any other group. The cycling association has thought about this quite hard and has quite sensible views, so I would like to think that the department was institutionally obliged to consult it and take its views into account.

That is the very valid point of this group of amendments. I would like to hear from the Minister why he cannot accept them, because it seems self-evident that if we are not prepared to put things in law which require high safety standards, then we will have to find some other mechanism by which the public can be reassured.

[Baroness Brinton (LD)]

My Lords, I want to make a brief intervention on this group of amendments. I thank the noble Lord, Lord Liddle, for raising the important issue of an advisory council. The disabled community talks about the importance of co-production right from the start to make sure that there is not consultation at the end when it is really too late to do things. I hope that the Minister will take that on board. The Government have finally begun to understand the importance of co-production with disabled people. You can never have just one representative and it is important to understand all the issues. But as the noble Lord, Lord Liddle, said, that also applies to other users, so an advisory council is going to have to cover a fairly broad range of interests. As the Minister reminds us continually during the course of the Bill, we are in new territory and design is inevitably going to have to change, so I hope that he will support these amendments.

[Lord Berkeley (Lab)]

My Lords, I will intervene very briefly and apologise for being late. I support my noble friend Lord Liddle in his comments on Amendment 49 and the need for an advisory council. We have come across this before in many other Bills and Ministers always seem to say, “We don’t want to list those people who might be on it, because they might change”. I just draw the Committee’s attention to the news, which I think came yesterday or today, about the new board for Channel 4. The comment was made that the only person who had any experience in diversity had been rejected. Whether it was because of that or because she was female we do not know, but everybody else—except for one—was a white male. The Government may say these things, but they do not always appear to do it.

--- Later in debate ---

Moved by

[Baroness Brinton]

21: Clause 6, page 4, line 39, at end insert—
“(6) A person may not be an authorised self-driving entity unless they meet the following requirements—(a) they have obtained a certificate of compliance with data protection legislation from the Information Commissioner’s Office for their policy in regard to the handling of personal data,(b) their policy in regard to the handling of personal data clearly outlines who has ownership of any personal data collected, including after the ownership of a vehicle has ended, and(c) they are a signatory to an industry code of conduct under the UK General Data Protection Regulation.”Member's explanatory statement
This amendment seeks to probe a number of concerns around data protection and ownership and seeks to prevent authorisation of companies as self-driving entities unless robust personal data practices are in place.

[Baroness Brinton (LD)]

My Lords, we move to a group that looks at data protection issues, which were covered at Second Reading. In this group, I have Amendment 21, the Clause 42 stand part notice and Amendments 35 and 36. I have found the Information Commissioner’s Office response to the joint consultation from the Law Commission and the Scottish Law Commission on automated vehicles, dated March 2021, extremely helpful. That response set out the legislative landscape and said, in paragraph 6:

“The consultation refers to Directive 2002/58/EC, known as the ePrivacy directive (‘ePD’), however, reference should be given instead to PECR, which is the UK law that gives effect to the ePD … Section 17.54 notes that the legislator ‘clearly did not have AVs … in mind’ when the Directive was enacted, and that ‘At the time, the typical terminal equipment was a telephone handset’ … Therefore, care must be taken when interpreting the legislation, so that its underlying rationale, and technology neutral approach is fully understood and any proposals accord with its objectives. The ICO has produced guidance”


on this. It is saying that GDPR rules are clearly not enough on their own.

I was grateful at Second Reading for the Minister’s clear response on the protection of personal data— I may disagree with what he said but I was grateful for the clarity of the response. He said:

“However, data must remain properly protected. Self-driving vehicles will be subject to existing data protection laws in the UK. Our proposed Bill does not alter that, so manufacturers and government will have to ensure that data is protected”.—[Official Report, 28/11/23; col. 1072.]


I remain concerned that the Bill, especially Clause 42, sets out a very high level, a top level, of legislation—whether primary or secondary, of which we know nothing yet—by which information will be protected, but it does not put in place the mechanisms by which individual people could rest assured that their personal data was being appropriately protected. The ICO further commented on personal data in its response to the Law Commission, at paragraph 12:

“Automated vehicles pose particular challenges in relation to personal data, as often they will process the personal data of several individuals: owners, drivers, passengers and even pedestrians. If the personal data of these users is processed inappropriately, there is a heightened risk of intrusion into individuals’ work and private lives. The Government and technology providers should therefore adopt a data protection by design and default approach, ensuring that privacy protections are built into the design and development of automated vehicles”.


To return to the Bill, Clause 42(4) sets out the offence of breaching data protection, but then Clause 42(5) gives a very wide range of defences, which is, frankly, quite worrying. It says:

“But it is a defence to prove that—(a) the person from whom the information was obtained as described in subsection (1) consented to the disclosure or use, or (b) the recipient reasonably believed that the disclosure or use was lawful”.


I have been trying to think through what this might mean in practice. Let us say that you call an AV—it could be yours; it could be a neighbourhood vehicle; it could be a taxi; it could even be getting on a bus—and when you call it, it will ask you, probably in your app, to confirm the terms and conditions. We all do this every day when we go online; we just tick “Yes”, but do we know what the operating licence holder might be doing with our personal data? Worse, the licence holder or a future recipient of that data, somebody else in the chain of information, might think that disclosure was lawful. Amendment 21 sets out the baseline good practice for any organisation that is dealing with personal data, especially data that the individual is not necessarily aware of.

I want to give the Committee an example I experienced when a number of people and organisations were involved in handling personal data. My dentist—please do not laugh; it is relevant—requires patients to sign online, before they are seen every time, that they are content with their personal, medical and other personal data being held, so that the surgery can better look after patients, with an assurance that it will be held appropriately. That is fine. A couple of years ago, the regular online form changed, and after page one I was asked to sign a different set of Ts and Cs from a specialist data processing company. I clicked through, read the 17-odd pages and discovered that in the small print this multibillion-dollar company wanted my permission to be able to pass my data, medical and personal, on to other interested parties in its group and for other associated services. This included insurance companies, providers of healthcare and pharmaceuticals. I was not happy.

When I raised it with the dental surgery, it was really shocked. It had not clocked the detail because it had not clicked through two or three times, as I had to do, and it dealt with it straightaway, but I am making a point: we are not expecting a single authorised organisation to process all the data. There will be many different tracks coming down the line, and the problem here was that this was an American company using American law, not GDPR. The defence in Clause 42(5) would have succeeded, because one would have automatically ticked on the Ts and Cs thing on the app. That is one of the reasons that, at Second Reading, I probed on protection for data. I hope that my amendments will strengthen what the Government are planning to do.

Amendment 21 sets out the criteria that would have to be met before a person or a body would be permitted to be authorised as a self-driving entity. First, they must

“have obtained a certificate of compliance with data protection legislation”

from the ICO for their policy of handling of personal data. Secondly, their policy relating to handling personal data of clients, passengers et cetera must clearly outline

“who has ownership of any personal data collected, including after the ownership of a vehicle has ended”.

Thirdly, they must be

“a signatory to an industry code of conduct under the UK General Data Protection Regulation”.

Because I remain concerned about Clause 42, I have laid that it should not stand part, partly as a probing issue to get the issues out and bring a response from the Minister. I hope the Minister can provide the Committee with stronger reassurance than that given at Second Reading, given the 10 pages of response from the ICO to the Law Commission consultation.

I have two further amendments in this group. In every debate so far—and in meetings with the Minister—the Government have made it plain that the Bill is charting new territories and new technologies that not one other country has yet managed to do. Much of the focus on the Bill is understandably on vehicles, but the other element of newer and untested technology is how data will be used. We know just from the advances in AI over the last few months, let alone year, how fast it changes. Amendment 35 sets out for an annual report to Parliament on the use of personal data in relation to automated vehicles. This way, when the sector responds it can see how many breaches there are and how new technology as yet unseen and unknown—not even thought of—will affect individuals. Equally importantly, we will be able to see trends in data collection so that Governments and Parliament can consider whether further legislation is needed to further regulate the collection of data. Amendment 36 sets out the requirement for the Secretary of State to consult with the ICO in relation to the collection of personal data prior to the Secretary of State making any regulations in relation to personal data collection.

I know that the noble Lord, Lord Liddle, made the point about the Secretary of State making these decisions, and I just want to add at this point that this Government have had a habit of pushing an enormous amount of information into secondary legislation. I think we all understand that some of it needs to be there but, particularly with new technologies and new areas, Parliament is very concerned about giving permission for things that are not yet even understood, let alone explicit.

I also want to add that I support the other amendments in this group from my noble friend Lady Bowles and from the noble Lord, Lord Holmes of Richmond, all of which strengthen the protections needed for a technology that will have even more access to people’s personal data than we know now, whether it is commercial or third-party data. All the amendments in this group are following the ICO’s principal concern.

I say again that AVs pose a risk to individual rights if they have insufficient control over their data and their data protection rights. The ICO says that data systems for AVs should have a data protection system by a design and default approach. After all, it is a new technology.

I really look forward to hearing the Minister’s response. I beg to move.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I have four amendments in this group. I am looking more at the commercial interest side of things, partly because “information” is a very broad word that can mean all kinds of things. My Amendment 29 adds to the end of Clause 14 that information sharing

“must respect rights of ownership and privacy, including with a view to compensation in respect of any commercial rights”.

I will talk more on compensation in connection with later amendments as well, but there is a significant issue here.

Under Clause 14, authorisation requirements may state that there has to be information sharing with the Secretary of State, public authorities and private businesses. Clause 14(4) says that the purpose of the shared information must be disclosed, which is fair enough as far as it goes, but says nothing about privacy or commercial rights. Further, the information may not belong to the body being authorised. It may belong to individuals. Even in an anonymised state, it may belong to others than the authorised entity. I accept that there may be instances where sharing is needed—accidents and failures come immediately to mind—but there will still need to be ways to make sure that neither individual nor commercial rights are undermined.

--- Later in debate ---

[Lord Davies of Gower (Con)]

I omitted to say that I will copy in all those noble Lords.

[Baroness Brinton (LD)]

My Lords, I thank all the contributors to this debate. We are delighted that others have been so supportive of our amendments, which cover a considerable range of data protection issues. I am grateful to the Minister for his response and thank him, because, yes, I think a meeting is particularly important. He said in response to my noble friend Lady Bowles’s first amendment that the Government are not yet sure how data will be used or shared. That is the reason that the ICO is so clear that there needs to be extra provision, because otherwise, if everyone just assumes that it will be the way we have always used GDPR, we—being the Government and the public—are going to come a cropper pretty quickly, not least because technology has changed, is changing and will change again so fast. I hope that, as we have our meeting and progress towards Report, the Government will seriously consider following the ICO’s advice and make very clear, designed-by-default arrangements for this sector, which will be like none that we have seen so far. With that, I withdraw my amendment.

Amendment 21 withdrawn.