Data Protection Bill [HL]

Baroness Howe of Idlicote Excerpts

Committee: 1st sitting (Hansard - continued): House of Lords
Monday 30th October 2017 Lords Chamber

Moved by

[Baroness Howe of Idlicote]

16: Clause 8, page 5, line 15, leave out from “as” to “and” and insert “an age between 13 and 16 years, to be decided by the Commissioner based on relevant evidence and consultation,”

[Baroness Howe of Idlicote (CB)]

My Lords, there are a series of amendments to Clause 8 that we are debating today. I hope your Lordships will allow me to give some background to set the context. Clause 8 sets the age at which children can first provide their personal data online in relation to information society services, without the permission of a parent or guardian. Given that the provision of such personal data is in exchange for online products or services, this age of consent is effectively the age at which companies can begin making money from young people online without a parent or guardian’s involvement. Article 8(1) of the GDPR states that the age of so-called digital consent should be 16, but allows member states to lower the age as long as it does not go below 13. The UK Government have set the age at 13, the minimum age possible in Clause 8.

Amendment 16 is a probing amendment to explore the evidence for whether the UK should be opting for 13. As was mentioned at Second Reading, there is concern that the Government have sleepwalked into this position without having provided much in the way of evidence for the decision to this House or the public. Such evidence is needed, not least because a recent YouGov survey for BCS, the Chartered Institute for IT, has suggested that the Government’s thinking is a long way from where public opinion sits. In the survey, the public were asked what the most appropriate age of consent for providing personal data online should be. The findings were rather stark. A mere 2% believed 13 was the most appropriate age. The vast majority, 81%, believed it should be set to either age 16 or 18, with non-parents tending to favour 16 and parents favouring 18. These findings indicate that, even if 13 is the most appropriate age, the Government have some way to go in convincing the public that this is the case.

There is little evidence provided by the Bill’s Explanatory Notes, which simply note that the age of 13,

“is in line with the minimum age set as a matter of contract by some of the most popular information society services which currently offer services to children (e.g. Facebook, Whatsapp, Instagram)”.

Given that these are the very companies that stand to profit the most from children providing their personal data to them, it seems counterintuitive that they have effectively been allowed to set a de facto standard age of consent for them doing so. This was recognised in the Children’s Charities’ Coalition on Internet Safety’s open letter to the Information Commissioner’s Office earlier this year.

--- Later in debate ---

The Government recognise the need for consistency in regulation but we believe that the priority should be to provide consistency for all UK children. For this reason, it is essential that the age in Scotland be set at 12 to, in effect, match that in England and Wales. This prevents Scottish children being at a disadvantage compared to their English and Welsh counterparts—it is as simple as that. I therefore ask the noble Baroness to withdraw her amendment.

[Baroness Howe of Idlicote]

My Lords, I am most grateful to the Minister for his explanation, even though he cannot agree with my amendment. I think quite a number of my colleagues are still not just confused as regards Scotland and England, but concerned about how this is going to be interpreted in real life. We have time to think about it before Report. In the meantime, I am not pleased but I will withdraw my amendment and hope that there may be opportunities between now and Report to get a little more clarity on this subject.

Amendment 16 withdrawn.

Data Protection Bill [HL]

Baroness Howe of Idlicote Excerpts

2nd reading (Hansard): House of Lords
Tuesday 10th October 2017 Lords Chamber

[Baroness Howe of Idlicote (CB)]

My Lords, I have spoken extensively about the imperative to maximise online safety for children and of the need to provide the right tools to empower parents to help keep their children safe online. This will continue to be my priority as we discuss the Data Protection Bill at all its stages. Parents often feel that their children know rather more about accessing the technology than they do, but they still have a role and responsibility to guide their children, and this extends to the topic before us today—the child’s personal data.

During the extensive debates in this House on the Digital Economy Bill, we discussed what young people below the age of 18 should and should not see, and we voted to require a code of practice for the providers of online social media platforms, which is now Section 103 of the Act. In all our discussions about children during those debates, we were referring to individuals under the age of 18, and there was no dispute on the point. I am disappointed that nowhere in the Data Protection Bill’s 208 pages is a child defined as a person under the age of 18.

This Bill puts before us another dividing line between childhood and the influence of parents, the effect of which is nothing if not confusing. Clause 8 states that a child of 13 years can consent to providing data to information services; that is, they can sign up to social media sites and so on. By contrast, the default in the European General Data Protection Regulation is that a child should be 16 years old to be able to give “digital consent”.

The Explanatory Notes state of the age of 13:

“This is in line with the minimum age set as a matter of contract by some of the most popular information society services which currently offer services to children”.


These are contracts driven by decisions under United States federal law in the form of the Children’s Online Privacy Protection Act of 1998. However, the world of technology and what is at our children’s fingertips has changed significantly since 1998. What might have seemed good then does not mean that it is now.

Furthermore, given all the concerns expressed over recent months about the actions of social media sites, the current contracts of these sites should not be driving government policy; rather, the primary factor should be what is best for children and young people, and what is best should be established through a solid evidence base. I hope that the Minister will set out the Government’s evidence-based reasoning for using the age of 13 and tell us what evidence has been collected by the DCMS from children’s charities and those representing parents and others with an interest in these matters.

Choosing the right age for children to consent to signing up to these websites is far from a straightforward issue. I am aware that there is concern among children’s charities that setting the age of digital consent at 16 could lead to an increase in the grooming of young people by abusers, something that none of us in this House would wish to see. The Children’s Society has said that, if Parliament sets the age in Clause 8 at 16, significant changes should be made to the grooming and sexual offences legislation.

I have also received briefing material from BCS, The Chartered Institute for IT, which suggests that there is significant public support for the age being 16 or 18 and very little support for the age being 13. I understand that parents favour firmly the age of 18, so clearly there is a lot of room for discussion, and no doubt we will have it during Committee. In this context, I would like to suggest that the Government should launch an immediate public consultation on this point so that the House can make a fully informed decision before the Bill moves to the other place. Right now, either end of the age spectrum looks like it has dangers.

I also hope that the Minister will set out some clarification of the intentions of the Bill in relation to the consent of children. Paragraph (6) in Clause 8 includes an exemption for “preventive or counselling services”. Does that mean that a child could give their consent to these websites before the age of 13 or not at all? What is defined as a “preventive or counselling service”?

Clause 187 gives further criteria for the consent of children, but only children in Scotland, where a child’s capacity to exercise their consent should be taken into account, with the expectation that a child aged 12 or over is,

“presumed to be of sufficient age and maturity to have such an understanding”.

The Explanatory Notes to the Bill state that this clause must be read with Clause 8, which provides that the age limit is 13. Is Clause 187 intended to say that the age of digital consent cannot go below 13, which is the position of Article 8(1) of the GDPR, or that there might be circumstances when a child who is 13 cannot consent for genuine reasons? Either of these scenarios seems to give rise to confusion for children, parents and the websites that children access.

After all the detailed discussions about age verification that we had earlier in the year, there is an argument for age verification to apply to Clause 8. How will websites that require a child to verify that they are 13 years old ensure that the child is the age that they say they are without some requirement for the site to prove the age of the child? This is surely a meaningless provision. I hope that when the Minister comes to reply, he will set out the Government’s position on this matter and explain what penalties a website which breaches this age requirement will face.

Finally, I hope that the Minister will give us an update on the publication of the Green Paper on internet safety and how the digital charter that was announced in the Queen’s Speech will play into this Bill during its passage through this House and on to the other place.