Data Protection Bill [HL]

Baroness Kidron Excerpts

Monday 11th December 2017 Lords Chamber

Moved by

[Baroness Kidron]

7: Clause 8, page 5, line 19, at end insert—
“(2) The Secretary of State must as soon as practicable after the passing of this Act by regulations require the Commissioner to set standards for the age-appropriate design of relevant information society services accessed by children and that such standards are to be set out in a code in accordance with section (Age-appropriate design code).”

[Baroness Kidron (CB)]

Before I turn to the amendments in my name and that of the Minister, the noble Lord, Lord Stevenson, and the noble Baroness, Lady Harding, I would like to recognise the extraordinary role of children’s charities led by the NSPCC; the Duke of Cambridge Task Force; child experts John Carr and Professor Sonia Livingstone; the Children’s Commissioner; and the remarkable support of colleagues on the Communications Committee and from all sides of this House, especially the noble Lords, Lord Storey and Lord Clement-Jones. Without these powerful voices, we would not be introducing a statutory code of age-appropriate design to the Bill.

These amendments are a step towards a better digital future for children. They introduce a code that will set out the standards by which online services protect children’s data. They set standards that are directly related to a child’s age and the vulnerabilities associated with that age. They clarify the expectation on services to design data practices that put the “best interests” of the child above any other consideration, including their own commercial interest. They establish the standards by which the Information Commissioner will judge services on behalf of child users. Crucially, they connect design of services with the development needs of children, recognising that childhood is a graduated journey from dependence to autonomy.

Amendment 109 states that the Information Commissioner must consult widely on an age-appropriate design code, in particular capturing the voice of children, parents, child-development experts, child advocates and trade associations. In doing so, she will have to determine if the use of GPS location services to hold, sell or share a child’s current or predicted location is in a child’s best interest. She will have to consider if privacy settings for children should be automatically set to private. She will have to consider if the service can justify the collection of personal data, such as a child’s school or home address, their birth date, their likes, dislikes, friends or photographs, in order to facilitate a specific activity being undertaken by that child. She will have to deconstruct terms, conditions and privacy notices in order to make them understandable by, and appropriate for, children of different ages. A six year-old needs different protections and information from a 15 year-old. She will have to consider, with the development stages of childhood in mind, whether paid-for activity such as product placement and marketing is transparent to a child user and what reporting and resolution processes should be offered to children.

Responding to the concern raised by my noble friend Lord Erroll, the code will set out the duty of online services to facilitate the child’s right to erasure under the GDPR, with or without the help of an adult. Perhaps most importantly, the commissioner will—for the first time—consider strategies used to encourage extended user engagement; that is, those design features variously called sticky, reward loops, captology and enrapture technologies that have the sole purpose of making a user stay online. These will be looked at from a child development point of view. The opportunity cost, the need for a rich balance of varied online experiences as well as the need to get offline with ease will all be given weight.

Finally, the amendment invokes the UNCRC. The age-appropriate design code must incorporate all the rights of children, and the responsibilities of adults to them, as set out in the charter. The code created by the amendment will apply to all services,

“likely to be accessed by children”,

irrespective of age and of whether consent has been asked for. This particular aspect of the amendment could not have been achieved without the help of the Government. In my view it is to their great credit that they agreed to extend age-appropriate standards to all children.

Amendment 111 states that the code must be laid before Parliament as soon as practicable, but no later than 18 months from the passing of the Bill. Amendments 112 and 113 confirm the negative resolution procedure. Amendment 114 allows the commissioner to update the code. In Committee, my noble friend Lady Howe raised the question of enforcement. Although the code is not mandatory for online services, it is mandatory for the ICO to take it into account when investigating breaches and taking enforcement action.

Amendment 110 puts the age-appropriate design code into Clause 121 and, consequentially, into Clause 123. This means that online services facing a complaint of any kind, which have not complied with the age-appropriate code, risk enormous enforcement consequences, including the spectre of fines of up to €20 million or 4% of annual global turnover. In Committee, doubts were raised that it was technically possible to regulate the digital environment, so I am particularly grateful to the noble Baronesses, Lady Lane-Fox and Lady Shields, to Sky and to TalkTalk, for making it clear that there is no technological impediment to effective design; it is simply a question of corporate and legislative will.

Self-regulation has not provided a high bar of data protection for children. On the contrary, we have seen a greedy disregard of children’s needs from some sections of the tech sector in their eye-watering data collection policies. The introduction of a statutory code makes very clear what is required of them, and although data protection is crucial, it is not the only issue that confronts children in the digital environment. The principle which these amendments establishes—that a child is a child, even online—must now be established in every aspect of a child’s digital life, as a cultural and legal norm.

On this subject, I urge the Government to take one further step in the Bill: the introduction of a super-claimant procedure provided for by article 80(2) of the GDPR, and supported by the ICO. Children need advocates in all areas of life, including the digital. We will, no doubt, return to that in the new year. In the meantime, I thank the Minister, DCMS officials, the Bill team, the Minister for Digital and the Secretary of State. Along with those whom I have already mentioned, they have reason to be proud of introducing age-appropriate design standards to the Bill. Above all, it is a necessity for a 21st century child to access the digital environment knowledgably, creatively and fearlessly.

I support my noble friend Lord Clancarty, who has an amendment in this group. I look forward to hearing from the Minister of the Government’s commitment to the aspects of design that the commissioner will consider; that children’s needs will be at the heart of this code; and a clear indication that enforcement will be a priority for the commissioner and robustly applied. I beg to move.

--- Later in debate ---

In preparation for the GDPR coming into force, the department is actively reviewing its data-sharing processes with third parties to ensure greater security, consistency, accountability and transparency around data sharing. Before May 2018, the department will review its existing arrangements and processes for sharing sensitive personal data to date to ensure they are compliant with the incoming regulations, and review them regularly thereafter. As part of that work and to ensure citizens have even greater oversight of the department’s data, on 14 December the department is publishing an oversight of all DfE external personal-level data sharing to date and will continue to update this publication regularly. In view of this reassurance, I would be grateful if the noble Earl did not press his amendment.

[Baroness Kidron]

My thanks to the noble Lord the Minister. The wonderful thing about having the Minister’s name to your amendments is that he has answered all the difficult questions. I thank everyone who spoke for their very kind words, not on my behalf, but on behalf of all the people who work to protect children, online and offline. I accept noble Lords’ thanks. It is very moving.

I would like to say three things. I was overwhelmed this weekend when the news broke that we had come to terms on the amendment. I received many emails from other parts of the world. To those who said in the debate that this may be a first step not just for us, but for the world—or at least in Europe—all indications are in that direction. I also reassure everyone that this amendment in no way threatened adequacy. Officials and I have been through this issue at great length. We had the kind and generous advice of Jonathan Swift QC, who is a great expert in this matter. We are quite sure of adequacy. On the question of enforcement globally, this is a challenge not for this amendment alone, but one for the Bill as a whole.

In the meantime, I look forward to working with the Government and others to make sure this is a meaningful first step to creating a digital world in which children can thrive. I beg leave to withdraw Amendment 7, and note that the other amendments will be moved as they appear.

Amendment 7 withdrawn.