Crime and Policing Bill

Debate between Baroness Morgan of Cotes and Lord Clement-Jones

Committee stage
Wednesday 7th January 2026 Lords Chamber

[Baroness Morgan of Cotes (Non-Afl)]

My Lords, I will briefly speak to Amendment 358. It is a pleasure to follow the noble Lords, Lord Vaux and Lord Young of Cookham. Because we are going to be discussing this and a later amendment on fraud, I declare my interest as a director of Santander UK.

It was a huge pleasure and privilege to chair the Lords inquiry into online and digital fraud, which reported in 2022, and I would like to think that we had some impact in raising the issues, which are of huge importance to the public. Fraud is one of the crimes that people are most likely to be victims of. I know the Minister knows that because he is the Anti-Fraud Minister in the department.

Noble Lords have already spoken about the importance of this amendment, the need for the law to be kept up to date as the technology develops, and the fact that allowing as much flexibility in legislation as possible to enable that to happen is important. The reason we talked about the “fraud chain” in the report is that, obviously, people encounter fraud in myriad ways. Fraudsters are, as we have heard, incredibly flexible, and entrepreneurial—for all the wrong reasons. Of course, telecoms—people’s smartphones or phones—is where many people will first encounter the fraudster, who will then try, as we heard in our evidence, to get them away from technology and strike up some kind of relationship which unfortunately ends in people often losing life-changing amounts of money.

I do not want to pre-empt the debate on Amendment 367, which I hope we will also reach today, but the question, perhaps now or for later, is whether the Minister is confident that the previous Government’s and this current Government’s ask of the telecoms industry is strong enough given the frequency with which the public encounter fraud via their telephones. I will ask the question now, but I am sure we will come back to it. We are all waiting for the forthcoming fraud strategy from the Government, which we understand is—I hope—close. Can the Minister give us a little precursor of whether that will impose tougher asks and potential penalties on the telecoms companies for the reasons that we have already heard?

[Lord Clement-Jones (LD)]

My Lords, we strongly support Amendment 358 in the names of the noble Lords, Lord Vaux, Lord Young of Cookham and Lord Holmes of Richmond, and the noble Baroness, Lady Morgan of Cotes, who have made the case extremely well today. I pay tribute to the Fraud Act committee chaired by the noble Baroness, Lady Morgan, and I shall quote from it extensively in the next group.

This amendment would rightly ensure that the definition of a specified article included devices capable of using virtual subscriber identity modules, not just physical SIM cards. As we have heard, the criminal landscape evolves rapidly. If we legislate only for plastic SIMs, criminals will simply pivot to readily available virtual SIM technology. By incorporating virtual SIMs into the definition now, we will help to future-proof these provisions and make them genuinely effective against highly scalable, technology-enabled fraud.

Clauses 112 to 117 quite rightly seek to address the serious and growing problem of SIM farms being used at scale to perpetrate fraud and other abuses—it was very interesting to hear the quotes of the noble Lord, Lord Young, from the Select Committee’s report, which demonstrates that the problem has been with us for several years now—but, as drafted, Clause 114 risks being a technological step behind the criminals. As we have heard, it refers to devices capable of using physical SIM cards, but the market is already rapidly moving towards virtual or embedded SIMs. Indeed, I have an iPad in my hand that has a virtual SIM inside it—no physical SIM card at all. If the Bill focuses only on the plastic card and not the underlying functionality, it will leave an obvious loophole that organised criminals will quickly exploit.

The noble Baroness, Lady Morgan, spoke of “entrepreneurial” but not in a good way. We know that fraudsters are highly adaptive. As mobile operators deploy more robust controls on physical SIMs—I suspect not enough for the noble Lord, Lord Vaux—and as handsets and routers increasingly use eSIMs or other virtual identities, those intent on running industrial-scale smishing and scam operations will migrate to those platforms. If we legislate today for yesterday’s technology, we will simply displace the problem from one category of device to another and be back here in a few years’ time having the same debate. I hope the Minister will be able either to accept the amendment or to confirm that the Government will bring forward their own wording—there is always a bit of “not invented here” with these things. Without that assurance, there is a real risk that this part of the Bill will be lacking in force from the day it comes into effect.

Data (Use and Access) Bill [HL]

Debate between Baroness Morgan of Cotes and Lord Clement-Jones

Committee stage
Monday 16th December 2024 Grand Committee

[Lord Clement-Jones (LD)]

My Lords, a key aspect of data protection rests in how it restricts the use of personal data once it has been collected. The public need confidence that their data will be used for the reasons they had shared it and not further used in ways that breach their legitimate expectations—or they will become suspicious as regards providing their data. The underlying theme that we heard on the previous group was the danger of losing public trust, which very much applies in the area of law enforcement and national security.

However, Schedules 4 and 5 would remove the requirement to consider the legitimate expectations of the individuals whose data is being processed, or the impact that this would have on their rights, for the purposes of national security, crime detection and prevention, safeguarding or answering to a request by a public authority. Data used for the purposes listed in these schedules would not need to undergo either a balancing test under Article 6.1(f) or a compatibility test under Article 6.4 of the UK GDPR. The combined effect of these provisions would be to authorise almost unconditional data sharing for law enforcement and other public security purposes while, at the same time, reducing accountability and traceability over how the police use the information being shared with them.

As with the previous DPDI Bill, Clauses 87 to 89 of this Bill grant the Home Secretary and police powers to view and use people’s personal data through the use of national security certificates and designation notices, which are substantially the same as Clauses 28 to 30 of the previous DPDI Bill. This risks further eroding trust in law enforcement authorities. Accountability for access to data for law enforcement purposes should not be lowered, and data sharing should be underpinned by a robust test to ensure that individuals’ rights and expectations are not disproportionately impacted. It is a bafflement as to why the Government are so slavishly following their predecessor and believe that these new and unaccountable powers are necessary.

By opposing that Clause 81 stand part, I seek to retain the requirement for police forces to record the reason they are accessing data from a police database. The public need more, not less, transparency and accountability over how, why and when police staff and officers access and use records about them. Just recently, the Met Police admitted that they investigated more than 100 staff over the inappropriate accessing of information in relation to Sarah Everard. This shows that the police can and do act to access information inappropriately, and there may well be less prominent cases where police abuse their power by accessing information without worry for the consequences.

Regarding Amendments 126, 128 and 129, Rights and Security International has repeatedly argued that the Bill would violate the UK’s obligations under the European Convention on Human Rights. On Amendment 126, the requirements in the EU law enforcement directive for logging are, principally, to capture in all cases the justification for personal data being examined, copied, amended or disclosed when it is processed for a law enforcement process—the objective is clearly to ensure that data is processed only for a legitimate purpose—and, secondarily, to identify when, how and by whom the data has been accessed or disclosed. This ensures that individual accountability is captured and recorded.

Law enforcement systems in use in the UK typically capture some of the latter information in logs, but very rarely do they capture the former. Nor, I am informed, do many commodity IT solutions on the market capture why data was accessed or amended by default. For this reason, a long period of time was allowed under the law enforcement directive to modify legacy systems installed before May 2016, which, in the UK, included services such as the police national computer and the police national database, along with many others at a force level. This transitional relief extended to 6 May 2023, but UK law enforcement did not, in general, make the required changes. Nor, it seems, did it ensure that all IT systems procured after 6 May 2016 included a strict requirement for LED-aligned logging. By adopting and using commodity and hyperscaler cloud services, it has exacerbated this problem.

In early April 2023, the Data Protection Act 2018 (Transitional Provision) Regulations 2023 were laid before Parliament. These regulations had the effect of unilaterally extending the transitional relief period under the law enforcement directive for the UK from May 2023 to May 2026. The Government now wish to strike the requirement to capture the justification for any access to data completely, on the basis that this would free up to 1.5 million hours a year of valuable police time for our officers so that they can focus on tackling crime on our streets, rather than being bogged down by administration, and that this would save approximately £42.8 million per year in taxpayers’ money.

This is a serious legislative issue on two counts: it removes important evidence that may identify whether a person was acting with malicious intent when accessing data, as well as removing any deterrent effect of them having to do so; and it directly deviates from a core part of the law enforcement directive and will clearly have an impact on UK data adequacy. The application of effective control over access to data is very much a live issue in policing, and changing the logging requirement in this way does nothing to improve police data management. Rather, it excuses and perpetuates bad practice. Nor does it increase public confidence.

Clause 87(7) introduces new Section 78A into the Act. This lays down a number of exemptions and exclusions from Part 3 of that Act when the processing is deemed to be in the interests of national security. These exemptions are wide ranging, and include the ability to suspend or ignore principles 2 through 6 in Part 3, and thus run directly contrary to the provisions and expectations of the EU law enforcement directive. Ignoring those principles in itself also negates many of the controls and clauses in Part 3 in its entirety. As a result, they will almost certainly result in the immediate loss of EU law-enforcement adequacy.

I welcome the ministerial letter from the noble Lord, Lord Hanson of Flint, to the noble Lord, Lord Anderson, of 6 November, but was he really saying that all the national security exemption clause does is bring the 2018 Act into conformity with the GDPR? I very much hope that the Minister will set out for the record whether that is really the case and whether it is really necessary to safeguard national security. Although it is, of course, appropriate and necessary for the UK to protect its national security interests, it is imperative that balance remains to protect the rights of a data subject. These proposals do not, as far as we can see, strike that balance.

Clause 88 introduces the ability of law enforcement, competent authorities and intelligence agencies to act as joint controllers in some circumstances. If Clause 88 and associated clauses go forward to become law, they will almost certainly again result in withdrawal of UK law enforcement adequacy and will quite likely impact on the TCA itself.

Amendment 127 is designed to bring attention to the fact that there are systemic issues with UK law enforcement’s new use of hyperscaler cloud service providers to process personal data. These issues stem from the fact that service providers’ standard contracts and terms of service fail to meet the requirements of Part 3 of the UK’s Data Protection Act 2018 and the EU law enforcement directive. UK law enforcement agencies are subject to stringent data protection laws, including Part 3 of the DPA and the GDPR. These laws dictate how personal data, including that of victims, witnesses, suspects and offenders, can be processed. Part 3 specifically addresses data transfers to third countries, with a presumption against such transfers unless strictly necessary. This contrasts with UK GDPR, which allows routine overseas data transfer with appropriate safeguards.

Cloud service providers routinely process data outside the UK and lack the necessary contractual guarantees and legal undertakings required by Part 3 of the DPA. As a result, their use for law enforcement data processing is, on the face of it, not lawful. This non-compliance creates significant financial exposure for the UK, including potential compensation claims from data subjects for distress or loss. The sheer volume of data processed by law enforcement, particularly body-worn video footage, exacerbates the financial risk. If only a small percentage of cases result in claims, the compensation burden could reach hundreds of millions of pounds annually. The Government’s attempts to change the law highlight the issue and suggest that past processing on cloud service providers has not been in conformity with the UK GDPR and the DPA.

The current effect of Section 73(4)(b) of the Data Protection Act is to restrict transfers for competent authorities who may have a legitimate operating need, and should possess the internal capability to assess that need, from making transfers to recipients who are not relevant authorities or international organisations and that cloud service provider. This amendment is designed to probe what impact removal of this restriction would have and whether it would enable them to do so where such a transfer is justified and necessary. I beg to move.

[Baroness Morgan of Cotes (Non-Afl)]

My Lords, I will speak to Amendment 124. I am sorry that I was not able to speak on this issue at Second Reading. I am grateful to the noble and learned Lord, Lord Thomas of Cwmgiedd, for his support, and I am sorry that he has not been able to stay, due to a prior engagement.

Eagle-eyed Ministers and the Opposition Front Bench will recognise that this was originally tabled as an amendment to the Data Protection and Digital Information (No. 2) Bill. It is still supported by the Police Federation. I am grateful to the former Member of Parliament for Loughborough for originally raising this with me, and I thank the Police Federation for its assistance in briefing us in preparing this draft clause. The Police Federation understands that the Home Secretary is supportive of the objective of this amendment, so I shall listen with great interest to what the Minister has to say.

This is a discrete amendment designed to address an extremely burdensome and potentially unnecessary redaction exercise, in relation to a situation where the police are preparing a case file for submission to the Crown Prosecution Service for a charging decision. Given that this issue was talked about in the prior Bill, I do not intend to go into huge amounts of detail because we rehearsed the arguments there, but I hope very much that with the new Government there might be a willingness to entertain this as a change in the law.