Pensions Dashboards Regulations 2022

Baroness Sherlock Excerpts

Tuesday 15th November 2022 Lords Chamber

As I began, I thank the Minister for her explanatory remarks at the beginning of our debate.

[Baroness Sherlock (Lab)]

My Lords, I thank the Minister for her comprehensive introduction to these regulations, and all noble Lords who have spoken. Most of us were involved in the passage of the Pension Schemes Bill, so it is nice to have the band back together again even if—it has to be said—we are a bit of a band of anoraks. I am also grateful to the Minister for the briefing that she arranged for us, and for her willingness to engage. It was helpful to be able to hear from Ministers—and, indeed, officials—about the work that has been done on the scheme, and really good to hear about the progress that has been made. We have supported the idea of a public dashboard and it is great to see that coming to life.

That said, I have a lot of questions to ask. I apologise to the House in advance, but this is the only chance that we will have to ask questions on a very complex, billion-pound project. Once we come out of here today, there is no automatic place where we will get to do it again, as the noble Lord, Lord Vaux, pointed out. So I hope that the Minister, and the House, will bear with me. I have tried to give notice of my questions to the Minister as many are quite technical.

First, we need clarity on timing, as mentioned by the noble Lord, Lord Vaux, but also on what schemes will be covered. Schemes with under 100 active or deferred members are outside the scope of these regulations. Can the Minister tell the House how many pension pots fall into that category, and can we expect all other pension pots to be included in due course? Schedule 2 shows when the different schemes will be brought on to the system. Can the Minister tell the House when data from personal and stakeholder pension schemes will be available to the public through the dashboard, and what is the position with group personal pension plans?

At the dashboards available point, or DAP, when the public can access dashboards, we expect to see some 99% of pension pots covered by the dashboards. Is that correct? How many pots does that leave out, and how many people will be in that position? Since some pots will not be displayed, how will I know as a consumer that I am not seeing all of my pensions? How will that be flagged up to me so that I can make an appropriate judgment?

My noble friend Lord Davies had some important questions about how the value of different pots will be displayed. I will be interested to hear the response to those. I also want to talk about handling data, on which the noble Lord, Lord Vaux, raised some important questions. But first, how confident is the Minister about the data quality? Has the work done so far thrown up any concerns?

My noble friends Lord Davies and Lady Drake raised some important questions about identity verification. It will be interesting to hear the answers to those but, once you have the identity, the next step is matching the consumer to the pension pot. That, essentially, is the central activity on which the whole system hangs, yet the Government have decided not to set a common data standard which has to be met to trigger the release of pensions data. Instead, firms are to be told to set their own data standards to trigger release; so, once a find request is received, a scheme will have to complete matching to identify whether they hold information on an individual’s pension matching that in the request. But rather than requiring trustees to use particular data criteria for determining matching, DWP expects schemes to take “reasonable, diligent steps” and to minimise the risk of data breaches or not returning any matches.

Regulation 28 requires information on the matching process used by schemes to be given to MaPS, TPR and the FCA. The idea is that the relevant regulator can, if they so decide, require a scheme to change its matching data requirements if it does not think them appropriate. There will be guidance from the Secretary of State, and the FCA will be seeking consistency of approach to identity matching for release of view data by its regulated providers, while the ICO will be issuing its own statement on matching data breaches. The DWP consultation points out that the whole thing rests on consent:

“The nature of an individual’s consent must be clear, explicit, understood, and informed. It cannot merely be … a tick box condition of usage”


That will be articulated more closely by the pensions dashboard programme in another publication. Given all that, why did the DWP not set particular minimum data standards for schemes for matching and releasing data to a view request, especially given the number of schemes involved? Can the Minister explain for the record what would happen if data submitted by a consumer are a partial match for data held by a firm? That is something I have had offline.

Can the Minister also tell me whether a member’s view data can be screen-scraped and stored by a third party? I am very exercised by this. I think the regulations say that a firm cannot store the data except during a session, but let us think through what this means in practice. Suppose a consumer is viewing her data on a firm’s dashboard, with an adviser from that firm sitting next to her. Can the firm screen-scrape the data from its own dashboard, retain it and immediately conduct a transaction off-dashboard, which might be a matter of pressing a button and jumping from one screen to another? If the answer is, “Only if the consumer consents”, how will the Government ensure that consent is meaningful, given the quotation I gave earlier from the DWP?

Sometimes the answer to this tends to be, “Don’t worry, because the FCA will have regulatory oversight of the firms and, where appropriate, the advisers”. This is where my noble friend Lord Jones comes in, because that was of course the case when British Steel’s pension scheme got into trouble and had to be restructured. Has the Minister read the report published in July by the Public Accounts Committee? It found that the FCA failed to protect British Steel pension scheme members from “unscrupulous financial advisers” who were incentivised by existing fee structures and regulation “to provide unsuitable advice” that led to around 7,800 steelworkers losing an average of £82,600 in life savings—I stress, an average of that—with some losing up to £489,000. The committee said:

“The FCA has consistently been behind the curve in responding to unsuitable pension transfer advice.”


The Minister cannot simply say that it is a matter for the FCA. If her Government choose to legislate to mandate the creation of commercial dashboards, on which we have expressed concern, and the release of data belonging to millions of consumers knowing that the Public Accounts Committee has said that the FCA is consistently behind the curve on protecting those consumers from unsuitable advice, then it is the Government who will bear responsibility for the consequences if people suffer losses. What assurance can the Minister give the House that the PAC will not be publishing another report in three or five years’ time on the fallout from commercial dashboards?

That takes us to the liability question. I am still not entirely clear about end-to-end liability in the system. Where does liability lie if a consumer makes a decision on the basis of view data which later prove inaccurate? If liability is with a trust-based scheme, ultimately that means the trustees. Is the Minister concerned that if some significant liability were established, many trustees simply would not have the personal wealth needed to fund any redress, and where would that leave consumers? Does this pose a risk that anyone other than corporate trustees will be deterred from serving as a trustee on a pensions board?

Next, where can consumers go to make a complaint? I understand that there is to be a single front door, but where does it lead and what is behind it? Which bodies will handle requests for redress from consumers who lose money as a result of making decisions which turned out to be based on wrong data? Can they go to the Pensions Ombudsman, the Financial Ombudsman Service or somewhere else?

Hackers and scammers were raised by my noble friend Lord Davies. I assume the plan is to warn consumers to be aware of scammers, but is there a strategy in place to counter the risks of scams within the system, as opposed to at the individual consumer’s end? Has it been designed to make it hard for scammers to operate and is there a plan to counter the risk of hacking or are we, as my noble friend said, going to see pensions view data being traded on the dark web, as we do credit card details? Are there back-up systems? If somebody were to lose a payslip, so that somebody picking it up simply had a name, address and national insurance number, could that be enough to hack their pensions data?

We have highlighted a range of concerns and some potentially serious risks of the project, but clearly there will be benefits too. I take the point made by the noble Baroness, Lady Bowles, about the importance of who benefits, not just that there should be benefits; we need the consumers too. Like the noble Lord, Lord Vaux, I read the impact assessment and I had a lot of fun with it. I know that it is a very anoraky thing to say but, my goodness, what a great document. Basically, it sets out low, central and high estimates for costs and benefits. In present value, the central estimate says that the project will cost £1.089 billion over 10 years. That is broken down as, roughly speaking, £850 million in industry costs and £240 million in public administration costs, or £1 billion over 10 years in today’s money.

As the noble Lord, Lord Vaux, said, the central estimate of the benefits comes in incredibly conveniently at just £29.5 million over. Of course, that is plus or minus £1 billion because the high and low estimates are literally £1 billion over or under. It is not a very meaningful aggregate figure anyway because it costs industry and government £1 billion and saves consumers a very notional £1 billion. But when we look at the benefits to consumers, that £1 billion of benefit in the central estimate is split almost equally between £541 million for the value of lost pots and £578 million for something called the consumer surplus. Digging further, it turns out that consumer surplus is the notional value deriving from consumers getting for free a service for which they would have been willing to pay. How do we know they would have been willing to pay? Researchers were sent out to ask them what they would pay for this service, then came up with this number. All I will say is “Hmm”, although we learned the interesting fact along the way that the number of users is expected to rise from 3 million in 2024-25 to 18.5 million in 2031-32.

We cannot incur all this risk and spend north of £1 billion for those two bits of value, particularly the consumer surplus. There must be other benefits. The Explanatory Memorandum has a really good section headed “What is being done and why?” at paragraph 7.4. It says that pensions dashboards

“will engender a greater sense of ownership of pensions, reconnect individuals with any lost pension pots, support the advice and guidance process, and enable more informed choices to be made when individuals access their pensions savings”.

The key question is: will people end up with higher pensions? The answer is “We don't know”, because the impact assessment says on page 23 that

“there is no robust evidence to attach causality and monetise the benefits in terms of increased retirement income that result from the dashboards”.

Could they end up with lower pensions? That might sound daft, but if someone sees their pension assets and decides to use them by taking some cash out—using the pension freedoms the Government gave them—to deal with their current living costs, they would end up with less to live on. Out of curiosity, is there any evidence that the process could lead to reduced retirement income? The IA did not address that.

--- Later in debate ---

[Baroness Stedman-Scott (Con)]

I note the noble Baroness’s point. This is something that we will take back with officials and to the relevant authorities, and it is something else that I shall write about and I hope give her a better answer than she has had to date.

The noble Baroness, Lady Bowles, raised the issue of risk of exploitation of data. Pensions dashboards and the technology behind them are designed to maximise data security. For example, pensions information is sent directly and securely from the scheme to the individual; it is not stored by qualifying pensions dashboard services or by the digital architecture. Individuals will always have control over who has access to their data, and will be able to revoke access at any time.

The noble Lord, Lord Jones, and the noble Baroness, Lady Sherlock, have raised to me individually the issue of British Steel pension schemes. The FCA is responsible for the regulation of the financial advice market and has looked closely at the advice provided to those BSPS members who decided to transfer out of the defined benefit scheme. It found that a very high proportion had received unsuitable advice, as has been said. The FCA has announced that it intends to take forward a scheme to provide compensation for BSPS members who received poor advice; it published a consultation on this scheme on 31 March, which has now closed. I think that the point that the noble Lord and the noble Baroness were making was that it must not happen again, and I am sure that message is understood.

The noble Baroness, Lady Sherlock, asked me to confirm when the data from personal and stakeholder pension schemes will be available to the public through the dashboard. She also asked what the position was with group personal pension plans. As set out in FCA rules, the majority of personal and stakeholder pension schemes are required to stage as part of the first cohort by the end of August 2023. That includes group personal pension plans. Until dashboards are launched to the public, schemes’ data must be available to invited users for testing purposes.

The noble Baroness raised a point about missing pots. Only a very small proportion of occupational pension scheme memberships are out of scope of the obligations to connect in our regulation and FCA rules. We expect that, at the point when dashboards are launched to the public, most individuals can be confident that all their pensions will be available to find via dashboards. When the value data for found pensions has not yet been provided—for example, if the member is new to the scheme, or when the value is still being calculated by the scheme—information to that effect will be displayed on the dashboard.

The noble Baroness asked how confident Ministers were about the quality of the data and whether the work has so far thrown up any concerns. It is critical that savers can trust the information in front of them; trustees and managers have existing legal obligations in respect of data quality, including the accuracy principle under UK GDPR, which requires that organisations ensure that data remains accurate and up to date. The Pensions Regulator set out its expectations on data quality in its record-keeping guidance; this includes that data is measured at least once a year.

The noble Baroness asked why the DWP had not set particular minimum data standards for schemes for matching and releasing data. The regulations allow for the trustees and managers of schemes to set their own matching criteria. We believe that schemes should be given discretion over which data elements they use to suitably search their records for a match. It is important that any scheme’s matching policy is appropriate to the level of confidence that they have in their own data; a uniform approach across all schemes would be likely to result in suboptimal matching.

Just to divert the House for a moment, I am conscious of how long I have been speaking, and I am keeping others from their business, but I am absolutely committed to answering these questions. With the leave of the House, I hope that I can carry on.

The noble Baroness, Lady Sherlock, asked whether I could explain for the record what would happen if the data submitted by a consumer was a partial match with data held by a firm. Schemes have the option of returning a possible match if they believe that they hold a record for an individual but are not certain. When a scheme returns a possible match, an individual will receive a limited form of administrative data that will enable them to contact the scheme to see if the possible match is in fact a match made.

The noble Baroness asked about screen-scraping. The regulations prohibit the storing of dashboards of view data, unless for temporary caching and for the sole purpose of displaying the view data in a single session. Similarly, transactions are not possible through the dashboard ecosystem. Making it possible for consumers to find information about all their pensions in a single place and requiring the consumer to undertake an identity verification check before being able to access that information significantly reduces the consumer appeal or perceived benefit of agreeing to screen-scraping. I have much more that I could say on that issue, so I shall write and place a copy of the letter in the Library of the House.

The noble Baroness, Lady Sherlock, and the noble Lord, Lord Davies, raised the point about complaints and where the liability lies if a customer makes a decision on the basis of view data that later proves to be inaccurate. As set out in our response to the consultation on the draft regulations, trustees or managers are responsible for meeting the requirements, which include receiving fine data, as well as undertaking, matching and returning the correct view data. Trustees or managers are not responsible for verifying the identity of users, and the authorisation of view requests or any processing of view data carried out by dashboards. The question of liability in the event that something goes wrong to the detriment of the individual would have to be considered on a case-by-case basis.

The noble Baroness, Lady Sherlock, raised the issue of liability and risk for trustees. The Government acknowledge that many trustees do an excellent job, often on a voluntary basis. The vast majority of trustees are in schemes with fewer than 99 members, so will be outside the scope of these regulations, unless they connected to pensions dashboards voluntarily. Although we accept that the regulatory requirements on trustees have grown a great deal over the years, this is only right, given what is at stake—we are talking about pension savings for millions of people.

The noble Baroness, Lady Sherlock, raised the issue of handling complaints and where consumers go to make a complaint. The dashboard ecosystem is made up of multiple different parts and, as such, dashboard users would potentially have complaints against a number of different parties. MaPS will therefore provide a central queries and complaints navigation tool, which qualifying pension dashboard services must direct individuals to, to help them understand their issues and know to whom they should direct their query or complaint if things go wrong, and the available routes to redress.

The noble Baroness, Lady Sherlock, raised the issue of scams and hackers and asked whether there is a strategy in place to counter the risk of scams within the system and whether this is being revisited regularly. It is crucial that dashboards give power to consumers and not scammers, which is why the dashboard ecosystem has been designed to ensure that only relevant pension schemes and authorised qualifying pension dashboard services have access. To maximise the effectiveness of the Money and Pensions Service pensions dashboard, users will have access to a retirement planning hub, which will provide onward planning journeys in a single place, supporting good decision-making. The FCA and MaPS will keep their rules and standards under review as dashboards emerge and evolve.

[Baroness Sherlock (Lab)]

If I can put the Minister out of her misery, I would be content from this point onward if she were to write to me with answers to the remaining questions. I just say for the record that I flagged up to the usual channels some time ago that this instrument would take rather longer than the normal time, and it would have been helpful if the planning for this evening had taken that into account. However, I am very grateful to her for having answered so fully and to have taken the time to do this—I really appreciate it.