Facial Recognition and the Biometrics Strategy

Darren Jones Excerpts

Wednesday 1st May 2019 Westminster Hall

[Darren Jones (Bristol North West) (Lab)]

I beg to move,

That this House has considered facial recognition and the biometrics strategy.

It is a pleasure to serve under your chairmanship, Sir Roger. First, I must declare my interests, which are not directly in the subject but in the privacy and data protection space in which I practise as a lawyer, as set out in the Register of Members’ Financial Interests. I chair various technology all-party parliamentary groups and Labour Digital. I am also a member of the Science and Technology Committee, which has an ongoing inquiry into the subject. We have taken evidence from Professor Paul Wiles, the Biometrics Commissioner, and Baroness Williams of Trafford, the Minister in the other place. Some hon. Members have sent their apologies, which I entirely understand, because we are competing with the climate change debate in the main Chamber.

Why did the subject first come to my attention? As a consumer, I have become increasingly used to using facial recognition technology, whether I have proactively agreed to it or not. I often forget my passwords these days, because I use my face to pay for things and open my iPad and phone, although as I was saying to my hon. Friend the Member for Sheffield, Heeley (Louise Haigh), that can prove tricky when I am trying to pay for things at a distance. For many of us, facial recognition technology provides consumer services on Facebook and Google by auto-tagging friends and family members and allowing us to search our images. There is an entire debate to be had about consent, transparency and privacy in the use of such technologies in the private sector, but my focus today is on the role of the state, the police and the security services in the use of facial recognition technology.

Facial recognition technology is beginning to be used more widely. It is well known to those who take an interest in it that the South Wales police has used it at sporting events; that the Metropolitan police has trialled auto-facial recognition technology on many occasions, including at events such as the Notting Hill carnival and Remembrance Sunday, and at transport hubs such as Stratford; and that Leicestershire police has used it at the Download music festival. I am concerned that it is also being used at public protests, although perhaps I understand why; I will come on to that later in relation to our freedom of association.

[Chi Onwurah (Newcastle upon Tyne Central) (Lab)]

I congratulate my hon. Friend on securing this debate on a key subject. He has spoken light-heartedly about the competition with the climate change debate. Does he agree that in some ways, as with climate change, although only a small number of issues are currently associated with this topic, the range of impacts that facial recognition technology will have on our society and economy, on the way we work and do business, and on our trust relationships will be huge and will grow over time?

--- Later in debate ---

[Darren Jones]

I agree wholeheartedly with my hon. Friend. She and I often end up in these types of debates in this place. One thing that they have in common is that the technology is changing and the services are becoming more mature at such a pace that the regulation and concerns are often slower. As legislators, we need to understand the technology as well as we can and make sure that the appropriate protections are in place.

In other spaces, we talk about the fact that I have a date of birth, I am male, I have two daughters and I am a vegan, which means that companies profile me and suggest that I might like to buy Quorn sausages that children like. There is a public debate about that, of course, but facial recognition technology is a particularly sensitive area of personal data. Such technology can be used without individuals really knowing it is happening, as I will come on to shortly, which is a big issue. It is not just police forces that are interested in the technology; some councils are using it to enforce certain rules, as is the private sector, as I say.

Facial recognition technology uses two methods: live auto-facial recognition, which is referred to as AFR Locate, and non-live auto-facial recognition, which is referred to as AFR Identify. What does Locate do? When such technologies are being trialled—although some police forces have been trialling such technologies for many years, so the definition of trial is important—cameras will build a biometric map of the face and facial features of members of the public who are walking down the high street, through a shopping centre or at a sporting or music event. That builds a numerical code that identifies them as individuals, which is matched against a database of images to identify them using the technology. That spurs an action by the police force or others, should they feel that that individual is high risk or has broken the law and some enforcement needs to be taken against them.

As I have alluded to, unlike fingerprints, which people have to proactively give, the technology is so pervasive that many people will walk past the cameras not really knowing that they are taking part in the process and, therefore, not consenting to it. As I will come on to shortly, the rules in place for the use of facial recognition technology are non-existent.

On non-live AFR, the so-called Identify scheme, I will focus on the databases that are being used. After we have built the facial image—the map or code of a person’s face—we match it against a database of images. What is that database and where do those images come from? The police have watch lists of people they are concerned about. Obviously, we want terror suspects to be on a watch list so that the police can do their job properly. There has been a question about scraping social media for images that police forces can match against. Can the Minister confirm that today? If we are doing that in an untargeted fashion for those about whom there are legitimate concerns, we ought not to be. There are also custody images on databases such as the police national database, about which there are long-running concerns, as we have heard on my Select Committee. When the police take someone’s picture and put it on to the PND, it stays there. It does not matter whether they are convicted and go on to a list of people with convictions—perhaps we would understand if that were the case—or they are found innocent or no action is taken against them; their images are kept on the database anyway.

We have known for many years that the way the police have been processing the facial images of innocent citizens is unlawful. In the High Court in 2012, in the case of RMC and FJ v. Commissioner of Police of the Metropolis, the High Court was clear that it was being managed unlawfully. The Home Office responded, albeit some years later—I am not entirely sure why it took so long to respond to such an important issue—setting out a six-year review period in which the police would have to review the images on the database to decide whether they should weed and take out the images of innocent citizens. It also said that any of us could proactively ask the police force to remove our images because we claim our innocence.

There are several problems with that. Unsurprisingly, the number of requests to remove facial images from the database has been low, because people do not know about it. The fact that people have to proactively prove their innocence to not be on a police database is also fundamentally an issue. It is well known, however: the minutes from the September meeting of the Law Enforcement Facial Images and New Biometrics Oversight and Advisory Board say that

“most forces were struggling to comply”

with the Government’s response to the High Court’s ruling of unlawfulness. In answer to my questions in the Select Committee hearing, the Minister in the other place and her officials confirmed that no additional resource had been given to police forces to respond to or promote the fact that people can request the removal of their images from the database, or to undertake the review in which they are supposed to weed out and delete the images that they are not keeping on the database.

Evidently, the system is not fit for purpose. In my view, we continue to act in a way that the High Court said was unlawful, and I know that the Information Commissioner has also expressed concern. It will be useful if the Minister sets out how the Government will act to improve the situation, not only in terms of resourcing and support for police forces across the country but in terms of honouring the Government’s commitment to build new databases, so that the process can be automatic. Technology is pretty advanced now in some of these areas of facial recognition. If Facebook is able to identify me, tag me and take an action, and if Google is able to identify me and allow me to search for myself online, surely the Government ought to be able to auto-scan images, identify people who are not criminals and automatically delete the images of them. That ought to be deliverable. Indeed, it was our understanding that such a system was being delivered, but only a few weeks ago, when I asked Baroness Williams, the Minister in the House of Lords with responsibility for this issue, when we could expect the new computer system to be delivered, there was stony silence from the Minister and her officials. They were not clear when it was going to be delivered, why it had been indefinitely delayed and whether the delay was due to financing, contractual issues or technology issues. There was no clarity about how the existing system would be fixed.

We found in 2012 that the system was unlawful in relation to civil liberties. That in 2019 going into 2020, we do not know what we are doing to fix it or how it will be fixed, it is wholly unsatisfactory. Will the Minister give us a clearer update today about when the automatic deletion service will be available to police forces?

[Chi Onwurah]

I thank my hon. Friend for giving way to me again. He has made some very important points about the way in which this technology is already being used by Facebook and others, but is it not the case that, however advanced the technology is, it has also been found that it can be biased because of the training data that has been used, which means that particularly those from minorities or specific groups are not recognised adequately? Does he agree that it is all the more important that there is investment as well as transparency in the police database, so that we can ensure that groups who are already marginalised in many ways, particularly with regard to police services, are not once again being discriminated against?

[Darren Jones]

Unsurprisingly, I agree entirely. This is part of a much broader conversation about designing technology with ethics at the very start, not only in facial recognition but in algorithmic decision making and a host of different areas where we have seen that human biases have been hardwired into automated decision processes that are delivered through technological solutions.

The Government have a really important role to play here, not just in setting the regulatory framework and building on, and really giving strength and resource to, the Centre for Data Ethics and Innovation to set the national and international tone, but through their procurement of services. They must say, “We have got to get this technology right. We are going to buy these systems, but we really must see this ethics by design right from the very beginning, dealing with biases in a way that allows us to avoid biased solutions.” That would stimulate the market to ensure that it delivered on that basis.

On the legal basis for biometrics, older forms of biometrics such as DNA and fingerprints have a legal framework around them; they have guidance and rules about how they can be used, stored and processed. There is no specific law relating to facial recognition and no specific policy from the Home Office on it. The police forces that are trialling these systems say that they are using existing legislation to give them the legal basis on which to perform those trials, but the fact of the matter is that we only need to look at the dates of that legislation to see that those laws were put in place way before the technology came into existence or before it reached the maturity that we are seeing today.

There was some debate during the passage of the Data Protection Act 2018, when I, my hon. Friend the Member for Sheffield, Heeley and others served on the Committee scrutinising that Bill, but there was no specific discussion during that process or any specific regulation arising from it about facial recognition technology. If police are relying on the Police and Criminal Evidence Act 1984—perhaps there is an irony in the date of that legislation—the basis and the understanding of the technology did not exist at that time, so it is not in that legislation. Even the Protection of Freedoms Act 2012 is too old. The definition of biometrics in that legislation cannot encapsulate a proper understanding of the use, sensitivity and application of automatic facial recognition.

I am not alone in saying this—indeed, it seems to be the view of everybody but the Government. The Information Commissioner has opened investigations; the independent biometrics and forensics ethics group for facial recognition, which advises the Home Office, agrees with me; the London Policing Ethics Panel agrees with me; the independent Biometrics Commissioner agrees with me; and, perhaps unsurprisingly, civil liberties groups such as Liberty and Big Brother Watch not only agree with me but are involved in legal action against various police forces to challenge the legal basis on which these biometrics trials are being conducted. When he responds, will the Minister say that the Government now agree with everybody else, or that they continue to disagree with everybody else and think that this situation is okay?

I will now address the second part of this debate, which is the biometrics strategy. I focused on facial recognition because it is a particularly timely and sensitive component of a broader biometrics strategy. All of us who use technology in our daily lives know that biometric markers and data can be used to identify our location, identity and communications. That means that the Government and, indeed, the private sector can access data and learn things about us, and that area of technology is growing. People are rightly concerned about ensuring that the right checks and balances are in place. It is one thing for an individual to agree to facial recognition technology in order to unlock their tablet or phone, having read, I hope, about what happens to their data. It is another thing, however, for them not to be given the opportunity to give their consent, or not to receive a service and therefore not know about it, when the state is using the same types of technology.

The biometrics strategy needs to get into the detail. It needs to set out not only what is happening now but what is envisaged will happen in the future and what the Government plan to do about it, in order to protect civil liberties and inform citizens about how the data is being used. Clearly, they would not be informed individually—there is no point in telling a terrorist planning an incident that there will be a camera—but the right balance can be achieved.

Again, I do not understand why the Government are so slow in responding to these fundamental issues. It is so long since the 2012 High Court ruling on the retention of custody images, and we had to wait five years for the biometrics strategy. Imagine how much the biometrics sector in this country changed during those five years. Perhaps the Government were trying to keep up with the pace of change in the technology space, but the strategy was long delayed and long awaited.

Given my tone, Sir Roger, you will not be surprised to hear that everyone was very disappointed with the biometrics strategy, because it merely gave a kind of literature review of current uses of biometric data. There was a little bit about the plans for a new platform, which the Home Office is building, regarding how different people access biometric data. It said nothing at all, however, about the future use, collection and storage of biometric data, or about data protection. It said nothing about the Government’s own use and collection of data; the need for enforceable guidelines to enable devolved decision making by, for instance, police forces across the country; how different Departments might be able to use different forms of biometric data across Government, which, evidently, is very easy to deliver with today’s technology; or how the data would be stored securely.

People are concerned about cyber-security and breaches of their personal data, so what steps will the Government take in this developing space? Where will the data be stored? In advance of this debate, I received representations arguing that we should not send it to companies overseas and that it should be stored in the UK. One would think that the biometrics strategy addressed those issues, but it does not. Is the beta version of the biometrics strategy due soon, or does the Minister think that the Government have provided a sufficient response on this important field?

I do not want to keep saying that everybody agrees with me, because that would be a little uncomfortable, but there is no denying that the Biometrics Commissioner, the Surveillance Camera Commissioner and the Information Commissioner’s Office have all said exactly the same thing—this biometrics strategy is not fit for purpose and needs to be done again. The Government need to be clearer and more transparent about their endeavours and make that clear to the public, not least because these areas of technology move at pace. I understand entirely why police forces, civil servants or others want to be able to take the opportunities to deliver their services more efficiently, more effectively and with more impact—we support that—but the right checks and balances must be in place.

I will touch on our fundamental rights and freedoms, because that debate does not get enough air time in the technology space. Our freedoms are increasingly being challenged, whether the issue is cyber-defence or how we regulate the online world, and also in this space. Fundamental freedoms—freedoms that we hold, or purport to hold, dear—are encapsulated in the European convention on human rights and the Human Rights Act 1998. They go to the very nature of this technology, such as the right to a private life that can only be interfered with for a legitimate aim and only if that interference is done proportionately. Scanning a load of people going about their day-to-day life does not feel proportionate to me, and there is no accountability to make sure that it is being done legitimately. As my hon. Friend the Member for Newcastle upon Tyne Central (Chi Onwurah) said, if the selections that those technologies pick up are resulting in false matches or are discriminating, primarily against women and people from ethnic minority backgrounds, that also ought to be considered.

Those freedoms also include freedom of expression and of association. In public protests in recent weeks, people who dearly hold certain views have gone too far by moving away from their right to freedom of expression and to peaceful demonstration, towards criminal activity, intimidation or hostility. We should set the tone and say that that is not welcome or acceptable in our country, because having a right also means having a responsibility to use it wisely. Of course we want to protect those who want to demonstrate through peaceful public protests.

I am sure the public will say—this lies at the heart of my contribution—“Fine. Use some of this technology to keep us safe, but what is the right balance? Do we understand how it is being used? What are the accountability measures? What rules and guidance are being put down by the Government, on behalf of Parliament and the people, to make sure this is being done in a way that is not a slippery slope towards something we ought not to be doing?” We need a wider debate in public life about how we protect freedoms in this new digital age, and this issue is an example of that.

The House of Commons digital engagement programme is often a very good process for Westminster Hall debates, as it allows the public to be part of the conversation and to submit their comments. It would be remiss of me to not point out that some members of the public highlighted a certain irony in the fact that this debate was being promoted on Facebook, so I have shared their concerns, but that is still a medium through which the public like to engage in debate. Hundreds of thousands of people engaged across different platforms—way more than I was expecting—which shows the level of public interest in the use of these technologies.

As might be expected, there were two sides to the argument. The minority view on the platforms was, “I have nothing to hide. Please go out and keep us safe. Crack on, use it.” The other side said, “Actually, this is a slippery slope. I don’t know how this is used, and I’m worried about it. Why can’t I go about my day-to-day life without the police or the state surveilling me?”

I will share some of the comments. On the first side of the argument was Roy. I do not know where he is from. I wish his location had been given, because I could have said, “Roy from Sheffield”. He said:

“No objection. I’ve nothing to hide and don’t find it scary or objectionable for ‘the state’ to be able to track my movements. They already can if I’m in a car”—

I did not know that—

“and that doesn’t seem to be a problem. The added security of the police being able to track potential terrorists far outweighs any quibbles about reduced privacy.”

That is a perfectly legitimate view.

Karyn said:

“Having seen the numbers of crimes solved and even prevented by CCTV I have no objections. Today we have to be realistic, with phones listening in on conversations for marketing and plotting where we are, this is small price to pay for public safety and if you have done nothing there is nothing to fear.”

That is an interesting contribution on what is happening in the private and state sectors. We need to be much more advanced in both spheres.

That was a minority view, however. I do not have the percentage, but the bulk of comments came from people who are concerned. Chris Wylie, who many of us will have read about—he was the Cambridge Analytica whistle- blower, so he clearly knows something about these issues —was firm:

“No. Normalising this kind of indiscriminate surveillance undermines the presumption of innocence.”

We should pause on that, because it is really important. Why should we be tracked and surveilled by the police on the assumption that we might be guilty of something? That does not feel right, just as it does not feel right that people have to prove their innocence to get their images taken off a police database. Chris went on to say:

“It should never be up to us as citizens to prove we are not criminals. Police should only interfere with our lives where they have a reasonable suspicion and just cause to do so.”

I share Chris’s views.

Andrea said that this was a slippery slope:

“The idea that some people have about privacy as an exclusive issue for the bad guys is completely wrong. Not only privacy prevents my acts from limiting my rights but also avoids an unjustified use of power by the Gov’t.”

Again, we should pause there. It is our job in Parliament to hold the Government to account, yet we have no strategy, legislation or rules to enable us to do so. That is a fundamental problem. She goes on to say:

“Such a huge involvement of disturbing tech could lead to a 1984-like slippery slope, one which none of us wants to fall in, regardless of their legal background.”

Jenny said:

“I believe that this would suppress people’s ability to engage in public demonstrations and activities that challenge the government, which is hugely dangerous to democracy.”

A lot of people said that if they thought the state was scanning their data and putting it on a database, they might not associate with or take part in public demonstrations. If that were to happen, it would represent a significant diminution of our democratic processes.

Lastly, Bob said:

“It makes it easier for a future, less liberal government to monitor the activity of dissident citizens. During the miners strike in the 1980s miners were stopped from travelling just on the suspicion they would attend rallies based on their home locations and where they were heading. How would this technology be applied in the future for, say, an extinction rebellion march?”

Regardless of our political disagreements across the House, none of us thinks that the state is overreaching in a way that many other countries would. However, given the lack of legislation, guidance and regulation to enable us to hold the Government to account, and with independent commissioners and regulators saying that this is not good enough, I agree with Bob. There is a huge risk in not putting in place a framework with the appropriate checks, balances and protections, not just because that is the right and important thing to do today, but because we need that framework for future Governments.

[Chi Onwurah]

My hon. Friend is being very generous with his time, and I congratulate him again on having raised this important topic. Does he agree, as I think he is suggesting, that the level of interest in this debate—demonstrated by the quotes he has read out—shows that technology such as facial recognition, as well as algorithms and data, needs to be publicly debated? We can make a choice as to how it is used, so that citizens are empowered. Technology should not be something that is done to people; they should have rights and controls as to how it is enacted.

[Darren Jones]

My hon. Friend is absolutely right. The debate is a broader one about technology. How do we engage the public with these issues? I am an evangelist for technological reform, although I will not go on about that topic for too long, because it is not linked to the title of the debate. In my view, the idea that we can increase our economy’s productivity, increase wages, transform people’s working lives and reform and make more efficient our public services without using technology does not make sense. As my hon. Friend says, however, we have to do that in the right way and bring the public with us.

On a cross-party basis, we share the belief that we need to take crime seriously, and to address the increasingly sophisticated methods that criminals and terrorists may employ when trying to commit crimes or terror in our country. However, we must get the balance right, and there is a lacuna of regulation in this space. There are no legal bases, there is no oversight, and as a consequence there are no protections. That is why the Government should act now.

--- Later in debate ---

[Louise Haigh]

That is completely right, and that is why this debate and the framework are so important. We cannot allow the police, with all the best intentions, to attempt to use this technology and then in some cases to mess it up—as they will—and have to roll it back. We want to ensure that the framework is in place so that the police can go ahead with confidence and the public have confidence. We must ensure that biases are designed out and that people accept the intrusion into their privacy and understand that such technology is being used proportionately and out of necessity. At the moment we cannot have confidence in that, which is why this debate is so important.

[Darren Jones]

I thank my hon. Friend for giving way, not least because I spoke at great length today. I did not mention earlier that we took evidence in the Select Committee from the Biometrics Commissioner that trials should be conducted on the basis of rigorous scientific guidelines and processes. The problem is that if we let different police forces do different things in different ways, we do not get clear answers on how and in what circumstances the technology can best be used. We need guidelines not just for the regulatory purposes, but so that the trials can be done in the right way.

[Louise Haigh]

That is absolutely right. I do not get a strong impression that individual police forces are learning from each other either. In the case of the Met, the word “trial” has been used for the technology’s use at Notting Hill carnival. It has been trialled for three years in a row. When does a trial become a permanent fixture? I do not think that that can now be called a trial. My hon. Friend is absolutely right that if it is a trial, we should be gathering data, and they should be informing Parliament and the public and should be addressing the concerns around false positives and ethnic biases and whether it is being used proportionately. My hon. Friend the Member for Stretford and Urmston gave the astonishing figure that demonstrated the mismatch between the numbers of people who were covered by the facial recognition technology when just one individual was identified. That surely cannot be proportionate.

The question of technology within law enforcement gets to the heart of public consent for policing in this day and age, and the issues we have discussed today represent only the tip of the iceberg of potential privacy issues. So much of what defines an investigation today is data-driven. Data-driven policing and data-led investigations are transforming policing. It is already completely unrecognisable from when I was a special constable only 10 years ago. The police have the scope to access more of the intimate details of our personal lives than ever before.

The trialling of technology—including facial recognition and, as my hon. Friend the Member for Bristol North West mentioned, risk assessment algorithms—has not been adequately considered by Parliament and does not sit easily within the current legal framework, but it is having some phenomenal results that we should not ignore. The identification of images of child sexual abuse rely on hashing technology, which enables law enforcement and the Internet Watch Foundation to scrape hundreds of thousands of images off the internet each year.

This week, we have had the news on what is in essence compulsion for rape victims to hand over their mobile phones for what potentially amounts to an open-ended trawl of data and messages, without which there is little prospect of conviction. That high-profile debate has lifted the lid on the ethical questions that ubiquity of data and technological advances are having on law enforcement. Nascent technologies such as facial recognition are at the sharp end of this debate. They do not just represent challenges around collecting and storing of data; they also provide recommendations to law enforcement agencies to act, to stop and search and, potentially, to detain and arrest people.

As my hon. Friend the Member for Bristol North West said, we served on the Data Protection Bill Committee, where we discussed these matters briefly. We outlined our concerns about facial recognition, in particular the lack of oversight and regulatory architecture and the lack of operational transparency. I reiterate the call I made to the Home Secretary in May last year that Her Majesty’s inspectorate of constabulary launch a thematic review of the operational use of the technology and report back to the Home Office and to Parliament.

We believe such a report should cover six key areas: first, the process police forces should and do follow to put facial recognition tools in place; secondly, the operational use of the technology at force level, taking into account specific considerations around how data is retained and stored, regulated, monitored and overseen in practice, how it is deleted, and its effectiveness in achieving operational objectives; thirdly, the proportionality of the technology’s use to the problems it is seeking to solve; fourthly, the level and rank required for sign-off; fifthly, the engagement with the public and an explanation of the technology’s use; and sixthly, the use of technology by authorities and operators other than the police.

It is critical as operational technology such as this is rolled out that the public are kept informed, that they understand how and why it is being used and that they have confidence that it is effective. The Minister has the power to commission reports of this type from HMIC and it would be best placed to conduct such a report into the use of police technology of some public concern.

We have discussed concerns about the accuracy of facial recognition tools, particularly in relation to recognising women and people from BME backgrounds—that is quite a swathe of the population! We do not know whether this is because of bias coded into the software by programmers, or because of under-representation of people from BME backgrounds and women in the training datasets. Either way, the technology that the police are currently using in this country has not been tested against such biases. In the debate around consent, it is extremely worrying that potentially inaccurate tools could be used in certain communities and damage the relationship with and the trust in the police still further.

As I said, we had some debates on this issue in the Data Protection Bill Committee, where we attempted to strengthen the legislation on privacy impact assessments. It should be clear, and I do not believe that it is, that police forces should be required to consult the Information Commissioner and conduct a full PIA before using any facial recognition tools.

I am further worried that the responsibility for oversight is far from clear. As we have heard, software has been trialled by the Met, the South Wales police force and other police forces across the country, particularly in policing large events. In September last year, the Minister made it clear in response to a written question that there is no legislation regulating the use of CCTV cameras with facial recognition. The Protection of Freedoms Act 2012 introduced the regulation of overt public space surveillance cameras, and as a result the surveillance camera code of practice was issued by the Secretary of State in 2013. However, there is no reference to facial recognition in the Act, even though it provides the statutory basis for public space surveillance cameras. The Surveillance Camera Commissioner has noted that “clarity regarding regulatory responsibility” for such facial recognition software is “an emerging issue”. We need clarity on whether it is the Biometric Commissioner, the Information Commissioner or the Surveillance Camera Commissioner who has ultimate responsibility for this use of technology. It would also be helpful if the Minister made absolutely clear what databases law enforcement agencies are matching faces against, what purposes the technology can and cannot be used for, what images are captured and stored, who can access those images and how long they are stored for.

The Government’s new biometric strategy takes a small step forward on oversight, with a board to evaluate the technology and review its findings, but it meets too infrequently—three times since last July, as far as I can tell—to have effective oversight of the operational use of the technology. In any case, it is clearly not designed to provide operational safeguards, and that is where big questions remain about discriminatory use and effectiveness. The lack of operational safeguards and parliamentary scrutiny may lead to ill-judged uses of the technology.

I am hopeful that the Minister can assure us today of the Government’s intention to make things a lot clearer in this space, that existing and emerging technologies will be covered by clear, consistent guidance and legislation from the Home Office, that the relevant commissioner will have all the powers they need to regulate these technologies, and that our law enforcement agencies fully understand what they need to do, both before any technology or new method of data collection is rolled out, and afterwards, when an individual’s data rights may have been abused. We need clear principles, and I am not convinced that the legislative landscape as it stands provides that.

--- Later in debate ---

[Darren Jones]

I thank the hon. Member for Strangford (Jim Shannon), my hon. Friends the Members for Stretford and Urmston (Kate Green) and for Newcastle upon Tyne Central (Chi Onwurah), and the shadow Minister, my hon. Friend the Member for Sheffield, Heeley (Louise Haigh), for their contributions. I also welcome the interventions of the Chair of the Science and Technology Committee, the right hon. Member for North Norfolk (Norman Lamb), and the Minister’s responses.

It is clear from today’s debate that everyone, including the Minister and, by extension, the Home Office, agrees that we have some work to do, which is a good conclusion. I put it on the record that the Select Committee is interested in the actions being taken by the Scottish Government in the biometric data Bill that the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) mentioned. We will keep a close eye on the work being done in Scotland, and think about what lessons we might learn in Westminster.

As my hon. Friend the Member for Stretford and Urmston said, if we have 29 million facial scans for one hit, we clearly need to have a better debate about the balance between impact and invasion of privacy. As many colleagues mentioned, the demand for a stronger regulatory system comes from not just police forces, commissioners, politicians and the public, but from the technology companies providing such solutions. They wrote to me in advance of the debate to say that they want to do the right thing, and would rather that there were a framework in which they can operate so that—no doubt for their own brand purposes—they are not pushing the envelope by delivering solutions that police forces and others may take too far.

I welcome the Minister’s commitment to privacy impact assessments. I am sure that we all welcome that confirmation. I understand that dealing with legacy IT systems is difficult; we have been talking about that on the Select Committee too. We encourage the Government not to put a sticking-plaster over old systems, but to invest in new ones, so that we are not just dealing with a legacy problem, but building something fit for the future. I look forward to reading the letter that the Minister referred to from Baroness Williams of Trafford.

The Minister said that it was good that in our system we can hold the Government to account and show our interest in such matters. It is clear from the debate, and from the Select Committee’s ongoing work, that we will continue to do so. We therefore look forward with anticipation to the further announcements that the Minister has committed to in the season of “summer”. Even though we do not quite know when that will start or end, we look forward to those announcements, and I thank him for his contribution.

Question put and agreed to.

Resolved,

That this House has considered facial recognition and the biometrics strategy.

Immigration and Social Security Co-ordination (EU Withdrawal) Bill

Darren Jones Excerpts

2nd reading: House of Commons & Money resolution: House of Commons & Programme motion: House of Commons & Ways and Means resolution: House of Commons
Monday 28th January 2019 Commons Chamber

[Darren Jones (Bristol North West) (Lab)]

I pay tribute to my right hon. Friend the Member for Hackney North and Stoke Newington (Ms Abbott), who from a lifetime of experience is in the right place on this issue.

The nature of a country and the values that underpin it are often reflected in the rules of its immigration system. On that basis, the United Kingdom could be seen as hostile, expensive, often offensive and demeaning, and overly restrictive. That is not the type of country I wish to help to lead from this House. Our immigration system should be fair, both to those who wish to come here and those already here, and should strike a balance between rights, restrictions, contributions and rewards for those who wish to come and be a part of our great country.

At a time of rising populism, the Bill was an important opportunity for the Government to set the right tone, but on that measure they have failed, not least because the Bill is remarkably light on detail, instead giving Ministers wide powers to make up the rules as they see fit. It gives the House no insight into what they seek to do. It fails to recognise either the positive contribution migrants make to our country or the positive bottom line for UK plc; it fails to recognise the rights of British citizens living in the EU—in greater numbers than EU citizens in Britain; and it fails to recognise the different types of immigration, whether they be those who come because we need them, those who come to contribute, or those who come seeking asylum. Nothing in the Bill sets out what type of country we seek to become—what type of country we wish to be—and that is a grave missed opportunity.

The Bill offers little hope to people in Bristol North West, whether the hundreds of doctors, nurses and social care workers at Southmead Hospital, or the migrant labourers in Avonmouth working in our warehousing and logistics business, or the people I meet in my constituency surgery week in, week out, including, sadly, victims of modern slavery—I know the Government have done great work on that, and I pay tribute to them and look forward to the conclusions of the review of ways of strengthening the support victims receive—or its scientists, researchers and technology entrepreneurs.

A recent report by the Science and Technology Select Committee, on which I sit, noted that collaboration across disciplinary and geographical boundaries was the foundation of scientific and technological endeavour—one this country has a proud history of leading and no doubt wishes to lead in the future—but also highlighted the overly restrictive tier 1 visa system for exceptional talent and how difficult the tier 2 system made it for employees and employers who want and need to be here to come here. It also dealt with long and short-term stays for the purposes of research and collaboration on innovation. We are failing to be able to bring the best scientific teams and technological minds to our country at a time when we need them not only to fuel our own GDP and economic success but to secure our position in the world as a leader in science and innovation.

I have a few questions that I hope the Minister will respond to when she sums up, although some have been asked already. First, in respect of the many nurses and social care workers and other low-paid workers, including scientists and innovation and tech entrepreneurs in Bristol earning less than £30,000 a year, are the Government not confusing vital skills with pay, and pay with value? The value that many of our low-paid workers, whether in healthcare or other settings, add to my constituents is hugely valuable but may not be reflected in their pay. We should be saying in this country that we welcome their contribution to creating a fairer, more open and more tolerant society, but instead we are saying that they do not earn enough to have the right to be here.

Secondly, is it right that amendments to immigration policy should not be debated on the Floor of the House? I understand that the Government have given themselves this power in the Bill, but surely the Minister will today confirm that they will none the less bring those matters to the House, both for debate and in the interests of their own accountability. Thirdly, there has been some concern about EU citizens who reside in this country for valid reasons other than exercising their treaty rights and whether they will be protected as part of the transitional arrangements if we leave the EU. I hope the Minister will clarify that distinction. She says “when” we leave the EU. I am hopeful that we will not be doing so.

[Mr Ben Bradshaw (Exeter) (Lab)]

Hear, hear.

[Darren Jones]

I thank my right hon. Friend for that.

Fourthly, in response to the report by the Science and Technology Committee, which I recommend to all right hon. and hon. Members, I hope the Minister will say how she and her Department will seek to meet the requirements I mentioned in order that we might stay at the forefront of international collaboration on scientific endeavour.

Lastly, I assume the Government will not admit it, but this is a prime opportunity to set out what type of country we want to be, whether Brexit happens or not; to say to people around the world who Britain is and what their experience will be here; to say to people who live in this country what values we expect of our communities and what we will not condone and that xenophobia is not welcome, regardless of what people felt they could and could not say as a consequence of the leave campaign; to set out afresh a new, innovative, welcoming and fair immigration system that brings to life the values that supposedly represent the Treasury Bench’s intentions for this country. Instead, it is a failure on all the measures I have set out, so I will happily not be supporting the Bill this evening.

European Union (Withdrawal) Act

Darren Jones Excerpts

Wednesday 5th December 2018 Commons Chamber

[Darren Jones (Bristol North West) (Lab)]

It is a pleasure to follow the hon. Member for Argyll and Bute (Brendan O'Hara).

I rise as one of the Brexit generation of politicians elected to this place because of the causes and consequences of Brexit. I now find myself, as a Member of this House, faced with a divided Parliament and a divided country embroiled in a constitutional crisis not previously seen in our history, and I am being asked to use my vote on behalf of my constituents to make this great country of ours poorer and weaker in the world. Understandably, in that context, many people look to us with bemusement, questioning our ability as elected politicians to lead and to serve.

Regardless of whether one voted to leave or stay in the European Union, we do not have what we were promised. The Prime Minister’s proposals are worse than our current position, and they mean that Brexit will dominate the political agenda for many years to come. Leave voters were promised £350 million a week for the NHS. Instead, we have European doctors and nurses leaving us and Government risk assessments resulting in the stockpiling of medicines. Leave voters were promised that the UK could go it alone, with new trade deals around the world. Instead, we have heard the United States say it is not that interested, and we have the prospect of a transition period—which we may never get out of—that will make us unable to conclude trade deals until 2021 at the earliest.

Leave voters were promised that we would take back control of our laws. Instead, the Prime Minister’s proposals lock us into European regulations without the UK having a meaningful say. Unsurprisingly, this confirms that we have more power and more influence as a member of the European Union. We do not have what we were promised. Our current position is far better, and we will be locked into a debate on Brexit for the next decade.

Britain is a powerful nation. We are one of the largest and most sophisticated economies in the world, and we should be proud of our status and of the benefits it brings to the British people. In contrast, the Prime Minister’s proposals are a humiliation.

The majority of my constituents in Bristol North West voted to remain and, based on my extensive engagement with them, I know they continue to want to do so. Whether for advanced manufacturing jobs in aerospace and automotive industry across north Bristol, for NHS jobs at Southmead Hospital, for research jobs at our two universities or for warehousing and logistics jobs reliant on import and export in and around the port at Avonmouth, our current position as a member of the European Union is far stronger than any other option on the table.

I did not stand to be the Member of Parliament for my home constituency, where I was born and raised, only to come here to vote to make my constituents poorer. Whether I am an MP for a short time or for a long time, as a millennial and as the father of a daughter who turns one today, I will be left to deal with the mess left behind by this incompetent Government long after they leave the Treasury Bench.

In the face of the inevitable rejection of the Prime Minister’s proposals, I support the call for a people’s vote. All of us, regardless of whether we voted to stay or to leave, now know what leaving the EU means. I did not know when I voted to remain, and nor did people who voted to leave. New facts have emerged. It is not patronising to say to people that they have the right to change their mind now they know what leaving the EU means—a basis for the rules on which we leave and a wish list for the future. It is not undemocratic to provide more democracy by going back to the people. It is the right of the British people to have the final say on whether we leave on the Prime Minister’s proposed basis or stay in the European Union.

Securing a people’s vote is not the end, regardless of whether the outcome is to leave or stay. We now know loud and clear that the country is divided, driven apart by an increasing gap between the haves and the have-nots, between the cities and the towns, between the south and the north, between the old and the young and between the rich and the poor and struggling, characterised by differences in access to education, in the ability to rent or own a secure home, in the reliance on struggling public services and in the despair that comes from flatlining wages and a fear that our children are being raised in a country in decline.

Leaving the European Union will not fix these woes, and neither will remaining, unless we reform both the EU and Britain. As politicians, it is our job to step up to meet that cry for change and put forward a radical programme of reforms that shows we can be on the up once again. As politicians, we must not pander to the politics of the easy answer, as we have seen in this Brexit campaign. Instead we must be honest about the significant challenges facing our country in a fast-changing world. We must embrace the opportunity and the power of patriotism to drive our great nation forward, and discard the destructive desire of national populism to secure power for power’s sake.

This country of ours feels as though it is coming to the end of its current chapter. In a proudly sovereign Parliament, at the centre of a strong and successful United Kingdom, we have a choice to make about what comes next. We are a proudly sovereign Parliament, with our sovereignty derived from the British people, which gives us the right to go back to them to check and ask for further instruction. I truly hope that from the ashes of Brexit, whatever that will mean, we choose a future of hope and possibility, anchored in the reality of the world that we find ourselves in, and not another chapter of self-inflicted, populist decline.

Modern-day Slavery

Darren Jones Excerpts

Tuesday 9th October 2018 Westminster Hall

[Gareth Snell]

My hon. Friend must be somewhat prescient, because he has read ahead in my speech before I have managed to get to that point. I shall touch on it later.

I welcome the announcement by the Government of the review of the Modern Slavery Act, which will be ably chaired by my right hon. Friend the Member for Birkenhead (Frank Field) and the right hon. Member for Basingstoke (Mrs Miller), as well as the noble Lady Butler-Sloss. That is a triumvirate of expertise if ever there were one. I am grateful to my right hon. Friend for being present this afternoon.

I want to talk about the processes in the Modern Slavery Act. It was a step forward in properly attacking and dealing with some of the horrible situations people find themselves in, but it also contained important preventive measures that helped to reduce modern slavery in all forms, whether sexual exploitation, domestic servitude, forced labour or criminal exploitation.

For me, one of the most important parts of the Act is section 54, which requires large companies with a turnover of £36 million or more to place on record transparency in their supply chains. Such modern slavery statements are a welcome process to deal with these problems but, if we are honest and up front, the implementation is simply not working properly. At a meeting of the Public Accounts Committee, on which I sit, the Home Office confirmed that it does not compile a list of companies that may be required to make a declaration, does not have a list of those that have done so and, importantly, does not maintain the database. Any further analysis of the information in the declarations is made by non-governmental organisations.

[Darren Jones (Bristol North West) (Lab)]

On that point, will my hon. Friend join me in congratulating TISCreport, which was developed and is based in Bristol? It has looked at the 18,000 companies with revenue of more than £36 million, and it is the only organisation that maintains a database of the companies that comply with section 54. The database is now searchable via a zoomable map. Will he encourage the Minister to engage with TISCreport and to allow it to help the Home Office in its endeavours?

[Gareth Snell]

My hon. Friend makes an excellent point. NGOs are doing some excellent work but, fundamentally, I believe that such work should be done by the Home Office and by Government—because we are talking about something set out in statute—rather than relying on the benevolence of third-party organisations.

Despite the work of the organisation in my hon. Friend’s constituency, and even though the matter has been progressed, I know that the Minister is aware of concerns about how section 54 is being implemented. Back in April I asked a question in the Chamber of a Department for International Development Minister, who confirmed that a hub was being set up. Will the Minister present today confirm what progress has been made on that hub?

What is really worrying, however, is that an investigation by The Guardian demonstrated that of the companies that had made a modern slavery statement, more than two thirds had failed to refer specifically to the risk of modern slavery. They had made a declaration, but it did not comply with the requirements of the Act. More worryingly, only 19% of all agricultural businesses that should be making a statement have done so, and that is an area in which exploitation could be rife.

Unfortunately, because everything is being done by third-party NGOs, the ability to compel necessary information simply does not exist. Until the Government introduce something on a formal statutory basis, more and more organisations will seek to put aside their responsibilities. The Co-operative Group, which I shall talk about later, has estimated that it is cheaper and easier for organisations simply to ignore the requirements than it is for them to produce the statements and submit them. There is no validation and so no penalty for failing to make a declaration.

The section 54 requirement also applies only to commercial organisations. The public sector, however, is a huge spender of money—billions and billions of pounds are spent in procurement—yet no public authority is required to make declarations to demonstrate their actions to reduce modern slavery. Were we to extend section 54 to cover public bodies and authorities, that might not stop certain aspects of modern slavery happening, but we would be able to have oversight of where the billions of pounds in public procurement are ultimately being spent, and Members could look for the impact on modern slavery.

--- Later in debate ---

[Darren Jones (Bristol North West) (Lab)]

I thank my hon. Friend the Member for Stoke-on-Trent Central (Gareth Snell) for securing this important debate and for introducing another six tests to remember. I support every single one of them.

I will make a very short speech—not least because I have only two minutes—about the unintended priority that this became as a consequence of being the new MP for Bristol North West. I grew up and have lived in my constituency for most of my life, but I never knew that modern slavery was taking place on my doorstep; it was not until I was elected that I came face to face with it, both through constituents in my surgeries and as a result of raids in Bristol thanks to the excellent work of Avon and Somerset police. I now understand about Bristol’s excellent history with Unseen, which provides the national modern slavery helpline, which was established and is based in Bristol.

TISCreport, which I have already mentioned, is looking at supply chains’ compliance with the Modern Slavery Act. I should add that even though I agree with my hon. Friend the Member for Stoke-on-Trent Central that the Home Office should have a statutory responsibility to ensure that data is used properly, that does not mean that it cannot work with non-governmental bodies to ensure it is done in the best possible way.

In my final minute, let me say that this is not just a domestic issue but an international one. We in the United Kingdom have something to be proud of in our work at home as well as abroad. I had the pleasure of being in Nairobi for 36 hours with the Commonwealth Parliamentary Association during the summer recess, where I saw at first hand the impact that British money is having on the ground in Kenya not only in aid but in security. British police officers were working with Kenyan police officers to massively increase the enforcement potential in investigation on the ground, although interestingly there was a lack of resourcing for victim support—something that was pledged to change as a consequence of the CPA organising meetings between non-governmental organisations and Kenyan politicians.

My one question for the Minister—I am sorry to be the one to introduce the Brexit word—is whether the projects on the ground in Kenya and other countries that are co-funded by the European Union and the United Kingdom will continue to be funded in a no-deal scenario.

Data Protection Bill [ Lords ] (Eighth sitting)

Darren Jones Excerpts

Thursday 22nd March 2018 Public Bill Committees

[Darren Jones (Bristol North West) (Lab)]

I want to add some further comments in support of the new clauses.

The Science and Technology Committee, one of the two Committees that I sit on, has had a detailed debate on algorithmic fairness. It is important to understand what the new clauses seek to do. There is a nervousness about regulating algorithms or making them completely transparent, because there are commercial sensitivities in the coding in respect of the way they are published or otherwise.

These new clauses seek to put the obligation on to the human beings who produce the algorithms to think about things such as equalities law to ensure that we do not hardcode biases into them, as my hon. Friend the Member for Cambridge said on Second Reading. It is important to understand how the new clauses apply to the inputs—what happens in the black box of the algorithm—and the outputs. The inputs to an algorithm are that a human codes and sets its rules, and that they put the data into it for it to make a decision.

The new clauses seek to say that the human must have a consistent and legal obligation to understand the equalities impacts of their coding and data entry into the black box of the algorithm to avoid biases coming out at the other end. As algorithms are increasingly used, that is an important technical distinction to understand, and it is why the new clauses are very sensible. On that basis, I hope the Government will support them.

[The Chair]

I call the Minister, whose birthday it is today.

--- Later in debate ---

[Liam Byrne]

That sounds like a terrifying application; my hon. Friend’s daughter very much has my sympathies. He is absolutely right. Lord Knight made this point with such power in the other place. The technology is advancing so quickly, and schools know that if they can monitor things in new, more forensic ways, that helps them to do their job of improving children’s education. However, it has costs and consequences too. I hope that Her Majesty’s Government will look sympathetically on the task of teachers, as they confront this 200-and-heaven-knows-what-page Bill.

[Darren Jones (Bristol North West) (Lab)]

Does my right hon. Friend share my concerns that, in response to a number of written parliamentary questions that I tabled, it became clear that the Government gave access to the national pupil database, which is controlled by the Government, to commercial entities, including newspapers such as The Daily Telegraph?

[Liam Byrne]

Yes. My hon. Friend has done an extraordinary job of exposing that minor scandal. I am surprised that it has not had more attention in the House, but hopefully once the Bill has passed it is exactly the kind of behaviour that we can begin to police rather more effectively.

I am sure that Ministers will recognise that there is a need for this. No doubt their colleagues in the Department for Education are absolutely all over it. I was talking to a headteacher in the Minister’s own constituency recently—an excellent headteacher, in an excellent school, who is a personal friend. The horror with which headteachers regard the arrival of the GDPR is something to behold. Heaven knows, our school leaders and our teachers have enough to do. I call on Ministers to make their task, their lives, and their mission that bit easier by accepting the new clause.

[Liam Byrne]

I am reassured by that and I beg to ask leave to withdraw the motion.

Clause, by leave, withdrawn.

New Clause 17

Personal data ethics advisory board and ethics code of practice

‘(1) The Secretary of State must appoint an independent Personal Data Ethics Advisory Board (“the board”).

(2) The board’s functions, in relation to the processing of personal data to which the GDPR and this Act applies, are—

(a) to monitor further technical advances in the use and management of personal data and their implications for the rights of data subjects;

(b) to monitor the protection of the individual and collective rights and interests of data subjects in relation to their personal data;

(c) to ensure that trade-offs between the rights of data subjects and the use of management of personal data are made transparently, inclusively, and with accountability;

(d) to seek out good practices and learn from successes and failures in the use and management of personal data;

(e) to enhance the skills of data subjects and controllers in the use and management of personal data.

(3) The board must work with the Commissioner to prepare a data ethics code of practice for data controllers, which must—

(a) include a duty of care on the data controller and the processor to the data subject;

(b) provide best practice for data controllers and processors on measures, which in relation to the processing of personal data—

(i) reduce vulnerabilities and inequalities;

(ii) protect human rights;

(iii) increase the security of personal data; and

(iv) ensure that the access, use and sharing personal data is transparent, and the purposes of personal data processing are communicated clearly and accessibly to data subjects.

(4) The code must also include guidance in relation to the processing of personal data in the public interest and the substantial public interest.

(5) Where a data controller or processor does not follow the code under this section, the data controller or processor is subject to a fine to be determined by the Commissioner.

(6) The board must report annually to the Secretary of State.

(7) The report in subsection (6) may contain recommendations to the Secretary of State and the Commissioner relating to how they can improve the processing of personal data and the protection of data subjects’ rights by improving methods of—

(a) monitoring and evaluating the use and management of personal data;

(b) sharing best practice and setting standards for data controllers; and

(c) clarifying and enforcing data protection rules.

(8) The Secretary of State must lay the report made under subsection (6) before both Houses of Parliament.

(9) The Secretary of State must, no later than one year after the day on which this Act receives Royal Assent, lay before both Houses of Parliament draft regulations in relation to the functions of the Personal Data Ethics Advisory Board as listed in subsections (2), (3), (4), (6) and (7) of this section.

(10) Regulations under this section are subject to the affirmative resolution procedure.’—(Darren Jones.)

This new clause would establish a statutory basis for a Data Ethics Advisory Board.

Brought up, and read the First time.

[Darren Jones]

I beg to move, That the clause be read a Second time.

New clause 17 is in my name and that of my right hon. Friend the Member for Birmingham, Hodge Hill. I do not take it personally that my other hon. Friends have not signed up to it; that was probably my fault for not asking them to do so in advance.

The new clause would bring a statutory footing to the data and artificial intelligence ethics unit, which I am very pleased that the Government have now funded and established, through the spring statement, in the Minister’s Department. It comes off the back of conversations with the Information Commissioner in Select Committee about the differing roles of enforcing legislation and of having a public debate about what is right and wrong and what the boundaries are in this ever-changing space. The commissioner was very clear that we need to have that debate with the public, but that it is not for her to do it. The ICO is an enforcer of legislation. The commissioner has a lot on her plate and is challenged by her own resource as it is. She felt that the new unit in the Department would be a good place to have the debate about technology ethics, and I support that assertion.

With no disrespect to any colleagues, I do not think that the House of Commons, and perhaps even the Select Committees to a certain extent, necessarily has the time, energy or resource to get into the real detail of some of the technology ethics questions, nor to take them out to the public, who are the people we need to be having the debate with.

The new clause would therefore establish in law that monitoring, understanding and public debate obligation that I, the ICO and others agree ought to exist in the new data ethics unit, but make it clear that enforcement was reserved for the Information Commissioner. I tabled the new clause because, although I welcome the Government’s commitment to the data and AI ethics unit, I feel that there is potential for drift. The new clause would therefore put an anchor in the technology ethics requirement of the unit so that it understands and communicates the ethical issues and does not necessarily get sidetracked into other issues, although it may seek to do that on top of this anchor. However, I think this anchor needs to be placed.

Also, I recognise that the Minister and the Secretary of State supported the recommendation made previously under the Cameron Government and I welcome that, but of course, with an advisory group within the Department, it may be a future Minister’s whim that they no longer wish to be advised on these issues, or it may be the whim of the Treasury—with, potentially, budget cuts—that it no longer wishes to fund the people doing the work. I think that that is not good enough and that putting this provision in the Bill would give some security to the unit for the future.

I will refer to some of the comments made about the centre for data ethics and innovation, which I have been calling the data and AI ethics unit. When it was first discussed, in the autumn Budget of November 2017, the Chancellor of the Exchequer said that the unit would be established

“to enable and ensure safe, ethical and ground-breaking innovation in AI and data-driven technologies. This world-first advisory body will work with government, regulators and industry to lay the foundations for AI adoption”.

Although that is a positive message, it says to me that its job is to lay the foundations for AI adoption. I agree with that as an aim, but it does not mean that at its core is understanding and communicating the ethical challenges that we need to try to understand and legislate for.

I move on to some of the documents from the recruitment advertising for personnel to run the unit from January of this year, which said that the centre will be at the centre of plans to make the UK the best place in the world for AI businesses. Again, that is a positive statement, but one about AI business adoption in this country, not ethical requirements. It also said that the centre would advise on ethical and innovative uses of data-driven tech. Again, that is a positive statement, but I just do not think it is quite at the heart of understanding and communicating and having a debate about the ethics.

My concern is that while all this stuff is very positive, and I agree with the Government that we need to maintain our position as a world leader in artificial intelligence and that it is something we need to be very proud of—especially as we go through the regrettable process of leaving the European Union and the single market, we need to hold on to the strengths we have in the British economy—this week has shown that there is a need for an informed public debate on ethics. As no doubt all members of the Committee have read in my New Statesman article of today, one of the issues we have as the voice of our constituents in Parliament is that in order for our constituents to understand or take a view on what is right or wrong in this quickly developing space, we all need to understand it in the first place—to understand what is happening with our data and in the technology space, to understand what is being done with it and, having understood it, to then to take a view about it. The Cambridge Analytica scandal has been so newsworthy because the majority of people understandably had no idea that all this stuff was happening with their data. How we legislate for and set ethical frameworks must first come from a position of understanding.

That is why the new clause sets out that there should be an independent advisory board. The use of such boards is commonplace across Departments and I hope that would not be a contentious question. Subsection (2) talks about some of the things that that board should do. The Minister will note that the language I have used is quite careful in looking at how the board should monitor developments, monitor the protection of rights and look out for good practice. It does not seek to step on the toes of the Information Commissioner or the powers of the Government, but merely to understand, educate and inform.

The new clause goes on to suggest that the new board would work with the commissioner to put together a code of practice for data controllers. A code of practice with a technology ethics basis is important because it says to every data controller, regardless of what they do or what type of work they do, that we require ethical boundaries to be set and understood in the culture of what we do with big data analytics in this country. In working with the commissioner, this board would add great value to the way that we work with people’s personal data, by setting out that code of practice.

I hope that the new clause adds value to the work that the Minister’s Department is already doing. My hope is that by adding it to the Bill—albeit that current Parliaments cannot of course bind their successors and it could be legislated away in the future—it gives a solid grounding to the concept that we take technology ethical issues seriously, that we seek to understand them properly, not as politicians or as busy civil servants, but as experts who can be out with our stakeholders understanding the public policy consequences, and that we seek to have a proper debate with the public, working with enforcers such as the ICO to set, in this wild west, the boundaries of what is and is not acceptable. I commend the new clause to the Committee and hope that the Government will support it.

[Margot James]

I thank the hon. Gentleman for raising this very important subject. He is absolutely right. Data analytics have the potential to transform whole sectors of society and the economy—law enforcement and healthcare to name but some. I agree with him that a public debate around the issues is required, and that is one of the reasons why the Government are creating the centre for data ethics and innovation, which he mentioned. The centre will advise the Government and regulators on how they can strengthen and improve the way that data and AI are governed, as well as supporting the innovative and ethical use of that data.

--- Later in debate ---

There is more here that we agree on than disagree on, but the centre for data ethics and innovation, which we are in the process of creating, will, I trust, be the answer to much of the issue raised by the hon. Gentleman in his new clause. I hope that he feels confident enough in that to withdraw it.

[Darren Jones]

I thank the Minister for her co-operative words and for the invitation to be part of this developing area of public policy. Having already plugged my New Statesman article, I will plug a part of it, which is the news that, having worked with some of the all-party parliamentary groups, I am pleased that we will launch a commission on technology ethics with one of the Minister’s colleagues, whose constituency I cannot quite remember, I am afraid, so I cannot make reference to him. But he is excellent.

We look forward to working with industry, stakeholders and politicians on a cross-party basis, to get into the debate about technology ethics. I accept the Minister’s warm words about co-operating on this issue positively, so that hopefully the outcomes of this commission can perhaps help to influence the work of the unit, or centre, and the Government’s response to it.

I would like this new unit to be given a statutory basis, to show its importance. It is vital that it has clout across Government and across Departments, so that it is not just a positive thing when we have Ministers who are willing to take part in and listen to this debate and instead is something that will go on with successive Ministers, should the current Minister be promoted, and with future Governments, too. However, in return for the Minister’s warm words of co-operation, I am happy not to press the new clause to a vote today.

[Daniel Zeichner]

Very briefly, I declare an interest as the chair of the all-party parliamentary group on data analytics. This is a subject, of course, that is very dear to our hearts. I will just say that there is a great deal of common ground on it. I commend my hon. Friend the Member for Bristol North West for trying to put it into the Bill, because I, too, think it needs to be put on a statutory basis. However, I will just draw attention to a lot of the very good work that has been done by a whole range of people in bringing forward the new structures.

I will just say again that in general I think we are heaping a huge amount of responsibility on the Information Commissioner; frankly, we are now almost inviting her to save the world. She and her office will need help. So an additional body, with resources, is required.

The Royal Society and the British Academy have done a lot of work on this issue over the last few years. I will conclude by referring back to a comment made by the hon. Member for Gordon, because it is worth saying that the Royal Society and the British Academy state in the conclusions of their report:

“It is essential to have a framework that engenders trust and confidence, to give entrepreneurs and decision-makers the confidence to act now, and to realise the potential of new applications in a way that reflects societal preferences.”

That is exactly the kind of thing we are trying to achieve. This body is essential and it needs to be set up as quickly as possible.

--- Later in debate ---

[Darren Jones]

I beg to ask leave to withdraw the new clause.

Clause, by leave, withdrawn.

New Clause 20

Automated number plate recognition (No. 2)

“(1) Vehicle registration marks captured by automated number plate recognition systems are personal data.

(2) The Secretary of State shall issue a code of practice in connection with the operation by the police of automated number plate recognition systems.

(3) Any code of practice under subsection (1) shall conform to section 67 of the Police and Criminal Evidence Act 1984.”—(Liam Byrne.)

This new clause requires the Secretary of State to issue a code of practice in connection with the operation by the police of automated number plate recognition systems, vehicle registration marks captured by which are to be considered personal data in line with the opinion of the Information Commissioner.

Brought up, and read the First time.

[Liam Byrne]

I beg to move, That the clause be read a Second time.

I will touch on this new clause only very briefly, because I hope the Minister will put my mind at rest with a simple answer. For some time, there has been concern that the way in which data collected by the police through automatic number plate recognition technology is not adequately ordered, organised or policed by a code of practice. A code of practice is probably required to put the police well and truly within the boundaries of the Police and Criminal Evidence Act 1984, the Data Protection Act 1998 and the Bill.

With this new clause, we are basically asking the Secretary of State to issue a code of practice in connection with the operation by the police of ANPR systems under subsection (1), and we ask that it conform to section 67 of the Police and Criminal Evidence Act 1984. I hope the Minister will just say that a code of practice is on the way so we can safely withdraw the new clause.

Data Protection Bill [ Lords ] (Fifth sitting)

Darren Jones Excerpts

Tuesday 20th March 2018 Public Bill Committees

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

I agree that these amendments ask a legitimate and important question about the level of safeguards on international data sharing by UK intelligence agencies. As it stands, clause 109 contains two fairly otiose sub-clauses to do with the sharing of personal data abroad by our intelligence agencies. In contrast, there is a whole chapter and a full seven clauses putting in place safeguards in relation to transfer to third countries by law enforcement agencies. These amendments borrow some of the safeguards placed on law enforcement agencies and there seems to be no good reason why that is not appropriate. I take the point that it does not necessarily follow that what is good for law enforcement agencies is definitely good for intelligence services. However, it is for the Government to tell us why those safeguards are not appropriate. If there are different ways for us to go about this, I am all ears, like the right hon. Gentleman. The right hon. Gentleman quite rightly raised the example of drones and US attacks based on information shared by personnel. At the moment, the lack of safeguards and of a very clear legal basis for the transfer of information can be lethal for billions and is dangerous for our personnel, as the Joint Committee on Human Rights has pointed out. We support the thrust of these amendments.

[Darren Jones (Bristol North West) (Lab)]

I declare my interests as set out in the Register of Members’ Interests.

[The Chair]

Order. The hon. Gentleman declared his interests in previous Committees, but I have been advised that he needs to specify what the interests are, as well as declaring them.

[Darren Jones]

Thank you, Mr Hanson. The two items on the register are, first, that I was a legal counsel at BT before my election as a Member of Parliament, where I was responsible for data protection law. Secondly, I had a relationship with a law firm called Kemp Little to maintain my practising certificate while I was a Member of Parliament.

My argument in support of amendment 160 is one that I have rehearsed in previous debates. In line with recommendations from the Joint Committee on Human Rights, today we benefit from an exemption under European treaties that say that national security is a member state competence and therefore not one with which the European Union can interfere. However, if the UK leaves the European Union, the European Commission reserves the right to review the entire data processing legislation, including that for intelligence services of a third country when seeking to make a decision on adequacy—as it has done with Canada. Where the amendment talks about adequacy, it would be helpful—

[Victoria Atkins]

Does the EU have an adequacy agreement with Canada?

[Darren Jones]

It does, but it has been reviewed by the European Commission. One of the concerns the Commission has had with Canada is its intelligence-sharing arrangements with the United States of America, which is why this amendment is so pertinent and why it is right to support the Government in seeking this adequacy decision. I make the point again that we will no longer benefit from the exemption if we leave the European Union and I hope that the Government keep that in mind.

[Victoria Atkins]

Before I start, I want to clarify what the hon. Gentleman has just said about adequacy decisions. Canada does have an adequacy decision from the EU for transfers to commercial organisations that are subject to the Canadian Personal Information Protection and Electronic Documents Act. I am not sure that security services are covered in that adequacy decision, but it may be that we will get assistance elsewhere.

As the right hon. Member for Birmingham, Hodge Hill is aware, amendments 159, 160 and new clause 14 were proposed by a campaigning organisation called Reprieve in its recent briefing on the Bill. They relate to concerns about the sharing of personal data with the US and seek to apply the data sharing protections designed specifically for law enforcement data processing, provided for in part 3 of the Bill, to processing by the intelligence services, provided for in part 4. That is, they are seeking to transpose all the law enforcement measures into the security services. However, such safeguards are clearly not designed for, and do not provide, an appropriate or proportionate basis for the unique nature of intelligence services processing, which we are clear is outside the scope of EU law.

Before I get into the detail of these amendments, it is important to put on record that the international transfer of personal data is vital to the intelligence services’ ability to counter threats to national security. Provision of data to international partners bolsters their ability to counter threats to their security and that of the UK. In a globalised world, threats are not necessarily contained within one country, and the UK cannot work in isolation. As terrorists do not view national borders as a limit to their activities, the intelligence services must be in a position to operate across borders and share information quickly—for example, about the nature of the threat that an individual poses—to protect the UK.

In the vast majority of cases, intelligence sharing takes place with countries with which the intelligence services have long-standing and well-established relationships. In all cases, however, the intelligence services apply robust necessity and proportionality tests before sharing any information. The inherent risk of sharing information must be balanced against the risk to national security of not sharing such information.

--- Later in debate ---

[Liam Byrne]

I did not say it was Government policy. I said that there are people within the Administration, including the Secretary of State for Environment, Food and Rural Affairs, who have made the argument for a British Bill of Rights that would remove Britain from the European convention on human rights and, therefore, the Council of Europe. I very much hope that that ambiguity has been settled and that the policy of the current Government will remain that of the Conservative party from now until kingdom come; but the key point for the Committee is that convention 108 is in draft. The modernisation is in draft and is not yet signed. We have heard an express commitment from the Minister to the signing of the thing when it is finalised. We hope that she will remain in her position, to ensure that that will continue to be Government policy; but the modernised version that has been drafted is not yet a convention.

[Darren Jones]

Does my right hon. Friend recognise that the modernisation process started in 2009, with rapporteurs including one of our former colleagues, Lord Prescott? When a process has taken quite so many years and the document is still in draft, it raises the question of how modern the modernisation is.

[Liam Byrne]

Some members of the Committee—I am one of them—have been members of the Parliamentary Assembly of the Council of Europe for some time. We know how the Council of Europe works. It is not rapid: it likes to take its time deliberating on things. The Minister may correct me, but I do not think that there is a deadline for the finalisation of the draft convention. So, to ensure that the Government remain absolutely focused on the subject, we will put the amendment to a vote.

Question put, That the amendment be made.

--- Later in debate ---

I am concerned that the way our regulators operate together is simply inadequate. Many of the allegations about misuse of data during election campaigns and referendums will touch on whether the data was collected, repurposed illegally and then used to target so-called dark social ads in an inappropriate way, but there is also sometimes a need to explore where the money came from to buy those ads. Where money has, potentially, been laundered onshore there is a requirement for the Financial Conduct Authority to investigate. Sometimes it will require further investigations in, for example, Financial Conduct Authority countries such as Gibraltar. At the moment, there is no information sharing gateway between the Financial Conduct Authority, the Electoral Commission and the Information Commissioner. It is actually impossible for any regulator to create a single picture of what on earth has gone on. That challenge gets even harder when the Information Commissioner does not have the power to get the information she needs to do her job.

[Darren Jones]

Does my hon. Friend agree that this is also a question of access to the judiciary? Last night, the Information Commissioner had to wait until this morning to get a warrant because no judges or emergency judges were available. At the same time, we assume that Facebook was able to exercise its contractual right to enter the offices of Cambridge Analytica. Emergency judges are available for terrorism or deportation cases. Should there not be access to emergency judges in cases of data misuse for quick regulatory enforcement too?

[Liam Byrne]

If I wanted to hide something from a newspaper and I thought that the newspaper was going to print it inappropriately, I would apply for an emergency injunction to stop the newspaper running it. I do not understand why the Information Commissioner has had to broadcast her intentions to the world, because that has given Cambridge Analytica a crucial period of time in which to do anything it likes, frankly, to its data records. The quality of the Information Commissioner’s investigation must be seriously impaired by the time that it has taken to get what is tantamount to a digital search warrant.

Is the Minister satisfied in her own mind that clause 131 and its associated clauses are powerful enough? Will she say more about the Secretary of State’s declaration to the House last night that he would be introducing amendments to strengthen the Commissioner’s power in the way that she requested? When are we going to see those amendments? Are we going to see them before this Committee rises, or at Report stage? Will there be a consultation on them? Is the Information Commissioner going to share her arguments for these extra powers with us and with the Secretary of State? We want to see a strong sheriff patrolling this wild west, and right now we do not know what the Government’s plan of action looks like.

Data Protection Bill [Lords] (Fourth sitting)

Darren Jones Excerpts

Thursday 15th March 2018 Public Bill Committees

[Victoria Atkins]

If I understand the hon. Lady’s argument correctly, she has presented the judicial commissioners as permitting, for example, warrant to be granted. Having sat through the Joint Committee on the Draft Investigatory Powers Bill and then the Public Bill Committee, I can tell her that I am afraid that is not how that Act works. What happens is that the Secretary of State grants the warrant and then that decision is overseen by the judicial commissioner. I will come on to the difference between the Investigatory Powers Act and this Bill in due course, because the terminology used draws on that in the Investigatory Powers Act, but that Act is very different from this Bill, which is about the processing of data, in its engagement with people and their rights.

[Darren Jones (Bristol North West) (Lab)]

Will the Minister give way on that point?

[Victoria Atkins]

If I may, I will make some progress. Along with existing provisions in section 28 of the 1998 Act, clause 27 provides for a certificate signed by a Minister of the Crown certifying that exemption from specified data protection requirements is required for the purposes of safeguarding national security. There are equivalent provisions in parts 3 and 4 of the Bill. Such a certificate is conclusive evidence of that fact, for example in any legal proceedings. That is the point about the certificates—they only come into play if the exemption or restriction is actually applied.

The certificate provides evidence that the exemption or restriction is required for the purpose of safeguarding national security. It therefore has relevance only in the event that, first, the exemption or restriction is applied to the data in question and, secondly, there is a need to rely on the certificate as conclusive evidence in proceedings to establish that the exemption or restriction is required for the statutory purpose.

--- Later in debate ---

[Victoria Atkins]

I will come on, if I may, to the judicial review test. I have quite a lot about that.

[Darren Jones]

Before the Minister does that, will she give way?

[Victoria Atkins]

I am grateful to have more time for my officials to scribble a response.

[Darren Jones]

I am happy to help the Minister. She keeps referring to the framework that has been in place for the last 30 years. That has been a time when we have been a member of the European Union. In reviewing this situation, the House of Lords European Union Committee made the point that under the treaty on the functioning of the European Union, there is absolute jurisdiction for national member states to take decisions on national security. That is not an EU area of jurisdiction. The treaty says that we are protected as a member of the EU, but if we leave the European Union we are not protected by that exemption under the treaty. That is why, for third countries, the European Commission looks at the whole legislative framework. Do we not risk the adequacy decision by taking this approach? In the future, we will not have the answer of saying that it is an issue of exemption from the European Commission.

[Victoria Atkins]

National security must always be a matter for any member state in the EU, but also once we leave the EU. Sorry, I may have misunderstood the hon. Gentleman, but how we deal with national security is, of course, a matter for the state.

[Darren Jones]

I am happy to clarify for the Minister. The status quo is that the European Union will not look at areas of national security because they are the jurisdiction of member states. When we leave the European Union, the Commission will look at the entirety of legislation around data protection and privacy rights, because there are no exemptions that it needs to take into account. The noble Lords made the point that our

“data protection standards would be assessed without the benefit of the protection afforded by the national security exemption”

under the treaty. Do we not risk our adequacy by taking these exemptions?

[Victoria Atkins]

No, because those who have drafted the Bill have sought, at all times, to comply with the law enforcement directive and with the modernised, draft Council of Europe convention 108. The Bill very much meets those standards, not just on law enforcement but across parts 3 and 4.

--- Later in debate ---

[Darren Jones]

I rise to support the amendments in the name of my hon. Friend the Member for Sheffield, Heeley. I had the pleasure of cross-examining Baroness Williams of Trafford, who is the Minister responsible for some of these issues, on the Select Committee on Science and Technology in our inquiry on the biometric strategy and why there has been such a delay in the Government publishing that document. We had grave concerns about the delay in the strategy, but also about the way in which IT systems and servers in different forces act in different ways, which make things potentially very difficult.

The amendments would add safeguards to legitimate purposes—to prevent them from going too far. They should be welcomed by the Government and included in the Bill. There are a number of situations where, in this developing area of technology, which could be very useful to us as a country, as my hon. Friends have said, we need to ensure that the appropriate safeguards are in place. On facial recognition, we know from information received by the Science and Technology Committee that there is too high a number of facial records on the police national database and other law enforcement databases, when there is no legitimate reason for them to be there. We understand that it is difficult to delete them, but that is, with respect, not a good enough answer.

The Select Committee also heard—I think I mentioned this in an earlier sitting—that we have to be careful about the data that the Government hold. The majority of the adult population already has their facial data on Government databases, in the form of passport and driving licence imagery. When we start talking about the exemptions to being able to share data between different Government functions and law enforcement functions, and the exemptions on top of that for the ability to use those things, we just need to be careful that it does not get ahead of us. I know it is difficult to legislate perfectly for the future, but these safeguards would help to make it a safer place.

I will mention briefly the IMSI-catchers, because that covers my constituency of Bristol North West. It was the Bristol Cable, a local media co-operative of which I am a proud member—I pay £1 a month, so I declare an interest—that uncovered some of the issues around IMSI-catchers with bulk collection of information. It is really important that when we are having debates, as we have had with algorithms and artificial intelligence, we recognise that human intervention and the understanding of some of these systems is sometimes difficult. There are very few people who understand how algorithms actually work or how the systems actually work. As they become more advanced and learn and make decisions by themselves, the idea of human intervention or a human understanding of that is increasingly difficult.

In a situation where human resource is extremely stretched, such as in the police service, the tendency will understandably be to rely on the decisions of the systems within the frameworks that are provided, because there is not time to do full human intervention properly. That is why the safeguards are so important—to prevent things getting ahead of us. I hope the Government support the amendments, which I think are perfectly sensible.

[Victoria Atkins]

I have just a small correction. The hon. Member for Sheffield, Heeley said in error that the Home Office were holding on to the photographs. It is not the Home Office. It is individual police forces that hold that.

Data Protection Bill [ Lords ] (Second sitting)

Darren Jones Excerpts

Tuesday 13th March 2018 Public Bill Committees

[Margot James]

The right hon. Member for Birmingham, Hodge Hill covered a lot of important ground. He mentioned the digital charter. We are bringing forward the digital charter and we do not intend for it to be set in stone. We recognise that this is a fast-changing environment and so it is deliberately something that will evolve over time. We both share the concerns that he expressed with regard to fake news and the rights and protections needed for children and young people who, as he says, make up a third of internet users. We will address many of the things he highlighted as part of our internet safety strategy, and I look forward to debating them further with him on Report.

To add to what we have already discussed under schedule 1, article 9 of the GDPR limits the processing of special categories of data. Those special categories are listed in article 9(1) and include personal data revealing racial or ethnic origin, health, political opinions and religious beliefs. Some of the circumstances in which article 9 says that special category data can be processed have direct effect, but others require the UK to make related provision.

Clause 10 introduces schedule 1 to the Bill, which sets out in detail how the Bill intends to use the derogations in article 9 and the derogation in article 10 relating to criminal convictions data to permit particular processing activities. To ensure that the Bill is future-proof, clause 10 includes a delegated power to update schedule 1 using secondary legislation. Many of the conditions substantively replicate existing processing conditions in the 1998 Act and hon. Members may wish to refer to annexe B to the explanatory notes for a more detailed analysis on that point.

[Darren Jones]

I want to make one point about schedule 1. Amendment 9, which was made this morning, allows democratic engagement to be a purpose under article 6(1)(e) of the GDPR—namely, that consent is not required for the processing of data for public interest or the exercising of official authority and the purposes of democratic engagement. I wonder whether the definitions of political parties and politicians under schedule 1 could be used to restrict that amendment, so that organisations other than political parties and politicians are not able to process data in the public interest for democratic engagement without consent. For example, if Leave.EU or Open Britain wanted to process our personal data, they ought to do so with consent, not using the same public interest for democratic engagement purposes as politicians or parties.

[Margot James]

I understand the hon. Gentleman’s concerns. The GDPR requires data controls to have a legal basis laid down in law, which can take the form, for example, of a statutory power or duty, or a common-law power. Any organisation that does not have such legal basis would have to rely on one of the other processing conditions in article 6. With regard to the amendment that was agreed to this morning, we think that further restricting clause 8 might risk excluding bodies with a lawful basis for processing. However, the hon. Gentleman is free to raise the issue again on Report.

Question put and agreed to.

Schedule 1, as amended, accordingly agreed to.

Clauses 11 to 13 ordered to stand part of the Bill.

Clause 14

Automated decision-making authorised by law: safeguards

--- Later in debate ---

[Brendan O'Hara]

The hon. Gentleman is absolutely correct; I was just getting on to the point about the information held by the Home Office. If it cannot be checked and if it is wrong at source, it is wrong at the end of the process. As far as I can see, there are no safeguards against that. He is absolutely correct that one early error in data collection and processing becomes an irrefutable and indisputable fact by the time it reaches the Home Office. The Home Office could then base its case against an individual on that wrong information.

The hon. Gentleman is right—as constituency MPs, there is not one of us, I am sure, who is not painfully aware of wrong information being held not just by the Home Office, but by a whole range of Departments. That makes the exemption fundamentally unfair. This is an issue of basic fairness and there is little wonder it has been so loudly and roundly condemned by civil liberties groups and many in the legal profession. If we go ahead with the schedule as it stands, it fundamentally changes how we can operate and how we can help people who require our assistance.

At the moment, we have subject access requests. As matters stand, the Home Office and the subject or their legal representative have a right to access the same information, on which legal claims and challenges are based. Surely, if both sides do not have access to the same information, the fairness of any legal proceedings is inevitably compromised. Subject access requests are often the only route through which a legal professional can make representations on very complicated issues on behalf of their client. Indeed, for clients who have been victims of domestic abuse and are fleeing an abusive partner, sometimes a subject access request is all that stands between them and a successful application to remain.

This exemption will reduce legal representatives’ ability to best represent their clients and it removes a fundamental tool for holding the Home Office to account when it either gets things wrong or chooses to ignore or misrepresent the facts. The exemption is fundamentally unfair and as unnecessary as it is disproportionate. I urge the Government to reconsider.

[Darren Jones]

I support the amendment tabled by my right hon. and hon. Friends, because there are some harsh realities about this exemption for effective immigration control, including the harsh reality that such an exemption right does not exist under the GDPR. Indeed, it is a new exemption compared with the law that exists today under the Data Protection Act 1998.

This broad, undefined exemption really must be restricted. I declare an interest. My wife is Australian and is here on a spousal visa. I therefore assume that, as a British citizen, I too could be subject to my rights being exempted for the effective control of immigration in order to understand what my wife is up to. I should declare for the record that her staying here in the UK is perfectly legitimate. This is a wide-ranging exemption that could apply to EU citizens, non-EU citizens and, as I say, British citizens who are connected with those who are subject to immigration controls.

This is not just an issue for the Home Office; there is data across various Departments that could be of use to the Home Office for the effective control of immigration. Indeed, we have been waiting for quite some time for the Government to publish the biometric strategy, setting out how they intend to use lots of biometric data across Government Departments. We have been waiting for a couple of years to see how the Government intend to do that.

My understanding is that if all the photographs held on our passports and driving licences were collated, in essence the Government would have the power to have a virtual ID card for the bulk of the adult population in this country. How on earth would that information be used for the effective control of immigration, which would potentially be applied to so many people here in the UK?

This exemption creates a derogation for many rights: the right to information, the right to access, the right to explanation, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, and all the principles set out in article 5 of the GDPR. This is an enormous derogation from rights that our colleagues in Europe think are important. Again, this relates to the risk of failing to seek adequacy in our negotiations with the EU.

I seek not only to support the amendment but to ask the Minister to clarify something. If the Government do not support the amendment, how does the exemption fit within the language of article 23 of the GDPR, which states that it can only exist

“when such a restriction respects the essence of the fundamental rights”—

which we have already noticed today are being repealed by this Government—

“and freedoms and is a necessary and proportionate measure in a democratic society”?

My assertion is that this exemption goes too far and, therefore, that the amendment tabled by my right hon. and hon. Friends is perfectly sensible. I look forward to it receiving Government support.

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

We have already heard three very good speeches in support of the amendment. I will not take too long to support pretty much everything that has been said so far. As a former troublesome immigration lawyer from back in the day—in fact, when the right hon. Member for Birmingham, Hodge Hill was busy making his reforms in the Department—I do not think that I could have lived it down if I had not said a few words in support of the amendment.

We must remember that the context for all this is that we have a Department—the Home Office—where, as the most recent statistics show, half of all immigration decisions that are challenged in a tribunal are overturned, which is a record high. The Home Affairs Committee has recently expressed grave concerns about the poor quality of decision making in far too many areas and the functioning of a hostile environment, for example in the area of bank checks, where there is something like a 10% error rate. We also live in a world where the creeping reach of the Home Office’s information tentacles is almost being seen to put off migrants from accessing necessary public services such as health, creating a public health danger.

To provide a massive and almost unlimited exemption from many of the key protections, as has been described, is not only unjustified but counterproductive, because rather than fixing the fundamental problems with Home Office decision making, it will make them worse by hiding them from view and from scrutiny. The Home Office, not for the first time, is being pretty greedy with the powers that it seeks, because even if we take out the exemption, as this amendment proposes, the Home Office will still have plenty of scope—perhaps too much scope—to do what it wants to do. Recent immigration Acts have created myriad criminal offences in the sphere of immigration law, so the Home Office can already rely on other exemptions within the Bill where necessary. What is absolutely lacking is any explanation of why the exemption is needed. Will the Minister explain what it is about current data protection laws that has unacceptably hindered Home Office operations? I have seen no evidence of that at all.

Another concern is that it is not just the Home Office that will benefit from this exemption but other organisations that are involved in immigration control, such as G4S in its operation of detention centres. There is no justification for that, but there are serious risks, harms and injustices that might be created by the proposed exemption.

As we have heard, subject access requests are regularly a crucial part of representing a migrant caught up in the immigration system. They can be used to establish statuses that have not been communicated or have been lost. They can be used to establish other crucial facts that have not been known to that individual or their representatives. They can, of course, be absolutely crucial in establishing that the Home Office has made errors, as all too many hon. Members will have experienced.

Members of the Committee have been provided with a host of examples by the Law Society, the Bar Council, the Immigration Law Practitioners’ Association and others. Those are real-life examples occurring day in, day out. Quite simply, the failure to allow those individuals access to data protection rights is not only a denial of those rights but a denial of access to justice altogether. This part of the Bill desperately needs reconsideration by the Government.

--- Later in debate ---

[Victoria Atkins]

Absolutely. The exemption will not be enacted on the basis of nationality. It is enacted on a case-by-case basis to uphold the integrity of the immigration system. There will be no question of EU nationals being in any way targeted by it. Indeed, we know the great effect that EU nationals and other people from other countries have had in this country, and we certainly would not be looking to target them on the basis of nationality.

[Darren Jones]

Is it not right to say that EU citizens will be part of the immigration system? They will be immigrants with immigration rights as part of the Brexit process. These rules could therefore apply to them, could they not? Secondly—

[Victoria Atkins]

I will answer the first one—yes. The hon. Gentleman asked whether EU citizens would be targeted. Once we leave the European Union, we will have our own immigration policy. There will clearly be no distinction between EU and non-EU, because everyone will be outside of the UK, if I may put it that way, very inelegantly.

[Darren Jones]

But they would still be subject to the right to exempt them from their data protection rights. I welcome the Minister’s comments on the time-limited nature of the intention of using the rules, but can she point me to the section of the Bill that defines that time limit, because I am struggling to find it?

[Victoria Atkins]

If I may, I will come back to that point in a moment. In the case of subject access requests, each request would need to be considered on its own merits. For example, we could not limit the information given to visa applicants on how their personal data would be processed as part of that application. Rather, the restrictions would be applied only where there was a real likelihood of prejudice to immigration controls as a result of disclosing the information concerned.

--- Later in debate ---

[Victoria Atkins]

I would not make that assumption. The vast majority of immigration cases are dealt with in a civil context.

[Darren Jones]

Will the Minister give way?

[Victoria Atkins]

No, forgive me. I have been very generous with interventions. I am going to make some progress, and then no doubt others will intervene on me in due course.

I turn to the charge that the exemption has no basis in EU law. Article 23 of the GDPR allows member states to restrict the application of certain provisions of the regulation to safeguard important objectives of general public interest. Immigration control constitutes one such objective. We see immigration as an important matter of public interest, and the GDPR allows member states to exempt rights where that is the case. We are not alone in our belief that immigration is an important matter of general public interest. The Irish Government clearly stated that in their own Data Protection Bill. Clause 54 of the Irish Bill gives powers to make regulations restricting certain rights and obligations under the GDPR to safeguard important objectives of general public interest. The list of such objectives in the Bill includes matter relating to immigration.

Opposition Members have talked about their concerns about the fact that these provisions may be covered by paragraph 2 of the schedule. I want to reflect on the outcome of the debate on this provision in the House of Lords, which contains many noble Lords who are extremely learned in the law, have much experience of campaigning on immigration rights and so on. We listened very carefully to the concerns raised at Lords Committee stage, and as a result the Government tabled amendments at Lords Report stage to narrow the scope of the exemption so that it no longer covers the right to rectification and data portability. In response to those amendments, Lord Kennedy of Southwark said:

“The amendments tabled by the Government provide important clarification on what is exempt, limit the power in Bill and seek to address the concerns highlighted during the previous debate and today…I am happy to support their amendments.”—[Official Report, House of Lords, 13 December 2017; Vol. 787, c. 1590.]

Furthermore, in a Division on a Liberal Democrat amendment to strike out the immigration exemption, the official Opposition abstained. I wonder what has changed between their abstaining on that amendment and accepting that the Government’s amendments were sufficient, and today. Nothing has changed since the Bill left the Lords, so perhaps the right hon. Member for Birmingham, Hodge Hill can help us with why their position has changed.

I hope I have been able to satisfy the Committee that this provision is necessary and important.

--- Later in debate ---

[Darren Jones]

I feel for the Under-Secretary, because she is on a bit of a sticky wicket given the Government’s drafting, but does my right hon. Friend agree that it is concerning that I asked twice to be pointed to specifics—I asked first how the pause is drafted in the Bill, and secondly where the word “immigration” appears under article 23 of the GDPR—but on neither occasion was I was pointed to them? We ought also to draw the Committee’s attention to the report on the Bill by the Joint Committee on Human Rights, which states:

“The GDPR does not expressly provide for immigration control as a legitimate ground for exemption.”

[Liam Byrne]

My hon. Friend is bang on the money, but perhaps the Under-Secretary can enlighten us.

Modern Slavery Act 2015

Darren Jones Excerpts

Thursday 26th October 2017 Commons Chamber

[Darren Jones (Bristol North West) (Lab)]

I congratulate my hon. Friend the Member for Gedling (Vernon Coaker) on bringing this important debate to the House. It goes without saying that human trafficking, sexual exploitation, forced labour, organ harvesting and servitude—to name but a few forms of modern slavery—are criminally deplorable, and for many people they go unseen. It is for this House and for others to make it clear that slavery continues to exist at every level of our society, including in my constituency. As my hon. Friend the Member for Bristol East (Kerry McCarthy) said, in July this year the Avon and Somerset constabulary raided a nail bar in my constituency, arresting four people on suspicion of human trafficking and slavery offences. In greater Bristol, further such raids have taken place in recent months.

A constituent came to see me at one of my first constituency surgeries as a new MP. She was tearful, she had little English, and she was unable to communicate the sheer disempowerment and lack of dignity that she had suffered through sexual exploitation in another part of the country. However, thanks to the Modern Slavery Act 2015, the modern slavery helpline and other organisations, she was being supported, even though the visa process at the Home Office was going very slowly. I know that the Minister is aware of that case.

Car washes and nail bars are a common location for these activities, and vigilance and local knowledge are required. I share other Members’ concern that the papers have reported a so-called backlash against the Avon and Somerset constabulary for raising this issue on social media in a way that communicates to people in their daily lives and asks them to keep an eye out for these activities. Along with my hon. Friends the Members for Bristol East and for Bristol West (Thangam Debbonaire), I too have proudly painted my nails today in support of the Avon and Somerset police’s “Let’s Nail It” campaign. Perhaps I am the first male MP to have painted nails in the Chamber. I should add the cautionary note that this is not an endorsement for Eddie Izzard’s candidacy for Labour’s national executive committee.

We know that much more needs to be done, but in the face of continued severe cuts to our policing, the job is becoming more difficult. I often stand here and say that Bristol is leading the way, and I am proud to say that that is also the case on this issue. In 2007-08, Andrew Wallis and friends in Bristol started conversations that led to the establishment of safe houses in 2011, a resettlement service in 2013, the Anti-Slavery Partnership in Bristol, and the headquarters of the national charity, Unseen, which now provides the national modern slavery hotline.

In true Bristol fashion, we are also innovating in the way we do things. As the hon. Member for Erewash (Maggie Throup) has mentioned, the “Transparency in Supply Chains” report—the TISC report—is the world’s largest open data register, helping to track and monitor compliance with the Modern Slavery Act 2015. It was built by Jaya Chakrabarti and friends in Bristol, and it provides a compliance solution that can prevent modern slavery. There is little point in legislating without enforcing. We have already heard about the difficulties for the police in enforcing the legislation in local communities due to funding cuts, and the TISC report has a growing list of more than 2,264 companies that continue not to comply with their reporting obligations under the Act. I do not know whether the Minister has seen the TISC Report, but if not, I would be happy to arrange for a copy to be sent to her. I hope that, in her summing up, she will set out what she will do to ensure that companies get in line, comply with the legislation and take this matter seriously.

Finally, I want to draw the Minister’s attention to the issue of construction projects. Where projects are entirely privately funded, the checks and balances built into public procurement process are often bypassed, and with the use of sub-contractors who sub-contract to sub-contractors, or the use of umbrella companies who sign the deal but do not directly employ workers themselves, the situation becomes much more complex. It is often at the depths of the sub-contractor chain that exploitation can take place. I raise this matter because I have significant construction projects in or near my constituency, including energy plants, Hinckley Point C and its supply chain, tens of thousands of new homes, expanding retail projects and major infrastructure upgrades in Bristol. I understand from trade union officials, who play a vital role in checking whether exploitation is happening on the shop floor and on the ground, that there are concerns about unethical working practices in my constituency that, in their view, approach modern slavery. I am working with them on that.

Learning lessons from the Welsh Government, who have addressed unethical working practices and modern slavery together to create ethical workplaces for constituents, I will begin work on a new project next year that will seek to eradicate unethical working practices and modern slavery from my constituency. To the individuals and companies who exploit or enslave my constituents and to those that exploit and enslave others within my constituency, let me be clear: you are on notice; you are not welcome; and we and our partners will ensure that you are prosecuted. But in order to do that work properly, I must work with businesses, trade unions and community groups and with important innovations such as the TISC report. We need proper Government enforcement, proper funding for policing and proper support from the Home Office for those who have been enslaved. I make a final plea to the Minister to set out how the Government, in the face of all the challenges, will ensure that the Modern Slavery Act—a good piece of legislation—is enforced properly and how we can work with partners to ensure that that is the case.