Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

There are many potential uses for generative AI—we are in a period of early exploration—but I ask the Minister to think long and hard before giving up the protection of creatives and innovators with respect to their ideas and their works in the service of the claims of need from generative AI manufacturers. We need to interrogate why they really need copyrighted works in their training sets, and what service they are really going to deliver as a result of having them. If it is a matter of technical difficulties around not being able to differentiate copyrighted works, that is a problem to be solved, not a reason for abandoning copyright protection. And the people who solve problems are the creatives—the people whose livelihoods are under threat.

[Lord Arbuthnot of Edrom (Con)]

My Lords, as a former Chief Whip, I am all too well aware of the dangers of listening to a debate. However, I have to tell my noble friend Lord Camrose that I have been persuaded by what I have heard so far, and I am afraid that he may have a great deal of work to do to persuade me not to vote for this amendment.

[Lord Cashman (Non-Afl)]

My Lords, I have reluctantly stayed out of this debate precisely because I am a copyright holder with copyrights stretching back over several decades. But, having listened to the noble Baroness, Lady Kidron, and others, it would be entirely wrong of me to remain silent.

I have to express deep concern and disbelief that the Labour Party of Jennie Lee and of Chris Smith is proposing such a way forward. You cannot on the one hand talk about the importance to every single member of our country—whether at school or going to the high arts of opera—of the importance of the creative industries, and then, with legislation, begin their demolition.

The Government’s approach is entirely wrong. Yes, they can strip away my rights. Indeed, only last week I received the huge sum of £1.76 for a performance. But that £1.76 represented a contract between an artist and someone who used the artist’s material. We are destroying that principle of contract.

These amendments seem sensible, rational and reasonable, and they open the door for the development of AI in exactly the same way as when, as one of the offices of the British Actors’ Equity Association in the early 1990s, we were tasked with negotiating with the BBC, ITV and Channel 4 on the brilliant and new innovation of cable and satellite. We negotiated in order to try to protect artists, some hugely successful and some not so successful. Those negotiations took two years—although we do not have two years now—and at the start of them we were told that we would never reach an agreement. We reached an agreement, which has been adapted and adopted for all other forms of the use of television and audio material.

Are the Government seriously telling us that we do not have the wit, intelligence or drive as a country to come to an adequate negotiation that protects copyright and advances AI? If they are seriously telling us that, I urge noble Lords to disregard it. I urge your Lordships most of all to vote not for the Elton Johns or the Paul McCartneys but for that one person who might be relying on that £1.76, and support these amendments.

--- Later in debate ---

[Lord Holmes of Richmond (Con)]

My Lords, in moving Amendment 47, I shall speak also to Amendment 48.

Here we are again: the Computer Misuse Act 1990 is another year older. It was put into statute at a time when technology looked nothing like it did 10 or 20 years ago, never mind today. I will give some brief facts. We have a fantastic cyber sector in our country, which adds so much to our economy and safety. The Computer Misuse Act constrains the sector from keeping us as safe as it might and constrains businesses in terms of their growth and what they could be adding today to our economy in terms of—yes—growth.

There is no reason for us to continue with the Computer Misuse Act when we have the solution in our hands, set out, I suggest, in Amendments 47 and 48. Our cyber- security professionals, often working way out of sight, for obvious reasons, do such important work and professionally, diligently, keep us safe and keep our country, assets and economy secure.

When the Minister responds, will he say, even sotto voce, that a Division on these amendments might help him in his discussions within the department to get some movement on this issue? We heard in previous debates how doing this would be premature and how the time was not now. Well, for a statute that came into being at the beginning of the 1990s, I suggest that it is high time that we made these amendments for individuals, for businesses, for our economy and for our society, in an extraordinarily uncertain world and at a time when I imagine that every Minister should be looking to every potential source of economic growth. I look forward to the debate and to the Minister’s response. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, in Committee, the noble Baroness the Minister said there was no consensus on the best way forward to amend the law to provide protection for ethical hackers trying to work against cybercrime. All I ask is that noble Lords should read the amendment, which says:

“It is a defence to a charge … to prove that … the person’s actions were necessary for the detection or prevention of crime or … the person’s actions were justified as being in the public interest”.


What on earth could be wrong with that? I support my noble friend Lord Holmes of Richmond.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I am pleased to follow the noble Baroness, Lady Morgan, who did so much during the Online Safety Bill—now Act—to champion the issues that are now before us. She should get full credit for the first steps she made. I think I said it before, and I will say it again in her presence, that we thought we had achieved much of what we are talking about today in the final wind-up of that Bill, but we had to swap it for a slightly bigger prize and it fell down slightly on the list, so I feel very guilty about this and want to help to redress somehow the balance of the deficit that was created.

I do not want to get, in this House, any reputation for being a person who asks geeky questions about Third Reading issues, but the Minister will know that getting access to debates at Third Reading is tricky. It often requires the graven head of the clerk to nod very slowly at an appropriate moment, and I wonder if we could just rehearse that slightly so that we are quite clear exactly what the noble Baroness, Lady Morgan, was saying.

Am I right in saying that the intention—and good intentions are great—is that there will be a government amendment at Third Reading? Since it is being produced by the Government, there is not an issue for the clerk to nod at, because that is allowed. If there is a government amendment dealing with all the issues we raised today, then we are all in a good place. It is right that this House, which has done so much to come together to create it, gets the credit for this Bill going down to the Commons. That is appropriate and something that we should get right.

In the absence of the Bill—and I recognise that there are difficulties about drafting, and it may well be that we have a very short time between Report and Third Reading—would it not be appropriate for the Minister to say to the clerk that it is his intention that, if necessary, the noble Baroness, Lady Owen, may bring forward an amendment on these issues so that at least we get, if not all of the package, the parts that are relevant and most important to it in the Bill as it leaves this House? That would be helpful all round, and it would be in accordance with the sentiment of the House.

[Lord Arbuthnot of Edrom (Con)]

My Lords, I share in the congratulations of my noble friend Lady Owen. It has taken me about 10 years to begin to understand how this House works and it has taken her about 10 minutes.

I want to pursue something which bewilders me about this set of amendments, which is the amendment tabled by the noble Baroness, Lady Gohir. I do not understand why we are talking about a different Bill in relation to audio fakes. Audio has been with us for many years, yet video deepfakes are relatively new. Why are we talking about a different Bill in relation to audio deepfakes?

[Lord Clement-Jones (LD)]

My Lords, this has been a very interesting debate. I too congratulate the noble Baroness, Lady Owen, on having brought forward these very important amendments. It has been a privilege to be part of her support team and she has proved an extremely persuasive cross-party advocate, including in being able to bring out the team: the noble Baroness, Lady Kidron, the noble Lord, Lord Pannick, who has cross-examined the Minister, and the noble Lord, Lord Stevenson. There is very little to follow up on what noble Lords have said, because the Minister now knows exactly what he needs to reply to.

I was exercised by this rather vague issue of whether the elements that were required were going to come back at Third Reading or in the Commons. I did not think that the Minister was specific enough in his initial response. In his cross-examination, the noble Lord, Lord Pannick, really went through the key elements that were required, such as the no intent element, the question of reasonable excuse and how robust that was, the question of solicitation, which I know is very important in this context, and the question of whether it is really an international law matter. I have had the benefit of talking to the noble Lord, Lord Pannick, and surely the mischief is delivered and carried out here, so why is that an international law issue? There is also the question of deletion of data, which the noble Lord has explained pretty carefully, and the question of timing of knowledge of the offence having been committed.

The Minister needs to describe the stages at which those various elements are going to be contained in a government amendment. I understand that there may be a phasing, but there are a lot of assurances. As the noble Lord, Lord Stevenson, said, is it six or seven? How many assurances are we talking about? I very much hope that the Minister can see the sentiment and the importance we place on his assurances on these amendments, so I very much hope he is going to be able to give us the answers.

In conclusion, as the noble Baroness, Lady Morgan, said—and it is no bad thing to be able to wheel on a former Secretary of State at 9 o’clock in the evening—there is a clear link between gender-based violence and image-based abuse. This is something which motivates us hugely in favour of these amendments. I very much hope the Minister can give more assurance on the audio side of things as well, because we want future legislation to safeguard victims, improve prosecutions and deter potential perpetrators from committing image-based and audio-based abuse crimes.

--- Later in debate ---

[Lord Lucas (Con)]

My Lords, if we are to live in a data-rich world, we really need a set of well-understood, good definitions for the basic information we are collecting. At the moment, age is about the only stable personal characteristic, in that we generally know where it comes from, where it is recorded and can trust it. Name has become unstable: people are using name changing to hide previous criminal convictions, because we do not have a system of linking one name with another. Residence is widely abused by people who want to get their kids into the school of their preference.

Disability, ethnicity, sexuality and religion are all self-identified. We really need to understand why we are basing policy on something that is self-identified and whether we are collecting the right information for the policy uses we are making of it, particularly when, in areas such as employment, we are encouraging people to make particular choices because they are favoured in the employment advertisements. There is a collection of information there which we really ought to make an effort to be clear about if we are to make proper use of it and understand data going down the decades.

The definition we ought to do something about now is the protected characteristic of sex, because the misuse of sex and its conflation with gender has caused a whole suite of disadvantages and corruptions in the system. Basically, sex is simple: there are only two sexes. For the huge majority of humans, you can easily determine which sex they are. There are some for whom it is harder, but there are still only two sexes. We are in a situation where we record sex and use it to provide safe spaces for women, to have female sports, to know which prison to put someone in, to know how to record crime and, presumably, to know what action to take as a result of it.

Sex and knowing how women are doing is a really important thing to collect accurately, because there is a whole suite of areas in which women have been historically disadvantaged, such as in employment. It is well known that the standards in medical care have been set on men, not women, which has led to a series of disadvantages. We need accurate data. To my mind, rules based on reality and truth that are then adapted to people are much better than rules based on the way we wished things were, then trying to reconcile that with the truth.

We would do better for everybody—women in particular, but also people who identify as trans—if we based our description of them, when it comes to sex, on the truth. We would provide better healthcare, better protection, a much easier attitude to integration into society and proper provision for them. We should seek to do this. Truth should be the base of how we collect data; we should really insist on that. We should not corrupt our data but adapt our practice. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, this one should be easy. Last week, we passed amendments that said that the public authorities, in recording data on matters including sex, should do so accurately. Some might think that that should not be particularly controversial. This amendment says that the Government “may make regulations” about definitions of that sort of thing—that is “may”, not must. It is a negative resolution, not a positive one. It is not difficult, so let us do it.

--- Later in debate ---

[Baroness Kidron (CB)]

My Lords, I move Amendment 68 in my name and those of the noble Lords, Lord Arbuthnot, Lord Holmes and Lord Clement-Jones. This amendment has been debated several times within this Bill and its predecessor; however, this version differs slightly in approach. The objective remains the same: to overturn the common-law assumption in both civil and criminal law that computers are infallible.

This assumption has led to untold injustice. Innocent people have lost their lives, freedom and livelihoods because the law wrongly assumed that computers are never wrong. This of course is nonsense, as explained in detail in our last debate, at column GC 153 of Hansard. In summary, computer systems are very susceptible to both human and technological error. Indeed, the presence of bugs is normal, anticipated and routine in all contexts other than the court.

As with previous iterations of this amendment, Amendment 68 overturns that common-law assumption, but the drafting now closely mirrors provisions under the Electronic Trade Documents Act 2023, which was enacted in recognition that the majority of trade documents are now electronic.

The ETDA ensures and assures the integrity of electronic trade documents. It was put in place to protect those on both sides of the trade, so I am curious, at the very least, as to why we will be able to consider the efficacy of computer evidence in relation to trade but not in our legal system. I am also concerned that the MoJ, under several Governments, has been so slow to recognise the scale of the problem of this assumption, which one of my most experienced computer science colleagues described as “wicked nonsense”.

In brief, the amendment provides that the electronic evidence produced by or derived from a computer may be relied upon as evidence where that evidence is not challenged and where the court is satisfied that the evidence can be relied upon. The rest of the amendment is carefully drafted by legal experts and computer scientists with legal expertise to support the court in coming to a meaningful assessment of whether to be satisfied, or not, that the evidence can be relied upon.

This proposal has been tried and tested within our legal system. We know that it works, and I therefore see no reason why the Government should not simply accept it. However, rather than discuss it, the Government chose to announce, last week, a consultation on computer evidence. The call for evidence is a source of significant frustration for those of us who have championed this issue, as is the fact that the promised meeting with the MoJ did not happen before that announcement, in spite of repeated requests.

In her introductory remarks to the consultation, the Minister for Justice, Sarah Sackman, says that the purpose of the consultation is to help her department

“better understand how the current presumption concerning the admissibility of computer evidence is working in practice, and whether it is fit for purpose in the modern world”.

This is a backward step. The evidence that presumption is not working and is not fit for purpose is overwhelming and decades long; what are needed now are solutions, one of which is before us tonight.

Moreover, the Government’s preference for doing everything behind doors has sunk their own consultation. Had experts been consulted, the first thing they would have pointed out is that the scope is insufficient because it does not address civil proceedings but only criminal proceedings, even though the presumption is the same for both. This means that, at best, the Government’s consultation can lead only to a partial solution.

We in this House have discussed this issue in the case of the postmasters; it is a case that is front of mind. This approach may have spared those postmasters who were subject to criminal prosecutions, but not those such as Lee Castleton who was subject to civil proceedings by the Post Office, which chased him to bankruptcy. He was also branded a thief, spat at and verbally abused in the street. He developed post-traumatic stress disorder. His wife developed epilepsy from stress, his daughter developed an eating disorder and his son remains so traumatised that he cannot be in a room where someone says the words “Post Office”. A solution that does not prevent the injustice done to Lee and his family from happening to others is not fit for purpose. If the MoJ had done us the courtesy of a meeting, this could have been avoided.

I am sure the Minister will assure us that the Government are acting, but for those whose lives have been ruined, those who have fought for too many years on this issue, the consultation creates the spectre of yet another battle and further delay when the solutions are here and at hand. I want nothing more than to be wrong on this, and for the Government to prove me wrong. But for past victims, for lawyers and experts who have given their time so generously, and for those whose lives will be ruined because the computer got it wrong, half a consultation on a matter so well-established and urgent is a pretty poor result. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, as so often, I listened with awe to the noble Baroness. Apart from saying that I agree with her wholeheartedly, which I do, there is really no need for me for me to add anything, so I will not.

[Lord Clement-Jones (LD)]

My Lords, I too am lost in admiration for the noble Baroness, Lady Kidron—still firing on all cylinders at this time of night. Current law is clearly out of touch with the reality of computer systems. It assumes an untruth about computer reliability that has led to significant injustice. We know that that assumption has contributed to miscarriages of justice, such as the Horizon scandal.

Unlike the amendment in Committee, Amendment 68 does not address the reliability of computers themselves but focuses rather on the computer evidence presented in court. That is a crucial distinction as it seeks to establish a framework for evaluating the validity of the evidence presented, rather than questioning the inherent reliability of computers. We believe that the amendment would be a crucial step towards ensuring fairness and accuracy in legal proceedings by enabling courts to evaluate computer evidence effectively. It offers a balanced approach that would protect the interests of both the prosecution and the defence, ensuring that justice is served. The Government really must move on this.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Report stage
Tuesday 21st January 2025 Lords Chamber

[Lord Arbuthnot of Edrom (Con)]

My Lords, I support my noble friend. I have a confession to make. Before this Bill came up, I foolishly thought that sex and gender were the same thing. I have discovered that they are not. Gender is not a characteristic defined in UK law. I believe that you are born with a biological sex, as being male or female, and that some people will choose, or need, to have a gender reassignment or to identify as a different gender. I thank the charity Sex Matters, which works to provide clarity on this issue of sex in law.

As my noble friend Lord Lucas said, the digital verification system currently operates on the basis of chosen gender, not of sex at birth. You can change your records on request without even having a gender recognition certificate. That means that, over the last five years, at least 3,000 people have changed their passports to show the wrong sex. Over the last six years, at least 15,000 people have changed their driving licences. The NHS has no records of how many people now have different sexes recorded from those they had at birth. It is thought that perhaps 100,000 people have one sex indicated in one record and a different sex in another. We cannot go on like that.

The consequences of this are really concerning. It means people with mismatched identities risk being flagged up as a synthetic identity risk. It means authorities with statutory safeguarding responsibilities will not be able to assess the risk that they are trying to deal with. It means that illnesses may be misdiagnosed and treatments misprescribed if the wrong sex is stated in someone’s medical records. The police will be unable to identify people if they are looking in the wrong records. Disclosure and Barring Service checks may fail to match individuals with the wrong sex. I hope that the Government will look again at correcting this. It is a really important issue.

[Lord Clement-Jones (LD)]

My Lords, I will speak to Amendments 7 and 9. Amendment 7 would require the Secretary of State to lay the DVS trust framework before Parliament. Given the volume of sensitive data that digital ID providers will be handling, it is crucial for Parliament to oversee the framework rules governing digital verification service providers.

The amendment is essentially one that was tabled in Committee by the noble Viscount, Lord Camrose. I thought that he expressed this well in Committee, emphasising that such a fundamental framework demands parliamentary approval for transparency and accountability, regardless of the document’s complexity. This is an important framework with implications for data privacy and security, and should not be left solely to the discretion of the Secretary of State.

The DPRRC in its ninth report and the Constitution Committee in its third report of the Session also believed the DVS trust framework should be subject to parliamentary scrutiny; the former because it has legislative effect, and it recommended using the affirmative procedure, which would require Parliament to actively approve the framework, as the Secretary of State has significant power without adequate parliamentary involvement. The latter committee, the Constitution Committee, said:

“We reiterate our statement from our report on the Data Protection and Digital Information Bill that ‘[d]ata protection is a matter of great importance in maintaining a relationship of trust between the state and the individual. Access to personal data is beneficial to the provision of services by the state and assists in protecting national security. However, the processing of personal data affects individual rights, including the right to respect for private life and the right to freedom of expression. It is important that the power to process personal data does not become so broad as to unduly limit those rights’”.


Those views are entirely consistent with the committee’s earlier stance on a similar provision in the previous Data Protection and Digital Information Bill. That was why it was so splendid that the noble Viscount tabled that amendment in Committee. It was like a Damascene conversion.

The noble Baroness, Lady Jones, argued in Committee and in correspondence that the trust framework is a highly technical document that Parliament might find difficult to understand. That is a bit of a red rag to a bull. However, this argument fails to address the core concerns about democratic oversight. The framework aims to establish a trusted digital identity marketplace by setting requirements for providers to gain certification as trusted providers.

I am extremely grateful to the Minister, the Bill team and the department for allowing officials to give the noble Viscount, Lord Camrose, and me a tutorial on the trust framework. It depends heavily on being voluntary in nature, with the UK Accreditation Service essentially overseeing the certifiers, such as BSI, Kantara and the Age Check Certification Scheme, certifying the providers, with the installation of ISO 17065 as the governing standard.

Compliance is assured through the certification process, where services are assessed against the framework rules by independent conformity assessment bodies accredited by the UK Accreditation Service, and the trust framework establishes rules and standards for digital identity verification but does not directly contain specific provision for regulatory oversight or for redress mechanisms such as a specific ombudsman service, industry-led dispute resolution or set contract terms for consumer redress or enforcement powers. The Government say, however, that they intend to monitor the types of complaints received. Ultimately, the scope of the framework is limited to the rules providers must follow in order to remain certificated and it does not address governance matters.

Periodic certification alone is not enough to ensure ongoing compliance and highlights the lack of an independent mechanism to hold the Secretary of State accountable. The noble Baroness, Lady Jones, stated in Committee that the Government preferred a light-touch approach to regulating digital verification services. She believed that excessive parliamentary scrutiny would hinder innovation and flexibility in this rapidly evolving sector.

The Government have consistently emphasised that they have no plans to introduce mandatory digital IDs or ID cards The focus is on creating a secure and trusted system that gives citizens more choice and control over their data. The attributes trust framework is a crucial step towards achieving the goal of a secure, trusted and innovative digital identity market—all the more reason to get the process for approval right.

These services will inevitably be high-profile. Digital ID is a sensitive area which potentially also involves age verification. These services could have a major impact on data privacy and security. Public debate on such a critical issue is crucial to build trust and confidence in these systems. Laying the DVS trust framework before Parliament would allow for a wider range of voices and perspectives to be heard, ensuring a more robust and democratic approval process.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

For the reasons that I have given, I think that the trust framework is a technical document and one best dealt with in this technical form. It is built on other assurance processes, with the United Kingdom Accreditation Service overseeing the conformity accreditation bodies that will test the digital verification services. In this case, our view is that it does not need to come under parliamentary scrutiny.

On Amendments 6 and 8 from the noble Lord, Lord Lucas, I am absolutely behind the notion that the validity of the data is critical. We have to get this right. Of course, the Bill itself takes the data from other sources, and those sources have authority to get the information correct, but it is important, for a digital service in particular, that this is dealt with very carefully and that we have good assurance processes.

On the specific point about gender identity, the Bill does not create or prescribe new ways in which to determine that, but work is ongoing to try to ensure that there is consistency and accuracy. The Central Digital and Data Office has started to progress work on developing data standards and key entities and their attributes to ensure that the way data is organised, stored and shared is consistent between public authorities. Work has also been commenced via the domain expert group on the person entity, which has representations from the Home Office, HMRC, the Office for National Statistics—importantly—NHS England, the Department for Education, the Ministry of Justice, the Local Government Association and the Police Digital Service. The group has been established as a pilot under the Data Standards Authority to help to ensure consistency across organisations, and specific pieces of work are going on relating to gender in that area.

The measures in Part 2 are intended to help secure the reliability of the process through which citizens can verify their identity digitally. They do not intervene in how government departments record and store identity data. In clarifying this important distinction, and with reference to the further information I will set out, I cannot support the amendments.

[Lord Arbuthnot of Edrom (Con)]

I would be grateful if the Minister could confirm whether he accepts that, on some occasions, passports and drivers’ licences inaccurately reflect the sex of their holders.

[Lord Vallance of Balham (Lab)]

I can be absolutely clear that we must have a single version of the truth on this. There needs to be a way to verify it consistently and there need to be rules. That is why the ongoing work is so important. I know from my background in scientific research that, to know what you are dealing with, data is the most important thing to get. Making sure that we have a system to get this clear will be part of what we are doing.

Amendment 6 would require the Secretary of State to assess which public authorities can reliably verify related facts about a person in the preparation of the trust framework. This exercise is out of scope of the trust framework, as the Good Practice Guide 45—a standard signposted in the trust framework—already provides guidance for assessing the reliability of authoritative information across a wide range of use cases covered by the trust framework. Furthermore, the public authorities mentioned are already subject to data protection legislation which requires personal data processed to be accurate and, where relevant, kept up to date.

Amendment 8 would require any information shared by public authorities to be clearly defined, accompanied by metadata and accurate. The Government already support and prioritise the accuracy of the data they store, and I indicated the ongoing work to make sure that this continues to be looked at and improved. This amendment could duplicate or potentially conflict with existing protections under data protection legislation and/or other legal obligations. I reassure noble Lords that the Government believe that ensuring the data they process is accurate is essential to deliver services that meet citizens’ needs and ensure accurate evaluation and research. The Central Digital and Data Office has already started work on developing data standards on key entities and their attributes to ensure that the way data is organised, stored and shared is consistent.

It is our belief that these matters are more appropriately considered together holistically, rather than by a piecemeal approach through diverse legislation such as this data Bill. As such, I would be grateful if noble Lords would consider withdrawing their amendments.