Data Security: UK Citizens

Debate between Lord Clement-Jones and Baroness Ramsey of Wall Heath

Tuesday 8th September 2026 Lords Chamber

[Baroness Ramsey of Wall Heath (Lab)]

I note my noble friend’s point about the safety, security and sovereignty of UK citizens’ data. This Government will continue to pay close attention to how UK citizens’ data is transferred overseas and processed by non-UK data controllers. For our adequacy decisions, DCMS undertakes active ongoing monitoring processes, including the tracking of changes to relevant legislative frameworks and case law within third countries.

[Lord Clement-Jones (LD)]

My Lords, we welcome the return of data protection to DCMS. The Government’s own Data (Use and Access) Act replaced the “essentially equivalent” test for adequacy for international data transfers with a lower threshold of “not materially lower”. Does the Minister accept that this weaker standard leaves UK citizens’ data more exposed to the gaps in foreign countries’ protections? What monitoring of that effect are the Government carrying out to safeguard real UK sovereignty over our data?

[Baroness Ramsey of Wall Heath (Lab)]

Our priority is the protection of UK citizens’ personal data, and we will monitor our adequacy decisions with this in mind. The DCMS has a statutory duty to monitor all our data adequacy decisions and a duty to amend or revoke them if the Secretary of State becomes aware that the standard has fallen below that of the UK GDPR. Officials are monitoring all existing adequacy decisions on an ongoing basis and the DCMS Secretary of State must be satisfied that the level of data protection afforded to UK data subjects in a given country or territory is not materially lower than that of the UK GDPR.

Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Lord Clement-Jones and Baroness Ramsey of Wall Heath

Committee stage
Monday 7th September 2026 Grand Committee

[Viscount Camrose (Con)]

My Lords, I thank the noble Lord, Lord Clement-Jones, for opening the final day of Committee. For a Bill of such importance, I am surprised at the speed of our progress. However, if quantity has been low, quality has more than compensated.

I agree with the noble Lord that this Committee deserves rather more justification from the Government as to the need for the powers they are granting themselves. The Delegated Powers and Regulatory Reform Committee described the Clause 37(7) power as “unusual” and “novel”, capable of watering down requirements for consultation as it is not constrained by set criteria. The Government’s justification thus far for this power is that it allows them to

“prioritise the content of the code of practice, rather than arbitrary requirements”.

It sounds to me rather as if the Government’s position is that they see any set requirements for consultations and codes of practice as arbitrary. If that is the case—I would appreciate clarification from the Minister—I have to agree with the committee’s description that the position is “quite extraordinary”.

By the way, I noted this morning that the Chancellor of the Duchy of Lancaster has demanded an end to the culture of consultation. I fear that that will be quite a wrench for the former DSIT and its functions, it having launched four new consultations on a single day in July without having responded to the more than 11,000 responses to the AI and copyright consultation. We are already unclear about the machinery of government for that former department. Can the Minister tell us whether its existing and planned consultations will continue or whether today’s announcement represents a fundamental change of approach?

It is not clear why the power conferred by Clause 40(5) has to be sufficiently broad to allow the Government to water down the contents of reports on network and information systems. Could it not be amended, as the committee has recommended, so that the power cannot be used to reduce the requirements to report? It is not unreasonable to question whether the Government really need these extensive powers. Your Lordships’ Committee deserves at least more justification than the Government describing set criteria as arbitrary. I appreciate the need for flexible and adaptive approaches to legislating for fast-moving technologies, but that must come with accountability and I am not sure that we have the balance right at this point. I look forward to the Minister’s response.

[Baroness in Waiting/Government Whip (Baroness Ramsey of Wall Heath) (Lab)]

I thank the noble Lord for his Amendments 92C and 95C, and note that these amendments were recommended by the Delegated Powers and Regulatory Reform Committee in its report of 17 July. Some noble Lords may be aware that, until very recently, I was the chair of that committee. I am wondering how best to describe myself: am I gamekeeper turned poacher or poacher turned gamekeeper? I had better let noble Lords decide at the end of my responses.

These delegated powers were included to prevent a scenario where procedure takes priority over the best possible products, whether that be a code of practice or a report on the legislation. The delegated powers will not allow Ministers to bypass Parliament. They are about ensuring that government can respond quickly and effectively to new threats and new technologies that could undermine our national security. The law has always been slower than innovation, and it is unlikely to catch up unless we change our approach. Ministers must provide clear justification and carry out assessments before regulations are laid before Parliament.

On the code of practice, we anticipate that any code will be updated from time to time to remain effective, in line with the latest recommended good practice, evolving threat information and emerging technologies. Any revisions and reissues of a code of practice must first be consulted on with relevant stakeholders before they are effective.

On consultations, it might be above my pay grade to comment so soon after the Chancellor of the Duchy of Lancaster has commented, but I am sure that my noble friend the Minister will have a further response to that at some point, possibly in writing.

I assure noble Lords that the Government are carefully considering the committee’s recommendations and the views of noble Lords today, and will reflect accordingly ahead of Report. My noble friend the Minister will respond formally to the Delegated Powers and Regulatory Reform Committee in the usual manner ahead of Report.

[Lord Clement-Jones (LD)]

I thank the Minister for her response, which was the reverse of the usual ministerial response—the sting was not in the tail but at the beginning. The end was much more conciliatory, given that she said the Government will consider taking on board the DPRRC’s recommendations before Report. I very much hope they do. At this stage in Committee, of course, nothing gets decided, but I assure the Minister that, if this continues, and the Government do not respond in some shape or form to both those pretty solid recommendations from the committee, we will bring this back on Report.

When I say that the sting was in the beginning of the response, I mean that it was a bit surprising, given that the Minister has been the chair of the committee and knows the seriousness with which we all take its recommendations. A huge amount of work goes into the detail, and she knows how much store we place on the recommendations. I hope that she will use all her influence to make sure that the Government introduce before Report something along the lines of what I have produced. In the meantime, I beg leave to withdraw Amendment 92C.