Data Protection and Digital Information Bill

Debate between Lord Clement-Jones and Lord Vaux of Harrowden

Committee stage
Wednesday 24th April 2024 Grand Committee

[Lord Clement-Jones (LD)]

My Lords, we have talked about proportionality and disproportionality throughout the debate on this Bill. Is it not extraordinary that that figure is not on the table, given the extent of these powers?

[Lord Vaux of Harrowden (CB)]

My Lords, the Minister was kind enough to mention me a little earlier. Can I just follow up on that? In the impact assessment, which I have here, nowhere can I find the £600 million figure, nor can I find anywhere the costs related to this. There will be a burden on the banks and clearly quite a burden on the DWP, actually, if it has got to trawl through this information, as the noble Viscount says, using people rather than machines. The costs are going to be enormous to save, it would appear, up to £120 million per year out of £6.4 billion per year of fraud. It does seem odd. It would be really helpful to have those cost numbers and to understand in what document they are, because I cannot find in the impact assessment where these numbers are.

[Viscount Younger of Leckie (Con)]

I hope I can help both noble Lords. Although I must admit that I have not read every single page, I understand that the figure of £500 million is in the IA.

Data Protection and Digital Information Bill

Debate between Lord Clement-Jones and Lord Vaux of Harrowden

Committee stage
Monday 22nd April 2024 Grand Committee

[Lord Vaux of Harrowden (CB)]

My Lords, I was not intending to speak on this group, but another question occurs to me. We have been assuming throughout this that we are talking about requests of information to banks, but the Bill actually says that:

“The Secretary of State may give an account information notice to a person of a prescribed description”.


Could the Minister explain what that is?

[Lord Clement-Jones (LD)]

My Lords, I would of course much prefer Clause 128 not to stand part, but we were just privileged by a master class from the noble Baroness, Lady Sherlock. She talked about these being probing amendments, but I do not think that I have seen a schedule so expertly sliced and diced before. If those are probing, they are pretty lethal. I agree with so many of those elements. If we are to have provisions, those are the kinds of additions that we would want and the questions that we would want to ask about them. I very much hope that the Minister has lots of answers, especially for the noble Baroness, Lady Sherlock, but also for the other noble lords who have spoken.

Data Protection and Digital Information Bill

Debate between Lord Clement-Jones and Lord Vaux of Harrowden

Committee stage
Wednesday 17th April 2024 Grand Committee

[Lord Vaux of Harrowden (CB)]

My Lords, I have added my name to Amendment 195ZA—I will get to understand where these numbers come from, at some point—in the name of the noble Lord, Lord Kamall, who introduced it so eloquently. I will try to be brief in my support.

For many people, probably most, the use of online digital verification will be a real benefit. The Bill puts in place a framework to strengthen digital verification so, on the whole, I am supportive of what the Government are trying to do, although I think that the Minister should seriously consider the various amendments that the noble Baroness, Lady Jones of Whitchurch, has proposed to strengthen parliamentary scrutiny in this area.

However, not everyone will wish to use digital verification in all cases, perhaps because they are not sufficiently confident with technology or perhaps they simply do not trust it. We have already heard the debates around the advances of AI and computer-based decision-making. Digital identity verification could be seen to be another extension of this. There is a concern that Part 2 of the Bill appears to push people ever further towards decisions being taken by a computer.

I suspect that many of us will have done battle with some of the existing identity verification systems. In my own case, I can think of one bank where I gave up in deep frustration as it insisted on telling me that I was not the same person as my driving licence showed. I have also come up against systems used by estate agents when trying to provide a guarantee for my student son that was so intrusive that I, again, refused to use it.

Therefore, improving verification services is to be encouraged but there must be some element of choice, and if someone does not have the know-how, confidence, or trust in the systems, they should be able to do so through some non-digital alternative. They should not be barred from using relevant important services such as, in my examples, banking and renting a property because they cannot or would prefer not to use a digital verification service.

At the very least, even if the Minister is not minded to accept that amendment, I hope that he can make clear that the Government have no intention to make digital ID verification mandatory, as some have suggested that this Part 2 may be driving towards.

[Lord Clement-Jones (LD)]

My Lords, this is quite a disparate group of amendments. I support Amendment 195ZA, which I have signed. I thought that the noble Baroness, Lady Jones, and the noble Lords, Lord Kamall and Lord Vaux, have made clear the importance of having a provision such as this on the statute book. It is important that an individual can choose whether to use digital or non-digital means of verifying their identity. It is important for the liberty and equality of individuals as well as to cultivate trust in what are essentially growing digital identity systems. The use of the word “empower” in these circumstances is important. We need to empower people rather than push them into digital systems that they may not be able to access. Therefore, a move towards digitalisation is not a justification for compelling individuals to use systems that could compromise their privacy or rights more broadly. I very much support that amendment on that basis.

I also very much support the amendments of the noble Baroness, Lady Jones, which I have signed. The Delegated Powers and Regulatory Reform Committee could not have made its recommendations clearer. The Government are serial offenders in terms of skeleton Bills. We have known that from remarks made by the noble Lord, Lord Hodgson, on the Government Benches over a long period. I am going to be extremely interested in what the Government have to say. Quite often, to give them some credit, they listen to what the DPRRC has to say and I hope that on this occasion the Minister is going to give us some good news.

This is an extremely important new system being set up by the Government. We have been waiting for the enabling legislation for quite some time. It is pretty disappointing, after all the consultations that have taken place, just how skeletal it is. No underlying principles have been set out. There is a perfectly good set of principles set out by the independent Privacy and Consumer Advisory Group that advises the Government on how to provide a simple, trusted and secure means of accessing public services. But what assurance do we have that we are going to see those principles embedded in this new system?

Throughout, it is vital that the Secretary of State is obliged to uphold the kinds of concerns being raised in the development of this DVS trust framework to ensure that those services protect the people who use them. We need that kind of parliamentary debate and it has been made quite clear that we need nothing less than that. I therefore very much support what the noble Baroness, Lady Jones, had to say on that subject.

--- Later in debate ---

[Lord Clement-Jones (LD)]

My Lords, in essence, the Minister is admitting that there is a gap when somebody who does not have access to digital services needs an identity to deal with the private sector. Is that right?

[Lord Vaux of Harrowden (CB)]

In the example I gave, I was not willing to use a digital system to provide a guarantee for my son’s accommodation in the private sector. I understand that that would not be protected and that, therefore, someone might not be able to rent a flat, for example, because they cannot provide physical ID.

[Viscount Camrose (Con)]

The Bill does not change the requirements in this sense. If any organisation chooses to provide its services on a digital basis only, that is up to that organisation, and it is up to consumers whether they choose to use it. It makes no changes to the requirements in that space.

I will now speak to the amendment that seeks to remove Clause 80. Clause 80 enables the Secretary of State to ask accredited conformity assessment bodies and registered DVS providers to provide information which is reasonably required to carry out her functions under Part 2 of the Bill. The Bill sets out a clear process that the Secretary of State must follow when requesting this information, as well as explicit safeguards for her use of the power. These safeguards will ensure that DVS providers and conformity assessment bodies have to provide only information necessary for the functioning of this part of the Bill.

--- Later in debate ---

[Lord Clement-Jones (LD)]

Before the Minister stands up, let me just say that I absolutely agree with what the noble Lord, Lord Bassam, said. Have the Government taken any independent advice? It is easy to get wrapped up in your own bubble. The Government seem incredibly blithe about this Bill. You only have to have gone through our days in this Committee to see the fundamental changes that are being made to data protection law, yet the Government, in this bubble, seem to think that everything is fine despite the warnings coming from Brussels. Are they taking expert advice from outside? Do they have any groups of academics, for instance, who know about this kind of thing? It is pretty worrying. The great benefit of this kind of amendment, put forward by the noble Baroness, Lady Jones, is that nothing would happen until we were sure that we were going to be data adequate. That seems a fantastic safeguard to me. If the Government are just flying blind on this, we are all in trouble, are we not?

[Lord Vaux of Harrowden (CB)]

My Lords, can I point out, on the interests of the EU, that it does not go just one way? There is a question around investment as well. For example, any large bank that is currently running a data-processing facility in this country that covers the whole of Europe may decide, if we lose data adequacy, to move it to Europe. Anyone considering setting up such a thing would probably go for Europe rather than here. There is therefore an investment draw for the EU here.

Register of Overseas Entities (Delivery, Protection and Trust Services) Regulations 2022

Debate between Lord Clement-Jones and Lord Vaux of Harrowden

Tuesday 12th July 2022 Grand Committee

[Lord Vaux of Harrowden (CB)]

My Lords, I start by thanking the Minister for arranging the recent meetings to which he just referred to show us the progress that has been made in creating the register of overseas entities and demonstrating the prototype. I was rather impressed by the progress and, in particular, the verification process that has been included.

The verification goes some way—further than I had expected—towards the suggestion that I and others raised in the debates on the Act, which was to have a regulated person sign off publicly that they have verified the information. We could still go a little further, by ensuring that the name of that person is shown up front and central in the publicly available database. I know it can be found, but I would like to see it in the key information on people involved in the entity, right alongside the beneficiaries, officers and directors. A search function that allows the database to be searched by verifier would also be a very useful tool. It would allow users to see whether any trends emerge and would soon highlight any enablers who are not taking the verification process seriously. The more publicly visible the verification is, the more likely it is to be taken seriously by those doing it.

I hope that the Government will look at strengthening that a bit but, more importantly, that the identities of those doing the verification will be rigorously checked, that the statistics will be closely monitored to identify any trends that emerge, and that action will be taken if it becomes clear, for example, that a small number of persons are verifying a disproportionate number of entities, especially entities registered in less than transparent locations.

I realise that that all relates to the SIs tabled under the negative procedure, but it is relevant to the instrument in front of us today, which mostly covers the rules that will allow the details of an entity to be kept private. Of course, there may be perfectly innocent reasons for that—for example, a celebrity who is worried about stalking, or things of that nature—but privacy must be the exception. These sorts of rules, if not rigorously applied, can creep to become the norm if we are not careful.

Can the Minister explain how the application of these rules for keeping details private will be monitored, and at what stage the Government would step in if there was evidence that the use of the rules was becoming more common than we would expect? What statistics will be available to the public about the use of these privacy rules? How will they be reported, and how regularly?

I am not completely clear which information will be private and which will be public if someone gets a dispensation. I spoke earlier about the verification process and the making public of the identity of the regulated person who carries out the verification being an important disincentive to casual, or even false, verification. If the details of the entity are private, will that also be private? If so, why? The identity of a regulated person is not likely to be sensitive. The regulations are to protect the privacy of people on an exceptional basis; they must not become a back-door way for enablers to avoid the disinfectant of publicity. The identity of the verifier should always be public. The Minister mentioned in his opening words the penalties for false filing that will apply to the directors and officers of the entity. Can he let us know what the penalties would be for a verifier who fails to verify appropriately?

[Lord Clement-Jones (LD)]

My Lords, first, I thank the Minister for his introduction and give apologies from my noble friend Lord Fox, who is unavoidably detained up a mountain. He would never normally miss an SI debate for the whole world. It is very good to see the noble Lord, Lord Vaux, in his place, as he played such a prominent role during the Bill’s Committee stage. Like him, I thank the Minister for arranging an extremely interesting and instructive hybrid demonstration of the digital application process, the way that it is put on the register and the way that the register will be maintained.

I want to speak to all three SIs, linked as they are, even if only one needs specific approval today. I welcome the speed at which the register is being brought into effect and echo the Minister’s praises for those who have been responsible for doing so. It goes quite some way to justify the rather cursory nature of the passage of the Act itself.

Of course, we still have unfinished business on the economic crime front and I hope very much that it is actively in the pipeline, to ensure that there are no kleptocrats or oligarchs out there who are unexposed. I hope that part 2 will consolidate the UK’s fragmented and ineffective anti-money laundering supervisory regime and reform corporate criminal liability law to ensure that it includes enablers. Enablers were very much the subject of our discussion in Committee. I hope that it combats the use of strategic litigation against public participation, which stifles public interest criticism of these characters, and empowers and resources Companies House to effectively monitor, verify and investigate suspicious companies. I hope that it will significantly increase resource for law enforcement agencies fighting economic crime and support whistleblowers to play an effective role in tackling economic crime. Could the Minister give us a little indication of when we might expect those goodies in the part 2 Bill?

On Regulation 7, I hope that the provisions regarding not putting information on the public register are rigorously applied. But I think there are questions when one looks through the regulation. Will certain elements of the enforcement and crime prevention authorities be consulted when an application under Regulation 7 takes place? What checks of the evidence provided by the applicant will be carried out? That is going to be an extremely important element to maintain that rigour.

As I said, we have had much discussion about enablers. It seems that those who do not comply with the requirements or make false returns on behalf of clients will be subject only to sanctions by their professional body or regulator. Have I got that right? I believe that that is what the Minister said when we had our demonstration. If that is correct, are there plans in part 2 to have sanctions on those professionals who give false verification under Section 16 of the Act, other than via professional bodies? Otherwise, it seems a very tame way of making sure that those who provide that verification do it honestly and with integrity.

It is notable that in this SI process the Act has actually been improved along the lines suggested in Committee by myself and my noble friend Lord Fox for overseas corporate trusts and nominee companies. I used the example of a Panamanian nominee company with multiple properties to point out the flaws in the original Bill. I believe—and I hope that the Minister can confirm—that that avenue is now completely closed, and that a Panamanian nominee trust company would have to disclose the beneficial ownership of every property in its portfolio.

I see that there is no impact statement. In fact, there is a statement in each SI that there is no impact from any of the SIs. That seems very strange. Is it a technicality? In other words, does the main impact come from the passing of the primary legislation? Or is it the case that this set of SIs and maintaining the register will have no impact? It seems extraordinary to put that statement into these SIs, when what they actually do is put into effect the really important part of part 1 of the economic crime legislation. I hope that the Minister can clarify where the Government believe that the impact is.

I have a little technical teaser for the SI team. I noticed that these regulations are made partly under Section 25(3) but not under Section 25(3)(e) and (g). Given that they are being made under paragraphs (a) to (d) and (f), that seems rather odd. Paragraph (e) is

“recording of restrictions in the register”

and paragraph (g) is

“the charging of fees by the registrar for disclosing information where the regulations permit disclosure, by way of exception, in specified circumstances.”

Since the SI specifically mentions the bits of the Act which are prayed in aid to make the regulation, it would be useful to know why these two paragraphs have been excluded.

We have three SIs here. Are any other SIs needed to bring the register into effect or is that it? Can we say it is done and dusted, all that needs to happen now is that Companies House gets on with it and the register will be open as soon as possible?

Finally, it would be useful to know from the Minister by when he expects the Crown dependencies and overseas territories to introduce public company ownership registers. I believe it was meant to be by the end of the year; are they still on track for that? In the meantime, will the Government ensure that the authorities in those dependencies and overseas territories will proactively share information with UK authorities to enable comprehensive sanctions designations?