Data (Use and Access) Bill [HL]

Lord Leong Excerpts

Report stage
Tuesday 21st January 2025 Lords Chamber

[Viscount Camrose (Con)]

I thank the noble Baroness, Lady Kidron, for leading on this group, and the noble Lord, Lord Clement-Jones, for his valuable comments on these important structures of data communities. Amendments 2, 3, 4 and 25 work in tandem and are designed to enable data communities, meaning associations of individuals who have come together and wish to designate a third party, to act on the group’s behalf in their data use.

There is no doubt that the concept of a data community is a powerful idea that can drive innovation and a great deal of value. I thank the noble Lord, Lord Clement-Jones, for cataloguing the many groups that have driven powerful thinking in this area, the value of which is very clear. However—and I keep coming back to this when we discuss this idea—what prevents this being done already? I realise that this may be a comparatively trivial example, but if I wanted to organise a community today to oppose a local development, could I not do so with an existing lawful basis for data processing? It is still not clear in what way these amendments would improve my ability to do so, or would reduce my administrative burden or the risks of data misuse.

I look forward to hearing more about this from the Minister today and, ideally, as the noble Baroness, Lady Kidron, said, in a briefing on the Government’s plan to drive this forward. However, I remain concerned that we do not necessarily need to drive forward this mechanism by passing new legislation. I look forward to the Minister’s comments.

Amendment 42 would require the Information Commissioner to draw up a code of practice setting out how data communities must operate and how data controllers and processors should engage with these communities. Amendment 43 would create a register of data communities and additional responsibilities for the data community controller. I appreciate the intent of the noble Baroness, Lady Kidron, in trying to ensure data security and transparency in the operation of data communities. If we on these Benches supported the idea of their creation in this Bill, we would surely have to implement mechanisms of the type proposed in these amendments. However, this observation confirms us in our view that the administration required to operate these communities is starting to look rather burdensome. We should be looking to encourage the use of data to generate economic growth and to make people’s lives easier. I am concerned that the regulation of data communities, were it to proceed as envisaged by these amendments, might risk doing just the opposite. That said, I will listen with interest to the response of noble Lords and the Minister.

[Lord in Waiting/Government Whip (Lord Leong) (Lab)]

My Lords, I rise to speak to Amendments 2, 3, 4, 25, 42 and 43. I thank the noble Baroness, Lady Kidron, and the noble Lord, Lord Clement-Jones, for these amendments on data communities, which were previously tabled in Committee, and for the new clauses linking these with the Bill’s clauses on smart data.

As my noble friend Lady Jones noted in Committee, the Government support giving individuals greater agency over their data. The Government are strongly supportive of a robust regime of data subject rights and believe strongly in the opportunity presented by data for innovation and economic growth. UK GDPR does not prevent data subjects authorising third parties to exercise certain rights on their behalf. Stakeholders have, however, said that there may be barriers to this in practice.

I reassure noble Lords that the Government are actively exploring how we can support data intermediaries while maintaining the highest data protection standards. It is our intention to publish a call for evidence in the coming weeks on the activities of data intermediaries and the exercise of data subject rights by third parties. This will enable us to ensure that the policy settings on this topic are right.

In the context of smart data specifically, Part 1 of the Bill does not limit who the regulations may allow customers to authorise. Bearing in mind the IT and security-related requirements inherent in smart data schemes, provisions on who a customer may authorise are best determined in the context of a specific scheme, when the regulations are made following appropriate consultation. I hope to provide some additional reassurance that exercise of the smart data powers is subject to data protection legislation and does not displace data rights under that legislation.

There will be appropriate consultation, including with the Information Commissioner’s Office, before smart data schemes are introduced. This year, the Department for Business and Trade will be publishing a strategy on future uses of these powers.

While the smart data schemes and digital verification services are initial examples of government action to facilitate data portability and innovative uses of data, my noble friend Lady Jones previously offered a meeting with officials and the noble Baroness, Lady Kidron, to discuss these proposals, which I know my officials have arranged for next week—as the noble Baroness indicated earlier. I hope she is therefore content to withdraw her amendment.

[Baroness Kidron (CB)]

Before the Minister sits down, may I ask whether there is a definition of “customer” and whether that includes a user in the broader sense, or means worker or any citizen? Is it a customer relationship?

[Lord Leong (Lab)]

My understanding is that “customer” reflects an individual, but I am sure that the Minister will give a better explanation at the meeting with officials next week.

[Lord Clement-Jones (LD)]

Again before the Minister sits down—I am sure he will not be able to sit down for long—would he open that invitation to a slightly wider group?

[Lord Leong (Lab)]

I thank the noble Lord for that request, and I am sure my officials would be willing to do that.

[Baroness Kidron (CB)]

My Lords, I do not intend to detain the House on this for very long, but I want to say that holding meetings after the discussion on Report is not adequate. “Certain rights” and “customer” are exactly the sort of terms that I am trying to address here. To the noble Viscount—and my noble friend—Lord Camrose, I say that it is not adequate, and we have an academic history going back a long way. I hope that the meeting next week is fruitful and that the Government’s enthusiasm for this benefits workers, citizens and customers. I beg leave to withdraw the amendment.

--- Later in debate ---

[Viscount Camrose (Con)]

My Lords, I will speak to Amendments 11 and 13 in my name and that of my noble friend Lord Markham. The national underground asset register contains the details of all underground assets and apparatus in England, Wales and Northern Ireland, or at any rate it will do as it goes forward. This includes water pipes, electricity cables, internet cables and fibres—details of the critical infrastructure necessary to sustain the UK as we know it.

Needless to say, there are many hostile actors who, if they got their hands on this information, would or could use it to commit appalling acts of terror. I am mindful of and grateful for the Government’s assurances given in Committee that it is and will be subject to rigorous security measures. However, the weakest link in cyber defence is often third-party suppliers and other partners who do not recognise the same level of risk. We should take every possible measure to ensure that the vital data in NUAR is kept safe and shared only with stakeholders who have the necessary security provisions in place.

For this reason, I have tabled Amendment 11, which would require the Secretary of State to provide guidance to relevant stakeholders on the cybersecurity measures which should be in place before they receive information from NUAR. I do not believe this would place a great burden on government departments, as appropriate cybersecurity standards already exist. The key is to ensure that they are duly observed.

I cannot overstate the importance of keeping this information secure, but I doubt noble Lords need much convincing on that score. Given how frighteningly high the stakes are, I strongly urge the most proactive possible approach to cybersecurity, advising stakeholders and taking every possible step to keep us all safe.

Amendment 13, also tabled in my name, requires the Registrar-General to make provisions to ensure the cybersecurity of the newly digitised registers of births, still-births, and deaths. There are a great many benefits in moving from a paper-based register of births and deaths to a digitised version. People no longer have to make the trip to sign the register in person, saving time and simplifying the necessary admin at very busy or very difficult points in people’s lives. It also reduces the number of physical documents that need to be maintained and kept secure. However, in digitising vast quantities of personal, valuable information, we are making a larger attack surface which will appeal to malign actors looking to steal personal data.

I know we discussed this matter in Committee, when the noble Baroness the Minister made the point that this legislation is more about a digitisation drive, in that all records will now be digital rather than paper and digital. While I appreciate her summary, I am not sure it addresses my concerns about the security risks of shifting to a purely digital model. We present a large and tempting attack surface, and the absence of paper back-ups increases the value of digital information even more, as it is the only register. Of course, there are already security measures in place for the digital copies of these registers. I have no doubt we have back-ups and a range of other fallback opportunities. But the same argument applies.

Proactive cybersecurity provisions are required, taking into account the added value of these registers and the ever-evolving threat we face from cybercriminals. I will listen with great interest to the thoughts of other noble Lords and the Minister.

[Lord Leong (Lab)]

My Lords, I thank the noble Viscount, Lord Camrose, and the noble Lord, Lord Markham, for these amendments. Clause 56 forms part of NUAR provisions. The security of NUAR remains of the utmost importance. Because of this, the Government have closely involved a wide range of security stakeholders in the development of NUAR, including the National Protective Security Authority and security teams from the asset owners themselves. Providing clear acceptable user and usage policies for any digital service is important. As such, we intend to establish clear guidance on the appropriate usage of NUAR, including what conditions end users must fulfil before gaining access to the service. This may include cybersecurity arrangements, as well as personal vetting. However, we do not feel it appropriate to include this in the Bill.

Care must be taken when disclosing platform-specific cybersecurity information, as this could provide bad actors with greater information to enable them to counter these measures, ultimately making NUAR less secure. Furthermore, regulations made in relation to access to information from NUAR would be subject to the affirmative procedure. As such, there will be future opportunities for relevant committees to consider in full these access arrangements, including, on an individual basis, any security impacts. I therefore reassure noble Lords that these measures will ensure that access to NUAR data is subject to appropriate safeguards.

Science and Technology: Economy

Lord Leong Excerpts

Thursday 31st October 2024 Lords Chamber

[Baroness Neville-Jones (Con)]

My Lords, I am lucky enough to be one of the Members of this House who is on the Science and Technology Committee. I very much welcome this debate and the excellent introduction that the noble Viscount, Lord Stansgate, gave it.

The excellent briefing that we received, among many others, from the Library, for which I thank it, rightly says that it is hard to measure the value of the contribution made by science and technology to the UK economy because of its all-pervasive nature and the fact that it is growing all the time. I also want to emphasise the general scene and the many problems we face, but one thing that is reassuring is the recognition across the Benches of this House, and indeed in Parliament generally, of the fundamental importance and quality of the scientific work and technological development that takes place in this country, and the opportunity we now have to make good on it to further benefit our own society and, more broadly, the population of the world.

I will make one point about something rather concerning that is connected to that. Science and technology, as a topic, is beginning to become a source of hostility and tension in international relations. One only has to think of the way in which the Chinese are exploiting it. Far from being a binder among nations, it can very easily become a source of real competition, hostility and seriously malign action. We should bear in mind that the liberal democracies do not have an agreed strategy on how to deal with this, but we need to develop one. We should not go on refraining from tackling the issue because it is difficult, even though that is the case. If we do not tackle it, we will find in due course that the extent to which science and technology can benefit society is greatly reduced by the potential problem of conflict.

Returning to the UK, something puzzling about our situation is that we are a society with a reputation for science and innovation, but we seem to lag behind in what we ought to be good at, which is greater productivity. How come we have this contradiction? Our universities are the bedrock of our capability; their graduates feed our independent laboratories and learned societies, and their geographical spread helps to keep our educational disparities under control. However, as has been rightly said, they are not going to survive the financial situation in which they now find themselves. I am very concerned that we are about to witness a drama if that situation is not gripped.

The public sector needs to intervene, but I do not believe that it can deal with the whole thing. What is notable is that private sector companies, which used to be great sources of R&D themselves, no longer—with some notable exceptions—play that role. It is very important that they begin to move closer to universities, so that they themselves become sources of innovation. Whacking up the tax on them does not help with the notion that they will engage in greater investment. The Chancellor said yesterday that the public spending outlined will crowd in private investment, but I worry that it might crowd it out.

The low skills base is another problem we need to tackle. As the noble Lord, Lord Mair, rightly said, it is a soluble problem, and other people have models that we ought to draw on. We are making heavy weather of that, and we ought to do better.

I will make just one last point. The difficulties British start-ups face when they want to scale up are well known. Our relatively small economy, openness and English language make us an attractive research destination, but they also make us vulnerable to poaching. We have to inculcate the habit of investing in our intellectual property and rewarding higher-risk, higher-reward propositions. If we do that, we will go a long way towards dealing with the issue of our lag in productivity.

[Lord Leong (Lab)]

My Lords, the advisory speaking time for this debate is four minutes. I gently urge all noble Lords to keep within this time limit so that the debate can finish at a reasonable time.