Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025

Debate between Lord Leong and Lord Stevenson of Balmacara

Monday 8th September 2025 Grand Committee

[Lord Stevenson of Balmacara (Lab)]

I am grateful to my noble friend for trying to explain the “just and reasonable” approach. Just to unpick what he said, what is Ofcom consulting about? There seems a disjuncture in what we are trying to do here. We are going to pass this regulation tomorrow—it will be in force in a couple of weeks, according to Ofcom—yet we still do not know whether Ofcom has completed its discussion about whether companies are prepared to accept “just and reasonable”. Is that a fair summary of where we are?

[Lord Leong (Lab)]

My noble friend makes a good point. Ofcom is consulting on the guidance to help providers understand the ways of apportioning revenue in a “just and reasonable” manner. Its guidance will hopefully be published in the last quarter of this year. Until such time, I am sure there will be further guidance for providers along the way.

To come back to the scrutinising of legislation, ongoing parliamentary scrutiny is crucial. Indeed, the Online Safety Act requires Ofcom’s codes to be laid in Parliament for scrutiny. The Secondary Legislation Scrutiny Committee continues to provide vital scrutiny of statutory instruments and has drawn special attention to several instruments that my department has laid in the past few months. It identified the instrument we are debating today as an instrument of interest. The Science, Innovation and Technology Select Committee and the Lords Communications and Digital Committee also play a vital role in scrutinising the regime.

Finally, the Secretary of State is required under Section 178 of the Act to review the effectiveness of its regulatory framework between two and five years after key provisions of the Act come into force. A report of the outcome of this review will be published and laid before Parliament.

Ofcom has said in response to the SLSC that it will review the information from providers and is able to use its powers to require further information under Section 100 of the Act should it need further details to scrutinise the approach taken by the provider—that is to do with the “just and reasonable” method. Ofcom has stated that it has access to sufficient expertise to make this assessment.

The noble Viscount, Lord Camrose, asked about exemptions. Under the Act, Ofcom has the power to make or revoke exemptions and this must be approved by the Secretary of State. Ofcom is proposing to exempt service providers whose UK referral revenue is less than £10 million. We will consider that carefully before deciding whether to approve the exemption. I am sure noble Lords will know that about 60 companies would probably fall within the bracket of the Ofcom fees regime—the majority of which are non-UK companies. I am sure noble Lords will also know that most of these companies have revenues in excess of £250 million. I would have thought that there are not many companies with revenue of less than £10 million.

In the last 12 months, we have seen key elements of the Online Safety Bill progressed and implemented. Many of Ofcom’s powers are now in effect. Platforms are now legally required to protect children from harmful content, including rolling out highly effective age assurance to tackle pornography, suicide, self-harm and eating disorder content. This instrument will bring us one step closer to a fully implemented online safety regime, ensuring that companies raising revenue from online services cover the cost of regulation—not taxpayers—and take responsibility for keeping our children safe online.

Data (Use and Access) Bill [HL]

Debate between Lord Leong and Lord Stevenson of Balmacara

Committee stage
Tuesday 10th December 2024 Grand Committee

[Lord Leong (Lab)]

My Lords, I thank noble Lords for another thought-provoking debate on consent in scientific research. First, let me set out my staunch agreement with all noble Lords that a data subject’s consent should be respected.

Regarding Amendment 70, Clause 68 reproduces the text from the current UK GDPR recitals, enabling scientists to obtain “broad consent” for an area of research from the outset and to focus on potentially life-saving research. This has the same important limitations, including that it cannot be used if the researcher already knows its specific purpose and that consent can be revoked at any point.

I turn to Amendments 71 and 72, in the name of my noble friend Lord Stevenson, on assessments for research. Requiring all research projects to be submitted for assessments could discourage or delay researchers in their important work, as various noble Lords mentioned. However, I understand that my noble friend’s main concern is around NHS data. I assure him that, if NHS data is used for research, individual patients cannot be identified unless either a patient has specifically agreed for that data to be shared or the Health Research Authority has approved an application for this information to be used, informed by advice from the independent and expert Confidentiality Advisory Group. Research projects using confidential patient data are always subject to rigorous governance, including the approval of an ethics committee; the Minister, my noble friend Lady Jones, mentioned this earlier. There are also strict controls around who can see the data and how it is used and stored. Nothing in this clause will change that approach.

I turn to Amendments 81 and 131 on consent. I understand the motivations behind adding consent as a safeguard. However, organisations such as the Health Research Authority have advised researchers against relying on consent under the UK GDPR; for instance, an imbalance of power may mean that consent cannot truly be “freely given”.

On Amendment 79, I am happy to reassure my noble friend Lord Stevenson that references to “consent” in Clause 71 do indeed fall under the definition in Article 4.11.

Lastly, I turn to Clause 77, which covers the notification exemption; we will discuss this in our debates on upcoming groups. The Government have identified a gap in the UK GDPR that may disproportionately affect researchers. Where data is not collected from the data subject, there is an exemption from notifying them if getting in contact would mean a disproportionate amount of effort. This does not apply to data collected from the data subject. However, in certain studies, such as those of degenerative neurological conditions, it can be impossible or involve a disproportionate effort to recontact data subjects to inform them of any change in the study. The Bill will therefore provide a limited exemption with strong safeguards for data subjects.

Numerous noble Lords asked various questions. They touched on matters that we care about very much: trust in the organisation asking for data; the transparency rules; public interest; societal value; the various definitions of “consent”; and, obviously, whether we can have confidence in what is collected. I will not do noble Lords’ important questions justice if I stand here and try to give answers on the fly, so I will do more than just write a letter to them: I will also ask officials to organise a technical briefing and meeting so that we can go into everyone’s concerns in detail.

With that, I hope that I have reassured noble Lords that there are strong protections in place for data subjects, including patients; and that, as such, noble Lords will feel content to withdraw or not press their amendments.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I thank those who participated in this debate very much indeed. It went a little further than I had intended in drafting these amendments, but it has raised really important issues which I think we will probably come back to, if not later in Committee, certainly at Report.

At the heart of what we discussed, we recognise, as the noble Baroness, Lady Kidron, put it, that our data held by the NHS—if that is a better way of saying it—is valuable both in financial terms and because it should and could bring better health in future. Therefore, we value it specifically among some of the other datasets that we are talking about, because it has a returning loop in it. It is of benefit not just to the individual but to the UK as a whole, and we must respect that.

However, the worry that underlies framing it in that way is that, at some point, a tempting offer will be made by a commercial body—perhaps one is already on the table—which would generate new funding for the NHS and our health more generally, but the price obtained for that will not reflect the value that we have put into it over the years and the individual data that is being collected. That lack of trust is at the heart of what we have been talking about. In a sense, these amendments are about trust, but they are also bigger. They are also about the whole question of what it is that the Government as a whole do on our behalf in holding our data and what value they will obtain for that—something which I think we will come back to on a later amendment.

I agree with much of what was said from all sides. I am very grateful to the noble Lords, Lord Kamall and Lord Holmes, from the Opposition for joining in the debate and discussion, and their points also need to be considered. The Minister replied in a very sensible and coherent way; I will read very carefully what he said in Hansard and we accept his kind offer of a technical briefing on the Bill—that would be most valuable. I beg leave to withdraw the amendment.