Cyber Security and Resilience (Network and Information Systems) Bill

Alex Sobel Excerpts

Report stage & 3rd reading
Tuesday 16th June 2026 Commons Chamber

[Matt Western (Warwick and Leamington) (Lab)]

It is a pleasure to follow the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith). I concur with the points he made on Jimmy Lai and Jagtar Singh Johal and, more widely, about the internet of things. I think of Norway and Denmark, which suddenly realised that hundreds of buses they had imported from China had kill switches, meaning that their entire public transport networks could potentially have been disabled, just like that. That is the reality of these new technologies, and we need to face up to it and have our eyes wide open in the contracts and deals that we sign.

On Second Reading five months ago, I welcomed the Cyber Security and Resilience (Network and Information Systems) Bill, but even in the short time since then, the world has become an ever more dangerous place, and the cyber-threat has only intensified. I commend the Government on their hard work in the intervening period, and in my remarks today I want to focus on the cyber-threat landscape, my two amendments—new clause 21 and amendment 28—and the need for a national conversation on national security, which of course includes cyber-security.

Let me start with the cyber-threat landscape. The UK is the most cyber-attacked nation in Europe and the third most cyber-attacked nation globally, with three in four businesses having suffered a cyber-attack in the past year. My hon. Friend the Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah) talked about the attacks on Jaguar Land Rover, Marks & Spencer, the Co-op and others. Having spoken with those businesses with the Joint Committee on the National Security Strategy and individually, I know of the scale of the impact that was felt within their operation and how affected they were by these attacks. It is unimaginable, even for the most seasoned business and industry leaders, to suddenly find themselves under such attack, and the repercussions for the economy have been very significant.

In April, the CEO of the National Cyber Security Centre, Richard Horne, laid out the scale of cyber-attacks: on average, the NCSC deals with around four nationally significant incidents a week—that is not the hundreds of incidents that are occurring every day, but the really serious, significant ones. The threat of cyber-attacks will only intensify. Continued state-backed cyber-attacks from Russia, China and Iran, either directly or via proxies, are being fuelled by technological advancements in AI and quantum computing, increasing the complexity and sheer volume of such attacks. The reality is that major cyber-attacks are no longer rare one-offs but an operational reality facing every business and organisation—public and private—across the UK, as they are globally. It is important that we secure our systems to make them more robust and deter such attacks, so that those who wish to do us harm will go after others. It is in this context that the Bill has been introduced, and it takes serious, robust steps to increase the resilience of the UK.

However, given the escalating threat picture, I continue to have concerns about the scope and breadth of the Bill. That is why I have tabled new clause 21 and amendment 28, which I hope the Minister will reconsider. New clause 21 would bring those in the food supply chain within the scope of the NIS regulations and regulate them as “operators of essential services”, while excluding smaller businesses, to avoid an unnecessary administrative burden. I understand that the Minister addressed this on Second Reading, explaining that essential services would only include those sectors

“the failure of whose network and information systems poses imminent threat to life to the British public.”—[Official Report, 6 January 2026; Vol. 778, c. 225.]

I would gently suggest that the collapse or disruption of the food supply chain would pose an imminent threat to life. I say that in an honest and not patronising way. Those of us who have had conversations behind the scenes about what happened during the pandemic, and Opposition Members who were far closer to that when in government, will realise that the health threat was one element, but the collapse of society—not just the economy, but society—with the potential for civil unrest and rioting, due to the lack of food and toilet rolls on shelves and so on, would have been the most urgent and pressing issue. It is worth noting that the European Union’s NIS2 directive does include food distribution in its regulation, so it is feasible and recognised internationally as important. The Bill does grant the Secretary of State powers to bring in new sectors. Could the Minister reassure me that the Department will give this due consideration today and in the future?

Secondly, amendment 28 would ensure that relevant managed service providers do not provide services to manage the technology systems for a number of customers that exceeds a critical risk threshold within the same sector or subsector. The rationale behind this is simple: it is about building resilience and ensuring that if one RMSP fails or is breached, a whole sector is not hamstrung by it. I can envision a situation whereby one particular RMSP dominates a large category or small subsector that may be a crucial part of a supply chain, thereby crippling the whole chain. Indeed, my hon. Friend the Member for Newcastle upon Tyne Central and West cited the UK Government’s dependency on AWS and Microsoft as an example. Will the Minister please consider that?

Aside from my two amendments, it is clear that the Bill, in itself, is not the only answer to our cyber-resilience; multiple approaches are needed. Given that the Bill does not include large swathes of the economy or local government, it is even more important that we explain to businesses and the public the very real threats that we face. That brings me to my final point, which is on the need for a national conversation on national security. We can have the best crafted and tightest legislation and regulation, but unless we have a real cultural shift and acknowledgment of the cyber-threat and its impacts, from board level to entry-level positions, all of this will be wasted. I once again encourage the Department and the whole machinery of government to go further and faster in explaining the threat posed and the steps we can all take to boost resilience, because resilience starts with the mobile phone in our pocket, and cyber-security is only as strong as its weakest link.

The Joint Committee on the National Security Strategy, which I chair, has begun its inquiry into building national resilience through a national conversation. It is clear from the evidence we have heard from Taiwan, the Netherlands and other European nations I have spoken to that we need to explain the threat to people, build a stronger cultural sense of resilience and explain that we all have a role to play; it is not simply the state’s responsibility. I will update the House on our findings in due course, and I hope the Minister and the Government will find that useful when considering their plans for national resilience.

To conclude, this Bill is a substantial and serious step forward in protecting the UK from cyber-attacks. It makes us more resilient and strengthens our collective security, but there are areas where I encourage the Government to be more ambitious—namely, by bringing the food supply chain into the essential services classification, as Europe is doing; setting critical risk thresholds for RMSPs; and expanding the scope of the Bill to encompass more of the economy.

[Alex Sobel (Leeds Central and Headingley) (Lab/Co-op)]

It is a pleasure to follow such esteemed colleagues. My only declaration before I start my speech is that I hold a degree in information systems from the University of Leeds.

I have been sat here for the last two hours looking at the memorial plaque for Jo Cox, 10 years after the horrific day that we lost Jo. I was a West Yorkshire candidate alongside Jo in the run-up to the 2015 election. It is to my huge detriment that I never got to serve with her here. Today is such a difficult day for so many colleagues. I know that Jo would have dearly liked to see many of the things that Labour is doing in government. It is incumbent on us to try to push forward all the things that Jo strived for, to make this place better, to make the country better and to make the world better.

Let me now turn to cyber-security. Data centres are warehouse-like facilities that house the information technology equipment upon which almost all digital activity relies. The UK Government say that they

“underpin almost all economic activity and innovation, including the development of AI and other technology, public service delivery”

and modern-day communications. Europe’s largest data centre market is Greater London, where most of the UK data centres are concentrated. There are four types of data centre, one being AI data centres, which are facilities specialised for the high-performance computing needs of AI development and AI models. Having data centres based in the UK allows our Government to regulate them, such as by requiring them to meet cyber-security standards and reduce their environmental impact, which is obviously very important.

Data centres are an essential part of our critical national infrastructure. They have a huge environmental impact so must be managed carefully, but the benefits of having them on our home turf is that we can regulate them. In our current state of hybrid war with Russia, it is vital to protect those data centres from any nefarious actors or cyber-warfare, and to strengthen their protections against cyber-attacks spawned by AI. Otherwise, the impact on public safety, the economy and society could be catastrophic.

--- Later in debate ---

[Kanishka Narayan]

I will give way to my hon. Friend the Member for Leeds Central and Headingley in the first instance and then to my hon. Friend the Member for Dunfermline and Dollar.

[Alex Sobel]

There is obviously a level of complexity here in relation to the data centre, AI development and the network in the UK and more broadly. Will the Minister therefore commit to a meeting with me and my hon. Friend the Member for Cowdenbeath and Kirkcaldy (Melanie Ward) to discuss this matter further?

[Kanishka Narayan]

I would be delighted to.

--- Later in debate ---

[Kanishka Narayan]

As ever, I would be delighted to work with the Chair of the Select Committee on a range of technology questions, including this one.

I am delighted with the support that this House has shown for the intention and principles of the Bill, and I am grateful for Members’ consistent, principled scrutiny.

[Alex Sobel]

On the amendment from the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith), I think we have made some progress with the Minister, but it is clear that trying to isolate the issues around fair trial from other matters is complex. Repeating my earlier call, will the Minister meet me, the right hon. Member for Chingford and Woodford Green and others who signed his amendment to explore the complexities of this after the debate?

Music Streaming: Label-led Principles

Alex Sobel Excerpts

Tuesday 22nd July 2025 Commons Chamber

[Chris Bryant]

Yes, I am more Wet Leg than Oasis as well.

[Alex Sobel (Leeds Central and Headingley) (Lab/Co-op)]

As co-chair of the all-party parliamentary group on music, I commend the Minister on doing an excellent job of bringing record labels into these new provisions. The history of the music industry is sadly full of tales of exploitation, and the industry has proved notable for its intransigence. Protecting the dignity of British songwriters by putting money in their pockets is a welcome step, and it is pleasing to see greater transparency over artists’ renegotiations. However, it is clear that the label provisions, as helpful as they are, do not change or rectify the economic injustice of the streaming model as it stands.

As the Minister knows, copyright law was not brought up to do date for streaming, never mind for what is approaching with AI. More than half the membership of the Musicians’ Union earn less than £14,000 a year. I commend the Minister for his efforts, but can he also offer Members reassurance that this is not job done, when so many music creators and workers are still so poorly served by current arrangements? What more is he going to do for new and emerging artists in terms of the streaming model?

[Chris Bryant]

The one bit we have not been able to address is the amount of money that goes from the streamers themselves directly to the record labels. That is an international settlement, so it is more difficult for us to address. There was a time, when I first arrived in the House, when musicians were getting absolutely nothing and the amount of money going to record labels and musicians fell off a cliff because of pirated music. Spotify and other streaming services then came into the equation and managed to rectify some of that, but the situation is far from ideal.

I wish more of the money was going directly to the artists. It is my own personal decision that I do not stream music; I buy music, because I think more of the money goes to the artists that way. But of course, for millions of people in the UK—even for the Swiftie over there on the Opposition Benches, the right hon. Member for New Forest East (Sir Julian Lewis)—I am sure that streaming is a convenient way of accessing music that they might never have come across otherwise.

Pride Month

Alex Sobel Excerpts

Monday 23rd June 2025 Commons Chamber

[Alex Sobel (Leeds Central and Headingley) (Lab/Co-op)]

In the words of the organisation Stonewall:

“Pride Month 2025 is grounded in this year’s powerful theme, activism and social change. It’s a reminder of how far the LGBTQI+ community has come and how much work still needs to be done.”

I would like to thank Stonewall, Trans+ Solidarity Alliance and Rainbow Migration for their vital work, which I have relied on in understanding the challenging issues facing the LGBT+ community. Rainbow Migration in particular supports LGBT+ people through the asylum and immigration system. Its work is pivotal to a number of constituents of mine who have fled their country and identify as LGBT+. They are seeking support in the UK, where they can feel like their true selves.

Rainbow Migration has asked Home Office Ministers to remove blanket inadmissibility provisions for so-called “safe states” such as Albania, Georgia and India. For example, Noah, a gay Georgian and former service user of Rainbow Migration, had the following lived experience of a “safe state”. Noah fled homophobic persecution in Georgia. He was extremely fearful of being sent back there, saying that he would rather take his own life than go back and face persecution. He said:

“No one can know that you are gay in Georgia. If people do, homophobic people will try to attack you. Either with words, or they’ll try to beat you.”

Noah was physically attacked by family members. He was forced to stay in a hospital for people with mental health issues and had an exorcism performed on him at church. Thankfully, he was granted refugee status due to the risk of harm, but he is deeply concerned about Georgia’s designation as safe. He says:

“Georgia cannot be considered a safe country. They don’t know what is going on in Georgia—how the LGBT people are living there. They cannot understand. The last time that Pride took place, the television operator was killed. Who will come and say Georgia is a safe country after that? If you’re gay, your two options are either hospital or exorcism.”

How can we in this country describe Georgia as safe for LGBT people?

In 1997, under the last Labour Government, the first positive recognition of same-sex relationships in UK law was introduced for migrants. The unmarried partners concession made it possible for same-sex couples to make an application for a partner of a British citizen to remain in the UK if they had lived together for four years. It paved the way for greater legislative equality for same-sex couples, and it was the first time same-sex relationships were recognised positively in British law.

Being an ally is about reflecting on how to contribute to lasting social change and acting on that reflection, so I agree with Rainbow Migration in calling for an asylum and immigration system that treats LGBT people with dignity.

Unfortunately, the UK’s current legal framework for dealing with inequality and discrimination is creaking under the weight of the culture wars. Legislation such as the Equality Act 2010 and the Human Rights Act 1998, which were designed to protect the most marginal and vulnerable in society, have been weaponised by those who seek to promote exclusion and social division, with this year’s Supreme Court ruling and the subsequent guidance by the EHRC causing widespread fear among the trans community.

At a time of rising discrimination, the UK should reassert its commitment to the value of equality, instead of creating a set of contested rights that dehumanise the most marginalised. It can do this in a powerful way by signing and ratifying protocol 12 to the European convention on human rights, which creates a general prohibition on discrimination. The UK is one of only nine countries in the Council of Europe not to have signed protocol 12. Everyone in the UK would benefit from access to the human right of the general prohibition on discrimination, including LGBTQI+ people.

Data (Use and Access) Bill [Lords]

Alex Sobel Excerpts

3rd reading
Wednesday 7th May 2025 Commons Chamber

[Siân Berry (Brighton Pavilion) (Green)]

I rise to speak to new clause 15, but I also want to associate myself with the many right hon. and hon. Members who have spoken up for our creative industries. Our most talented and creative minds have not been getting fair representation from the Government up to now, and this has been a very interesting, well informed and, hopefully, influential debate today. New clause 15 is about privacy, safety and providing a dedicated complaints procedure for individuals including victims of modern slavery, domestic abuse, gender-based violence and for others at risk of serious harm if their personal data is mishandled.

This is not a theoretical question. Last November, The Independent reported on Lola, a domestic abuse victim whose home address was leaked to her ex-partner by a company that obtains restraining orders. She said that she was left fearing for her life. As the Open Rights Group has laid out in its briefing, the Information Commissioner’s Office is not functioning as it should be in cases such as this. I have many examples—including how Charnwood district council sent details of the new address of an abused woman directly to her abuser at her former address, so that her abuser knew where she lived—yet people placed at risk in this way currently have no means of challenging the Information Commissioner’s Office if it fails to take the right action, which happens too often. New clause 15 simply proposes dedicated procedures to support vulnerable people making complaints and a right to appeal to the Information Tribunal, a route currently available to large tech firms but not to the people harmed by their practices. I hope that Ministers will take these proposals up.

On other amendments, I fully back the Liberal Democrats on new clauses 2 to 6, which I am signed up to. I personally will abstain from voting on the Liberal Democrats’ new clause 1 and on the Conservatives’ new clause 19. This is because, although I am minded to increase the age of digital consent from 13, given the wider implications of harmful content and data that can be collected and used to do harm, my discussions locally with parents and young people in Brighton Pavilion have led me to want to properly include both groups in any decision on what that new age should be, given that it would cut people off from social media. We must have rapid and real processes of deliberation on this issue as soon as possible that are not just consultative but collaborative.

Finally, new clause 21 is of serious concern to my constituents, and I agree with them and TransActual that it would constitute a gross violation of privacy rights by creating a mass outing of trans people. Subsection (1)(d) of this new clause even goes so far as to seek to revert historical changes made to someone’s gender marker. I urge the Government to reject this and to act further to protect trans rights more broadly.

[Alex Sobel (Leeds Central and Headingley) (Lab/Co-op)]

I rise to speak to my new clause 14 and amendment 10. Furthermore, I would like to make note of my steadfast opposition to new clause 21, which does not simply change data collection. It proposes to mark and track individuals based on “sex at birth”, regardless of their lived reality, legal recognition or consent. No one—not a Government, not a public authority, not a politician—has the right to define who another person is; only the individual can do that. This is a fundamental principle of dignity and respect that transcends political views and legal debates. We must reject new clause 21.

Moving on to my new clause 14, it is widely accepted that AI has already ingested everything on the internet, whether it be music, films or books, yet there is no legal requirement on these companies to disclose what they have used, making it difficult for musicians and authors to enforce their rights and, crucially, to be paid for their work. So I urge the Minister to give a commitment to legislating for transparency to protect the creative industries.

I note the Government’s new clauses 16 and 17 as a starting point, but we both know that we want to see a thriving licensing market between content creators and AI developers. A transparency commitment today would enable that licensing market as creators would be in a position to enforce their rights and demand fair pay. There would be certainty for AI developers, removing the risk of mitigation in the future. Without transparency, there is no incentive for AI firms to reach agreements with creators, and billionaire-owned tech firms will continue to rip off musicians, filmmakers and authors.

[Chris Hinchliff (North East Hertfordshire) (Lab)]

Does my hon. Friend agree that new technology should be a tool to improve lives, not just a mechanism for funnelling more wealth and power into the hands of already super-rich corporations? Does he agree that the Bill would benefit from going even further in providing greater transparency?

[Alex Sobel]

My new clause 14 would do that, so I hope the Government are taking note.

This debate is not just about economic rights. Last week I learned about the holocaust survivor Renee Salt, whose book “A Mother’s Promise” was ripped by AI, with similarly named books appearing online days after the original was released. There can be no starker contrast than Renee sharing her most traumatic experiences for the benefit of others, and a computer algorithm stealing from a Holocaust survivor to profit from her suffering. We must stand up for the human creativity that helps us to process the world we live in, or the world will become a much darker place.

I tabled amendment 10, which relates to safe data transfer, in order to confront a glaring weakness in our current data protection regime through the continued transfer of UK user data to jurisdictions that cannot and do not provide basic legal protections or enforceable rights. The need for the amendment is not theoretical. Under current rules, companies often rely on a set of contracts—international data transfer agreements—as proof that data transfers will be adequately protected. However, that assumption is increasingly proving to be false.

The Irish Data Protection Commission fined TikTok €530 million after an in-depth inquiry into its transfers of European Economic Area user data to China. The Irish authorities found that TikTok had failed to adequately assess whether Chinese law provided a level of protection “essentially equivalent” to that guaranteed under GDPR— the General Data Protection Regulation. The ruling was possible because there are no credible legal remedies in China. Laws such as the national intelligence law, the cyber-security law and the anti-terrorism law compel organisations to provide access to data without judicial oversight or meaningful recourse for individuals. China is unable to provide a level of protection “essentially equivalent” to that guaranteed in the Data Protection Act 2018 and in this Bill.

Contracts alone do not protect users when the legal system of the receiving country is incompatible with fundamental rights. This amendment introduces a clear rule: where there is no meaningful enforcement of data rights, no independent judiciary, no administrative remedy or no legal path to challenge unlawful access, such countries will be deemed unsafe for UK data transfers. The Bill must address this critical blind spot. Contracts alone cannot ensure user rights in jurisdictions that offer no legal safeguards. This amendment provides a principled, legally sound and urgently needed response to a real-world threat. I hope that the Minister, given his background, will take these issues seriously and meet me to look further at how we can close this loophole.

Data (Use and Access) Bill [Lords]

Alex Sobel Excerpts

2nd reading
Wednesday 12th February 2025 Commons Chamber

[Jonathan Davies]

My hon. Friend is right. There are tremendous opportunities to anticipate people’s needs throughout their lives and also drive scientific innovation, so that we can live longer and healthier lives. The Health Secretary and other Ministers have been clear that the huge investment that the Government are making in public services must go hand in hand with reform, since change will not be delivered solely by spending more money, and this Bill will help to make that possible.

I am also pleased that the Government will strengthen safeguards on personal data. That is key to ensuring that people have trust in the services that they use, and to preventing those who would exploit personal data from being able to do so. I look forward to following that aspect of the Bill as it progresses through its future stages.

I also wish to touch on the national underground asset register—a national map of the UK’s underground infrastructure. In Derbyshire, people find it so frustrating to find that their street, their road, or the highway that they use has been dug up again by yet another utility company, or another person who needs access to the cables or the infrastructure underground. Not only is that frustrating for people as they try to get around, but it is, I believe, undermining the integrity of the roads that we use and driving our pothole problems. I hope that, combined with our journey to local government devolution, our roads will be another area where people will be able to see a tangible difference.

During the Bill’s passage through the House of Lords, efforts were made to strengthen copyright protections for creators, including artists, photographers, authors, musicians, composers and lyricists. I welcome the work that the House of Lords has done to push those issues further up the agenda. Stronger protections for creators is something that I will always seek to support.

Artificial intelligence has benefits for sectors such as music, yet more transparency from AI firms on the music, art, and literature on which their systems draw is absolutely necessary. Although the technology is new, some of the arguments that we have heard here and today in the wider discourse on this Bill are decidedly not new. I am reminded of the 15th century—although I was not there—when Johannes Gutenberg rolled out his printing press for the first time. People were worried about the effect that that would have on scribes and the monks who transcribed the religious texts. The hon. Member for Perth and Kinross-shire (Pete Wishart), who is no longer in his place, spoke about the volumes of books that we have here in Parliament.

[Alex Sobel (Leeds Central and Headingley) (Lab/Co-op)]

I say gently to my hon. Friend that the difference is that then people understood from looking at the book whether it was printed or scribed, whereas with AI-generated works it is sometimes hard to distinguish, which is why we need labelling and additional consumer protections in this space.

[Jonathan Davies]

I thank my hon. Friend for his intervention. I shall get on to those points when I talk about the consultation that is currently under way.

We need to ensure that the benefits of AI are managed and that our creators are properly protected. This is a £120 billion industry, which employs more than 2 million people. It is an expression of who we are and contributes to our understanding of ourselves and each other, and it takes us on a journey where we can walk in somebody else’s shoes and build a more tolerant, cohesive and engaged society. If we do not get this right, all that is threatened. That would be bad not just for the global stars, the household names and the people whose records, CDs and downloads we have in our homes—

--- Later in debate ---

[Alex Sobel]

I visited Estonia last year and spoke to our ambassador there. We are now on our third agreement between the UK and Estonia on Government e-services and digital collaboration. That was underutilised by the previous UK Government. It would be great to see the Minister and his colleagues step up the work with Estonia and bring that sort of work here, given that those agreements are in place.

[Steff Aquarone]

This is absolutely not a pitch to be a member of the Bill Committee, but I would certainly be grateful for the opportunity to implement my views in the design and delivery of Britain’s very own Tiger Leap into the data-driven revolution.

Estonia is a crystal-clear example proving that the results of such a transformation are not just the preserve of tech geeks—a category into which I place myself—but provide tangible benefits for individuals, and not just by making them use digital stuff at the front end, which the hon. Member for Windsor (Jack Rankin) will be glad to hear. I think about the lady in her 90s whose Openreach engineer understandably refused her fibre upgrade because the local council had not shared with them the fact that she used a telecare device. I also think of the farmers who are baffled by the systems used to issue flood recovery payments, because the data is not transparent.