Leaving the EU: Data Protection

Alison Thewliss Excerpts

Thursday 12th October 2017 Commons Chamber

[Stephen Kerr]

I do not think that there is much virtue in rerunning the Brexit debate today, when we are discussing data, but I will say that it was well rehearsed, especially by the remain side, that leaving the European Union meant leaving the single market.

I am grateful for the opportunity to make a short contribution to this debate, and I do so from the perspective of having spent the past 30 years of my life in the world of sales. I should declare at the outset that I am a fellow of the Association of Professional Sales, a UK institution with a fast-growing global reputation. Its primary purpose is to raise the standard of sales professionalism, ethical sales conduct, and the overall talent and capability of sales professionals.

I recognise that this debate is about data protection as we leave the European Union, but let me be absolutely crystal clear: I am optimistic about the future of our country outside the European Union. I am not blind to the challenges that lie ahead, but I encourage Opposition Members who have a decided propensity to take a dim view of our future to brighten up. We have a great deal going for us in this country, and rather than cowering at the prospect of a global Britain, we should now embrace the opportunity.

So much of our national sales capability, which will be key to our global success, will hinge on our commitment to embracing new technologies. We in this country are driving the fourth industrial revolution, and I want our country, by which I mean—before my SNP colleagues shout, “Which country?”—the United Kingdom and Scotland—

[Alison Thewliss (Glasgow Central) (SNP)]

They are separate things.

[Stephen Kerr]

No, they are not separate things. I want our country to be at the forefront of this revolution, because it represents a massive competitive advantage and can be the primary means of unlocking the perplexing conundrum of Britain’s productivity gap.

The fourth industrial revolution is powered by data. It has already been said a number of times in this debate—perhaps it is a cliché—that data is the new oil. Increasingly, data makes the world go around. I am grateful to Guy Lloyd, a fellow of the Association of Professional Sales, for his graphic description of the digital age we live in, which is creating new information exponentially. Incredibly, 90% of data in the world today has been created in the past two years alone. Our current daily output of data is about the equivalent of 10 million Blu-ray discs which, if stacked, would be as high as four Eiffel towers. It does not take a genius to predict that, as the world becomes more connected and individuals become more empowered through technology, the data deluge will only increase.

Digital tools, fuelled by big data, are making it increasingly easy for business organisations to profile the marketplace they operate in, to identify the best potential customers for their business and to improve the effectiveness and efficiency of their lead generation activities. Using artificial intelligence search engines, businesses trawl company reports, social presence and analyst commentaries to find companies that are likely to have a problem suited to their offering, and then identify who to talk to and how to connect with them based on their prospects’ employee social profiles. Artificial intelligence will also identify problems in the prospect journey through the opportunity pipeline, even predicting possible issues before an initial engagement and suggesting workable solutions. The algorithmic examination of large amounts of data collected across the complex interactions of customers, and employees of customers, supports the design of much-improved customer experience. This is the world we are already living in.

Data protection should be about providing assurance that the data each of us provides to public bodies and private organisations is safe. The foundation principle of data protection must be trust. Each individual citizen must feel that their rights are protected in law, and they should also know that their rights are protected in law. The true focus of any data protection regime must be to provide reassurance to the individual citizen that their personal data is theirs to own, control and share as they choose and that they can make decisions to share their data on an informed basis. Public and private corporations must be accountable for how they use that information, and they must collect it ethically and transparently.

There is no argument from me about the fact that the data protection regime within the European Union is a robust system that has been designed to provide significantly enhanced rights and protections for individual EU citizens. My concern, however, is that data protection can also be a carefully constructed protectionist measure that works to the commercial advantage and convenience of some of the largest multinational companies. So often the voices of lobbyists and corporations drown out the better nature of our policymakers and, more often than not, that is certainly true of the European Union. EU regulations can become so complex and byzantine that new entrants to the field—I am talking from a commercial perspective—from emerging markets are crowded out. I seek assurances from the Minister in that regard.

Some Members will undoubtedly be in favour of protectionist policies, but I believe in free trade. The EU has built a wall from such regulations—a wall that we must be ready occasionally to breach. From my own point of view, the idea of being able to interact with the 3.7 billion humans who are on the internet is not only desirable but vital for the growth of many companies beyond the relatively small numbers within the European Union. We can position Britain at the heart of this global data processing industry. We have a proud history of this—from the Babbage engine to Skyscanner, via the work at Bletchley Park and Manchester 1. In my constituency of Stirling, superb IT companies are already expert in the field of data processing, and CodeBase Stirling, an organisation for supporting emerging companies, many of which will be developing new applications in this field, has recently located there. Students at Stirling University are learning about big data in a master’s programme, and the work carried out there on big data analytics as well as machine learning will bear fruit long into the future.

We in this country have the skills and the knowledge. Members who think that we will sink without the EU have little faith in the spirit of the British entrepreneur. Brexit gives us the opportunity to think globally, and think globally we shall. Rather than the existing adequacy model of the EU, we need to consider partnerships based on shared understanding of privacy rights and a shared goal of ensuring that consumers give informed consent to their data being used. A shared international framework would give surety to companies operating globally that there are common standards to adhere to, at the same time as protecting consumers.

--- Later in debate ---

[Darren Jones (Bristol North West) (Lab)]

I declare my interest as set out in the Register of Members’ Financial Interests. I pay tribute to my hon. Friend the Member for Warwick and Leamington (Matt Western) for the excellent curry in his constituency. As one of the few vegan MPs, I will happily visit and partake of the curried tofu if there is a vegan option; perhaps it will be better than that served in the Members’ Tea Room, grateful though I am for the option.

I was somewhat confused when I saw this debate on the Order Paper, not least because the Data Protection Bill is in the other place and scheduled to arrive here in due course, as the title was, “Exiting the European Union and Data Protection”. I therefore came with great hope—indeed, hope is the watchword of today—that the debate might be about some updates on how we will seek an agreement on adequacy with the European Union. Given that we are relying on hope and on some form of adequacy agreement—to proceed without an adequacy agreement would be, much like the rest of the Brexit policy, completely incoherent—I hope that the Minister will keep us posted on the progress that is being made towards an agreement, the timelines for doing so and the headway made in conversations about it.

We have a very short period in which to implement complicated and wide-ranging new laws. The Data Protection Bill, as we have heard today, incorporates not just GDPR issues for non-EU areas of competency, but matters of law enforcement and other things that have wide-ranging implications for our country and our laws. Those things must fit around the GDPR, which, as I said in my earlier intervention, will probably become law through a statutory instrument under the European Union (Withdrawal) Bill. I restate my ask of the Government that we should have the opportunity to debate that statutory instrument in substance in this House, not least because some of its important provisions require debate to guide businesses in my constituency and across the country on their application. An example concerns the right to human intervention when a decision has been made using profiling and automated processes—things such as algorithms. Many of my hon. Friends and other members of the Select Committee on Science and Technology will be looking at that issue, but some have grave concern about whether, when we bring in machine learning and changing algorithms, it is even possible to deliver the right to human intervention.

The Bill, which already covers many areas of law, is the start of a wider conversation that includes the network and information security directive and—to go to the important question of marketing, which my right hon. Friend the Member for East Ham (Stephen Timms) spoke about—the e-privacy regulation. How will those fit together? How will businesses, charities and other organisations, many of which do not have rooms full of lawyers and compliance specialists to help them to implement the law, know how everything fits together?

The Prime Minister and—dare I say?—her most ill-informed Brexiteer MPs seem happy with the idea of a no-deal hard Brexit. Many people can visualise lorries on the border, unable to export British goods to the continent. The same would be true for data. With a hard Brexit, there would be a standstill, and there would be blockages on the border for data. Much as with the goods in those trucks in Dover and in the port of Avonmouth in Bristol North West, that would be a disaster for business, consumers and importantly, as we have heard, for policing and the prevention of criminal activity.

[Alison Thewliss]

The issues that the hon. Gentleman is setting out are crucial to the whole Brexit debate. Would he agree that one of the major inadequacies of the debate until the referendum was that such issues were not debated and that they were not well understood?

[Darren Jones]

I agree with that sentiment. Dare I say it, but very few Government Members are present? Although my right hon. Friend the Member for East Ham said this may be an anorak issue, it is in fact crucial to our economy, our new civil liberties and the type of country we want to live in. We should be having such a debate, and I again restate our request that we should do so in this House not only on the Data Protection Bill, but on the GDPR statutory instrument.

I am looking forward to the Data Protection Bill and I am excited about the Committee stage, but I will take this opportunity to address some of the strategic issues that many Members have mentioned: first, the basis of data protection law in the European charter of fundamental rights, on which I will not revisit the arguments already made but will, I hope, add something interesting and new to the debate; secondly, the incoherence between the necessity to mirror EU law and the Government’s illogical policy approach on Brexit; and lastly, the rights and protections of children.

First, as we have heard in this debate, the Government have made it clear that the European charter of fundamental rights will be revoked under the European Union (Withdrawal) Bill. The Minister said that the GDPR in effect says the same thing, but article 8 of the charter, which underpins the GDPR, is referenced in article 45 of the GDPR. If the GDPR is referencing out to statutory, fundamental rights and we take that anchor away, we must replace it elsewhere. I will therefore support the amendment to the Bill proposed by my right hon. Friend the Member for East Ham, to ensure that that happens.