Data Protection and Digital Information Bill

Baroness Buscombe Excerpts

Committee stage
Monday 22nd April 2024 Grand Committee

[Baroness Chakrabarti (Lab)]

My Lords, it is a pleasure and a privilege to support that tour de force from the noble Baroness, Lady Kidron. I do not need to repeat it but, to summarise, I completely agree with the opinion from Matrix Chambers that, in addition to its immorality, this provision is in contravention of Article 8 of the European Convention on Human Rights on respect for private and family life—relating to correspondence in particular. It is not necessary or proportionate, as we have heard. It is discriminatory and, for the purposes of the convention, is not in accordance with law. Once more, as we have heard, promising the possibility of guidance in future is no substitute for properly confining a power of this kind. Instead, the power is breathtaking in its scope and in its intrusive nature over the most sensitive financial and other personal information that could be gleaned this way.

It is an intrusion and an indignity as the breaches of privacy are not just for vulnerable people who are on benefits—not only non-means-tested benefits but means-tested benefits too. They are also an intrusion on the financial privacy of those who have linked accounts, whether they are a family member who is helping out by way of paying carers, landlords and so on or a family member who gives a small gift to a vulnerable person on benefits. Perhaps that is the Government’s intention—I do not know—but it is breathtaking in its sweep and in the number of citizens and people in this country who will be caught up in it. That is what makes it disproportionate and not in accordance with law relying on hypothetical guidance.

The discriminatory aspect cannot be emphasised enough. There are, broadly speaking, two categories of people for these purposes in these islands: those who earn, have inherited or otherwise have enough wealth to come within the scope of HMRC and who should pay tax and not avoid it—that is, not defraud other taxpayers and the country as a whole; and those who are on benefits, whether means-tested or universal. Neither category of humanity should be exempt from fraud but nor should there be a discriminatory approach to policing any potential fraud. Why is it that, as we heard from the noble Baroness, Lady Kidron, we have this breathtaking snooper’s charter for those on benefits but a much more targeted approach to those who should be paying taxes? That discrimination cannot be justified.

[Baroness Buscombe (Con)]

What is the difference between the trawl in looking at people who are seeking to avoid tax, which is not a crime, and in looking at those who are possibly mis-stating the extent of their assets? In the noble Baroness’s view, how is the surveillance different in terms of this Bill?

[Baroness Chakrabarti (Lab)]

I am grateful to the noble Baroness. It is not just my view. It was put very well by the noble Baroness, Lady Kidron, and, as I recall, is outlined in the legal opinion. HMRC’s powers are more targeted and have more safeguards.

[Baroness Buscombe (Con)]

When the noble Baroness says, “more targeted”, is what way are they more targeted? That is what I would like to know.

[Baroness Kidron (CB)]

They relate to individual people by name, not whole sweeps of people who have done nothing wrong but get a particular benefit.

--- Later in debate ---

[Baroness Buscombe (Con)]

My Lords, I speak as someone who was a Minister at the Department for Work and Pensions back in 2017. I well remember, when I was in charge of fraud and benefit, when we had a new addition to my team. I felt very strongly about this area because, when I first started as a Minister there, I was incredibly shocked by the level of fraud. Someone talked about having a fraud strategy, but this area is very complex. In the years since then, we have learned that the greatest incidence of fraud is people misstating their assets. Everybody in the Room will know that it is important that you must have only a certain amount of assets to claim benefits, whatever your situation, unless they are not means-tested or are disability benefits.

In 2017, the Treasury ran a controlled pilot. I do not know the details of how it was run, but I saw the results and they were extraordinary. The pilot was at one bank, using the powers they already had, for those who may be avoiding tax—which of course is not a crime—to see whether there was an issue with regard to benefit claimants misstating the extent of their assets when claiming. The extraordinary thing was that they found that between 25,000 and 30,000 at that one bank alone were misstating their assets.

So we know that there is a real problem here, and we know that fraud itself has gone up and up. We are unable to calculate all fraud in the system because, under the legacy system, we found it difficult to check the degree of housing benefit and so on. Maybe it is easier now under universal credit—I hope my noble friend the Minister will be able to tell us that it is—to check people in receipt of benefits who claim to be living alone when they are not.

This is a very nuanced area, but all I can say is that we knew we had a major problem with people misstating their assets. We had to deal with that, but we could not do so without working out how to do so with care, bearing in mind all the issues that noble Lords have raised today about doing it in a proportionate way, in a way that does not conflict with human rights in a way that does not become mass surveillance for everyone. We should bear in mind that since 2011 taxpayers, the people actually funding the benefits system, including some benefit claimants themselves, have had their bank accounts checked to make sure that they are not avoiding tax, which is not a crime—I am talking not about evasion but about avoiding—while fraud in the benefits system is a crime.

We need to be quite careful. Some of the things that have been said today conflating this issue with Horizon are wrong. I have been reading the so-called facts that some of these lobbyists have written about how the clause is disproportionate and unfair and goes too far in terms of people’s privacy. The Department for Work and Pensions works tirelessly to try to do the right thing in the right way. This has not been thrown into the Bill at the last minute as if we have just dreamed it up. That discovery was seven years ago. The noble Lord, Lord Sikka, may laugh, but I do not see the relevance of an awful lot of what he was saying—about the noble Baroness, Lady Mone, and so on—to what we are discussing now.

The reality is that benefit fraud is a serious offence, depriving those who need it most of vital support. A lot of people have come up with cases of very difficult situations that people have to live through. Those are the people we want to support but, frankly, the bill at DWP for this one year is £290 billion. When I was there in 2019, it was £190 billion. We cannot afford to put up with benefit fraud, so we have developed this carefully constructed measure, which needs to be thought through with care. I am sure my noble friend will be able to answer a lot of the questions that have quite rightly been asked today in Committee.

[Baroness Lister of Burtersett (Lab)]

The noble Baroness mentioned lobby groups that say the clause is disproportionate. The Information Commissioner has questioned the proportionality of this measure. Does she consider the Information Commissioner a lobby group?

[Baroness Buscombe (Con)]

No. With respect, I am talking about Justice, which I think referenced 40 organisations. There was no list of what those organisations are in the information it sent me. There is also Big Brother Watch and many others.

I just think that everyone needs to take, if I may use the word, a proportionate approach to this. We are talking about tackling a really serious offence. I think all noble Lords agree that we have to tackle fraud but I am sure, and hope, that my noble friend can reassure everybody. The current powers that the DWP has to ensure benefit correctness are mostly over 20 years old. Over that time, fraud has evolved and become increasingly sophisticated. The system currently relies on self-verification for many factors, and that is one of the issues. I know it would sound so much better if people could find another way to check whether someone is being honest about their assets, but the problem is that a lot of this is to do with self-verification.

[Lord Davies of Brixton (Lab)]

The suggestion was made that this was carefully thought out and part of a long-term plan. Can the noble Baroness therefore explain why it was introduced into the Bill at such a late stage in going through the Commons, such that it did not receive any worthwhile consideration at all there?

[Baroness Buscombe (Con)]

I am sure my noble friend the Minister can talk about the particular timing of why it went into this Bill. Certainly in my time at DWP, the difficulty we had was finding the right Bill that we could add it to. This is one of the things that is really hard about being a Minister: you cannot just say, “This is something we have to do”. You have to find a route—like finding a route to market—to include a measure in a Bill that is relevant. This Bill is entirely relevant in terms of where we are now on data collection. The Minister and his team were right to choose this particular Bill.

I could go on.

[Noble Lords]

Oh!

--- Later in debate ---

[Baroness Buscombe (Con)]

I am sorry; I have spent a lot of time listening to others, and a lot of it has been slightly interesting to listen to, I have to say.

The measure will not enable the DWP to access any accounts, and the DWP will not be able to use this measure to check what claimants are spending. The DWP can request information only where there is a link between the DWP, the third party and the benefit claimant or recipient of a payment, and will receive only minimum information on those cases where potential fraud and error are signalled. Once received, the DWP will look at each case individually through its business-as-usual processes and by using existing powers. That work will carefully be undertaken by a human and no automated decisions will be made. That is a really interesting and important point in terms of this measure. I now turn to my noble friend.

[Lord Vaux of Harrowden (CB)]

I am grateful to the noble Baroness, but could she point out where those restrictions actually are in the Bill? It says that an account information notice can include

“the names of the holders … other specified information relating to the holders … and … such further information in connection with those accounts as may be specified”.

It basically allows the DWP to ask for any information relating to those accounts. I do not see the restrictions that she has just spoken about.

[Baroness Buscombe (Con)]

It is important that my noble friend answers that question. The point is that if we find—I am sorry, I still speak as if I am involved with it, which I am not, but I promise noble Lords that I have spent so much time in this area. If the DWP finds that there is a link that needs pursuing then that obviously has to be opened up to some degree to find what is going on. Remember, the most important thing about this is that the right people get the right benefits. That is what the Government are trying to achieve.

[Lord Clement-Jones (LD)]

My Lords, I note that the DWP has been passed a parcel by the Department for Science, Innovation and Technology—and I am not at all surprised. I am sure it will be extremely grateful to have the noble Baroness, Lady Buscombe, riding to its defence today as well. Also, attendance at this debate demonstrates the sheer importance of this clause.

We on these Benches have made no secret that this is a bad Bill—but this is the worst clause in it, and that is saying something. It has caused civil society organisations and disability and welfare charities to rise as one against it, including organisations as disparate as UK Finance, mentioned by the noble Lord, Lord Davies, and the ICO itself. They have gone into print to say that, for this measure to be deemed a necessary and proportionate interference in people’s private lives, to be in accordance with the law and to satisfy relevant data protection requirements, legislative measures must be drafted sufficiently tightly—et cetera. They have issued a number of warnings about this. For a regulator to go into print is extremely unusual.

Of course, we also have Big Brother Watch and the Child Poverty Action Group—I pay tribute to the noble Baroness, Lady Lister—the National Survivor User Network, Disability Rights UK, the Greater Manchester Coalition of Disabled People and the Equality and Human Rights Commission. We have all received a huge number of briefings on this. This demonstrates the strong feelings, and the speeches today have demonstrated the strong feelings on this subject as well.

There have been a number of memorable phrases that noble Lords have used during their speeches. The noble Baroness, Lady Kidron, referred to a “government fishing expedition”. The noble Baroness, Lady Chakrabarti, called it “breathtaking in its scope”. I particularly appreciated the speech of the noble Lord, Lord Kamall, who said, “What happened to innocence?” In answer to the noble Baroness, Lady Buscombe, this is not “nuanced”: this is “Do you require suspicion or do you not?” That seems to me to be the essence of this.

I was in two minds about what the noble Lord, Lord Sikka, said. I absolutely agree with him that we need to attack the fat cats as much as we attack those who are much less advantaged. He said, more or less, “What is sauce for the goose is sauce for the gander”. The trouble is that I do not like the sauce. That was the problem with that particular argument. The noble Baroness, Lady Lister, talked about stigma. I absolutely agree. The noble Lord, Lord Vaux, more or less apologised for using the word “draconian” at Second Reading, but I thought the word “overreach” was extremely appropriate.

We have heard some powerful speeches against Clause 128. It is absolutely clear that it was slipped into the Bill alongside 239 other amendments on Report in the Commons. I apologise to the Committee, but clearly I need to add a number of points as well, simply to put on record what these Benches feel about this particular clause. It would introduce new powers, as we have heard, to force banks to monitor all bank accounts to find welfare recipients and people linked to those payments. We have heard that that potentially includes landlords and anyone who triggers potential fraud indicators, such as frequent travel or savings over a certain amount. We have seen that the impact assessment indicates that the Government’s intention is to “initially”—that is a weasel word—use the power in relation to universal credit, pension credit and employment support allowance. We have also heard that it could be applied to a much wider range of benefits, including pensions. The Government’s stated intent is to use the power in relation to bank accounts in the first instance, but the drafting is not limited to those organisations.

Of course, everyone shares the intent to make sure that fraudulent uses of public money are dealt with, but the point made throughout this debate is that the Government already have power to review the bank statements of welfare fraud suspects. Under current rules, the DWP is able to request bank account holders’ bank transaction details on a case-by-case basis if there are reasonable grounds to suspect fraud. That is the whole point. There are already multiple powers for this purpose, but I will not go through them because they were mentioned by other noble Lords.

This power would obviously amend the Social Security Administration Act to allow the DWP to access the personal data of welfare recipients by requiring the third party served with a notice, such as a bank or building society, to conduct mass monitoring without suspicion of fraudulent activity, as noble Lords have pointed out. Once issued, an account information notice requires the receiver to give the Secretary of State the names of the holders of the accounts. In order to do this, the bank would have to process the data of all bank account holders and run automated surveillance scanning for benefit recipients, as we have heard.

New paragraph 2(1)(b) states that an account information notice requires,

“other specified information relating to the holders of those accounts”,

and new paragraph 2(1)(c) refers to other connected information, “as may be specified”. This vague definition would allow an incredibly broad scope of information to be requested. The point is that the Government already have the power to investigate where there is suspicion of fraud. Indeed, the recently trumpeted prosecution of a number of individuals in respect of fraud amounting to £53.9 million demonstrates that. The headlines are in the Government’s own press release:

“Fraudsters behind £53.9 million benefits scam brought to justice in country’s largest benefit fraud case”.


So what is the DWP doing? It is not saying, “We’ve got the powers. We’ve found this amount of fraud”. No, it is saying, “We need far more power”. Why? There is absolutely no justification for that. No explanation is provided for how these new surveillance powers will be able to differentiate between different kinds of intentional fraud and accidental error.

We have heard about the possibility and probability of automated decision-making being needed here. I do not know what the Minister will say about that, but, if there will not be automated decision-making—that is concerning enough—if the DWP chooses to make these decisions through human intervention the scale of the operation will require a team so large that this will be an incredibly expensive endeavour, defeating the money-saving mandate underpinning this proposed new power, although, as a number of noble Lords have pointed out, we do not know from any impact assessment what the Government expect to gain from this power.

It is wholly inappropriate for the Government to order private banks, building societies and other societies and financial services to conduct mass algorithmic suspicionless surveillance and reporting of their account holders on behalf of the state in pursuit of these policy aims. It would be dangerous for everyone if the Government reversed the presumption of innocence. This level of financial intrusion and monitoring affecting millions of people is highly likely to result in serious mistakes and sets an incredibly dangerous precedent.

This level of auditing and insight into people’s private lives is a frightening level of government overreach, in the words of the noble Lord, Lord Vaux, more so for some of the most marginalised in society. This will allow disproportionate and intrusive surveillance of people in the welfare system. In its impact statement, the DWP says it will ensure that data will be

“transferred, received and stored safely”.

That is in contrast to the department’s track record of data security, particularly considering that it was recently reprimanded by the ICO for data leaks so serious that they were reported to risk the lives of survivors of domestic abuse. With no limitations set around the type of data the DWP can access, the impact could be even more obscure.

We have heard about the legal advice obtained by Big Brother Watch. It is clear that, on the basis that,

“the purpose of the new proposed powers is to carry out monitoring of bank accounts”

and that an account information notice can be issued

“where there are no ‘reasonable grounds’ for believing a particular individual has engaged in benefit fraud or has made any mistake in claiming benefits”,

this clause is defective. It also says that

“financial institutions would need to subject most if not all of their accountholders to algorithmic surveillance”;

that this measure

“will be used not just in relation to detection of fraud but also error”;

and that this measure

“would not be anchored in or constrained by anything like the same legal and regulatory framework”

as the Investigatory Powers Act. It concludes:

“The exercise of the financial surveillance/monitoring powers contained in the DPDIB, as currently envisaged, is likely to breach the Article 8 rights of the holders of bank accounts subject to such monitoring”


in order to comply. It is clear that we should scrap this clause in its entirety.

--- Later in debate ---

[Viscount Younger of Leckie (Con)]

Absolutely; the noble Lord will know that I have not managed to answer all the questions. I have tried to bring in everybody on this important and serious debate. The answers will be forthcoming.

[Baroness Buscombe (Con)]

I thank my noble friend very much for all the explanation that he has given thus far. I just want to add a word that has not been mentioned: deterrent. One of the reasons why the Government have sought to introduce this in the Bill, I believe, is that it is hugely important that we are much more thoughtful about what will stop people doing the wrong thing. It has become an old-fashioned word but, from a legal, practical and moral standpoint, does my noble friend agree that this is a practical deterrent to make sure that people do the right thing?

[Baroness Lister of Burtersett (Lab)]

Is it not one of the dangers that this is a deterrent to people claiming these benefits?