Digital Economy Bill

Baroness Finlay of Llandaff Excerpts

Committee: 3rd sitting Hansard - continued): House of Lords
Monday 6th February 2017 Lords Chamber

[Baroness Janke]

I am drawn to recall the words of the noble Baroness, Lady Buscombe, when she spoke on some of these issues. She said that the technology was moving so quickly that we need to be aware that things are changing—and that it would be important for the public to trust these procedures. A review of these processes is a good thing. Equally, government sometimes changes very slowly, so it may be a better opportunity to revisit some of the issues during a review. We would certainly support that. Again, it has been drawn to our attention by a number of data breaches that have not been notified, ever—so we certainly support the processes that have been outlined in the amendments about putting these on record to have the trust and confidence of the public. Our Amendment 111 in this group is to do with individuals being notified that personal data have been disclosed about them. Again, we feel that this is very important to engender public trust in the processes that we are introducing.

[Baroness Finlay of Llandaff (CB)]

My Lords, I would like to speak to Amendments 213A to 213C, which explore the Government’s commitment to transparency and how people can know about information-sharing agreements that are in place and, looking to the future, how the equivalent of a subject access request could work, explicitly to assist with fraud detection.

I draw the Committee’s attention to the comment from the Delegated Powers and Regulatory Reform Committee at paragraph 52, which noted that, without even allowing for parliamentary scrutiny, the powers in Clause 39 as drafted are as “inappropriately wide” as those in Clause 30, and seem to be deliberately so. Those very wide powers are of great concern. As an increase in digital technology emerges, the public need to be informed to understand how to use the resources available to them—and they need to know how data on them, as citizens, are being used. They must have confidence in the safeguards in place, otherwise we will have a population that increasingly refuses to engage with any kind of data registration.

It is unclear where health issues sit in this Bill. I declare all my interests in relation to health, as in the register. The powers can include, in Clause 30(10)(a), individuals’,

“physical and mental health and emotional well-being”.

That suggests that health data must fall within the remit of this clause, whether held originally by the NHS or whether they are then held by other bodies. It was in an interview that the Government Digital Service director-general gave as an example the large databases between the NHS and the DWP, commenting that these are large databases of citizens’ records and that we really need to be able to match them, which would suggest a read-across between the two. So while there is a prohibition in the Bill on the use of health and social care data for research, the approach may not have a prohibition in relation to data otherwise disclosed. The NHS bodies, for example, hold the data and, although the Secretary of State is not currently listed in the regulations as published, it is difficult to see how the Secretary of State could not be added to regulations at a later point.

Digital Economy Bill

Baroness Finlay of Llandaff Excerpts

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 6th February 2017 Lords Chamber

Moved by

[Baroness Finlay of Llandaff]

213D: After Clause 69, insert the following new Clause—
“Creation of a digital system for lasting power of attorney
(1) The Secretary of State must by regulations make provision for a fully digital process to apply for and create a lasting power of attorney, and for the verification by appropriate bodies of attorneys appointed under this process.(2) Regulations under subsection (1) may in particular—(a) provide for the use of secure electronic signatures in place of any requirements for physical signatures;(b) use electronic online methods to verify the identify of donors and proposed attorneys, either in conjunction with or in place of electronic or physical signatures;(c) require at least one other person to be notified automatically when an application is made;(d) permit in-depth checking of selected applications; (e) require the involvement of a solicitor in the application process;(f) create an offence of knowingly or recklessly providing false information in relation to an application for a lasting power of attorney, subject to a maximum penalty on summary conviction of a term of imprisonment not exceeding six months;(g) provide for appropriate bodies to use secure online methods to verify the identity of an attorney or donor; and(h) cover both health and welfare lasting power of attorney, and property and financial affairs lasting power of attorney.(3) Regulations under this section must be made by statutory instrument and may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.”

[Baroness Finlay of Llandaff (CB)]

My Lords I declare my interest as chair of the National Mental Capacity Forum, and in that role I have been working closely with the Office of the Public Guardian.

For some time the Public Guardian has wanted to move away from the wet signature requirement for the creation of lasting power of attorney for both health and welfare, and property and financial affairs decisions, as laid out in the Mental Capacity Act 2005. This amendment would allow that process to be purely electronic and carried out online, with the safeguards it outlines. A digital process should now be secure given the advances in technology since the original provision was made, and the amendment would simply allow the Secretary of State to make appropriate regulations rather than creating the process.

As the hour is late I am inclined to ask the Minister, if he has any reservations about this amendment and the powers it would give to the Secretary of State, to curtail the debate by meeting with me and the Public Guardian before Report. However, I am rather pre-empting the Minister’s decision. If he decides to accept my amendment, that would be just wonderful. I beg to move.

[Lord Keen of Elie]

My Lords, in view of the hour, it occurs to me that it would be appropriate to give a lengthy and detailed analysis of powers of attorney, and, indeed, to take us back to the Powers of Attorney Act 1971 and the subsequent developments of the law. Nevertheless, and despite the enthusiasm from the Opposition Benches, I am perfectly happy to accept the kind invitation advanced by the noble Baroness, Lady Finlay, and to meet with her to explain the Government’s position on this matter. I would be obliged if she could at this stage withdraw the amendment.

[Baroness Finlay of Llandaff]

My Lords, in light of the forthcoming meeting—which I am sure the Public Guardian will wish to join—I beg leave to withdraw the amendment.

Amendment 213D withdrawn.

Digital Economy Bill

Baroness Finlay of Llandaff Excerpts

Committee: 4th sitting (Hansard - continued): House of Lords
Wednesday 8th February 2017 Lords Chamber

Moved by

[Baroness Finlay of Llandaff]

232: After Clause 87, insert the following new Clause—
“Active consent of online buyers required for retention and use of contact information
(1) A seller of goods or services via the internet must not retain, share or use any contact information provided by buyers for any purpose except directly facilitating the sale of the good or service, unless the buyer has actively consented to the retention, sharing or use of the information. (2) For the condition in subsection (1) to be satisfied, the seller must have specified any purposes to which the buyer is consenting.(3) The condition in subsection (1) may be satisfied by the buyer ticking a box on the seller’s web page, but it may not be satisfied by the buyer failing to untick such a box which has been pre-filled. (4) A seller who contravenes the requirement in subsection (1) is guilty of an offence.(5) A person guilty of an offence under this section is liable on summary conviction to a fine not exceeding 10% of the seller’s annual gross operating profit.”

[Baroness Finlay of Llandaff (CB)]

My Lords, I will try to be brief because the hour is late. I should also say that this amendment probably has one part missing. In my role as chair of the National Mental Capacity Forum, I have become aware of the large number of people who are subject to fraud through scams and through “suckers lists” which are compiled and which circulate for a great deal of money among criminal gangs. Unfortunately, these have often originated because people have purchased something online, have provided their details and have not opted out of those details being shared with others who may have like-minded sales intentions, partners or whatever.

One of the problems is that, when they are purchasing online, a lot of people really do not understand which boxes they should have clicked on—such as terms and conditions—and which they should have unclicked. So the point of this amendment is to try to require anyone selling any item online to have a box that has to be opted into for a mailing list, rather than the current opting-out system.

Where the amendment is deficient is that it does not stipulate that such permission should be time limited. I hope the Minister will point out to me that it should be time limited for a year, so that the criteria should be even tighter than in my amendment.

I think that enforcement would have to come through the Information Commissioner’s Office, rather than trading standards, but I am grateful to the trading standards workforce for having discussed this issue with me at length, as have social work leaders.

I know that the general data protection regulation will come into force across the European Union on 25 May 2018. This will replace the European data protection directive. It is associated with severe financial penalties for non-compliance. Despite our Brexit arguments, I would expect that, because of this timing, we should also be adopting this data protection regulation. I would be interested to know from the Minister whether that is correct. Coming in with it is law enforcement data protection—directive 2016/680—on protecting personal data processed for law enforcement purposes. This will replace the data protection framework decision 2008. It appears that this directive must be transposed into national law by member states by 6 May 2018. Again, there is a question over whether this will be coming into force. If both of these come into force fully, they may cover this area, although that is unclear and I cannot help feeling that it would be much better for us to get it in our own legislation first.

So that we are aware of the size of the problem, the national scams team has a current database of more than 240,000 people on suckers lists, which is growing all the time because data are intercepted by enforcement bodies and reveal that more and more people have had their data sold on in this way, often by criminal gangs, who then go on to target people and groom them. Many of the people targeted are lonely, isolated citizens who are confused by the opt-in/opt-out. They do not see the small print and they do not understand the significance. The amendment, I hope, would solve the problem. I beg to move.

[Baroness Buscombe]

My Lords, I begin by apologising to the noble Baroness, Lady Finlay of Llandaff, that she is, for the second time running, almost a tail-end Charlie. It was the same on Monday evening and she was extremely gracious in waiting for so long for us to get to her amendment. I welcome her amendment, which highlights an issue that most of us here are acutely aware of when buying goods and services online; namely, the consequence of not ticking a box or, in some cases, unticking a box.

The proposed new clause imposes a fine not exceeding 10% of a seller’s annual gross operating profit if a seller of goods and services on the internet were to retain, share or use the contact information of a buyer without the buyer’s consent to do so. It also makes it a requirement that websites provide a tick-box which is not pre-filled, as a means by which an individual can demonstrate their acceptance of having their contact information processed by the seller.

Although I accept the spirit of the amendment, I do not believe it is necessary, for the following reasons. Clause 77 already places a statutory duty on the Information Commissioner to publish a direct marketing code of practice. Putting the ICO’s direct marketing code of practice on a statutory footing will make it easier for the Information Commissioner to take enforcement action against those organisations in breach of the direct marketing rules under the Data Protection Act and the Privacy and Electronic Communications Regulations. The current direct marketing rules are also clear, stating as follows:

“Organisations will need to be able to demonstrate that consent was knowingly and freely given, clear and specific, and should keep clear records of consent. The ICO recommends that opt-in boxes are used”.


The general data protection regulation—GDPR—which will come into force in May 2018 will introduce tough new measures on consent and will place obligations on data controllers to demonstrate clearly how they obtained consent when processing personal data, such as contact information. Silence or pre-ticked boxes as a form of consent will not be permitted under the GDPR. The GDPR will also allow tougher penalties to be imposed on organisations in breach of the rules: up to 4% of the organisation’s total global annual turnover, or €20 million.

The noble Baroness also suggested that the time limit for retaining personal information should be limited, for example, to a year. The reality is that time is not specified: one should hold on to the information only as long as is necessary to process payment or whatever the application is made for. For these reasons, I hope the noble Baroness will feel able to withdraw her amendment.

[Baroness Finlay of Llandaff]

I thank the Minister for that reply and for welcoming the spirit of the amendment. Just for the record, the reason for specifying a year if someone has opted into the mailing list is that over time their circumstances might change. They might want to withdraw their consent but not be clear about how to do it. I hope the Information Commissioner will consider that. People might also lose cognitive function over time and therefore become much more vulnerable to scams than they were when they opted in. So I hope that a time limit is also introduced. However, on the basis of the Government’s response, I beg leave to withdraw the amendment.

Amendment 232 withdrawn.

Digital Economy Bill

Baroness Finlay of Llandaff Excerpts

Report: 2nd sitting (Hansard - continued): House of Lords
Monday 20th March 2017 Lords Chamber

My other two amendments were largely dealt with in Committee. I retabled them because I would like to be a bit more explicit. Having discussed the issue with Ministers, I think that they have the authority to add gas and electricity networks to the list. They are the bodies with which fuel-poor households are increasingly likely to engage, as distinct from the supply companies, so at some point they should be added to the list. If that is a relatively easy process, I will not pursue Amendments 27 and 28. However, I would like on the record a clearer indication from Ministers that the ability to add health authorities and health professionals, including GPs, to the list could come further down the line, because it would address an issue that was clearly identified by the Government as one of the most important reasons for engaging in information and data sharing in the first place. I beg to move.

[Baroness Finlay of Llandaff (CB)]

My Lords, I have tabled amendments in this group. I start by thanking the noble and learned Lord, Lord Keen of Elie, and his Bill team for having met with me and for dealing patiently with my queries. I know from that meeting that the Government are not minded to accept my amendments, but I would like the arguments to be put on the record.

I have listened carefully to the noble Lord, Lord Whitty. While I do not dispute at all that his amendments are well intentioned, I can see enormous difficulties arising in determining the threshold of the condition—how severe it has to be, which co-morbidities might be aggravating one another, which members of the family would be involved and so on. I am not sure from the way he argued for his amendment whether an email notification system against a set of clear criteria that had been pre-negotiated with the consent of the patient or family would meet the needs and be simple and straightforward. Would it be a communication system free from the risk of mining the patient’s clinical records? The reason I ask is that at the moment health bodies are not specified in the Bill, but if they were included, that would certainly need legislation because in effect it would override the common-law duty of confidentiality.

I know that at the previous stage the noble and learned Lord, Lord Keen, said that the Government were minded to consider bringing health and social care bodies within the scope of these powers in the future and that that would be done using a statutory instrument passed by the affirmative procedure. I appreciate that the Minister said that there would be wide consultation before that happened.

The difficulty is that in Clause 36(7) it appears that the duty of confidence, which could apply to the duty of medical confidentiality, could be removed if health is brought within the scope of the Bill. It could provide a legal gateway for sharing medical records for purposes that are not currently specified among a wide range of government departments and public service providers. The concern is that to date a special legal status has been afforded to health data in the common-law duty of medical confidentiality due to its sensitivity and the importance to the public of a confidential health service. This common-law duty of confidentiality protects health data over and above the safeguards provided by the Data Protection Act, so simply referring to the Bill’s requirement to comply with that Act when making disclosures does not maintain the current level of protection.

If the Bill proceeds unamended and the Government include health bodies in the list of specified bodies, which they could do by statutory instrument, I think that would be viewed as a serious assault on medical confidentiality because it would open up the power to share confidential information. Indeed, problems with the failure of the current safeguards in the system were aired this weekend over TPP, the IT system that many general practitioners use. In a way, that demonstrated that the current safeguards in place around the IT systems are, frankly, inadequate.

NHS Digital could be drawn into the Bill’s information-sharing powers. It holds vast quantities of confidential data, which would mean that the Bill could give the Government direct access to them without consent, because the process would override the current common-law duty. This needs to be considered in the context of the National Data Guardian, who has spoken about the need to build trust in the health system’s ability to handle data, and a real concern among many patient groups of the general mistrust that their very confidential data could be shared.

I believe that my amendments will not be accepted, but if they are not I hope the Government will be able to reassure me that if health data were to be brought into the Bill’s information-sharing powers they will not just be added to the current framework created by the Bill and then the duty of medical confidentiality deemed to be protected, but that there will be full public engagement and full parliamentary scrutiny prior to proceeding, and that the protections in place would include independent oversight and real-time monitoring of the data sharing. In Wales, the IT system overseeing NHS Wales has instituted real-time monitoring because there was concern that staff could have used their access rights to unprofessionally access healthcare records of people with whom they did not have a direct care relationship. I am afraid that human nature is that people are rather inquisitive about what may be happening to people they know, but those may be very sensitive and very private data. Therefore, they need the highest safeguards around them.

The problem is that once there is a data leak it really cannot be pulled back and closed. I hope the Government will provide the reassurance that, as well as the other aspects, there will be real-time monitoring and independent oversight of the whole process, with additional sanctions that will be of a high enough level to, I hope, act as a major deterrent for any breaches of any data-sharing agreement.

[Baroness Hamwee]

My Lords, we have Amendment 28AV in this group, which is also about the common-law duty of confidentiality. Obviously that includes doctor-patient confidentiality. We are with the noble Baroness in her concerns. Apart from wanting to see that duty preserved, the reason for the amendment is to seek confirmation that it is to be overwritten rather than preserved. I found subsection (7) quite difficult. When we were contacted by a member of the public who was clearly qualified to read the legislation with a query about it, it seemed appropriate to raise this because it is quite difficult to follow. Clearly, one should be quite certain about what we are doing.

--- Later in debate ---

[Lord Keen of Elie]

I am obliged to noble Lords, and in particular I thank the noble Lord, Lord Whitty, for his continued interest in this area and for taking the time to meet and discuss this matter at some length with me and the Bill team. Clearly, as the noble Lord, Lord Collins, observed, this is an important part of the fuel poverty agenda. That is why it takes on such considerable importance even when faced with issues such as medical confidentiality.

On the point about common-law confidentiality, and medical confidentiality in particular, it is not an absolute; there are already statutory gateways through which information can and must flow on occasions, and therefore one must not take it that medical confidentiality is somehow completely ring-fenced and separate from the world that we actually live in. There are circumstances where there should be, has to be and is disclosure. It may be possible—I put it no higher in terms of this Bill—to address a further gateway. However, one should not confuse any mechanism within the Bill with the consequences of human or IT failure, however regrettable they may be. I agree with the noble Lord, Lord Collins, that one has to have regard not only to the structure within which information is shared but to the need to ensure that the sharing process is itself secure. But they are separate issues.

The noble Lord, Lord Whitty, acknowledges that some parts of his amendment may not be necessary. Amendments 27 and 28 would provide that information can be shared with licensed electricity and gas distributors for the provision of fuel poverty assistance. They can already be added to the data-sharing arrangements in Clause 32 by regulations. The Government will consider whether to exercise this power in the context of considering the future role of electricity and gas distributors in delivering fuel poverty schemes. I reassure the noble Lord that the provision made by Amendment 26 is already covered by Clause 31, which provides powers to share information for,

“the improvement of the well-being of individuals or households”.

Of course, this includes,

“their physical and mental health and emotional well-being”.

While we do not consider the noble Lord’s amendment necessary in this instance, the objectives that he highlights are an example of how in appropriate circumstances information held by healthcare providers could, in future, be valuable to support the more effective delivery of public services to those in need. It underlines why the Government are unable to accept Amendments 28AV, 28AW and 28AX, tabled by the noble Baronesses, Lady Finlay and Lady Hamwee.

The Government do recognise the particular sensitivities with identifiable health information, as highlighted in the National Data Guardian for Health and Social Care’s recent review of data security, consent and opt-outs. Health bodies in England are therefore not included in the list of bodies now in the Bill that will be permitted to use these powers. However, as the noble Lord, Lord Whitty, noted, health issues are a key factor in the complex social problems faced by people, whom we are aiming to support with these powers. Excluding the use of identifiable health information altogether would remove the possibility of including such information in the future without amending legislation. It would be premature to take this step in advance of the implementation of the National Data Guardian’s review and the public consultation that that will engage.

An amendment to maintain the common-law duty of medical confidentiality is not considered necessary. Those powers enable information to be shared only where it is already held by specified persons, acquired in a different context from the patient-doctor relationship. Any information that would have been subject to medical confidentiality would have found its way into a specified person’s hands only through an existing gateway. As I indicated earlier, there are already statutory gateways through which such information can move. Of course, we are dealing with permissive powers.

At this late hour, I will attempt the impossible: to satisfy the interests of all parties in the context of these provisions. Beginning with the inquiry from the noble Lord, Lord Whitty, health bodies are not presently included in the schedules. As drafted, it would be possible for health bodies to be added to the schedules at a future date but—and I emphasise this—no decision will be taken until, first, the Government publish their response to the Caldicott review and any recommendations have been embedded and assessed; secondly, there has been a public consultation on the issue and the views of the National Data Guardian and appropriate representative health bodies such as the GMC and BMA have been sought; and, thirdly, there has been a debate in both Houses pursuant to the affirmative procedure required to add bodies to the schedule. I hope that that reassures the noble Lord, Lord Whitty, that it can be done, although it has yet to be done, and that there are steps that we will take to reassure the noble Baronesses, Lady Finlay and Lady Hamwee, before any such step is implemented.

If health bodies or information were to be expressly excluded in the Bill, it would require primary legislation to enable those bodies to share information under the powers. If and when we decide that it would be helpful to have those powers—in implementing the fuel poverty initiative, for example—it would be most unfortunate if we were delayed by literally years before we could actually achieve the objective, when in fact there is provision here to do it by way of the affirmative procedure so that both Houses have ample opportunity for debate.

If we take those steps, there will be safeguards. When considering whether to add any health bodies to the schedules in the public service delivery, debt and fraud chapters, clear safeguards will apply. First, before a new body may be added to the schedule, it must show that it fulfils the relevant criteria relating to that specific power designed to ensure that only bodies with relevant functions for holding or requiring information relevant to that particular power may be added. The Minister must consider the procedures in place for secure handling of information before any new body can be added to the schedule—a point raised by the noble Lord, Lord Collins. A decision will be taken on whether it is in the public interest and proportionate to share identifying health information in order to achieve a specified objective. There would be no question of simply sharing this information more widely. The powers must be exercised in accordance with the Data Protection Act, which requires that only the minimum information necessary to achieve the objective may be shared. Under the Bill—and under the Data Protection Act—personal information may be used only for the purpose for which it was shared and data must be stored securely to ensure compliance with that Act. Again, this point was raised a moment ago.

Identifying health information will constitute sensitive personal data and so to ensure fair and lawful processing, it must fulfil one of the more onerous Schedule 3 conditions as well as the Schedule 2 condition under the Bill. In addition, new criminal sanctions have been included for wrongful disclosure with a maximum penalty of up two years’ imprisonment, a heavy fine or both. Further steps can of course also be taken to remove a body from the schedule if it does not comply with the requirements of the Act.

I do not suppose that I have satisfied anyone with that explanation at the end of the day. But, if nothing else, I hope that it has assisted in informing your Lordships as to why we consider that these amendments are not appropriate and that it would be appropriate to retain the ability to introduce health bodies by way of appropriate regulation. We feel that there will be appropriate safeguards and extensive consultation before any such step is taken, so I invite the noble Lord to withdraw his amendment.

[Baroness Finlay of Llandaff]

May I ask for clarification over one issue? Would a statutory instrument, when brought forward, envisage adding health bodies to the Bill in a blanket way, or would it be envisaged that there would be statutory instruments for specific purposes, such as health bodies for the purposes of identifying fuel poverty, and that when something else emerged it would require a separate statutory instrument so as to keep that gateway as narrow as possible?

[Lord Keen of Elie]

With respect, we clearly intend to maintain any gateway in as narrow a manner as is reasonable. The point that the noble Baroness raises is really a question for another day. We are not there yet; health bodies are not included in the schedule. If and when it is contemplated that they will be, there will be extensive consultations on the very issues that she raises.