Digital Economy Bill

Baroness Finlay of Llandaff Excerpts

Committee: 4th sitting (Hansard - continued): House of Lords
Wednesday 8th February 2017 Lords Chamber

Moved by

[Baroness Finlay of Llandaff]

232: After Clause 87, insert the following new Clause—
“Active consent of online buyers required for retention and use of contact information
(1) A seller of goods or services via the internet must not retain, share or use any contact information provided by buyers for any purpose except directly facilitating the sale of the good or service, unless the buyer has actively consented to the retention, sharing or use of the information. (2) For the condition in subsection (1) to be satisfied, the seller must have specified any purposes to which the buyer is consenting.(3) The condition in subsection (1) may be satisfied by the buyer ticking a box on the seller’s web page, but it may not be satisfied by the buyer failing to untick such a box which has been pre-filled. (4) A seller who contravenes the requirement in subsection (1) is guilty of an offence.(5) A person guilty of an offence under this section is liable on summary conviction to a fine not exceeding 10% of the seller’s annual gross operating profit.”

[Baroness Finlay of Llandaff (CB)]

My Lords, I will try to be brief because the hour is late. I should also say that this amendment probably has one part missing. In my role as chair of the National Mental Capacity Forum, I have become aware of the large number of people who are subject to fraud through scams and through “suckers lists” which are compiled and which circulate for a great deal of money among criminal gangs. Unfortunately, these have often originated because people have purchased something online, have provided their details and have not opted out of those details being shared with others who may have like-minded sales intentions, partners or whatever.

One of the problems is that, when they are purchasing online, a lot of people really do not understand which boxes they should have clicked on—such as terms and conditions—and which they should have unclicked. So the point of this amendment is to try to require anyone selling any item online to have a box that has to be opted into for a mailing list, rather than the current opting-out system.

Where the amendment is deficient is that it does not stipulate that such permission should be time limited. I hope the Minister will point out to me that it should be time limited for a year, so that the criteria should be even tighter than in my amendment.

I think that enforcement would have to come through the Information Commissioner’s Office, rather than trading standards, but I am grateful to the trading standards workforce for having discussed this issue with me at length, as have social work leaders.

I know that the general data protection regulation will come into force across the European Union on 25 May 2018. This will replace the European data protection directive. It is associated with severe financial penalties for non-compliance. Despite our Brexit arguments, I would expect that, because of this timing, we should also be adopting this data protection regulation. I would be interested to know from the Minister whether that is correct. Coming in with it is law enforcement data protection—directive 2016/680—on protecting personal data processed for law enforcement purposes. This will replace the data protection framework decision 2008. It appears that this directive must be transposed into national law by member states by 6 May 2018. Again, there is a question over whether this will be coming into force. If both of these come into force fully, they may cover this area, although that is unclear and I cannot help feeling that it would be much better for us to get it in our own legislation first.

So that we are aware of the size of the problem, the national scams team has a current database of more than 240,000 people on suckers lists, which is growing all the time because data are intercepted by enforcement bodies and reveal that more and more people have had their data sold on in this way, often by criminal gangs, who then go on to target people and groom them. Many of the people targeted are lonely, isolated citizens who are confused by the opt-in/opt-out. They do not see the small print and they do not understand the significance. The amendment, I hope, would solve the problem. I beg to move.

[Baroness Buscombe]

My Lords, I begin by apologising to the noble Baroness, Lady Finlay of Llandaff, that she is, for the second time running, almost a tail-end Charlie. It was the same on Monday evening and she was extremely gracious in waiting for so long for us to get to her amendment. I welcome her amendment, which highlights an issue that most of us here are acutely aware of when buying goods and services online; namely, the consequence of not ticking a box or, in some cases, unticking a box.

The proposed new clause imposes a fine not exceeding 10% of a seller’s annual gross operating profit if a seller of goods and services on the internet were to retain, share or use the contact information of a buyer without the buyer’s consent to do so. It also makes it a requirement that websites provide a tick-box which is not pre-filled, as a means by which an individual can demonstrate their acceptance of having their contact information processed by the seller.

Although I accept the spirit of the amendment, I do not believe it is necessary, for the following reasons. Clause 77 already places a statutory duty on the Information Commissioner to publish a direct marketing code of practice. Putting the ICO’s direct marketing code of practice on a statutory footing will make it easier for the Information Commissioner to take enforcement action against those organisations in breach of the direct marketing rules under the Data Protection Act and the Privacy and Electronic Communications Regulations. The current direct marketing rules are also clear, stating as follows:

“Organisations will need to be able to demonstrate that consent was knowingly and freely given, clear and specific, and should keep clear records of consent. The ICO recommends that opt-in boxes are used”.


The general data protection regulation—GDPR—which will come into force in May 2018 will introduce tough new measures on consent and will place obligations on data controllers to demonstrate clearly how they obtained consent when processing personal data, such as contact information. Silence or pre-ticked boxes as a form of consent will not be permitted under the GDPR. The GDPR will also allow tougher penalties to be imposed on organisations in breach of the rules: up to 4% of the organisation’s total global annual turnover, or €20 million.

The noble Baroness also suggested that the time limit for retaining personal information should be limited, for example, to a year. The reality is that time is not specified: one should hold on to the information only as long as is necessary to process payment or whatever the application is made for. For these reasons, I hope the noble Baroness will feel able to withdraw her amendment.

[Baroness Finlay of Llandaff]

I thank the Minister for that reply and for welcoming the spirit of the amendment. Just for the record, the reason for specifying a year if someone has opted into the mailing list is that over time their circumstances might change. They might want to withdraw their consent but not be clear about how to do it. I hope the Information Commissioner will consider that. People might also lose cognitive function over time and therefore become much more vulnerable to scams than they were when they opted in. So I hope that a time limit is also introduced. However, on the basis of the Government’s response, I beg leave to withdraw the amendment.

Amendment 232 withdrawn.