Data Protection Bill [HL]

Baroness Howe of Idlicote Excerpts

2nd reading (Hansard): House of Lords
Tuesday 10th October 2017 Lords Chamber

[Baroness Howe of Idlicote (CB)]

My Lords, I have spoken extensively about the imperative to maximise online safety for children and of the need to provide the right tools to empower parents to help keep their children safe online. This will continue to be my priority as we discuss the Data Protection Bill at all its stages. Parents often feel that their children know rather more about accessing the technology than they do, but they still have a role and responsibility to guide their children, and this extends to the topic before us today—the child’s personal data.

During the extensive debates in this House on the Digital Economy Bill, we discussed what young people below the age of 18 should and should not see, and we voted to require a code of practice for the providers of online social media platforms, which is now Section 103 of the Act. In all our discussions about children during those debates, we were referring to individuals under the age of 18, and there was no dispute on the point. I am disappointed that nowhere in the Data Protection Bill’s 208 pages is a child defined as a person under the age of 18.

This Bill puts before us another dividing line between childhood and the influence of parents, the effect of which is nothing if not confusing. Clause 8 states that a child of 13 years can consent to providing data to information services; that is, they can sign up to social media sites and so on. By contrast, the default in the European General Data Protection Regulation is that a child should be 16 years old to be able to give “digital consent”.

The Explanatory Notes state of the age of 13:

“This is in line with the minimum age set as a matter of contract by some of the most popular information society services which currently offer services to children”.


These are contracts driven by decisions under United States federal law in the form of the Children’s Online Privacy Protection Act of 1998. However, the world of technology and what is at our children’s fingertips has changed significantly since 1998. What might have seemed good then does not mean that it is now.

Furthermore, given all the concerns expressed over recent months about the actions of social media sites, the current contracts of these sites should not be driving government policy; rather, the primary factor should be what is best for children and young people, and what is best should be established through a solid evidence base. I hope that the Minister will set out the Government’s evidence-based reasoning for using the age of 13 and tell us what evidence has been collected by the DCMS from children’s charities and those representing parents and others with an interest in these matters.

Choosing the right age for children to consent to signing up to these websites is far from a straightforward issue. I am aware that there is concern among children’s charities that setting the age of digital consent at 16 could lead to an increase in the grooming of young people by abusers, something that none of us in this House would wish to see. The Children’s Society has said that, if Parliament sets the age in Clause 8 at 16, significant changes should be made to the grooming and sexual offences legislation.

I have also received briefing material from BCS, The Chartered Institute for IT, which suggests that there is significant public support for the age being 16 or 18 and very little support for the age being 13. I understand that parents favour firmly the age of 18, so clearly there is a lot of room for discussion, and no doubt we will have it during Committee. In this context, I would like to suggest that the Government should launch an immediate public consultation on this point so that the House can make a fully informed decision before the Bill moves to the other place. Right now, either end of the age spectrum looks like it has dangers.

I also hope that the Minister will set out some clarification of the intentions of the Bill in relation to the consent of children. Paragraph (6) in Clause 8 includes an exemption for “preventive or counselling services”. Does that mean that a child could give their consent to these websites before the age of 13 or not at all? What is defined as a “preventive or counselling service”?

Clause 187 gives further criteria for the consent of children, but only children in Scotland, where a child’s capacity to exercise their consent should be taken into account, with the expectation that a child aged 12 or over is,

“presumed to be of sufficient age and maturity to have such an understanding”.

The Explanatory Notes to the Bill state that this clause must be read with Clause 8, which provides that the age limit is 13. Is Clause 187 intended to say that the age of digital consent cannot go below 13, which is the position of Article 8(1) of the GDPR, or that there might be circumstances when a child who is 13 cannot consent for genuine reasons? Either of these scenarios seems to give rise to confusion for children, parents and the websites that children access.

After all the detailed discussions about age verification that we had earlier in the year, there is an argument for age verification to apply to Clause 8. How will websites that require a child to verify that they are 13 years old ensure that the child is the age that they say they are without some requirement for the site to prove the age of the child? This is surely a meaningless provision. I hope that when the Minister comes to reply, he will set out the Government’s position on this matter and explain what penalties a website which breaches this age requirement will face.

Finally, I hope that the Minister will give us an update on the publication of the Green Paper on internet safety and how the digital charter that was announced in the Queen’s Speech will play into this Bill during its passage through this House and on to the other place.

Data Protection Bill [HL]

Baroness Howe of Idlicote Excerpts

Committee: 1st sitting (Hansard - continued): House of Lords
Monday 30th October 2017 Lords Chamber

Moved by

[Baroness Howe of Idlicote]

16: Clause 8, page 5, line 15, leave out from “as” to “and” and insert “an age between 13 and 16 years, to be decided by the Commissioner based on relevant evidence and consultation,”

[Baroness Howe of Idlicote (CB)]

My Lords, there are a series of amendments to Clause 8 that we are debating today. I hope your Lordships will allow me to give some background to set the context. Clause 8 sets the age at which children can first provide their personal data online in relation to information society services, without the permission of a parent or guardian. Given that the provision of such personal data is in exchange for online products or services, this age of consent is effectively the age at which companies can begin making money from young people online without a parent or guardian’s involvement. Article 8(1) of the GDPR states that the age of so-called digital consent should be 16, but allows member states to lower the age as long as it does not go below 13. The UK Government have set the age at 13, the minimum age possible in Clause 8.

Amendment 16 is a probing amendment to explore the evidence for whether the UK should be opting for 13. As was mentioned at Second Reading, there is concern that the Government have sleepwalked into this position without having provided much in the way of evidence for the decision to this House or the public. Such evidence is needed, not least because a recent YouGov survey for BCS, the Chartered Institute for IT, has suggested that the Government’s thinking is a long way from where public opinion sits. In the survey, the public were asked what the most appropriate age of consent for providing personal data online should be. The findings were rather stark. A mere 2% believed 13 was the most appropriate age. The vast majority, 81%, believed it should be set to either age 16 or 18, with non-parents tending to favour 16 and parents favouring 18. These findings indicate that, even if 13 is the most appropriate age, the Government have some way to go in convincing the public that this is the case.

There is little evidence provided by the Bill’s Explanatory Notes, which simply note that the age of 13,

“is in line with the minimum age set as a matter of contract by some of the most popular information society services which currently offer services to children (e.g. Facebook, Whatsapp, Instagram)”.

Given that these are the very companies that stand to profit the most from children providing their personal data to them, it seems counterintuitive that they have effectively been allowed to set a de facto standard age of consent for them doing so. This was recognised in the Children’s Charities’ Coalition on Internet Safety’s open letter to the Information Commissioner’s Office earlier this year.

--- Later in debate ---

The Government recognise the need for consistency in regulation but we believe that the priority should be to provide consistency for all UK children. For this reason, it is essential that the age in Scotland be set at 12 to, in effect, match that in England and Wales. This prevents Scottish children being at a disadvantage compared to their English and Welsh counterparts—it is as simple as that. I therefore ask the noble Baroness to withdraw her amendment.

[Baroness Howe of Idlicote]

My Lords, I am most grateful to the Minister for his explanation, even though he cannot agree with my amendment. I think quite a number of my colleagues are still not just confused as regards Scotland and England, but concerned about how this is going to be interpreted in real life. We have time to think about it before Report. In the meantime, I am not pleased but I will withdraw my amendment and hope that there may be opportunities between now and Report to get a little more clarity on this subject.

Amendment 16 withdrawn.

Data Protection Bill [HL]

Baroness Howe of Idlicote Excerpts

Committee: 2nd sitting (Hansard): House of Lords
Monday 6th November 2017 Lords Chamber

[Baroness Jay of Paddington (Lab)]

My Lords, I support the aim of these amendments, as do other noble Lords who have spoken. They were extraordinarily well introduced, given the scope of what they are intended to achieve. As I said at Second Reading, I do not have the same authority and technical background in the industry as many noble Lords who have taken part, particularly the noble Baroness, Lady Harding. However, I have a legitimate question for the noble Baroness. The Minister, who will have heard the general support around the House, will also be aware of this. However good the intentions of the amendments—and I support their aims—it is difficult to regulate in a world in which technical capacity is international. As the noble Baroness, Lady Harding, said, these matters are rather low on the agendas of the major, global corporations which are responsible for producing the technology, delivering the content and organising the platforms that children may be accessing, appropriately or not. It is legitimate to ask, as she did, whether what we say and how we regulate in this country can be a beacon. I think she said that this could be the beginning of a geographical spread of better regulation. It would be pointless to ignore the fact that we are dealing not with an internal issue of domestic regulation as we would be with terrestrial broadcasting, but with global corporations, most of them based on the west coast of the United States, which do not necessarily even agree with the aims of these amendments—which I very certainly do.

[Baroness Howe of Idlicote (CB)]

My Lords, the intention for a minimum level of design to help children and their parents, set out in Amendments 18, 19, and 155, is indeed laudable and provides an excellent opportunity for us to debate the role of the Information Commissioner. However, I am concerned that these amendments continue legal uncertainty in a number of ways. The revised Clause 8, introduced by Amendment 18, would uphold the age of 13 as the age of digital consent—but only when a website,

“meets the minimum standards of age-appropriate design as determined by the Commissioner”.

Similarly, Amendment 19 seeks to ensure that sites which children under 13 are likely to visit have a certain minimum design to help children and parents. Details for establishing those standards are in Amendments 155, 156 and 157.

My first concern is how a consumer—a child or parent—will know whether a website meets the minimum standards and therefore which age of consent applies. Secondly, what would happen were a site not to meet the minimum standards set by the Information Commissioner but still used 13 as the age for when a parent is no longer required to consent to the use of the child’s data?

Data Protection Bill [HL]

Baroness Howe of Idlicote Excerpts

3rd reading (Hansard): House of Lords & Report: 2nd sitting (Hansard): House of Lords
Wednesday 17th January 2018 Lords Chamber

Moved by

[Baroness Howe of Idlicote]

4: Clause 124, page 69, line 7, at end insert—
““children” means people under the age of 18;”

[Baroness Howe of Idlicote (CB)]

My Lords, I am pleased to speak to my Amendment 4, which I regard as small but important for the purposes of clarification.

Last month, there was universal support from your Lordships when my noble friend Lady Kidron introduced her excellent amendment on the age-appropriate design code, which is now the subject of Clause 124. At the time, I raised a question about the intention regarding the scope of the amendment, as there is no definition of “children” either in the amendment or in the Bill. I said that, as the amendment refers to the United Nations Convention on the Rights of the Child,

“I assume that the intention is that the age-appropriate design code of practice will cover all children up to the age of 18”.—[Official Report, 11/12/17; col. 1430.]

During the debate, my noble friend Lady Kidron said:

“The code created by the amendment will apply to all services,


‘likely to be accessed by children’,

irrespective of age and of whether consent has been asked for. This particular aspect of the amendment could not have been achieved without the help of the Government. In my view it is to their great credit that they agreed to extend age-appropriate standards to all children”.—[Official Report, 11/12/17; col. 1427.]

I was reassured by this statement about the intent of the clause but I remain concerned that there is no explicit definition in the Bill to indicate that we are indeed talking about any person under the age of 18, especially as the reference to the requirement to engage with the UN Convention on the Rights of the Child in Clause 124(4) is an obligation only to “have regard to”.

The truth is that there is no clear or consistent reference to a child or children in the Data Protection Bill. Clause 9 defines the right of a child to consent to their data’s use and says that this right starts at 13. Clause 201 covers children in Scotland, suggesting that there the right commences at the age of 12. These different approaches open up the door for arguments about the age at which the rights conferred by Clause 124 are operational for children. I would hate us to find ourselves in a position where, once this Bill was passed, a debate began about the ages at which the benefits of Clause 124 applied to children. This could result in a narrowing of the definition of children benefiting from Clause 124 so that it related only to some people under 18, rather than to all those under 18, on account of the Bill not being clear.

Years of experience have taught me that it is best to be crystal clear about what we are talking about, and that is why I have tabled this amendment. If the Government do not think it necessary, I hope the Minister will clearly state in his reply that the Government intend that Clause 124 should indeed relate to all persons under the age of 18. I look forward to hearing what he has to say. I beg to move.

[Baroness Kidron (CB)]

My Lords, I thank my noble friend for bringing this issue to the attention of the House. It is my understanding that, by invoking the UNCRC, we are talking about children being people under the age of 18. I would very much welcome the Minister’s saying that that extends beyond Clause 124, which we brought forward, to everywhere in the Bill that “children” is mentioned.

--- Later in debate ---

[Baroness Howe of Idlicote]

My Lords, I thank all those who have spoken, particularly the Minister for his considerate reply, which he will appreciate I nevertheless find somewhat disappointing. I hope that when the Data Protection Bill reaches the other place the issue will be debated again—and even that the Minister might by then have changed his mind. Nevertheless, in the meantime clearly I must do as requested. Therefore, I beg leave to withdraw the amendment.

Amendment 4 withdrawn.