Data (Use and Access) Bill [HL]

Baroness Kidron Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

Moved by

[Baroness Kidron]

44: After Clause 92, insert the following new Clause—
“Code of practice on Children's Data and Education(1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on the processing of data in connection with the provision of education.(2) Guidance under subsection (1) must include consideration of—(a) all aspects of the provision of education including learning, school management and safeguarding;(b) all types of schools and learning settings;(c) the need for transparency and evidence of efficacy on the use of AI systems in the provision of education;(d) the impact of profiling and automated decision-making on children’s access to education opportunities;(e) the principle that children have a right to know what data about them is being generated, collected, processed, stored and shared;(f) the principle that those with parental responsibility have a right to know how their children's data is being generated, collected, processed, stored and shared;(g) the safety and security of children’s data;(h) the need to ensure children's access to and use of counselling services and the exchange of information for safeguarding purposes are not restricted.(3) In preparing a code or amendments under this section, the Commissioner must have regard to—(a) the fact that children are entitled to a higher standard of protection than adults with regard to their personal data as set out in the UK GDPR, and the ICO’s Age Appropriate Design code;(b) the need to prioritise children's best interests and to uphold their rights under UN Convention on the Rights of the Child and General Comment 25;(c) the fact that children may require different protections at different ages and stages of development;(d) the need to support innovation to enhance UK children's education and learning opportunities, including facilitating testing of novel products and supporting the certification and the development of standards;(e) ensuring the benefits from product and service developed using UK children’s data accrue to the UK.(4) In preparing a code or amendments under this section, the Commissioner must consult with—(a) children,(b) educators,(c) parents,(d) persons who appear to the Commissioner to represent the interests of children,(e) the AI Safety Institute, and(f) the relevant Education department for each nation of the United Kingdom.(5) The Code applies to data processors and controllers that— (a) are providing education in school or other learning settings;(b) provide services or products in connection with the provision of education;(c) collect children's data whilst they are learning;(d) use education data, education data sets or pupil data to develop services and products;(e) build, train or operate AI systems and models that impact children’s learning experience or outcomes;(f) are public authorities that process education data, education data sets or pupil data.(6) The Commissioner must prepare a report, in consultation with the EdTech industry and other stakeholders set out in subsection (4), on the steps required to develop a certification scheme under Article 42 of the UK GDPR, to enable the industry to demonstrate the compliance of EdTech services and products with the UK GDPR, and conformity with this Code.(7) Where requested by an education service, evidence of compliance with this Code must be provided by relevant providers of commercial products and services in a manner that satisfies the education service's obligations under the Code.(8) In this section—“EdTech” means a service or product that digitise education functions including administration and management information systems, learning and assessment and safeguarding, including services or products used within school settings and at home on the recommendation, advice or instruction of a school;“education data” means personal data that forms part of an educational record.“education data sets” means anonymised or pseudonymised data sets that include Education Data or Pupil Data.“efficacy” means that the promised learning outcomes can be evidenced.“learning setting” means a place where children learn including schools, their home and extra-curricular learning services for example online and in-person tutors.“pupil data” means personal data about a child collected whilst they are learning which does not form part of an educational record.“safety and security” means that it has been adequately tested.“school” means an entity that provides education to children in the UK including early years providers, nursery schools, primary schools, secondary schools, sixth form colleges, city technology colleges, academies, free schools, faith schools, special schools, state boarding schools, and private schools.”Member's explanatory statement
This amendment proposes a statutory Code of Practice on Children and Education to ensure that children benefit from heightened protections when their data is processed for purposes relating to education. Common standards across the sector will assist schools in procurement.

[Baroness Kidron (CB)]

My Lords, Amendment 44 in my name and those of the noble Lords, Lord Russell and Lord Clement-Jones, and the noble Baroness, Lady Harding, proposes a statutory code of practice on children’s education to ensure that children benefit from heightened protections when their data is processed for the purposes of relating to education.

My understanding is that, when the Minister stands up, he will tell us that the Secretary of State is going to write to the ICO and require him to either write such a code or, if it is more practical, extend the AADC to cover educational settings. The either/or is because Government say the ICO is undertaking a consultation on edtech and DSIT is doing a consultation on AI, both of which have ramifications for children’s data at school.

Rather than make the argument for the amendment as written, I shall put on record for the department and the ICO the expectations of such a code. I hope that the Minister concurs with this list and that he will ensure that the ICO works with me and expert colleagues in the field to look at and respond to the evidence and ensure that the code addresses our concerns.

The code must apply to education provided in school settings but also outside the classroom—for example, when children use edtech products to complete homework set by school or for independent learning. The code must consider all aspects of the provision of education, including safeguarding and administration, as well as learning. The code should take as a starting point that children merit heightened protections and consider the needs of children at different ages and stages. The code should provide specific guidance on profiling, including predictions that may impact on children’s educational opportunities or outcomes. The code should require the ICO or the DfE to work with third parties to develop certification and accreditation schemes to support educators and parents in choosing products and services that are safe and private and improve learning outcomes. Lastly, in drawing up the code, the ICO must consult with children, parents, educators, devolved Governments and industry.

I also want to put on record that “school” means an entity that provides education to children in the UK. Importantly, that includes early-years providers, nursery schools, primary schools and so on, because often early years are left out of this equation.

--- Later in debate ---

[Baroness Kidron (CB)]

May I ask for a commitment from the Dispatch Box that, when the order is complete and some of those conversations are being discussed, we can have a meeting with the ICO, the DfE and noble Lords who have fought for this since 2018?

[Lord Vallance of Balham (Lab)]

I am very happy to give that commitment. That would be an important and useful meeting.

[Baroness Kidron (CB)]

I thank the Minister and the Government. As I have just said, we have been fighting for this since 2018, so that is quite something. I forgot to say in my opening remarks that edtech does not, of course, have an absolute definition. However, in my mind—it is important for me to say this to the House—it includes management, safety and tech that is used for educational purposes. All those are in schools, and we have evidence of problems with all of them. I was absolutely delighted to hear the Government’s commitments, and I look forward to working with the ICO and the department. With that, I beg leave to withdraw.

Amendment 44 withdrawn.

--- Later in debate ---

Moved by

[Baroness Kidron]

44A: Clause 94, page 119, line 1, at end insert—
“(1) In the 2018 Act, in section 139, after subsection (2) insert—“(2A) The report must include an assessment of the Commissioner’s performance of the duties assigned to it by regulations under section (Enforcement) of the Data (Use and Access) Act 2025.””

[Baroness Kidron (CB)]

In moving Amendment 44A, I shall also speak to Amendments 61 to 65 in my name and the names of the noble Lords, Lord Stevenson and Lord Clement-Jones, and my noble friend Lord Freyberg. I registered my interests in Committee, but I begin by restating that I am a copyright holder. I am married to a copyright holder, and I have deep connections with many in the creative communities who are impacted by this issue. I am also an adviser to the Institute for Ethics in AI at Oxford, and I have the pleasure and privilege of working alongside dozens of people whose businesses and academic interests relate solely to AI.

Until last night, I had a very technical argument about the amendments—about what they would do and how they would work. But I sat in the Gallery of the other place for several hours last night to listen to the debate on the creative industries, and I listened virtually to what I did not see from the Gallery, and it really made me reconsider my approach today. It was striking that, whether on the Green, DUP, Liberal Democrat or Conservative Benches, or the Government’s own Back Benches, the single biggest concern in a debate that ran for hours, with many speakers, was the question of copyright and AI. Indeed, it figured in all but two or three speeches. Moreover, as I sat in the Gallery and people started to read from the Times, the Mail, Politico and the tech blogs, an increasing flow of MPs, many on the Government’s own Benches and some actually in the Government, texted me to say that their leadership was wrong and they hoped this fight would be won for the UK’s creative industries.

It is a very great privilege to be on these Benches and never have to vote against the Whip. But I say to my friends and colleagues on all sides that, as we debate today, hundreds of organisations and many individual rights holders are watching. They are watching to see what this House will do in the face of a government proposal that will transfer their hard-earned property from them to another sector without compensation, and with it their possibility of a creative life, or a creative life for the next generation.

The Government are doing this not because the current law does not protect intellectual property rights, nor because they do not understand the devastation it will cause, but because they are hooked on the delusion that the UK’s best interests and economic future align with those of Silicon Valley. The Minister will say to the House that a consultation is ongoing and we should wait for the results. This was the same line the Minister in the other place, Chris Bryant, took last night; he said that his door and his mind were open. If that is the case, I would like to know why the honourable Dame Caroline Dinenage, the chair of the Commons Select Committee, said she felt “gaslit” by Ministers and the Secretary of State.

I would also like to know why the Minister in charge of the Bill in the other place has refused a meeting with me twice and why the creative industries say that they get blandishments from a junior Minister while the AI companies get the undivided attention of the Secretary of State. Most importantly, the assertion that the consultation is open and fair is critically undermined because it was launched with a preferred option. For the record, the Government’s preferred option is to give away the property rights of those who earned them on the promise of growth, growth, growth to the nation. Unfortunately, the Government cannot say to whom that growth will accrue or how much it will be. But the one thing they are absolutely sure of—Government, Opposition, AI companies and those whose property rights the Government are giving away—is that it will not accrue to the creative industries.

We have before us the most extraordinary sight of a Labour Government transferring wealth directly from 2.4 million individual creatives, SMEs and UK brands on the promise of vague riches in the future. Before I turn to the Opposition—which I will—I make it clear that there is a role in our economy for AI, there is a role in our economy for companies headquartered elsewhere, there is a role in our economy for new AI models and there is an opportunity of growth in the combination of AI and creative industries. But this forced marriage, on slave terms, is not it.

We have the Government, putting growth front and centre, stunting one of their most lucrative industries, and the equally extraordinary sight of the Conservative Opposition for the most part sitting on their hands, against the wishes of many in their tribe, putting party ahead of country because they prefer to have proof of the Government’s economic incompetence rather than protect the property rights of their citizens and creative industries.

Let me kill a few sacred cows. Judges, lawyers and academics all agree that the law on copyright is clear, and the ICO determination that copyright stands in spite of the advances of AI is also clear. Ministers choosing to mirror the tech lobbyist language of uncertainty rather than defending the property rights of citizens and wealth creators is bewildering. They are not quoting the law or the experts; they point at the number of court cases as proof of lack of clarity. But I am at a loss, since a person who has had their goods stolen relying on their legal rights seems to be a sign that the law is clear.

However, given the scale of the theft and the audacity of the robber barons, they should be able to turn to the Government for protection—rather than suggesting that we redefine the notion of theft. The Minister, the honourable Chris Bryant, said last night that change is needed and that we cannot do nothing, and the unified voices of the creative industries—from the biggest brands such as Sony and Disney to newspapers such as the Telegraph, the FT and the Guardian, and those who represent publishers, musicians or visual artists and the artists themselves—all agree. Nobody is saying that we should leave it as it is. They are saying, “Make the copyright regime fit for the age of AI”—which is exactly what the amendments do.

The amendments surface the names and owners of the crawlers that currently operate anonymously, record when, where and how IP is taken and, crucially, allow creators to understand what has been taken so that they can seek redress. This is not new, burdensome regulation—and it is certainly less regulation than the incredibly complex, costly and ultimately unworkable opt-outs or rights reservation mechanism of the preferred option of the consultation. All that creators are asking for is the enforcement of an existing property right. And when I say “creators”, I am not talking about 19th-century aristocrats occupying the time between lunch and dinner. In spite of the immense pleasure and extraordinary soft power that the creative industries bring, it is a hard-nosed, incredibly competitive and successful sector. It takes training, skill and talent to pursue what is often an insecure career, in which the copyright of career highs pays for the costs of a freelance life and the ongoing costs of making new work.

In the other place last night, the Minister talked about transparency without reference to the fact that the tech lobby is already on manoeuvres, saying that transparency must not be too detailed because it will impact on their IP. Creatives’ IP is being given away for literally nothing, but AI companies wish to hide behind the IP of products that are simply impossible to make without the raw material of that data. So will the Minister explain why the Government pay for software licences, why our NHS pays for drugs and why members of the Cabinet pay for branded clothes, yet the Government think that the creative industries should invent something for nothing?

The Government say that doing nothing is not an option. I agree—they could call a halt to the theft, instruct the ICO and the IPO now or even do an impact assessment of their preferred policy. This is the most extraordinary thing. They have a preferred way forward but, when I asked, they had to admit that they had not done an economic impact assessment, including of job displacement, even while acknowledging that job losses were inevitable. The Prime Minister cited an IMF report that claimed that, if fully realised, the gains from AI could be worth up to an average of £47 billion to the UK each year over a decade. He did not say that the very same report suggested that unemployment would increase by 5.5% over the same period. This is a big number—a lot of jobs and a very significant cost to the taxpayer. Nor does that £47 billion account for the transfer of funds from one sector to another. The creative industries contribute £126 billion per year to the economy. I do not understand the excitement about £47 billion when you are giving up £126 billion.

The Government have a preferred option, but they have no enforcement mechanism. They have a preferred option, but no protocols to make it work. They have a preferred option but, by their own admission, no idea how an individual artist could hope to chase down dozens, hundreds or maybe thousands of AI companies to opt out or trace their work and rights. They have a preferred option, which is to give away other people’s livings and their vast contribution to the Treasury, and with that the jobs, joy and soft power of our creative industries that the country relies on globally.

There are plenty of great ideas about how creativity could add GDP to the country, but that is not the demand that the Government have made of the sector. I will not quote most of those to whom I have spoken in the last week, because the language is unparliamentary. However, I will pass on the deep regret of Lord Lloyd- Webber that he is no longer in his place to stand by me today. I will also pass on the words of a Labour donor, who said that this was economically illiterate.

--- Later in debate ---

To further show our commitment on this issue, I will be pleased to update the House on progress and to set out next steps very soon after the consultation has closed on 25 February. Noble Lords may be aware that I called for early clarity on this matter in my 2023 review for the previous Government. I hope that we can move swiftly to reach much-needed certainty and fairness. I hope that noble Lords will allow us the chance to properly conclude our consultation process and bring forward comprehensive proposals as a result. As such, I ask the noble Baroness to withdraw her amendment.

[Baroness Kidron (CB)]

My Lords, I want to return to the moment just before the Front-Bench speeches of the Opposition and the Government, when there was absolute agreement around the House. There were fantastic speeches from all sides, which understood AI not as competition but as a fellow traveller of the creative industries. I want to make that really clear, as all colleagues did around the House. I thank all noble Lords on both Benches who are being whipped not to vote for this for saying that they will support it. As I said at the outset, there are many hundreds of people watching this, and they want to know what the House is going to do to protect their future.

I will not address my remarks to the noble Viscount, Lord Camrose; he knows what I think. For a Conservative Party not to act on the property rights of UK citizens is a crying shame. To the Government and the Minister —to whom I keep finding myself saying, “who I like very much”—I have to say that this is not good enough. The Minister used the word “premature” twice. There may be a dispute about 09 or 10, but we seem to be in agreement on the 17 over on our Benches. It is not premature to use the copyright law to protect the property rights of British citizens.

I also noticed the slight slide around the preferred option. I am sorry, but to say it is a preferred option and then suggest that it is an open consultation is simply not correct. I also want to talk about this business of the impact assessment—and I am going to revisit this. I was in a meeting with officials, and I asked for the impact assessment. They said, “Well, there was one, but I don’t think it will suffice for you, Lady Kidron”. The reason it did not suffice for the noble Baroness, Lady Kidron, is because this impact assessment of AI on companies was just eight bullet points. If just one of the bullet points concerns this point about job losses and loss of income, I do not call that an impact assessment. To have a preferred option that is so catastrophic for our country’s second most effective industry—£126 billion down the drain for this magical £4.7 billion—means that I, like other noble Lords, do not understand what we are doing here.

I can see that the Chamber is filling up. Finally, on this point about international law, we have heard it all before: we heard about data law, we heard about the OSA, we heard about competition law. I wonder whether, when they do an impact assessment, the Government might consider how many creative copyright owners might like to come to the UK to ply their trade when we have our copyright laws in full order. I remember one of the first reasons Canal+ gave for making its IPO in London was our copyright laws—and it has “Paddington”.

I thank all noble Lords for speaking. They made tremendous speeches, which were educated, thoughtful and non-hysterical. These are very modest amendments, and this House has a duty to those people outside to vote on them. I will add that, at a personal level, in the 12 years I have been in your Lordships’ House I have done so many deals with the Government of the day, whichever Government that was. I have always tried to avoid voting, and I have never called a vote that I did not know I was going to win. Because of the whipping arrangements, I believe I will lose today, but we will vote. I invite those people who want the creative industries to know that we have their back to follow me through the Lobby. I would like to test the opinion of the House.

--- Later in debate ---

Moved by

[Baroness Kidron]

51: Clause 123, page 153, line 14, leave out “may by regulations” and insert “must, as soon as reasonably practicable and no later than 12 months after the day on which this Act is passed, make and lay regulations to”
Member’s explanatory statement
This amendment removes the Secretary of State’s discretion on whether to lay regulations under Clause 123 and sets a time limit for laying them before Parliament.

[Baroness Kidron (CB)]

My Lords, these amendments have to do with research access for online safety. Having sat on the Joint Committee of the draft Online Safety Bill back in 2021, I put on record that I am delighted that the Government have taken the issue of research access to data very seriously. It was a central plank of what we suggested and it is fantastic that they have done it.

Of the amendments in my name, Amendment 51 would simply ensure that the provisions of Clause 123 are acted on by removing the Government’s discretion as to whether they introduce regulations. It also introduces a deadline of 12 months for the Government to do so. Amendment 53 seeks to ensure that the regulators will enable independent researchers to research how online risks and harms impact different groups, especially vulnerable users, including children. Given the excitements we have already had this evening, I do not propose to press any of them, but I would like to hear from the Minister that he has heard me and that the Government will seek to enshrine the principle of different ages, different stages, different people, when he responds.

I note that the noble Lord, Lord Bethell, who has the other amendments in this group, to which I added my name, is not in his place, but I understand that he has sought—and got—reassurance on his amendments. So there is just one remaining matter on which I would like further reassurance: the scope of the legal privilege exception. A letter from the Minister on 10 January explains:

“The clause restates the existing law on legally privileged information as a reassurance that regulated services will not be asked to break the existing legislation on the disclosure of this type of data”.


It seems that the Minister has veered tantalisingly close to answering my question, but not in a manner that I can quite understand. So I would really love to understand—and I would be grateful to the Minister if he would try to explain to me—how the Government will prevent tech companies using legal privilege as a shield. Specifically, would CCing a lawyer on every email exchange, or having a lawyer in every team, allow companies to prevent legitimate scrutiny of their safety record? I have sat in Silicon Valley headquarters and each team came with its own lawyer—I would really appreciate clarity on this issue. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, I can only support what the noble Baroness, Lady Kidron, had to say. This is essentially unfinished business from the Online Safety Act, which we laboured in the vineyard to deliver some time ago. These amendments aim to strengthen Clause 123 and try to make sure that this actually happens and that we do not get the outcomes of the kind that the noble Baroness has mentioned.

I, too, have read the letter from the Minister to the noble Lord, Lord Bethell. It is hedged about with a number of qualifications, so I very much hope that the Minister will cut through it and give us some very clear assurances, because I must say that I veer back and forth when I read the paragraphs. I say, “There’s a win”, and then the next paragraph kind of qualifies it, so perhaps the Minister will give us true clarity when he responds.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

I thank the noble Baroness, Lady Kidron, for the amendments on researchers’ access to data for online safety research, an incredibly important topic. It is clear from Committee that the Government’s proposals in this clause are broadly welcomed. They will ensure that researchers can access the vital data they need to undertake an analysis of online safety risks to UK users, informing future online safety interventions and keeping people safe online.

Amendment 51 would compel the Secretary of State to make regulations for a researcher access framework, and to do so within 12 months. While I am sympathetic to the spirit of the noble Baroness’s amendment, a fixed 12-month timescale and requirement to make regulations may risk compressing the time and options available to develop the most effective and appropriate solution, as my noble friend Lady Jones outlined in Committee. Getting this right is clearly important. While we are committed to introducing a framework as quickly as possible, we do not want to compromise its quality. We need adequate time to ensure that the framework is fit for purpose, appropriately safeguarded and future-proofed for a fast-evolving technological environment.

As required by the Online Safety Act, Ofcom is currently preparing a report into the ways in which researchers can access data and the barriers that they face, as well as exploring how additional access might be achieved. This report will be published in July of this year. We are also committed to conducting a thorough consultation on the issue prior to any enforceable requirements coming into force. The Government intend to consult on the framework as soon as practicable after the publication of Ofcom’s report this summer.

Sufficient time is required for a thorough consultation with the wide range of interested stakeholders in this area, including the research community, civil society and industry. I know that the noble Baroness raised a concern in Committee that the Government would rely on Ofcom’s report to set the framework for the regime, but I can assure her that a robust evidence-gathering process is already under way. The framework will be informed by collaboration with key stakeholders and formal consultation, as well as being guided by evidence from Ofcom’s report on the matter. Once all interested parties have had their say and the consultation is completed, the Government expect to make regulations to install the framework. It is right that the Government commit to a full consultation process and do not seek to prejudge the outcomes of that process by including a mandatory requirement for regulations now.

Amendment 53 would seek to expand the list of examples of the types of provision that the regulations might make. Clause 123 gives non-exhaustive examples of what may be included in future regulations; it certainly does not limit those regulations to the examples given. Given the central importance of protecting children and vulnerable users online, a key aim of any future regulations would be to support researchers to conduct research into the different ways that various groups of people experience online safety, without the need for this amendment. Indeed, a significant driving force for establishing this framework in the first place is to improve the quality of research that is possible to understand the risks to users online, particularly those faced by children. I acknowledge the point that the noble Baroness made about people of all ages. We would be keen to discuss this further with her as we consult on specific requirements as part of developing regulations.

I will touch on the point about legal privilege. We believe that routinely copying a lawyer on to all emails and documents is not likely to attract legal privilege. Legal privilege protects communication specifically between legal advisers and their clients being created for the purpose of giving or receiving legal advice, or for the sole or dominant purpose of litigation. It would not be satisfactory just to copy everyone on everything.

We are confident that we can draft regulations that will make it entirely clear that the legal right to data for research purposes cannot be avoided by tech companies seeking to rely on contractual provisions that purport to prevent the sharing of data for research purposes. Therefore, there is no need for a specific requirement in the Bill to override a terms of service.

[Baroness Kidron (CB)]

I thank the Minister for his very full answer. My legal adviser on my right—the noble and learned Lord, Lord Thomas of Cwmgiedd—let me know that I was in a good place here. I particularly welcome the Minister’s invitation to discuss Ofcom’s review and the consultation. Perhaps he would not mind if I brought some of my researcher friends with me to that meeting. With that, I beg leave to withdraw the amendment.

Amendment 51 withdrawn.