Data (Use and Access) Bill [ Lords ] (First sitting)

Ben Spencer Excerpts

Committee stage
Tuesday 4th March 2025 Public Bill Committees

[Chris Bryant]

Strictly speaking, it is a misnomer to say that we do the Bill line by line; we do it clause by clause, or grouping by grouping. The first grouping contains clause 1 and new clause 15, which was tabled by the Liberal Democrat spokesperson, the hon. Member for Harpenden and Berkhamsted.

Clauses 1 to 26 establish regulation-making powers to implement smart data schemes. I think this part of the Bill is universally accepted, or it was in a previous version of the Bill—this is at least the third version of the Bill that a House of Commons Committee has considered line by line, clause by clause or grouping by grouping. These clauses were part 3 of the old Bill, but it is none the less important that we go through each of the clauses segment by segment, because this is a newly constituted House of Commons, with different Members and political parties, and therefore we have to consider them fully.

As many hon. Members will know, smart data involves traders securely sharing data with the customer or authorised third parties at the customer’s request. Those third parties may use the data to provide the customer with innovative services, including account management services or price comparisons. This has already been spectacularly successful in open banking.

Clause 1 defines the key terms and scope of part 1, which covers clauses 1 to 26. Subsection (2) defines the kinds of data to which part 1 applies: “customer data”, which is information specific to a customer of a trader, and “business data”, which is generic data relating to the goods, services or digital content provided by that trader. It also defines “data holder” and “trader” to clarify who may be required to provide data. That covers persons providing the goods, services or digital content, whether they are doing so themselves or through others, or processing related data.

Subsections (3) to (5) set out who is a customer of a trader. Customers can include both consumers and businesses such as companies. Subsection (6) recognises that regulations may provide for data access rather than transfer.

I commend clause 1 to the Committee and urge hon. Members to resist the temptations offered by the hon. Member for Harpenden and Berkhamsted, who tabled new clause 15. I thank her for her interest in smart data. We had a very good conversation a week ago. I am glad to be able to confirm that, following some pressure from the Liberal Democrats in the other place, the Government announced that the Department for Business and Trade intends to publish a strategy document later this year on future uses of those powers. Since the hon. Member’s new clause asks for a road map and we are saying that there will be a strategy, the difference between us may just be semantic.

The strategy document will lay out the Government’s plans to consult or conduct calls for evidence in a number of sectors. It is important that we implement those powers only after having properly spoken with relevant parties such as consumer groups and industry bodies in the sector. Clause 22 also requires consultation before commencement in any sector. As such, we think the best approach is to use powers in part 1 of the Bill to implement smart data schemes that fit the identified needs of the relevant sector. The strategy document will set out the Government’s plans for doing so. For that reason, I ask the hon. Lady to withdraw her new clause.

[Dr Ben Spencer (Runnymede and Weybridge) (Con)]

It is a pleasure to serve under your chairmanship, Mr Turner, and I thank all hon. Members taking part in the Committee as well as the officials. As the Minister said, this is the third iteration of this Bill and it has been extensively covered in Committee before. We rely on and thank former Members and those in the other place who worked on the Bill to get it to where it is. I am pleased that the Government are taking the Bill forward and that it is one of the early Bills in the Session.

There is much to say about the Bill that is positive, and not just because it is a reformed version of our previous two Bills. Although, ironically, the Bill does not reference the term “smart data”, clause 1 brings forward smart data and smart data schemes. That will help to open up a digital revolution, which will build on the successes of open banking in other sectors. We very much support that.

[Victoria Collins (Harpenden and Berkhamsted) (LD)]

It is a pleasure to serve under your chairmanship, Mr Turner. The Liberal Democrats very much support the Bill and the move towards smart data. Every single day, millions of people in the UK unknowingly generate vast amounts of data, whether they are switching energy providers, checking their bank balance or simply browsing the internet. That is why I want to speak to new clause 15.

For the past decade, we have seen the enormous benefits of open banking, which has given customers the power to securely share their financial data with new providers. That has unlocked better deals, personalised financial data and a wave of innovation. I welcome what the Minister said about a strategy, but new clause 15 explicitly seeks to extend the benefits across multiple sectors, from energy to telecoms and beyond, giving consumers and small businesses a real say in how their data is used and the chance to benefit from that.

If Linda, a business owner in Tring, wants to switch to a cheaper energy provider or broadband deal, she faces a mountain of admin and endless calls to suppliers. She has no simple way of exporting her usage data and instantly comparing deals. But what if she did? A multi-sector consumer data right, as proposed by the new clause, would give Linda the ability to export her energy usage securely to a new provider. She could use a digital tool to automatically compare plans, switch to a greener provider and save thousands in operational costs, freeing up her focus for growing a business.

However, it is not just Linda and family businesses. New clause 15 would put real power in the hands of households struggling with the cost of living crisis—an ability to break free from restrictive contracts, find better deals and ultimately reduce bills. This is not just a radical idea: Australia has already implemented the consumer data right across finance, energy and telecoms, leading to an explosion of new services, better competition and savings for consumers. The European Union is moving in that direction, yet in the UK we have not taken that step. However, I accept what the Minister said about our strategy moving forward, which I very much welcome.

New clause 15 does not demand an overnight change. It would require the road map to be published in 12 months and to ensure that technical standards are in place and data sharing is secure and efficient. It includes a phased implementation plan to bring in new sectors gradually as well as consumer protection measures so that is done safely and fairly, with public trust at its core. This is not just about giving consumers more control over their data. It is about driving economic growth and innovation. If we get this right, we can see new fintech and comparison tools so that consumers can slash bills and switch telecom providers faster and more easily. It is about more competition, more choice and more innovation. I urge colleagues to consider the new clause, but I absolutely welcome what the Minister has said. Let us take a step forward and ensure that consumers and businesses have the rights that they deserve over their own data.

--- Later in debate ---

Clause 9 contains safeguards limiting enforcers’ investigatory powers. Those require a warrant for entry to private dwellings, and restrict enforcers’ use of information, safeguarding the privileges of Parliament and legal privilege, and protecting against self-incrimination, except for offences under part 1 of the Bill and perjury. The clause also prevents, subject to exceptions, written or oral statements given in investigations from being used against a person being prosecuted for an offence other than one under this part of the Bill. That reflects section 143(8) of the Data Protection Act 2018. I commend clauses 8 and 9 to the Committee.

[Dr Spencer]

We support technical amendments to the Bill to make sure it works properly, but I am intrigued why these amendments are necessary at such a late stage, bearing in mind the multiple layers of scrutiny that the Bill has gone through. Can he explain where he received the feedback about the necessity of the proposed changes?

[Chris Bryant]

As the hon. Gentleman says, these are technical changes, and sometimes we just have to go through it again and again to make sure that we have got things right. Amendment 4, for instance, was simply a matter of working out that the grammar did not really work. Sometimes, it is just a question of filleting, I am afraid, and that is what we have been doing.

Amendment 1 agreed to.

Amendments made: 2, in clause 8, page 13, line 16, after second “specified” insert “documents or”.

This amendment provides that regulations may require enforcers to publish or provide documents as well as information, making the regulation-making powers in relation to enforcers consistent with the powers in relation to decision-makers and interface bodies (under clauses 6(9) and 7(4)(k)). See also Amendments 3 and 5.

Amendment 3, in clause 8, page 13, line 18, leave out “information about” and insert—

“documents or information relating to”.

See the explanatory statement for Amendment 2.

Amendment 4, in clause 8, page 13, line 18, leave out—

“, either generally or in relation to a particular case”.

This amendment leaves out unnecessary words. Power for regulations to make provision generally or in relation to particular cases is conferred by clause 21(1)(a).

Amendment 5, in clause 8, page 13, line 20, leave out “information about” and insert—

“documents or information relating to”.—(Chris Bryant.)

See the explanatory statement for Amendment 2.

Clause 8, as amended, ordered to stand part of the Bill.

Clause 9 ordered to stand part of the Bill.

Clause 10

Financial penalties

--- Later in debate ---

[Chris Bryant]

Again, it might be more convenient if I speak to the clauses first and come back to the amendments, because then it is more self-explanatory, but I may need to speak at greater length here.

Open banking has revolutionised the UK retail banking sector by enhancing competition and introducing innovative services. Establishing a long-term regulatory framework for open banking will pave the way for its future growth, and this framework will rely on the FCA having the powers necessary for effective regulation and oversight. Clause 14 therefore empowers the Treasury to enable or require the FCA to set rules for interface bodies and participants in smart data schemes, ensuring compliance with essential standards. Clause 15 sets out further detail about the regulation-making powers conferred on the Treasury by clause 14.

These provisions create a clear framework for delegating rule-making powers, ensuring effective regulation, proper funding and mechanisms to address misconduct by scheme participants, with clear objectives for the FCA’s oversight of smart data schemes. Regulations may enable or require the FCA to impose interface requirements relating to an interface body, as set out for the smart data powers more broadly in clause 7, and to require fees to be paid by financial services providers to cover interface body costs.

Clause 15 further provides that such regulations must impose certain requirements upon the FCA, including a requirement, so far as is reasonably possible, to exercise functions conferred by the regulations in line with specified purposes, and a requirement that the FCA must have regard to specified matters when exercising such functions. Additionally, regulations under clause 15 may empower or require the FCA to impose requirements on individuals or organisations to review their conduct, to take corrective action and to make redress for loss or damage suffered by others as a result of their conduct.

Clause 16 covers the Treasury’s ability to make regulations enabling the FCA to impose financial penalties and levies. The regulations may require or enable the FCA to set the amount or method for calculating penalties for breaches of FCA interface rules. The regulations must require the FCA to set out its penalties policy, and may specify matters that such a policy must include. Additionally, the Treasury may impose itself, or provide for the FCA to impose, a levy on data holders or third-party recipients of financial services data under the scheme to cover its regulatory costs, with the funds being used as specified in the regulations. Only those capable of being directly impacted should be subject to the levy.

Penalties and levies are a necessary part of smart data schemes, including in financial services, to allow the FCA to penalise non-compliance and recover the costs of its regulatory activities. The clause ensures that any penalties or levies are subject to proportionate controls.

Clause 17 gives the Treasury the power to amend section 98 of the Financial Services (Banking Reform) Act 2013 through regulations. This will allow the Treasury to update the definitions of the FCA’s responsibilities and objectives in that section, so they can include new functions or objectives given to the FCA by regulations made under part 1 of this Bill. That will ensure that the FCA’s new duties fit into the existing system for co-ordinating payment system regulators, helping maintain a consistent approach across the financial sector. Regulations made under the clause will be subject to the affirmative procedure.

We have tabled Government amendments 7 to 9 to ensure that the Treasury may delegate to the FCA powers to set rules for action initiation, as well as data sharing. We think this is vital to ensure that open banking continues to work properly and is in line with the policy as set out elsewhere.

[Dr Spencer]

I apologise, Mr Turner: I misspoke earlier with regard to our position on the Government amendments. Rather than offering positive support, I meant to say that we will not oppose the technical amendments.

What does the FCA think about these amendments? Has the Department consulted the FCA?

[Chris Bryant]

I am not sure whether we have specifically—I am looking to my left for inspiration. I am getting vague inspiration, although it is remarkably non-productive. If the hon. Member would like to intervene for a little longer, perhaps I will be able to be more inspired.

--- Later in debate ---

[Dr Spencer]

I thank the Minister for giving way. I appreciate that it is a technical question and I hope he is able to give a response. Equally, I appreciate that he may have to write to me in due course. I see that there are papers coming his way.

[Chris Bryant]

To quote Richard II, methinks I am a prophet new inspired. Yes, this is all based on a consultation with the FCA. The FCA is content with us proceeding in this direction. I hope that, on that basis, the shadow Minister—I am trying to differentiate between his not opposing and supporting, but I think on the whole in Parliament, if you are not against us, you are for us. I think in this measure he is for us.

--- Later in debate ---

[Chris Bryant]

Part 2 of the Bill is about digital verification services. Those are obviously a very important part of the Bill; they lay out how we want to move into a new era and they are essential to many businesses being able to deliver their services effectively. They are also important to the Government being able to deliver some of the things we hope for—in terms of greater productivity in the delivery of services—and, frankly, to turning Government-provided services into services that feel as intuitively available and accessible as those provided by the private sector.

Clause 27 defines digital verification services and sets out the scope of provision in part 2, which runs from clauses 27 to 55, to help secure their reliability. New clause 9, which we will hear about in a few moments, has been tabled by the hon. Member for North Norfolk. It would require organisations to offer non-digital verification services where practicable. The provision would change the voluntary nature of part 2 by imposing new obligations on businesses.

I fully support the idea of digital inclusion, which is why as the digital inclusion Minister I introduced our first action plan last week; we are the first Government to bring one forward in 10 years. However, we believe that the new clause is unnecessary because we are already prioritising digital inclusion. The office for digital identities and attributes will monitor the inclusivity of certified services, and include findings in the annual report that must be published under clause 53, which we will come to later.

In addition, there are already legislative protections in the Equality Act 2010 for protected groups. If in future the Government find evidence suggesting that regulatory intervention is appropriate to ensure that individuals have equal access to services across the economy, then we will consider appropriate intervention. I reassure the House that digital inclusion is a high priority for the Government, which is why we have set up the digital inclusion and skills unit within the Department for Science, Innovation and Technology, and why just last week we published the digital inclusion action plan, setting out the first five immediate steps we are taking towards our ambition of delivering digital inclusion for everyone across the UK, regardless of their circumstances.

We want to be able to deliver as many services digitally as possible, in a way that is fully accessible to people. However, we also accept that many people are not engaged in the digital world, and that there must also be provision for them. For those reasons, I hope the hon. Member for North Norfolk feels comfortable not pressing his new clause to a vote.

[Dr Spencer]

Digital verification services are important, and will make a big change when rolled out as part of this legislation. The provision is entirely right, particularly on the proportionality of data disclosure. Reading through some of the various reports and briefings we have received, the example used is of someone going into a nightclub: why should a scanned copy of their driving licence be consumed and contained by whoever the data holder is, when all they need to do is prove their age? These services will open the door to allow the proportionate disclosure of data. There is a both a data assurance component and a section on privacy, so we are glad that the Government are taking these measures forward.

I sympathise with the intention of new clause 9, in the name of the hon. Member for North Norfolk, which is to make sure that we do everything we can to support people who are digitally excluded. That ensures that people are not locked out and that there is a degree of reciprocity, so that as we digitalise more, the opportunity remains for people to access non-digital base services. I am not sure about the scope of the binding duty in the provision and about how the duties on small providers, as opposed to a duty on public service providers, play out politically. I think those are different things. Nevertheless, I support the sentiment of the new clause.

[Steff Aquarone (North Norfolk) (LD)]

It is a pleasure to serve under your chairship, Mr Turner. Don’t get me wrong: there are huge opportunities to improve the seamlessness of services for all users, regardless of whether they access those services digitally or not. Through new clause 9, I want to establish a right for those who do not wish to or cannot use digital identification within the verification framework that the Bill creates. The amendment was also tabled in Committee in the other place by the noble Lord Clement-Jones, and I am pleased to bring it before this House, too.

--- Later in debate ---

[The Chair]

Before I call the shadow Minister, I want to clarify that amendment 11 is in this group, but a decision on it will be taken when we get to clause 45.

[Dr Spencer]

Amendments 10 and 11 seek to remove certain provisions that were introduced in Committee in the other place. I thank Sex Matters for its work, but also many people in this policy area who have tried to focus on the importance of data accuracy and validity when it is used.

I hope we all agree that it is important that data, when it is collected—in fact it is a principle of data collection and maintenance—is accurate and correct and that there is no point holding or using data if it is incorrect. Biased data is worse than no data at all. Therefore, I do not understand—especially given the extra use of the data that will come as part of digital verification services—why the Minister and the Government are not keen on the provision to stipulate that public bodies that hold sensitive data should be certain of its accuracy, particularly when the data is going to be passed on and used as part of digital verification services. I am confused by the resistance to ensuring that the data is correct, particularly when we anticipate that it will be used as part of a far bigger spectrum. It will be consumed by a digital verification service in which it is not routine to go back and look at the original paper records. The only dataset to be relied on will be some Oracle Excel spreadsheet or whatever database is used by public authorities.

This debate has become more acute with regard to the importance of sex data. It is critical that sex data is available to protect public spaces and to be used in scientific research to allocate someone’s sex as part of medicine and healthcare. I speak as a former doctor, and I guess I should declare an interest in that I am married to a doctor. The use of sex data is critical in medical screening programmes, such as cervical screening and prostate screening, to understand and interpret investigations. It is critical that the data is accurate; otherwise, there is a danger that research will not be appropriate or will produce bad results, and there is also a potential degree of medical harm. It is critical that we get sex data correct when it is being used.

I do not agree with the argument that requiring the disclosure of sex data is either disproportionate or somehow a breach of the European convention on human rights. The whole point of digital verification services is proportionate disclosure. In fact, we have heard speeches from both sides of the Committee about proportionate disclosure, and limiting the amount of personal data that is passed on as part of a digital verification service.

My challenge is, quite simply, that if somebody is collecting sex data as part of a verification system, why are they doing so? If they do not need to know what someone’s sex is, it should not be collected. Digital verification services allow people to choose their proportionate disclosure. There will be times when sex data is required for renting a property—that example has been used before—because people may want to rent properties in single-sex accommodation. I may argue that is a proportionate disclosure. If it is a standard rental property in another situation, it is probably a non-proportionate disclosure. Another argument has been made that it is needed to triangulate data to verify ID. Again, that does not seem to work, because the whole point of a digital verification service is to allow someone to have a digital ID framework and use different points to verify.

The perversity of this debate is that these schemes and their proportionate disclosure protect people’s identities. They protect people from non-disproportionate disclosure. We need to make sure that the data we are using is accurate and correct, and that it says what we want it to say when someone is inquiring about somebody’s sex. If somebody is asking for sex data but they do not need it, people should be able to say no, which the existing provisions allow for.

[Chris Bryant]

No, they don’t.

[Dr Spencer]

What is the point of politics if we do not have a debate? We strongly disagree with the interpretation that the provisions are somehow incompatible with ECHR rights. They totally support people’s privacy rights under article 8 regarding proportionate disclosures. If somebody needs to have someone’s sex data, they need sex data. They do not need gender data. The provisions allow for it, and if somebody does not need sex data, they should not be collecting it in the first place.

[Joe Robertson (Isle of Wight East) (Con)]

It is an honour to serve under your chairmanship, Mr Turner.

Further to the comments made by my hon. Friend the Member for Runnymede and Weybridge, does the Minister at least accept that the Bill poses a risk of entrenching inaccurate data relating to sex through public bodies using DVS systems? Notwithstanding his views on the Lords amendments, could he address that point? What steps will the Government take to ensure the reliability of sex data to ensure protection, such as of women using female-only spaces? What will the Minister do to ensure that inaccurate data entrenched by the Bill will not pose a risk to people in those situations and others? I am thinking, of course, of services available in healthcare, but that is by no means the only example.

--- Later in debate ---

[Chris Bryant]

The clause creates a permissive information gateway. This will enable public authorities to share information relating to an individual with registered digital verification services, when requested by the individual. The gateway enables digital identity checks to be made against public authority data, thereby increasing the trustworthiness of identity and eligibility checks across the economy.

Clause 45 also makes it clear that the power does not authorise disclosure of information that would breach the data protection legislation or the Investigatory Powers Act 2016. However, disclosure of information under the clause would not breach any obligations of confidence owed by the public authority or any other restrictions on the disclosure of the information. The clause also enables public authorities to charge a fee for the disclosure of information under the clause.

[Dr Spencer]

I am not going to rehash the previous debates. Clearly, the Committee has made its decision, no matter how disappointing that is. I just wanted to pick up the Minister’s previous point about the use of common sense in arbitration decisions when it comes to access to protected same-sex spaces. I fully support using common sense, but how does that play out in a situation where somebody has gone through a digital verification service that has used data that is held by a local authority, but that has been changed at a later date—that is, in effect, gender data? How will that be resolved?

[Chris Bryant]

I think that I will have to write to the hon. Gentleman. We have agreed the amendment, so that is slightly rehashing the debate. I am happy to write to him and he will have that before we come back for Thursday’s Committee sitting.

Question put and agreed to.

Clause 45, as amended, accordingly ordered to stand part of the Bill.

Clause 46

Information disclosed by the Revenue and Customs

Question proposed, That the clause stand part of the Bill.

--- Later in debate ---

[Chris Bryant]

I am sure Members were wondering when we were going to get to a code of practice, and this is the clause that introduces it. Clause 49 requires the Secretary of State to prepare and publish a code of practice for the disclosure of information under the information gateway created in clause 45. The code of practice will provide guidance and best practice for such disclosure, including what information should be shared, who it should be shared with and how to share it securely.

In preparing and revising the code, the Secretary of State must consult with the Information Commissioner, devolved Governments and other appropriate persons. The code will be laid before Parliament before it is finalised. The first version of the code will be subject to the affirmative procedure and subsequent versions to the negative procedure, allowing proper parliamentary scrutiny.

[Dr Spencer]

Will the code of practice include information on the proportionate disclosure of data through the DVS scheme?

[Chris Bryant]

Yes.

Question put and agreed to.

Clause 49 accordingly ordered to stand part of the Bill.

Clause 50

Trust mark for use by registered persons

Question proposed, That the clause stand part of the Bill.