Data (Use and Access) Bill [ Lords ] (Fourth sitting)

Ben Spencer Excerpts

Committee stage
Tuesday 11th March 2025 Public Bill Committees

[The Chair]

With this it will be convenient to discuss the following:

Amendment 52, in schedule 14, page 242, line 33, at end insert—

“(1A) The appointment of the Chair of the Information Commission must be subject to approval by a resolution of each House of Parliament.”

This amendment seeks to strengthen the regulator’s independence by subjecting key appointments to Parliamentary approval.

Schedule 14.

Clauses 118 to 120 stand part.

[Dr Ben Spencer (Runnymede and Weybridge) (Con)]

I rise to speak to clause 117, the first clause in part 6, on reforming the information commission. Part 6 sets out provisions to abolish the Information Commissioner’s Office and transfer its functions to a new body, the information commission, with a chief executive and board of directors. His Majesty’s Opposition welcome the fact that the Government are substantially taking forward some measures on reform of the ICO envisaged in previous iterations of this Bill, including the previous Government’s Data Protection and Digital Information Bill. Indeed, the ICO has said that the changes under the Bill will bring its governance structure into line with that of comparable regulators. Given some of the challenges and opportunities that our data-driven economy will present, the new information commission must be set up in the right way to perform its regulatory functions as effectively as possible.

There is no doubt that the scope of the information commission’s role will grow, commensurate with the changes brought in by the Bill—for example, the obligation to have regard, in the performance of its role, to factors such as promoting innovation and competition. We are supportive of those aims, but it would be helpful if the Minister could briefly address some of the concerns raised by my noble Friend Lord Holmes of Richmond in the other place, particularly the Minister’s strategy for ensuring that the information commission is provided with clarity as to its responsibilities and obligations when it comes to economic growth, and how he will ensure that that remains consistent with the information commission’s primary functions relating to data protection.

[Victoria Collins]

I will speak only briefly about amendment 52, but I would like to think that after all the Liberal Democrat interventions today, no one will have any doubt that we take data very seriously. I realise that we have outlined a lot of proposals, but they are all in the spirit of helping to shape the data vision and of saying how important we feel it is. Amendment 52 is about the questioning of scrutiny. I am happy not to press the amendment, but again it is important to make sure we have trust in line with innovation.

--- Later in debate ---

[Chris Bryant]

Clause 121 and schedule 15 make clear that information standards published under section 250 of the Health and Social Care Act 2012, as amended by the Health and Care Act 2022, will include standards relating to information technology or IT services used, or intended to be used, in connection with the processing of information related to the provision of health and adult social care in England.

For the health and adult social care system to work effectively, data needs to be processed in a standardised way using common specifications, which goes to some of the points made by the hon. Member for North Norfolk in quoting Government publications. These provisions are an important step towards creating a modern health and adult social care service, where systems are integrated and staff have quicker access to patient data, freeing up time that can be spent with patients.

In previous debates, several Members have referred to physical records, and I have referred to one hospital in Doncaster that employs 42 members of staff solely to carry around physical records. There are still departments in many parts of the NHS in England that are producing more physical, handwritten notes every day of the week. That must be nonsense; it must make it more difficult for us to deliver connected services in future and it cannot be in the interests of the patient, because we would want the patient to be able to hold in their hand an app with everything that relates to their own medical health, almost like a medical passport of their own. That simply is not possible if all the different bits of the NHS in England cannot work together. Government amendment 14 is a technical change to ensure that any personal data processed in the exercise of the public censure power, set out in schedule 15, is subject to the relevant existing data protection legislation.

New clause 3 would require researchers to keep and publish records about the health and social care data that they have processed for research. There are already extensive transparency requirements for health data, and the Information Commissioner’s Office provides detailed advice to the public on their data rights. The law only allows confidential patient information to be used for research without consent when it has been approved by the Health Research Authority. There are detailed arrangements for this approval, based in law, and the transparency arrangements include published registers of approved applications showing what data is used for what purpose and by whom. I hope therefore that the hon. Member for Harpenden and Berkhamsted will accept that this means her new clause is not necessary.

[Dr Spencer]

This part of the Bill is a concatenation of different provisions relating to data, which is one of the reasons why I think the Bill is so glorious; it covers such a wide scope of things to sort out. I will speak to some of the deeper debates that we will have later, but I am quite glad to start off by speaking to clause 121. As a former doctor—my wife is a doctor too—I particularly welcome these provisions and the opportunity they provide to ensure that health data can be shared properly.

I would say to the Minister that the issue is not merely carrying around patient notes; certainly, in my experience the issue is whether patient notes turn up in the first place at all. As somebody who does not work in the health service any more, I see the other side, where the burden is quite often on the patient to provide their notes or to give information repeatedly that different parts of the system already have. That is a wholly inefficient way of doing things. One of the benefits of having the NHS set up as it is must surely be the ability to have coherent approaches to the sharing of data, so that we do not have this situation with notes.

It is not merely an inconvenience. Patients can be exposed to repeated tests and repeated imaging, all of which have a degree of iatrogenic harm and risk, plus delays to progressing. My former field of work was psychiatry, and the places where I worked were very quick to adopt electronic patient records, noting not only the importance of data sharing, but the risk of retraumatising people when repeated disclosures of traumatic events are required—in part, I worry, because that data is not shared as effectively as it could be.

I raised the point on Second Reading that changes in this area will need to be supported by ensuring that hospitals and healthcare settings have access to IT of sufficient quality to support the new systems. Can the Minister provide an update on his strategy—although I recognise it is not precisely his strategy; it is shared with the Department of Health and Social Care—on renewing NHS IT infrastructure and ensuring that the necessary kit is put in place so that the provisions can be rolled out to maximum advantage? This is about not merely the sharing of data, but the fact that faxing information is no longer required, and we must have the computer infrastructure necessary for data sharing.

--- Later in debate ---

[Chris Bryant]

Clause 124 delivers on the Labour manifesto commitments to further support coroners, and procurators fiscal in Scotland, to access information held by online services after a child’s death. This is a very sensitive issue, and we have tried to address it as such. The provision will require Ofcom, when informed by a coroner, to issue a data preservation notice to specified online service companies. That will help to ensure that those online service companies retain all the relevant data they have on a child so that it will be available on request should a coroner later require it as part of an inquest into a child’s death. The clause demonstrates the Government’s commitments to keeping children safe online and supporting families that have endured unimaginable losses. I am conscious that some might want us to go further; further to the conversation we had earlier, we might be able to have a fruitful discussion on that before we reach Report.

On new clause 29, I reassure the hon. Member for Harpenden and Berkhamsted that there are already strong powers to ensure that companies comply with data preservation notices. Those include the power to issue fines for non-compliance of up to £18 million, or 10% of qualifying worldwide revenue, and the ability to hold senior managers criminally liable for non-compliance. Those sanctions will help to ensure that online services comply with any notice issued under section 101 of the Online Safety Act 2023. Under a provision in that Act, the Secretary of State must already review the effectiveness of the Act’s regime, including the data preservation measures, between two and five years after it comes into force and must produce a report detailing his findings, which will then be laid in Parliament. I therefore hope that the hon. Member will not feel the need to press her new clause to a vote.

[Dr Spencer]

This is not the appropriate place to discuss new clause 30, but I hope that there will be ample opportunity on Report for further discussion of the broader issue, which is of great importance.

[Victoria Collins]

Clause 124 concerns the retention of information by internet service providers in the deeply tragic event of a child’s death. It rightly acknowledges the potential need to access such data for crucial investigations and to understand the circumstances surrounding such a loss. However, mere provision for data retention is insufficient without a mechanism to ensure its effective implementation in line with broader online safety efforts. That is why we have proposed new clause 29, which ensures Government oversight by requiring the Secretary of State to publish a compliance report within 12 months. The report will assess whether social media platforms, including category 1 services under the Online Safety Act 2023, are preserving data when needed for investigations, regulatory actions and legal proceedings. I appreciate the comments from the Minister.

Although it is not in this Bill, this is an opportunity to highlight the Liberal Democrat’s belief that category 1 services should not be linked to the size of online platforms alone and that platform functionality and other characteristics should determine whether a regulated provider is classed as category 1 or 2. We know that harmful content, abuse and illegal activity leave a digital footprint but, without enforcement, key evidence may be erased before authorities can act. The new clause ensures that platforms are held accountable, preventing data from being lost if needed. It is about not just policy, but ensuring that social media companies meet their legal obligations and that enforcement is transparent and effective. Once again, I appreciate the open discussion of these issues that the Minister has put forward.

Question put and agreed to.

Clause 124 accordingly ordered to stand part of the Bill.

Clause 125 ordered to stand part of the Bill.

Clause 126

Retention of biometric data and recordable offences

Question proposed, That the clause stand part of the Bill.

--- Later in debate ---

[Chris Bryant]

I propose that the clause does not stand part of the Bill. Clause 140, which was tabled in the House of Lords, is a regulation-making power that would enable terms relating to core personal data attributes to be defined consistently across data held by public authorities. The intention behind this measure is that the power could be used to define the term “sex”. We seek to overturn this clause for the following reasons.

The Government believe that public sector data, including data about sex and gender, should continue to be collected based on the specific data requirements of those collecting the data, and their users, which differs across contexts. That is in line with the data minimisation principle set out in the data protection legislation. We do not think it is appropriate to have core personal data attributes defined in regulations in the way that is proposed.

Furthermore, setting out such definitions using secondary legislation could create confusion where terms are already defined in legislation, and so—depending on the approach taken—could cut across the existing definitions. For example, defining sex could cut across the existing legal framework and undermine protections in the Gender Recognition Act 2004 and the Equality Act 2010.

I am, however, keen to reassure the Committee that the Government recognise the importance of harmonising data and have already commenced important work on standards across Government—via a cross-Government working group led by the Data Standards Authority—to define the core attributes of a person. Last year, the Office for Statistics Regulation published guidance on collecting and reporting data about sex and gender identity, and in December 2024 the Government Statistical Service published a work plan for harmonised standards in this space.

The Government’s belief is that such matters are crucial and more appropriately considered holistically outside the Bill. The intention of the Bill is not to define or remark on the definitions of sex and gender, or other core personal data attributes. I therefore recommend that the clause does not stand part of the Bill.

[Dr Spencer]

As the Minister noted, the clause is a provision that was introduced in Committee in the other place, along with clause 28(3) and (4), and clause 45(6), which have now been removed from the Bill pursuant to our decisions in Committee.

Clause 140 aims to ensure the accuracy of data underpinning digital forms of verifying identity, and more broadly. To a degree, it is ironic that we live in a world where we have to debate data dictionaries when it comes to the definition of sex, but I think the point about data dictionaries more generally, over and above the focus on sex data in this debate, is nevertheless sound.

We are aware of the Government’s argument that the clauses inserted in the other place pertaining to data accuracy—in particular, clause 45(6)—are not compatible with certain provisions of the European convention on human rights and the Gender Recognition Act 2004. I am grateful to the Minister for writing to the Committee on that, among other matters, but I do not think that his explanation gives any rationale for the removal of clause 140.

We strongly disagree with the Government’s position for the reasons I set out last week, but I will not rehash those arguments now. Rather, I want to make a simple argument in favour of retaining the clause on data dictionaries that the Government intend to remove. Clause 140 grants the Secretary of State the power to make regulations establishing the definitions and associated metadata for core personal data attributes. The Secretary of State may require that those definitions are used for, among other things, personal data recorded by public authorities, under subsection (1)(d), and the digital verification service, under subsection (1)(a).

My noble friend Lord Lucas compellingly stated the case in support of his data dictionary amendment in the other place, saying that

“if we are to live in a data-rich world, we really need a set of well-understood, good definitions for the basic information we are collecting.”—[Official Report, House of Lords, 28 January 2025; Vol. 843, c. 237-238.]

It really is that simple: giving the Secretary of State the power to define those core personal data attributes so that a consistent approach can be taken across the board by public authorities and entities engaged in digital verification services.

My question for the Minister is, therefore: what is the objection to the Secretary of State having that power to clarify the meanings of those essential terms, which we need to define data attributes? A clear definition of data attributes, and in particular the meaning of sex, is a foundational building block that will help to ensure that the data we collect can be harnessed for good-quality research on which sound public policy decisions can be based.

In the other place, the DSIT Minister, the noble Lord Vallance of Balham, acknowledged the need for data to be “based in truth” and “consistent and clear”. However, he opposed this clause on the basis that the Government would prefer to consider the matter of data accuracy and consistency holistically, outside the scope of the Bill. In that regard, he pointed to ongoing research in the field, including the Sullivan review of data, stats and research on sex and gender, which was commissioned by the previous Conservative Government, and the findings of which this Government would like to take into account in developing their policies in the area.

I welcome the fact that the Government intend to take a closer look at the importance of data accuracy, especially in relation to the collection of sex data, but there is no need to kick the can down the road. The clause compels the Secretary of State to do nothing—well, not in an active sense—[Interruption.] If only. It does not compel the Secretary of State in an active sense, but it does give him the important power to put definitions of core personal data attributes in place once the important Sullivan review and other studies have been published and considered. As we have mentioned a few times, the Bill has gone through many iterations and a long legislative period. We believe that this clause will be useful, if not essential, for resolving some of these issues.

Getting those basic definitions right is essential. If we do not, there could be mistakes that could become entrenched in the records of public authorities. That could lead to skewed research findings on important societal matters, such as health disparities and outcomes across the sectors, as well as employment opportunities and equal pay. For those and many other good reasons, let us take this opportunity to get the basics right.

In that regard, I encourage the Minister to heed the timeless words of Julie Andrews with which he opened Committee stage. As far as definitions for core data attributes are concerned,

“Let’s start at the very beginning,

A very good place to start.”

[Chris Bryant]

Mr Turner, I have confidence in confidence alone; I have confidence in you—if we are going to do Julie Andrews.

This is obviously a serious matter. The clause pretends to be just a regulation-making power that would allow the Government to publish a data dictionary by regulations. It is framed as a means to promote data consistency, but its actual intent is to push the Government to set a single definition of the term “sex” through a public authority data dictionary that public authorities would need to have regard to when processing data. As I have said several times in debates already, that is inappropriate. The whole purpose of data is that it is set within a context and that that context changes. For instance, the data that is required for the running of a hospital or prison is different from that required for the hiring of a car or the purchase of a property. That is why we think it is important that we do not go down this route.

The Opposition are again trying to give the Secretary of State more powers to do things by regulation, but it would be completely inappropriate to develop this data dictionary by secondary legislation, which would be unamendable and therefore subject to only minimal debate. I completely agree with the noble Lord Vallance that data has to be consistent and accurate, but it also has to be in the context for which it is being used. That is the key determinant that some Members have not understood in the Government’s argument. I still suggest that clause 140 does not stand part of the Bill.

Question put, That the clause stand part of the Bill.

--- Later in debate ---

Clause 141 delivers our manifesto commitment by ensuring that those who create a deepfake intimate image of an adult without their consent or a reasonable belief in their consent can be prosecuted. There is no need to prove any motivation. This offence will carry a maximum penalty of an unlimited fine, six months imprisonment or both. The clause will also ensure that the courts have the power to deprive offenders of the images they have created and the devices containing them. Creating intimate image deepfakes is a truly demeaning and disgusting form of chauvinism. We believe that clause 141, as amended, will tackle that behaviour. We are sending a very clear message to the perpetrators, putting them on notice that they will face the full force of the law. I command the clause and the amendment to the Committee.

[Dr Spencer]

I start by congratulating my noble Friend Baroness Owen of Alderley Edge for her hard work and tenacity in raising the profile of the harms caused to victims of sexually explicit deepfakes, and ensuring that clauses criminalising that activity were inserted into the Bill in the other place. We very much welcome the Government’s engagement in this important area, and we broadly support their amendments, which substantially deliver the changes to the Sexual Offences Act 2003 that Baroness Owen sought in the other place.

In particular, we welcome Government amendment 31, which substantially reflects the offence of solicitation under clause 141, but could the Minister put a bit more flesh on the bones of the reasoning and necessity behind substituting the term “requesting” for “solicitation”? Does he regard those terms as having equivalent meaning in this context? If not, what is the material difference in the approach to terminology?

I am thankful for the Minister’s comments on the “reasonable excuse” defence, but I have some questions about what exactly a reasonable excuse looks like in this context. Does he have any examples to aid our understanding of what constitutes a reasonable excuse in these circumstances? Based on that, do the Government intend to publish guidance on the scope of this defence and its explanation?

We are pleased to see the inclusion of Government amendment 38, inserting among other things an extended limitation period of three years from the date of creation, or request for creation, of a purported intimate image for bringing criminal charges. This will increase the scope for victims to seek justice where these images come to light some time after creation.

[Victoria Collins]

The Liberal Democrats very much welcome clause 141 and action taken on violence against women and girls in particular, including online. However, the clause talks about creating or soliciting the creation of purported intimate images of adults, but it does not necessarily deal with the sharing of them. How do we hold to account those who are sharing intimate images that they should not be?

--- Later in debate ---

[Dr Spencer]

I just want to make two points. I was a bit confused by the timings in this new clause. I think we all agree on the importance of data adequacy, but my understanding is that, by three months post Royal Assent, we will already have to have a data adequacy agreement in place, given the time that it will take to achieve Royal Assent.

The other point I wanted to make was that I think this might be the last time that I get to speak on behalf of His Majesty’s Opposition in this Bill Committee, so I want to thank Members, officials and the Chairs for taking part in our proceedings. I look forward to further debate on Report.

[Chris Bryant]

First, I should have also thanked the Under-Secretary of State for Justice, my hon. Friend the Member for Pontypridd (Alex Davies-Jones), because she has been intimately involved in bringing forward the measures that we debated in the last group. My apologies for forgetting that, Mr Turner.

On new clause 2, I completely agree that EU data adequacy is vital, but I completely disagree with the new clause, because I think it is technically deficient. One reason for that is the timeline that it lays out of three months, by which time I hope we might be able to have made progress. I also think that it undermines the independence of the process that the European Commission has to go through. The European Commission has already confirmed that its review of its two adequacy decisions for the UK are currently under way—ahead of the deadline, which is good. As Lord Vallance stated in the House of Lords, DSIT and the Home Office have dedicated teams supporting the European Commission’s technical review, as required.

I acknowledge the unilateral nature of the adequacy assessment made by the European Commission. For that reason, it is important to provide the European Commission with the discretion needed to complete its process, which I am afraid new clause 2 would undermine. So, for that reason, I am resisting the blandishments of the Liberal Democrats.

--- Later in debate ---

[Victoria Collins]

This is my last intervention, which I am sure the Committee will all be very sad about, and it is on data. I know that we have talked a lot about public trust, but I also want to highlight that, as Liberal Democrats, we are also excited about unlocking the opportunities from data. These new clauses speak to that.

New clauses 6, 25 and 28 together would ensure that we harness the benefits of data while upholding fundamental rights. Too often, data is seen as something that happens to people rather than something that they have a say in. We have an opportunity here to unlock even more opportunities, not just in Government data systems but in how data is used across research, public services and wider society.

New clause 6 calls on the Government to develop a clear strategy for public-interest data trusts and community data governance. That means allowing individuals and communities to contribute their data for socially beneficial purposes while retaining meaningful control. Imagine if patients suffering from rare diseases could securely share their data for medical research, knowing that it would be used solely for public good, not commercial gain; that is a future we can build.

New clause 25 would ensure that the Government take a proactive role in shaping public-interest data governance, setting clear ethical guidelines for how data can be shared securely and fairly. This is about moving beyond reactive regulation. Instead, we should actively create frameworks that allow innovation to flourish while protecting those rights. If we want the UK to be a leader in responsible AI and data stewardship, we need clear structures that allow businesses, researchers and civil society to work together with confidence.

New clause 28 would establish a framework for data altruism, ensuring that those who wish to donate their data for public interest projects can do so safely and transparently. Consider a family in my constituency of Harpenden and Berkhamsted who want to contribute to a dementia research project. Right now, there is no clear framework guaranteeing that their data will be protected from misuse. By formalising ethical data-sharing models, we can enable research and innovation without compromising trust. These new clauses share a simple principle: data must serve people, not the other way around. We must strike the right balance, harnessing data to drive innovation while ensuring that public confidence and ethical standards remain at the core of our approach.

We have a huge economic opportunity. The UK has led the way in setting high regulatory and Government standards in sectors such as fintech, law and insurance, where trust, transparency and compliance are critical. We should build on those strengths and apply the same principles to emerging fields such as AI, healthtech and responsible data sharing. By learning from what works and setting clear guidelines now, we can unlock investment, support start-ups and ensure that the UK becomes a hub for innovative, data-driven businesses. That is why I urge colleagues to consider new clauses 6, 25 and 28, as well as the principles put forward in them, to ensure that we build a data-driven future that is transparent, accountable and a gold standard for responsible innovation and public involvement.

[Dr Spencer]

I listened carefully to the hon. Lady’s comments, and I want to reflect on one point. She presented, or at least seemed to present, a tension between public interests and the commercial use of data. It is really important that we recognise that a lot of health research, particularly pharmaceutical development, is for commercial purposes, with a huge amount of benefits for health as a consequence.

I do not think it is to right to try to sabotage the use of data for commercial purposes, because it has huge benefits for the care and treatment of people. We depend on pharmaceutical companies to spend the risk money, for which a state organisation would never have the appetite, to develop the new drugs of the future. It is important to be quite careful when one is thinking about commercial interests versus non-commercial interests for scientific research.

[Chris Bryant]

The hon. Member for Harpenden and Berkhamsted said that this is her last contribution to the debate, so in the words of the “The Little Mermaid”, I suppose we are poor, unfortunate souls. I thank her for tabling these new clauses, and she raised issues that were also discussed in the other place.

On new clause 6, as my noble Friend Baroness Jones noted in the House of Lords, the Government support giving individuals greater agency over their data and a robust regime of data subject rights. We have already announced our intention to publish a call for evidence on the potential role of data intermediaries. It is important that we establish a firm evidence base before we make any changes to people’s data rights, so I hope that that makes new clause 6 unnecessary.

On new clause 25, as I have just said, we have already published a call for evidence on the potential role of data intermediaries, which is why we need to proceed carefully before going down the route offered by the new clause. Finally, on new clause 28, the Government acknowledge that there are various models of data intermediaries, including those that manage voluntarily contributed personal data for the common good, such as data co-operatives and trusted research environments.

We have already announced our call for evidence, which will seek views on various aspects relevant to data intermediaries, including the delegation of data subject rights to third parties, barriers preventing data intermediaries from operating at full capacity and risk factors associated with significant growth in their activities. This will also include views on different models of data intermediaries, including those focused on data altruism, as the hon. Lady mentioned. Given that we have already announced our intention to act in these areas, I very much hope that the hon. Lady will be content to withdraw the motion.