Cambridge Analytica: Data Privacy

Debate between Dominic Grieve and Matt Hancock

Monday 19th March 2018 Commons Chamber

[Matt Hancock]

I add my praise for the Guardian journalists who have done the work published this weekend. I agree with the right hon. Gentleman on many of the issues he raises. It is best to proceed on this with the cross-party consensus that we have on many such areas. I am not sure about the argument that we have dragged our feet, given that this Government have brought forward the Data Protection Bill, and that this Government supported the general data protection regulation very strongly at European level. We are, indeed, already taking action to put right some of the things that need to be strengthened because of the development of technology.

The right hon. Gentleman asked about the e-commerce directive. With Brexit, we will of course be leaving the e-commerce directive, so it is not a question of updating it, but of what to put in its place. We will be leaving the digital single market, and we have an opportunity to make sure that we get that piece of legislation right for the modern age—supporting innovation, growth and the use of modern technology, but doing so in a way that commands the confidence of citizens.

The right hon. Gentleman asked about the directors of Cambridge Analytica. We will of course ensure that people are operating within the law. The question of whether they are fit and proper persons is for a different Department, but I am certainly very happy to talk about that to my ministerial colleagues.

[Mr Dominic Grieve (Beaconsfield) (Con)]

I am sure my right hon. Friend will agree that this news should cause us all great concern. Is not the difficulty that it has been apparent for a long time that the obtaining of data and the use that can be made of it, whether for commercial or political purposes, are a gold mine for those who wish to breach the law, and the sanctions that can be visited on those who do it are entirely inadequate? I am perfectly aware that the Government are amending the legislation, but I do not think the penalties we are enacting for those who behave in this fashion are anything like draconian enough. The financial incentives to break the law are far too great and the penalties are proportionately insufficient. Ultimately, we will have to be much tougher if we are to stop this sort of behaviour.

[Matt Hancock]

I have some sympathy with the argument my right hon. and learned Friend makes. A fine of 4% of global turnover is a significant one for an organisation for which data processing is only part of a broader business. Where data processing is the whole business, one could argue that it is less proportionate. We are therefore considering the Information Commissioner’s request. Of course, this is not just about the 4% of global turnover; the criminal offence in clause 145 of the Data Protection Bill carries the highest possible fines, as well as criminal records in England and Wales, for providing false information in response to an information notice, so there already are stronger sanctions for specific actions. The point he makes is one that has been made recently by the Information Commissioner and, therefore, one that is worth listening to.