Cyber Security and Resilience (Network and Information Systems) Bill
Iain Duncan Smith ExcerptsTuesday 16th June 2026
(1 month, 1 week ago)
Commons ChamberRead Full debate Cyber Security and Resilience (Network and Information Systems) Bill 2024-26 View all Cyber Security and Resilience (Network and Information Systems) Bill 2024-26 Debates Read Hansard Text Watch Debate Read Debate Ministerial Extracts Amendment Paper: Consideration of Bill Amendments as at 16 June 2025 - large print - (16 Jun 2026)
Sir Iain Duncan Smith (Chingford and Woodford Green) (Con)
The hon. Lady was very prescient then, and it has got worse since. There was lots of talk under the previous Administration about Downing Street cars being searched for IOTs. We know about the huge imports from bad actors, such as China and other countries—that is really what we should be worried about. Many of them contain kill switches, which would devastate some of our industry, such as energy. That would be a disaster. She is right to have raised the issue and to continue to raise it.
Dame Chi Onwurah
The right hon. Member does well to remind us that the impact of hostile action using CIMs, such as by turning on a kill switch, would be devastating across multiple sectors, including potentially the consumer sector, as well as security, automotive, transport and finance. That is why it is so important to consider this.
I particularly draw the Minister’s attention to the list provided by the US Federal Communications Commission—the equivalent of Ofcom—of equipment and services covered by section 2 of the Secure and Trusted Communications Networks Act. The list dictates what technology is legally permitted to be authorised for import and sale in the US, and many companies on the list are owned or controlled by the Chinese state. I thank the Minister in the other place for meeting me and my hon. Friend the Member for Dunfermline and Dollar (Graeme Downie), whose amendment I also support, and hearing our concerns about the supply of IOT devices. It was unfortunate that the Minister did not see the need for action, particularly given that the US has taken action against Chinese-made goods and that, during a trip of the British-American Parliamentary Group to the US just last week, we heard that further action is likely to be taken against cellular IOT modules specifically. That could mean UK products being banned from import into the US if they contain such CIMs.
We have seen a rapid growth of those devices across transport, as we have mentioned, as well as energy and, importantly, water and health. I am concerned about the ability of our domestic British businesses to export into the US given those restrictions, as well as the impact on our security. I would therefore be grateful if the Minister could set out whether he is looking into that concern.
As was eloquently emphasised in the personal statements made by the recently resigned Secretary of State for Defence, my right hon. Friend the Member for Rawmarsh and Conisbrough (John Healey), and Armed Forces Minister, my hon. Friend the Member for Birmingham Selly Oak (Al Carns), the first duty of Government is the security of their citizens. That is true when it comes to our armed forces and our defence in the real world, and it is also true when it comes to our security in the virtual world. Those two overlap so much more than in the past.
I welcome the Bill, but I have real concerns about the need to bring retail businesses such as M&S within its scope, the concentration of the UK’s public sector data in a small number of US-owned providers, the implications for technology sovereignty that that raises, and the risks posed by foreign state ownership of providers of cellular internet-of-things modules. I hope that the Minister will address those concerns and deliver the cyber-security and resilience that our constituents deserve.
Sir Iain Duncan Smith
It is always a great honour to follow the hon. Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah), who talks common sense most of the time she gets up, which may be one of the reasons why she is still on the Back Benches. If we listened more to those who know something about things, rather than talking as though we know things, and saying things that are invariably wrong, we in Parliament would obviously be better off.
The greatest threat we face is that bad actors out there are using this level of technology to get across to countries such as the UK. This is not a party political point, because both Governments have failed to face up to it to the degree that they should have—that is why this Bill is welcome, but it is not everything, as the hon. Lady says—but we think that we can treat the bad actors as though they were normal actors in a commercial sense. However, China is using slave labour to undercut markets and regularly puts IOTs into cars. It gets away with it because we think that we need China more than it needs us. That is the big problem. The hon. Lady is right to raise it, and I congratulate her for again making an excellent speech.
I will in due course beg to move my amendment on anti-refoulement, because although this is a good Bill, some bits are missing and others have been skated over. This is one area about which we will come, again and again, to regret that we had not done more. The issue is British citizens abroad ending up under the rule of Governments that do not believe in the concept of freedom before the law, in a fair trial as part of that process, or in habeas corpus, which is an English common law right that has gone around the world.
The amendment seeks to prohibit data sharing with jurisdictions that cannot guarantee a fair trial. It maintains the current legal approach, which generally restricts the sharing of sensitive information outside the EU. Currently, information sharing of a type enabled by proposed new regulation 6, which is in clause 18, is prohibited outside the EU. The proposed new regulation is therefore weaker than what is going on in the European Union. Sadly, it paves the way for such sharing, rather than restricting it.
The amendment therefore seeks to prohibit information sharing with places where the Secretary of State believes that a fair trial simply cannot be obtained. It would require the Secretary of State to consult civil society and human rights experts to identify jurisdictions—this would apply universally and not just to China, although China is a big player in this—where the right to a fair trial cannot be guaranteed, with all decisions subject to mandatory annual reports to Parliament. That is important: Parliament should be part of this and make decisions about whether it agrees with the Government.
Beijing is a good example. It has frequently used seemingly legitimate criminal complaints to target dissidents. Proposed new regulation 6, if unamended, therefore raises transnational repression risks rather than solving them. The amendment is necessary to close that loophole in the Bill, which currently fails to anticipate politically motivated requests from such totalitarian states. I often say that we should stop speaking about countries such as China, Russia, Iran and North Korea as authoritarian states. They are not authoritarian states; they are totalitarian states. Why do I say that? Because everything in those countries is owned and run by the state. Authoritarian states are often dictatorships, but they are not the same thing as totalitarian states. They are brutal and nasty, but totalitarianism is a complete system. This is about totalitarian states.
Proposed new regulation 6 is predicated upon helping other Governments obtain justice. The argument of my amendment 3 is that—quite apart from the transnational repression risks—justice as we understand it cannot be served in a country where essentially there is no rule of law, no right to a fair trial, and a judicial system that serves the party. As I often say, it is a matter of pride that perhaps the greatest gift this country has given to the world is the concept of freedom in the face of the law. That is the point I made earlier: habeas corpus came from English common law and dominates so much of the free world’s thinking. It was not until the 1970s that some countries in Europe actually practised habeas corpus, so it was not just the case that it was produced by Britain; it was also owned by many other countries. That is what is at risk here, and we should be the greatest defenders of that right to a fair trial anywhere in the world.
Let us take a few of these countries as examples for why amendment 3 is needed. Let us look at China. Requests were made by authoritarian states—totalitarian states in this case—regarding Interpol notices, as has been the recent pattern, and this happens a lot. The People’s Republic of China and other countries have a troubling recent history of very significant transnational repression, hounding dissidents in the UK and cloaking their political persecution in superficially legitimate criminal charges. The PRC is not alone in requesting information on political opponents in the UK, and it does it a lot. We can confidently speculate that China will make requests of the UK almost immediately should the Bill be passed.
Let me look at the single biggest case that confronts us in China at the moment: that of Jimmy Lai. He is a British citizen. I cannot tell you, Madam Deputy Speaker, how endlessly in debates, even under the previous Administration, we had to fight to get the Government to state that he is a British citizen, not a dual nationality citizen. He is a British citizen, is proud to be British, has been British all his life and has only ever owned a British passport—he has never been a Chinese citizen with a Chinese passport.
The special rapporteur on torture, Alice Jill Edwards, in her 2024 and 2025 reports, specifically flagged concerns that evidence obtained through torture is still widely admitted in Chinese courts. She also expressed concerns in late 2024 regarding the case of Jimmy Lai in Hong Kong, noting that evidence allegedly secured through torture in mainland China was and is being used in the trial. On 15 November 2024, the United Nations working group on arbitrary detention published its opinion that Jimmy Lai is “unlawfully and arbitrarily detained” and called for his immediate release. The proposed new regulation will not go far enough and therefore does not deal with this, and that is what my amendment 3 is all about.
On the risk of extradition to China from safe third countries, currently the UK does not have a bilateral extradition treaty with the People’s Republic of China, and it has suspended its bilateral extradition treaty with Hong Kong—something that many of us were calling out for at the time in 2020. In 2025, proposed changes to the Extradition Act 2003 would allow co-operation between UK and Hong Kong authorities on a
“case-by-case ad hoc basis”.
The trouble with that is that it begins to open the door. The risk of sharing NIS data is not confined to the physical removal of individuals; it also poses a profound threat to national security and the safety of the diaspora within the UK—how often have we heard about that?
These totalitarian states not only seek to extradite dissidents, they seek to silence them through transnational repression and to compromise the UK’s own digital resilience. Sharing NIS data with an adversarial jurisdiction is akin to providing a road map for a state-sponsored cyber-attack. For dissidents and human rights defenders living in the UK, NIS data can be used to demonise and de-anonymise their activity. This information is frequently used to identify and harass family members remaining in their home country, to conduct targeted phishing and surveillance against the individual’s private devices, and to coerce the individual into becoming an informant under the threat of criminal charges based on the shared technical data.
Let me deal with another case: that of Ryan Cornelius in the United Arab Emirates. Ryan Cornelius is a British citizen who has been arbitrarily detained in Dubai for 18 years, despite well-documented evidence of an unfair trial and inhuman treatment. Ryan’s detention has been found to be arbitrary by the UN working group on arbitrary detention. His case arose from a high-profile financial dispute involving loans connected to a major Dubai development project. Although he and his associates had reportedly complied with restructuring agreements with Dubai Islamic Bank, he was arrested without warning, transferred by plain-clothed officers to a police facility, where he was held incommunicado, denied access to a lawyer and subjected to aggressive interrogation. During this time, he was coerced into signing documents in Arabic—a language he does not understand—under the false premise that this would give him his release.
Sir Iain Duncan Smith
I am not quite certain that I understand the Minister’s reasons for why he cannot accept my amendment, tweak it or work with it in the other place. The reality is that with this Bill, we are opening the door in a way that we would not have otherwise done to the use of information that may predicate a failure for some British citizen sitting in a country where the rule of law does not protect them in the courts. The Government are taking a risk of making it worse, not better. While the Minister agrees to some degree with the principle of what I am saying, surely this is the time to put it right in the Bill.
Kanishka Narayan
As I say, I agree with much of the right hon. Gentleman’s diagnosis. Let me state in more detail the reasons for objecting on the mechanism. First, the provisions for information sharing are deeply discretionary for UK regulators. Secondly, the subjects in which they can pursue that information sharing are restricted to significant matters of national security and domestic crime prevention in the UK. Thirdly, the way that the amendment is drafted risks creating undue uncertainty in law. If this is the only regime where there is a specific and explicit reference to fair trial in the legislation, it calls into question how other information-sharing regimes are interpreted, such as under section 114 of the Online Safety Act 2023. In other words, drafted as it is, the amendment could invite legal challenge where a regulator exercises its discretion not to disclose this in other regimes, as there is no explicit exclusion. For those reasons, while I totally agree with the right hon. Gentleman’s diagnosis and his objective, I am afraid that the amendment in question risks undermining the objective.
Data (Use and Access) Bill [Lords]
Iain Duncan Smith Excerpts(1 year, 2 months ago)
Commons ChamberRead Full debate Read Hansard Text Watch Debate Read Debate Ministerial Extracts
Chris Bryant
I model myself in all things on the right hon. Gentleman, apart from the fact that I left the Tory party many years ago, and it is about time that he came over to the Labour Benches.
Chris Bryant
No, the right hon. Member for Maldon (Sir John Whittingdale) could come over here; I am not going back over there.
The point I was going to make is that I am fully cognisant of my duties. I think the right hon. Gentleman was referring to the artificial intelligence copyright issues that we will be addressing fairly shortly. I like the fact that I am in both Departments, because it means I can bring the knowledge of both sectors to bear on each other. If we are lucky, and if we work hard at it, I hope that I will be able to persuade him that we can come to a win-win solution. As he knows, this is not easy. When I had my first meeting with him after I was appointed in the post, he said, “This is not an easy area to resolve.” I hope I am not breaking a confidence—but he is smiling.
I have a large number of topics to cover, and I am conscious that many Members will think this is the data Bill, when we will actually be dealing with an awful lot of subjects this afternoon that do not feel as if they have anything to do with the measures in the original version brought forward by the right hon. Gentleman and previously. I hope that Members will bear with me. I intend to address the Government’s amendments as follows: first, AI and copyright; secondly, deepfakes; thirdly, the national underground assets register; and then smart data and other minor and technical amendments.
I will start with AI and intellectual property. As Members know, it was never the Government’s intention to legislate on that issue at all in this Bill. It is a complex and important issue, which is why we have consulted on a package of measures. That consultation had more than 11,500 responses, which we are still considering. Several hon. Members have said to me, “Will you remove the opt-out clause in the Bill?” I need to make it absolutely clear that no such opt-out clause is in the Bill. We never laid one in the Bill, so there is not an opt-out clause to remove.
As Members will also know, the Lords inserted a set of amendments on AI and copyright, which we removed in Committee. They reappear on the amendment paper today as new clauses 2 to 6, tabled by the hon. Member for Harpenden and Berkhamsted (Victoria Collins). A similar measure has been tabled as new clause 14 by my hon. Friend the Member for Leeds Central and Headingley (Alex Sobel).
We oppose all these new clauses for several reasons. First, they pre-empt the results of the consultation. It must surely be better to legislate on this complex subject in the round rather than piecemeal. The amendments are also unworkable. New clause 5, for instance, would make the Information Commissioner the regulator of transparency requirements, but the Information Commissioner’s Office has neither the skills nor the resources to perform that function. Obviously, transparency requirements without an effective enforcement mechanism are worse than useless, which means the other clauses on transparency are also unworkable in this context. The new clauses also fail to address some of the most important questions in this area. They effectively legislate piecemeal rather than in the round. Whenever Parliament has done that in the past, it has rued the day, and I think the same is true today.
Sir Iain Duncan Smith
I rise to speak in support of amendment 10 tabled by the hon. Member for Leeds Central and Headingley (Alex Sobel), in my name and that of others. I congratulate him on the amendment, as it is worth talking about.
The amendment is quite simple, in a way, as its key point is that it prevents the transfer of UK user data to jurisdictions where data rights cannot be enforced and there is no credible right of redress. The core principle of data protection law is accountability, yet current UK law allows UK companies to transfer user data to their international partners in jurisdictions where there is no credible appeals process and no predictable rule of law. That basically puts power in the hands of those who have signed contracts containing standard data protection clauses. Those contracts create the illusion of protection, but in reality the data transfer is unsafe, either because the prospect of state interference is real or because the conditions for protection of data transfer simply are not present. We rely too much on the idea that, somehow, contract law in the UK will protect the data being transferred across to other countries, but this is about countries where such rules do not apply.
Transferring data to regimes such as China, for example, is not just a threat to UK citizens’ privacy but a national security risk. British citizens’ personal information, health records, financial details, biometrics, genomics or location data could be accessed under China’s national intelligence law, which compels organisations to co-operate with state intelligence work in secret. That is not speculation; it is the well-known and established law in China.
This is not only about China, but I use that country as a good example because it is a regular abuser of data. We have been unbelievably stupid across the board, in companies and so on, in assuming straightaway that the rules would apply to Chinese companies and they would enforce them. They cannot, because under the national intelligence law, they are told, “You will provide data as and when we require it from whatever source you have access to.”
The situation right now in Ireland is interesting. The Irish Data Protection Commission recently fined TikTok the not inconsiderable sum of €530 million and found that the company had illegally transferred data from users in the European economic area to China. The commission determined that Chinese law offers no essential equivalent to protection on GDPR due to state surveillance laws and the lack of judicial oversight.
That is not a lone example. I have written on a number of occasions about the stupidity of the contract law covering things such as pregnancy tests and covid tests, which were dominated by a Chinese company called BGI. It is the biggest genomics company in the world and it was allowed to hold about 15% of the data gathered for tests for use back in China. We now know that China is using that data, working with AI companies, to develop tests and to reference weaknesses in certain ethnic groups. We see what is already going on in Xinjiang, where a troublesome ethnic group is being deliberately targeted through genocide to get rid of it, but it is also looking at areas and weaknesses in Europe that may well in turn be usable. We have allowed it under this contract to have that data presuming that it would be protected. It is not protected at all; it has simply been transferred and is now being used for military purposes.
Those are just two examples, but it is interesting that Ireland has already taken action. Let us not forgot the Shanghai police database leak in 2022 in which the personal data of over 1 billion Chinese citizens, including criminal records and biometric details, was left openly accessible online for over a year without any enforcement action or Government accountability.
I congratulate the hon. Gentleman on tabling the amendment, because it goes to the heart of what it means to be a democracy that values the rule of law, privacy and the dignity of the individual. It rightly states that no third country can be considered adequate if it lacks credible means for judicial protection, administrative redress or statutory legal remedy. It aligns closely with the high threshold set by the Schrems II judgment, and it ensures that the standards do not fall below those we uphold, and are upheld among our friends in the European Union.
David Davis
My right hon. Friend makes a formidably important point. The amendment highlights one of the extraordinary weaknesses of the Bill, which is that it in effect reverses GDPR on a large number of citizen protections. To reiterate the point he gently made, that enormous fine will not stop TikTok, because it operates under legal compulsion. Even though it paid £450 million, it will continue to commit the criminal offence for which it has just been convicted.
Sir Iain Duncan Smith
I agree with my right hon. Friend: that is the peculiarity. The Minister knows only too well about the nature of what goes on in countries such as China. Chinese companies are frankly scared stiff of cutting across what their Government tell them they have to do, because what happens is quite brutal.
We have to figure out how we protect data from ill use by bad regimes. I use China as an example because it is simply the most powerful of those bad regimes, but many others do not observe data protection in the way that we would assume under contract law. For example, BGI’s harnessing of the data it has gleaned from covid tests, and its dominance in the pregnancy test market, is staggering. It has been officially allowed to take 15% of the data, but it has taken considerably more, and that is just one area.
Genomics is a huge and vital area right now, because it will dominate everything in our lives, and it populates AI with an ability to describe and recreate the whole essence of individuals, so this is not a casual or small matter. We talk about AI being used in the creative industries—I have a vested interest, because my son is in the creative industries and would support what has been said by many others about protecting them—but this area goes a whole quantum leap in advance of that. We may not even know in the future, from the nature of who they are, who we are talking to and what their vital statistics are.
This amendment is not about one country; it is about providing a yardstick against which all third countries should be measured. If we are to maintain the UK’s standing as a nation that upholds privacy, the rule of law, democracy and accountability, we must not allow data to be transferred to regimes that fundamentally do not share those values. It is high time that we did this, and I am glad to see the Minister nodding. I hope therefore that he might look again at the amendment. Out of old involvement in an organisation that he knows I am still part of, he might think to himself that maybe this is worth doing or finding some way through.
Chris Bryant
I do not resile from my views just because I have become a Minister, just as the right hon. Member did not when he became a Minister. He makes an important set of points. I do think, however, that they are already met by the changes in the schedule to article 45B, which is not an exhaustive list of things that the Secretary of State may consider. The points he refers to are certainly things that the Secretary of State could—and should, I would argue—consider.
Sir Iain Duncan Smith
I am grateful to the Minister, and I hope that that might find its way on to the face of the Bill with a little more description, but I understand that and I acknowledge that he does as well.