Data (Use and Access) Bill [Lords]

Iqbal Mohamed Excerpts

2nd reading
Wednesday 12th February 2025 Commons Chamber

[Iqbal Mohamed (Dewsbury and Batley) (Ind)]

I stand in support of the objectives and aims of the Bill. Having worked with data and technology for more than 30 years, I wholeheartedly support the ethical, responsible and equitable use of technology and data to benefit and make easier the lives of the people of the UK, and to increase the efficiency of service delivery in the public sector. I also pay tribute to campaign groups including Big Brother Watch and Justice for their work to protect the vital privacy and data protection rights of people in the UK.

I want to share some concerns I have on the Bill, focused on two areas: clause 70 and clause 80. I urge the Government to take note and amend the Bill to ensure that the British public’s privacy rights and rights to equality and non-discrimination are not compromised. Clause 70 will weaken protections around personal data processing, thereby reducing the scope of the data that is protected by safeguards in data protection law. I am particularly concerned about the executive power to determine recognised legitimate interests, which will allow for more data to be processed with fewer safeguards than is currently permitted and reduce existing protections that ensure the lawful use of data. I am also concerned about the increased power of the Secretary of State to amend the definition of “recognised legitimate interest” through secondary legislation without appropriate parliamentary scrutiny.

Currently, automated decision making is broadly prohibited, with specific exemptions. Clause 80 will permit it in all but a limited set of circumstances. That will strip the public of the right not to be subject to solely automated decisions, which risks exacerbating the likely possibility of unfair, opaque and discriminatory outcomes from ADM systems; limiting individuals’ rights to challenge ADM; permitting ADM use in law enforcement and intelligence, with significant carve-outs in relation to the existing safeguards; and giving the Secretary of State executive control over the ADM regulatory framework through secondary legislation. They may not be direct examples, but Horizon and the many Department for Work and Pensions scandals show the failings and risks of relying solely on automation and AI.

The Bill introduces a new regime for digital verification services. It sets out a series of rules governing the future use and oversight of digital identities as part of the Government’s road map towards digital identity verification. The framework currently lacks important safeguards and human rights principles that prevent the broad sharing of the public’s identity data beyond its original purpose. Further, the Bill misses the opportunity to take a positive, inclusive step to codify a right for members of the public to use non-digital ID where reasonably practicable. Such a right is vital to protect privacy and equality in the digital age. The right to use a non-digital ID where practicable would protect accessibility, inclusion and people’s choice in how they choose to verify their identities when accessing public and private services, legally protecting the millions of people who cannot or do not want to hand over personal identity data online where an alternative is reasonably practicable.

Returning to automated decision making, it is clearly insufficient to move the burden of safeguards from the data controller, who is currently responsible for preventing harm, to the individual to complain if the ADM is unfair, since people may not complain due to a lack of knowledge or confidence, intimidation and various intersecting vulnerabilities.

[Sam Carling]

I understand the point the hon. Gentleman is making, but does he not accept that the Bill very clearly explains that in cases where any automated decision is taken, there would have to be the right to a proper explanation of the decision, which would probably address a lot of his concerns, and that there must always be a right for an individual to make representations about the decision and obtain human intervention if that is what they want?

[Iqbal Mohamed]

I welcome the limited protections in the Bill, but I know from experience that many applications for benefits—especially disability benefits and personal independence payments—that are processed through automated systems are refused, and the applicants have to go through a complicated and laborious appeals process in order to overturn those automated decisions.

Clause 70 introduces significant changes to the lawful bases for processing personal data. While the aim of those changes is to streamline data processing for legitimate interests, they also present challenges relating to privacy protection, parliamentary oversight, and the potential for misuse. It is essential to balance the facilitation of legitimate data processing with the safeguarding of individual rights and freedoms. Although the Bill is intended to modernise data protection laws, the proposed changes to automated decision-making rights in clause 80 raise significant concerns. The potential erosion of individual protections, increased power imbalances, reduced transparency and the risk of discrimination highlight the need for a more balanced approach that safeguards individual rights while accommodating technological advances.

While I welcome the positive elements of the Bill, I urge the Government to ensure that it does not deliver the proposed benefits along with diminished human rights and rights to privacy, increased discrimination and other unintended harms to individuals, the wider public, minorities, artists and creatives, public services, or our country as a whole.