Data Protection and Digital Information Bill

John Penrose Excerpts

Report stage
Wednesday 29th November 2023 Commons Chamber

[Sir John Whittingdale]

All I can say to the right hon. Gentleman is that the Government have made it clear that there is no intention to focus on claimants of the state pension. That is an undertaking that has been given. I am sure that Ministers from the DWP would be happy to give further evidence to the right hon. Gentleman, who may well wish to look at this further in his Committee.

Finally, I wish to touch on the framework around smart data, which is contained in part 3 of the Bill. The smart data powers will extend the Government’s ability to introduce smart data schemes, building on the success of open banking, which is the UK’s most developed data sharing scheme, with more than 7 million active users. The amendments will support the Government’s ability to meet their commitment, first, to provide open banking with a long-term regulatory framework, and, secondly, to establish an open data scheme for road fuel prices. It will also more generally strengthen the toolkit available to Government to deliver future smart data schemes.

The amendments ensure that the range of data and activities essential to smart data schemes are better captured and more accurately defined. That includes types of financial data and payment activities that are integral to open banking. The amendments, as I say, are complicated and technical and therefore I will not go into further detail.

[John Penrose (Weston-super-Mare) (Con)]

rose—

[Sir John Whittingdale]

I will give way to my hon. Friend as I know that he has taken a particular interest, and is very knowledgeable, in this area.

[John Penrose]

The Minister is very kind. I just wanted to pick up on his last point about smart data. He is right to say that the provisions are incredibly important and potentially extremely valuable to the economy. Can he just clarify a couple of points? I want to be clear on Government new clause 27 about interface bodies. Does that apply to the kinds of new data standards that will be required under smart data? If it does, can he please clarify how he will make sure that we do not end up with multiple different standards for each sector of our economy? It is absolutely in everybody’s interests that the standards are interoperable and, to the greatest possible extent, common between sectors so that they can talk to each other?

--- Later in debate ---

[Kate Osborne]

I thank my hon. Friend for that.

I have been contacted by many people and organisations about issues with the Bill. The British Medical Association and the National AIDS Trust have serious concerns, which I share, about the sharing of healthcare data and the failure to consider the negative impact of losing public trust in how the healthcare system manages data.

The Bill is an opportunity to adapt the UK’s data laws to strengthen accountability and data processing, but it currently fails to do so. It provides multiple Henry VIII powers that will enable future Secretaries of State to avoid parliamentary scrutiny and write their own rules. It undermines the independence of the Information Commissioner’s Office in a way that provides less protection to individuals and gives more power to the Government to restrict and interfere with the role of the commissioner.

The Government’s last-minute amendments to their own Bill, to change the rules on direct marketing in elections and give themselves extensive access to the bank accounts of benefit claimants, risk alienating people even further. I hope the House tells Ministers that it is entirely improper—in fact, it is completely unacceptable—for the Government to make those amendments, which require full parliamentary scrutiny, at this late stage.

We know people already do not trust the Government with NHS health data. The Bill must not erode public trust even more. We have seen concerns about data with GP surgeries and the recent decision to award Palantir the contract for the NHS’s federated data platform. A 2019 YouGov survey showed that only 30% of people trust the Government to use data about them ethically. I imagine that figure is much lower now. How do the Government plan to establish trust with the millions of people on pension credit, state pension, universal credit, child benefit and others whose bank accounts—millions of bank accounts—they will be able to access under the Bill? As my hon. Friend the Member for Rhondda (Sir Chris Bryant) and others have asked, legislative powers already exist where benefit fraud is suspected, so why is the amendment necessary?

My amendment 11 seeks to ensure that special category data, such as that relating to a person’s health, is adequately protected in workplace settings. As the Bill is currently worded, it could allow employers to share an employee’s personal data within their organisation without a justifiable reason. The health data of all workers will be at risk if the amendment falls. We must ensure that employees’ personal data, including health data, is adequately protected in workplace settings and not shared with individuals who do not need to process it.

The National AIDS Trust is concerned that the Bill’s current wording could mean that people’s HIV status can be shared without their consent in the workplace, using the justification that it is “necessary for administrative purposes”. That could put people living with HIV at risk of harassment and discrimination in the workplace. The sharing of individuals’ HIV status can lead to people living with HIV experiencing further discrimination and increase their risk of harassment or even violence.

I am concerned about the removal of checks on the police processing of an individual’s personal data. We must have such checks. The House has heard of previous incidents involving people living with HIV whose HIV status was shared without their consent by police officers, both internally within their police station and in the wider communities they serve. Ensuring that police officers must justify why they have accessed an individual’s personal data is vital for evidence in cases of police misconduct, including where a person’s HIV status is shared inappropriately by the police or when not relevant to an investigation into criminal activity.

The Bill is not robust enough on the transfer of data internationally. We need to ensure that there is a mandated annual review of the data protection test for each country so that the data protection regime is secure, and that people’s personal data, such as their LGBTQ+ identity or HIV status, will not be shared inappropriately. LGBTQ+ identities are criminalised in many countries, and the transfer of personal data to those countries could put an individual, their partner or their family members at real risk of harm.

I have tabled six amendments, which would clarify what an “administrative purpose” is when organisations process employees’ personal data; retain the duty on police forces to justify why they have accessed an individual’s personal data; ensure that third countries’ data protection tests are reviewed annually; and ensure that the Secretary of State seeks the views of the Information Commissioner when assessing other countries’ suitability for the international transfer of data. I urge all Members to vote for amendment 11, and I urge the Government and the other place to take on board all the points raised in today’s debate and in amendments 12 to 16 in my name.

[John Penrose]

I rise to speak to new clause 2, which, given its low number, everyone will realise I tabled pretty early in the Bill’s passage. It addresses the smart data clauses that sit as a block in the middle of the Bill.

It is wonderful to see the degree of cross-party support for the smart data measures. The shadow Minister’s remarks show that the Labour Front Bench have drunk deeply from the Kool-Aid, in the same way as the rest of us. It is vital that the measures move forward as fast and as safely as possible, because they have huge potential for our economy and our GDP growth. As the Minister rightly said, they seek to build on the undoubted world-leading success of our existing position in open banking.

My new clause is fairly straightforward, and I hope that the Minister will elaborate in his closing remarks on the two further measures that it seeks, which I and a number of other people urged the Secretary of State to take in a letter back in July. To underline the breadth of support for the measures, the letter was signed by the chief data and analytics officer of the NatWest Group, leading figures in the Financial Data and Technology Association, the co-founder and chief executive officer of Ozone API, the director general of the Payments Association, the founder and chief executive of Icebreaker One—who is, incidentally, now also chair of the Smart Data Council—the founder of Open Banking Excellence, and the CEO of the Investing and Saving Alliance. I am making not only a cross-party point, but a point that has widespread support among the very organisations involved in smart data, and particularly the open banking success that we all seek to replicate.

If we are to replicate our success in open banking across other parts of our economy, we need two things to be true. First, we must make sure that all data standards applied in other sectors are interoperable with the data standards that already exist in open banking. The point is that data standards will be different in each sector, because each sector’s data is held in different ways, in different places and by different people, under different foundational legal powers, but they must all converge on a set of standards that means that health data can safely and securely talk to, say, energy data or banking data.

Following on from my earlier intervention, when the Minister was talking about Government new clause 27, if we are to have data standards that allow different bits of data to be exchanged safely and securely, it is essential that we do not end up with siloed standards that do not interoperate and that cannot talk to each other, between the different sectors. Otherwise, we will completely fail to leverage our existing lead in open banking, and we will effectively have to reinvent the wheel from scratch every time we open up a new sector.

I hope that, by the time the Minister responds to the various points raised in this debate, inspiration will have struck and he will be able to confirm that, although we might have different data standards, it is the Government’s intention that those standards will all be interoperable so that we avoid the problem of balkanisation, if I can put it that way. I hope he will be able to provide us with a strong reassurance in that direction.

--- Later in debate ---

[Sir Chris Bryant]

I agree with the hon. Gentleman on this, but quite a lot of steps need to be taken here. For instance, we might need to mandate standards on smart meters in order to be able to take advantage of these measures. We have not been given any kind of plans so far—unless he has seen something.

[John Penrose]

I wish I had seen something, because then I would be able to pull my amendment or inform the House. I have not seen something, and I think such a plan is essential, not just for Members in the Chamber this afternoon, but for all those investors, business leaders and app developers. That would allow them to work out the critical path, whatever the minimum viable products might be and everything else that is going to be necessary, and by what date, for the sectors they are aiming for. So the hon. Gentleman is absolutely right in what he says, and it is vital that if the Minister cannot come up with the timetable this afternoon, he can at least come up with a timetable for the timetable, so that we all know when the thing will be available and the rest of the open banking industry can work out how it is going to become an “open everything” industry and in what order, and by what time.

So this is fairly straightforward. There are promising signs, both in the autumn statement and in the Government’s new clause 27, but further details need to be tied down before they can be genuinely useful. I am assuming, hoping and praying that the Minister will be able to provide some of those reassurances and details when he makes his closing remarks, and I will therefore be able to count this as a probing amendment and push it no further. I am devoutly hoping that he will be able to make that an easier moment for me when he gets to his feet.

[Robin Millar]

I apologise to right hon. and hon. Members for any confusion that my movements around the Chamber may have created earlier, Mr Deputy Speaker.

New clause 45 is about the comparability and interoperability of health data across the UK. I say to the hon. Member for Rhondda (Sir Chris Bryant), the Opposition spokesman, that I have never been called pregnant before—that is a new description—but I will return to his point shortly in these brief remarks. There are three important reasons worth stating why data comparability is important. The first is that it empowers patients. The publication of standardised outcomes gives patients the ability to make informed choices about their treatment and where they may choose to live. Secondly, it strengthens care through better professional decision making. It allows administrators to manage resources and scientists to make interpretations of the data they receive. Thirdly, comparable data strengthens devolution, administration and policy making in the health sector. Transparent and comparable data is essential for that and ensures that we, as politicians, are accountable to voters for the quality of services in our area.

We could have an academic and philosophical discussion about this, but what brings me to table new clause 45 is the state of healthcare in north Wales. We have a health board that has been in special measures for the best part of eight years, and I have to wonder if that would be the case if the scrutiny of it were greater. One of the intentions of devolution was to foster best practice, but in order for that to happen we need comparability, which has not proved to be the case in the health sector.

For example, NHS Scotland does not publish standard referral to treatment times. Where it does, it does not provide averages and percentiles, but rather the proportion of cases meeting Scotland-only targets. In Wales, RTTs are broadly defined as the time spent waiting between a referral for a procedure and getting that procedure. In England, only consultant-led pathways are reported, but in Wales some non-consultant-led pathways are included, such as direct access diagnostics and allied health professional therapies, such as physiotherapy and osteopathy, which inevitably impact waiting times.

On cancer waiting times, England and Scotland have a target of a test within six weeks. However, there are different numbers of tests—eight north and 15 south of the border—and different measures for when the period ends—until the last test is completed in England or until the report is written up in Scotland. Those who understand health matters will make better sense of what those differences mean, but I simply make the observation that there are differences.

In Wales, the way we deal with cancer waiting times is different. Wales starts its 62-day treatment target from the date the first suspicion is raised by any health provider, whereas in England the 62-day target is from the date a specialist receives an urgent GP referral. Furthermore, in Wales routine referrals reprioritised as “urgent, with suspicion of cancer” are considered to be starting a new clock.

What can be done about this and why does it require legislation? New clause 45 may seem familiar to hon. Members because it was first brought forward as an amendment to the Health and Care Bill in 2022. It was withdrawn with the specific intention of giving the Government the time to develop a collaborative framework for sharing data with the devolved Administrations. I pay tribute to all four Governments, the Office for National Statistics and officials for their work since then.

Notwithstanding that work, on 5 September 2023 Professor Ian Diamond, the UK national statistician, made the following remarks to the Public Administration and Constitutional Affairs Committee about gathering comparative health data across the devolved Administrations:

“You are entirely right that statistics is a devolved responsibility and therefore the data that are collected for administrative purposes in different parts of the United Kingdom differ. We have found it very difficult recently to collect comparable data for different administrations across the UK on the health service, for example.”

On working more closely with the devolved Administrations’ own statistical authorities, he said:

“We have been working very hard to try to get comparable data. Comparable data are possible in some areas but not in others. Trying to get cancer outcomes—”

as I have just referred to—

“is very difficult because they are collected in different ways… While statistics is devolved, I do not have the ability to ensure that all data are collected in a way that is comparable. We work really hard to make comparable data as best as possible, but at the moment I have to be honest that not all data can be compared.”

Mr Deputy Speaker, new clause 45 was brought forward as a constructive proposal. I believe that it is good for the patients, good for the professionals who work on their healthcare, and good for our own accountability. I do not think that this House would be divided on grounds of compassion or common sense. I thank all those Members who have supported my new clause and urge the Government to legislate on this matter. Today was an opportunity for me to discuss the issues involved, but I shall not be moving my new clause.

Online Safety Bill

John Penrose Excerpts

Report stage
Monday 5th December 2022 Commons Chamber

[Dame Margaret Hodge]

That is for an investigation by the appropriate enforcement agency—Ofcom et al.—and if there is evidence that culpability rests with the managing director, the owner or whoever, they should be prosecuted. It is as simple as that. A case would have to be established through evidence, and that should be carried out by the enforcement agency. I do not think that this is any different from any other form of financial or other crime. In fact, it is from my experience in that that I came to this conclusion.

[John Penrose (Weston-super-Mare) (Con)]

The right hon. Lady is making a powerful case, particularly on the effective enforcement of rules to ensure that they bite properly and that people genuinely pay attention to them. She gave the example of a senior executive talking about whether people should be stopped for getting it wrong—I think the case she mentioned was holocaust denial—by making factually inaccurate statements or allowing factually inaccurate statements to persist on their platform. May I suggest that her measures would be even stronger if she were to support new clause 34, which I have tabled? My new clause would require factual inaccuracy to become wrong, to be prevented and to be pursued by the kinds of regulators she is talking about. It would be a much stronger basis on which her measure could then abut.

[Dame Margaret Hodge]

Indeed. The way the hon. Gentleman describes his new clause, which I will look at, is absolutely right, but can I just make a more general point because it speaks to the point about legal but harmful? What I really fear with the legal but harmful rule is that we create more and more laws to make content illegal and that, ironically, locks up more and more people, rather than creates structures and systems that will prevent the harm occurring in the first place. So I am not always in favour of new laws simply criminalising individuals. I would love us to have kept to the legal but harmful route.

We can look to Elon Musk’s recent controversial takeover of Twitter. Decisions taken by Twitter’s newest owner—by Elon Musk himself—saw use of the N-word increase by nearly 500% within 12 hours of acquisition. And allowing Donald Trump back on Twitter gives a chilling permission to Trump and others to use the site yet again to incite violence.

The tech giants know that their business models are dangerous. Platforms can train their systems to recognise so-called borderline content and reduce engagement. However, it is for business reasons, and business reasons alone, that they actively choose not to do that. In fact, they do the opposite and promote content known to trigger extreme emotions. These platforms are like a “danger for profit” machine, and the decision to allow that exploitation is coming from the top. Do not take my word for it; just listen to the words of Ian Russell. He has said:

“The only person that I’ve ever come across in this whole world…that thought that content”—

the content that Molly viewed—

“was safe was…Meta.”

There is a huge disconnect between what silicon valley executives think is safe and what we expect, both for ourselves and for our children. By introducing liability for directors, the behaviour of these companies might finally change. Experience elsewhere has shown us that that would prove to be the most effective way of keeping online users safe. New clause 17 would hold directors of a regulated service personally liable on the grounds that they have failed, or are failing, to comply with any duties set in relation to their service, for instance failure that leads to the death of a child. The new clause further states that the decision on who was liable would be made by Ofcom, not the provider, meaning that responsibility could not be shirked.

I say to all Members that if we really want to reduce the amount of harmful abuse online, then making senior directors personally liable is a very good way of achieving it. Some 82% of UK adults agree with us, Labour Front Benchers agree and Back Benchers across the House agree. So I urge the Government to rethink their position on director liability and support new clause 17 as a cross-party amendment. I really think it will make a difference.

--- Later in debate ---

Although I am pleased that the Bill is back before us today, I am disappointed that aspects have been weakened since we last considered it, and urge the Government to consider closely some proposals we will vote on this evening, which would go a considerable way to ensuring that the online world is a safer place for children and adults, works in the interests of users, and holds platforms accountable and responsible for protecting us all online.

[John Penrose]

It is a pleasure to follow Zach’s MP, the hon. Member for Batley and Spen (Kim Leadbeater). I particularly want to pick up on her final comments about the difficulties of platforms—not just small platforms, but larger ones—hosting extremist content, be it incels, the alt-right, the radical left or any other kind.

I will speak to my new clauses 34 and 35, which seek to deal with both disinformation and misinformation. They are important amendments, because although the Bill has taken huge steps forward—we are led to believe that it may take a couple more in due course when the revised version comes back if the recommittal is passed—there are still whole categories of harm that it does not yet address. In particular, it focuses, rightly and understandably, on individual harms to children and illegal activities as they relate to adults, but it does not yet deal with anything to do with collective harms to our society and our democracy, which matter too.

We have heard from former journalists in this debate. Journalists know it takes time and money to come up with a properly researched, authoritatively correct, accurate piece of journalism, but it takes a fraction of that time and cost to invent a lie. A lie will get halfway around the world before the truth has got its boots on, as the saying rightly goes. Incidentally, the hon. Member for Rotherham (Sarah Champion) said that it is wonderful that we are all learning so much. I share that sentiment; it is marvellous that we are all comparing and sharing our particular areas of expertise.

One person who seems to have all areas of expertise under his belt is my hon. Friend the Member for Folkestone and Hythe (Damian Collins), who chaired the Joint Committee. He rightly pointed out that this is a systems Bill, and it therefore deals with trying to prevent some things from happening—and yet it is completely silent on misinformation and disinformation, and their effect on us collectively, as a society and a democracy. New clauses 34 and 35 are an attempt to begin to address those collective harms alongside some individual harms we face. One of them deals with a duty of balance; the other deals with factual accuracy.

The duty of balance is an attempt to address the problem as it relates to filter bubbles, because this is a systems Bill and because each of us has a tailored filter bubble, by which each of the major platforms, and some of the minor ones, work out what we are interested in and feed us more of the same. That is fine for people who are interested in fishing tackle; that is super. But if someone is interested in incels and they get fed more and more incel stuff, or they are vaguely left wing and get taken down a rabbit hole into the increasingly radical left—or alternatively alt-right, religious extremism or whatever it may be—pretty soon they get into echo chambers, and from echo chambers they get into radicalisation, and from radicalisation they can pretty soon end up in some very murky, dark and deep waters.

There are existing rules for other old-world broadcasters; the BBC, ITV and all the other existing broadcasters have a duty of balance and undue prominence imposed on them by Ofcom. My argument is that we should consider ways to impose a similar duty of balance on the people who put together the programs that create our own individual filter bubbles, so that when someone is shown an awful lot of stuff about incels, or alt-right or radical left politics, somewhere in that filter bubble they will be sent something saying, “You do know that this is only part of the argument, don’t you? Do you know that there is another side to this? Here’s the alternative; here’s the balancing point.” We are not doing that at the moment, which is one of the reasons we have an increasingly divided societal and political debate, and that our public square as a society is becoming increasingly more fractious—and dangerous, in some cases. New clause 35 would fix that particular problem.

New clause 34 would deal with the other point—the fact that a lie will get halfway around the world before the truth has got its boots on. It tries to deal with factual accuracy. Factual accuracy is not quite the same thing as truth. Truth is an altogether larger and more philosophical concept to get one’s head around. It is how we string together accurate and correct facts to create a narrative or an explanation. Factual accuracy is an essential building block for truth. We must at least try to ensure that we can all see when someone has made something up or invented something, whether it is that bleach is a good way to cure covid or whatever. When somebody makes something up, we need to know and it needs to be clear. In many cases that is clear, but in many cases, if it is a plausible lie, a deepfake or whatever it may be, it is not clear. We need to be able to see that easily, quickly and immediately, and say, “I can discount this, because I know that the person producing it is a serial liar and tells huge great big porkies, and I shouldn’t be trusting what they are sending me, or I can see that the actual item itself is clearly made up.”

The duty of achieving balance already exists in rules and law in other parts of our society and is tried and tested—it has stood us very well and done a good job for us for 40 or 50 years, since TV and radio became ubiquitous—and the same is true, although not for quite such a long time, for factual accuracy. There are increasingly good methods of checking the factual accuracy of individual bits of content, and if necessary, in some cases of doing so in real time, too. For example, Adobe is leading a very large global grouping producing something called the Content Authenticity Initiative, which can tell if something is a deepfake, because it has an audit trail of where the image, the item or whatever it may be came from and how it has been updated, modified or changed during the course of its life.

[Dean Russell]

On that point, I want to raise the work that my hon. Friend the Member for Bosworth (Dr Evans), who is not in the Chamber at the moment, has done on body image. When images are photo-shopped and changed to give an idea of beauty that is very different from what is possible in the real world, that very much falls into the idea of truth. What are my hon. Friend’s thoughts on that point?

[John Penrose]

Addressing that is absolutely essential. That goes for any of the deepfake examples we have heard about, including from my right hon. Friend the Member for Basingstoke (Dame Maria Miller), because if we know that something has been changed—and the whole point about deepfake is that it is hard to tell—we can tell easily and say, “I know that is not right, I know that is not true, I know that is false, and I can aim away from it and treat it accordingly”.

Just to make sure that everybody understands, this is not some piece of new tech magic; it is already established. Adobe, as I have said, is doing it with the Content Authenticity Initiative, which is widely backed by other very serious tech firms. Others in the journalism world are doing the same thing, with the Journalism Trust Initiative. There is NewsGuard, which produces trust ratings; the Trust Project, which produces trust indicators; and we of course have our own press regulators in this country, the Independent Press Standards Organisation and IMPRESS.

I urge the Government and all here present not to be satisfied with where this Bill stands now. We have all heard how it can be improved. We have all heard that this is a new, groundbreaking and difficult area in which many other countries have not even got as far as we have, but we should not be in any way satisfied with where we are now. My right hon. and learned Friend the Member for Kenilworth and Southam (Sir Jeremy Wright) said earlier that we need to approach this Bill in a spirit of being humble, and this is an area in which humility is absolutely essential. I hope all of us realise how much further we have to go, and I hope the Minister will say how he proposes to address these important and so far uncovered issues in due course.

[Liz Twist (Blaydon) (Lab)]

I wish to address new clauses 16 and 28 to 30, and perhaps make a few passing comments on some others along the way. Many others who, like me, were in the Chamber for the start of the debate will I suspect feel like a broken record, because we keep revisiting the same issues and raising the same points again and again, and I am going to do exactly that.

First, I will speak about new clause 16, which would create a new offence of encouraging or assisting serious self-harm. I am going to do so because I am the chair of the all-party parliamentary group on suicide and self-harm prevention, and we have done a good deal of work on looking at the issue of self-harm and young people in the last two years. We know that suicide is the leading cause of death in men aged under 50 years and females aged under 35 years, with the latest available figures confirming that 5,583 people in England and Wales tragically took their own lives in 2021. We know that self-harm is a strong risk factor for future suicidal ideation, so it is really important that we tackle this issue.

The internet can be an invaluable and very supportive place for some people who are given the opportunity to access support, but for other people it is difficult. The information they see may provide access to content that acts to encourage, maintain or exacerbate self-harm and suicidal behaviours. Detailed information about methods can also increase the likelihood of imitative and copycat suicide, with risks such as contagion effects also present in the online environment.

Oral Answers to Questions

John Penrose Excerpts

Thursday 10th February 2022 Commons Chamber

[Julia Lopez]

I thank the hon. Member for raising the issue of touring. I have been doing a lot of work with officials and other Departments to ease some of the challenges that people have had since we left the EU, and I will continue to work on this issue.

[John Penrose (Weston-super-Mare) (Con)]

T5. Broadcast news has a long-standing duty of balance, which moderates public debate, tests opposing views and helps forge consensus across our country, but today’s digital world means that more and more of us get our news through social media platforms, where individual filter bubbles can feed us more of one side without ever showing an alternative view, driving extremism, radicalisation and division instead. Is it now time to extend that duty of balance to include social media platforms?

[The Parliamentary Under-Secretary of State for Digital, Culture, Media and Sport (Chris Philp)]

My hon. Friend raises an important question, but we need to distinguish between broadcasters, or indeed newspapers, that are exercising editorial judgment, and social media platforms that are carrying content generated by other users. However, we will introduce shortly—in the coming weeks—an online safety Bill that will impose new duties on social media firms in connection with illegal content, content that is harmful to children and content, including disinformation, that is harmful to adults. I hope that will go a long way towards addressing the points that he rightly raises.