Media Bill (Third sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Thursday 7th December 2023 Public Bill Committees

[Damian Collins (Folkestone and Hythe) (Con)]

A lot of the existing regime, and also a lot of what is in the Bill, is based on the assumption that as many people as possible will seek to be designated as a public service broadcaster and will do everything they can to keep that designation. Is there not a danger now that if prominence is not effective enough, PSBs will simply decline to be PSBs, with all the obligations that being a PSB places on them, and just seek to make programmes that are popular and that will therefore be recommended and promoted on smart devices? Is my right hon. Friend confident that Ofcom will have the ability to issue guidance that distributors of programmes may need to increase the prominence of public broadcasting if they are not doing so already?

[Sir John Whittingdale]

My hon. Friend makes an interesting point, and I have sympathy with the concern he expresses. However, if this Bill was not passed, the advantages of being a public service broadcaster would be very small. All the PSBs have made it clear that they regard prominence as an essential benefit of the compact, in order that they are easily found and accessible. Because they have laid such stress on that, we assume that it is still their wish to remain designated as PSBs.

It is, of course, up to any PSB to walk away from the compact if they chose to do so. In doing so, they would no longer necessarily be able to benefit from prominence and the other advantages that come with PSB designation. However, I know that both my hon. Friend and I believe that there is a continuing need for public service broadcasting in this country. One of the purposes of the Bill is exactly to address the point he makes, by ensuring that PSB designation is still an attractive proposition for broadcasters to seek.

Let me return to one or two details of precisely how the system will operate. Once the necessary internet programme services and regulated television selection service providers have been designated, new sections 362AJ to 362AN introduce new rules to ensure the availability of public service content. That is achieved by requiring providers to offer their designated IPSs to RTSS providers and requiring RTSS providers to carry these designated services. After all, prominence would be redundant if the PSB services are not on the platform to begin with.

These availability requirements will be underpinned by statutory agreement objectives that providers of designated IPSs and RTSSs must act consistently with when reaching an agreement on the availability and prominence of designated services and when keeping that agreement in force. These include that the arrangements support the sustainability of public service broadcasting and do not disproportionately restrict how the platform may innovate its service. The intention behind these agreement objectives is for Parliament to provide expectations for the outcome of negotiations between designated IPS providers and RTSS providers. These objectives are to be supplemented by more detailed Ofcom guidance on how providers may act consistently with them.

In that respect, let me address the point made by the hon. Member for Barnsley East in her amendment 29. Proposed new section 362AL requires Ofcom to

“prepare…guidance about how providers of designated internet programme services and providers of regulated television selection services may act consistently with the agreement objectives”

when negotiating on the carriage and prominence of designated services and after an agreement has been reached. The Government absolutely recognise that Ofcom’s guidance should take into account the BBC’s equivalent duties under the framework agreement, as also reflected in its relevant strategies and policies under the agreement, including clause 62. However, I can tell the hon. Lady that proposed new section 362AL(2) already provides for such considerations by Ofcom by referring to

“any duty of the BBC under the BBC Charter and Agreement that is comparable to the duty of providers of designated internet programme services other than the BBC”.

This may be a good opportunity to expand on another point. By convention, the BBC is not regulated in statute. It is the Government’s intention for the new prominence framework to apply to the BBC through the framework agreement. We plan to work at pace with the BBC to make corresponding changes to the its framework agreement to ensure that the relevant parts of the prominence regime apply to the BBC, while also acknowledging how it legally functions. It is the Government’s view that there is already provision in the Bill for Ofcom to consider the BBC’s comparable duties and corresponding policies under its framework agreement in its guidance on the agreement objectives. It is for that reason that I am unable to accept the amendment of the hon. Member for Barnsley East.

Overall, we think the principles-based approach that we are taking, with Ofcom playing a vital role, is the correct one. It will give Ofcom the tools it needs to ensure that the regime is functioning effectively without being too inflexible or overly prescriptive. Once designated services are available on the platform in question, new sections 362A0 to 362AR introduce specific duties on providers of RTSSs, including the requirement to carry and display designated IPSs with an appropriate degree of prominence. That includes the requirement to carry and give regional prominence to designated S4C services in Wales and STV services in relevant parts of Scotland.

[Sir John Whittingdale]

I am happy to address that point. The hon. Lady also raised the subject, which was debated on Second Reading and in the Select Committee, of whether the requirement for “appropriate prominence” is a better description than “significant prominence”. That is something we looked at carefully, particularly as it was one of the Select Committee’s recommendations, but we feel that it is important that the approach to regulation should be proportionate and allow for flexibility and operability across different RTSSs. We believe that an appropriate level of prominence, as determined by Ofcom in the code of practice, provides that flexibility and enables Ofcom to implement the regime in a practical way.

[Damian Collins]

Does the Minister agree that, given the nature of new smart devices, which favour personalisation of content and recommendations to users, smaller regional broadcasters, such as S4C, may benefit significantly, because viewers who have a habit of watching programming in the Welsh language are far more likely to be recommended that programming in the future?

--- Later in debate ---

[Sir John Whittingdale]

I am most grateful to hon. Members for raising a number of interesting questions. The general answer to them is that these matters need to be considered by Ofcom when it draws up the details. However, I can seek to address one or two of the points made. On the continuing discussion about “appropriate” versus “significant”, I will try not to repeat our maxim that “significant” may be appropriate, but “appropriate” does not necessarily always mean significant—hopefully I got that right. For instance, there is the issue around S4C. Obviously, if someone lives in Wales, then S4C prominence is appropriate. If someone lives in Chelmsford and is learning Welsh, then perhaps it might become appropriate, as the hon. Member for Arfon set out.

My hon. Friend the Member for Torbay made a point about algorithms, and basing prominence on behaviour as well as geolocation. If someone regularly turns to, and finds, S4C, it is an indication that they are interested in Welsh language television. That might well be taken into account in the prominence regime, but that is a matter for Ofcom. The technology may not yet have reached that point, but I entirely take my hon. Friend’s point that geolocation does not necessarily deliver sufficient prominence for each individual viewer.

On the question that the hon. Member for Aberdeen North asked about PSB buttons on remote controls, she is right that one or two of the streaming services pay to have their own button. My remote control has a Netflix button. I think it would be quite difficult to have a PSB button, because PSB obviously covers quite a wide range of broadcasters. It would not be right to say, “You’ve got to have a BBC button”; in a sense, the whole of the point of the legislation is to ensure that we do not need to do that. The prominence regime is designed not to force people to watch PSBs, but just to make them easily findable, so that when someone turns on their television, the first thing they see is the range of PSB channels as suggestions. If that is delivered, we do not necessarily need a button. Netflix presumably paid to have a button because it does not automatically pop up when someone turns on their television, but it will only be pressed by those who choose to watch Netflix. I do not think a button is necessary.

The hon. Lady also raised the interesting question of television-like devices. My children had an Xbox, and because it was constantly plugged in, we used it to access TV, rather than having to remove all the wires. She is absolutely right that in some families, the games console may well be frequently used to access television. That too is something that Ofcom will need to take into account. She asks that I make it clear that it is not ruled out, and I am happy to do that. We have asked Ofcome to look into those issues and draw up what is appropriate. It came as something of a surprise to me to read in my guidance notes that people can watch television on their refrigerator in some cases. I am not necessarily suggesting that it would be appropriate to give the BBC prominence on a refrigerator. All those things are matters that Ofcom will need to consider.

[Damian Collins]

Does my right hon. Friend agree that a distinction needs to be drawn between internet-connected devices—through which BBC iPlayer or the ITV hub or whatever it is can be accessed—and a smart television, which displays multiple different TV providers in the same place? On the latter, the user is not necessarily going to a separate place on the internet to watch something; they are going to one place, where these things are held together. It is in that environment that we want to ensure that the public broadcasters have due prominence.

[Sir John Whittingdale]

My hon. Friend is absolutely right. More and more devices have screens, but they are not necessarily primarily or even occasionally used for watching television, so it would be completely wrong to include them within scope. However, there will be a variety of possible devices for watching TV, and Ofcom will need to look at that.

Media Bill (First sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Tuesday 5th December 2023 Public Bill Committees

[Sir John Whittingdale]

I start by agreeing with both Opposition spokesmen about the importance of supporting the production sector outside London and across every region and nation of the United Kingdom. The growth of the independent production sector outside London has been a phenomenal success in recent years, and we now have very strong companies in all parts of the UK. That is shown by the fact that since 2010, PSBs’ production spend allocated to programmes outside London has increased from 39% to over 50%, with ambitions to go even further. For instance, the recent publication of the BBC’s “Across the UK” strategy commits it to increasing the proportion of its own TV production budget outside London to 60% by 2027.

The amendment tabled by the hon. Member for Aberdeen North focuses on Scotland, where production spend is now worth over £266 million, supported by developments including the opening of a Channel 4 creative hub in Glasgow in 2019. As I say, the BBC’s “Across the UK” strategy includes commitments to expand its production studios within the city.

[Damian Collins]

Screen Scotland has pointed out that the total production spend last year on film and television and audiovisual content in Scotland was more than £600 million, which is a 55% increase on the 2019 figures, which shows a substantial increase in production in Scotland. Does the Minister agree that that is to be welcomed?

[Sir John Whittingdale]

My hon. Friend is absolutely right. It is not just the public service broadcasters that are committing to spending money on production in Scotland; it is right across the range of broadcasters. That exemplifies the strength of Scottish independent production. Indeed, similar figures can be quoted for Wales; it is not unique to Scotland. Every part of the UK is benefiting. Of course, Scotland has its own broadcasting company in the form of STV, which has a production arm, STV Studios, which has an ambition to become a world-class content producer for global networks and streaming services.

The success of the production sector in Scotland and across the UK has been supported and underpinned by a regulatory system. The importance of programmes being made outside London is in the new public service remit. In addition, all public service broadcasters, with the exception of S4C, are subject to regional programme-making quotas for spend and hours of production outside London. Channel 4 has its own out-of-England quota; the BBC also has a specific quota for content made in Scotland. Those quotas are set by Ofcom, which has the power to amend them, where appropriate. One example of the success of that regulatory system is the “Made outside London programme titles register”, published by Ofcom, which, in 2022, had 811 entries, including 543 from English regions outside London, 53 from Northern Ireland, 117 from Scotland and 72 from Wales. In each case, broadcasters are exceeding the production quotas quite comfortably. The Government will continue to support screen industries across the UK through a system of tax reliefs, investment in studio infrastructure and the UK global screen fund.

In line with the Government’s broader ambition to level up the UK, we want the production sector in all areas of the UK to continue to thrive, and we believe that PSBs play a very important role in our meeting that ambition. Returning to comments made by the hon. Member for Arfon, which I did not address earlier, S4C plays an extremely important part in that. I have not had the opportunity to visit production facilities in Scotland, but I have been to visit both BBC Wales in Cardiff and S4C, where I went on the set of “Pobol y Cwm”, and production in Wales is thriving. The position for S4C is slightly different from that for Scotland, in that there is, as the hon. Gentleman pointed out, a dedicated television channel for the Welsh language in the form of S4C. However, the Government are committed to supporting the production sector in all the nations of the UK.

I share the view of the hon. Member for Barnsley East that attempting to set quotas that are exactly in line with the population proportions would impose a constraint, which would be limiting and unnecessary. For that reason, I ask the hon. Member for Aberdeen North to withdraw her amendment.

Data Protection and Digital Information (No. 2) Bill (Seventh sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Tuesday 23rd May 2023 Public Bill Committees

[Sir John Whittingdale]

As the hon. Lady sets out, amendment 117 would remove new regulation 6B from the Bill, but we see this as an important tool for reducing frequent cookie consent banners and pop-ups that can, as we have debated already, interfere with people’s use of the internet. Members will be aware, as has already been set out, that clause 79 removes the need for organisations to seek consent to place cookies for certain non-intrusive purposes. One way of further reducing the need for repeated cookie pop-up notices is by blocking them at source—in other words, allowing web users to select which cookies they are willing to accept and which they are not comfortable with by using browser-level settings or similar technologies. These technologies should allow users to set their online preferences once and be confident that those choices will be respected throughout their use of the internet.

We will continue to work with the industry and the Information Commissioner to improve take-up and effectiveness of browser-based and similar solutions. Retaining the regulation-making powers at 6B is important to this work because it will allow the Secretary of State to require relevant technologies to meet certain standards or specifications.

Without regulations, there could be an increased risk of companies developing technologies that did not give web users sufficient choice and control about the types of cookies they are willing to accept. We will consult widely before making any new regulations under 6B, and new regulations will be subject to the affirmative resolution procedure. We have listened to stakeholders and intend to amend 6B to provide an explicit requirement for the Secretary of State to consult the Competition and Markets Authority before making new regulations.

[Damian Collins (Folkestone and Hythe) (Con)]

Is this something the Department has considered? For example, Google Chrome has a 77% share of the web browser market on desktop computers, and over 60% for all devices including mobile devices. Although we want to improve the use of the internet for users and get rid of unwanted cookies, the consequence would be the consolidation of power in the hands of one or two companies with all that data.

[Sir John Whittingdale]

I entirely agree with my hon. Friend. He accurately sums up the reason that the Government decided it was important that the Competition and Markets Authority would have an input into the development of any facility to allow browser users to set their preferences at the browser level. We will see whether, with the advent of other browsers, AI-generated search engines and so on, the dominance is maintained, but I think he is absolutely right that this will remain an issue that the Competition and Markets Authority needs to keep under review.

That is the purpose of Government amendment 54, which will ensure that any competition impacts are considered properly. For example, we want any review of regulations to be relevant and fair to both smaller publishers and big tech. On that basis, I hope that the hon. Member for Barnsley East will consider withdrawing her amendment.

--- Later in debate ---

[Damian Collins]

Does my right hon. Friend agree that, if amendment 118 were made, it could be used as a general get-out-of-jail-free card by companies? Let us consider, for example, a situation where a company could easily and obviously have spotted a likely breach of the regulations and should have intervened. When the commissioner discovered that the company had failed in its duty to do so, the company could turn around and say, “Well, yes, we missed that, but we were not under any obligation to monitor.” It is therefore important that there is a requirement for companies to use their best endeavours to monitor where possible.

[Sir John Whittingdale]

I completely agree; my hon. Friend is right to make that distinction. Companies should use their best endeavours, but it is worth repeating that the guidance does not expect service and network providers to monitor the content of individual calls and messages to comply with the duty. There is more interest in patterns of activity on networks, such as where a rogue direct marketing firm behaves in the manner that I set out. On that basis, I ask the hon. Lady not to press her amendment to a vote.

Data Protection and Digital Information (No. 2) Bill (Sixth sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Thursday 18th May 2023 Public Bill Committees

[Stephanie Peacock]

The clause defines key terms in this part of the Bill, such as business data, customer data and data holder, as well as data regulations, customer and trader. These are key to the regulation-making powers on smart data in part 3, and I have no specific concerns to raise about them at this point.

I note the clarification made by the Minister in his amendment to the example given. As he outlined, that will ensure there is consistency in the definition and understanding of business data. It is good to see areas such as that being cleaned up so that the Bill can be interpreted as easily as possible, given its complexity to many. I am therefore happy to proceed with the Bill.

[Damian Collins (Folkestone and Hythe) (Con)]

I rise to ask the Minister a specific question about the use of smart data in this way. A lot of users will be giving away data a device level, rather than just accessing individual accounts. People are just going to a particular account they are signed into and making transactions, or doing whatever they are doing in that application, on a particular device, but there will be much more gathering of data at the device level. We know that many companies—certainly some of the bigger tech companies—use their apps to gather data not just about what their users do on their particular app, but across their whole device. One of the complaints of Facebook customers is that if they seek to remove their data from Facebook and get it back, the company’s policy is to give them back data only for things they have done while using its applications—Instagram, Facebook or whatever. It retains any device-level data that it has gathered, which could be quite significant, on the basis of privacy—it says that it does not know whether someone else was using the device, so it is not right to hand that data back. Companies are exploiting this anomaly to retain as much data as possible about things that people are doing across a whole range of apps, even when the customer has made a clear request for deletion.

I will be grateful if the Minister can say something about that. If he cannot do so now, will he write to me or say something in the future? When considering the way that these regulations work, particularly in the era of smart data when it will be far more likely that data is gathered across multiple applications, it should be clear what rights customers have to have all that data deleted if they request it.

[Sir John Whittingdale]

I share my hon. Friend’s general view. Customers can authorise that their data be shared through devices with other providers, so they should equally have the right to take back that data if they so wish. He invites me to come back to him with greater detail on that point, and we would be very happy to do so.

Amendment 46 agreed to.

Clause 61, as amended, ordered to stand part of the Bill.

Clause 62

Power to make provision in connection with customer data

Data Protection and Digital Information (No. 2) Bill (Fifth sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Thursday 18th May 2023 Public Bill Committees

[Sir John Whittingdale]

Clause 43 is a technical measure that creates a presumption that our data protection laws should not be overridden by future laws that relate to the processing of personal data, but it respects parliamentary sovereignty by ensuring that Parliament can depart from this presumption in particular cases if it deems it appropriate to do so. For example, if new legislation permitted or required an organisation to share personal data with another for a particular purpose, the default position in the absence of any specific indication to the contrary would be that the data protection legislation would apply to the new arrangement.

[Damian Collins (Folkestone and Hythe) (Con)]

Will my right hon. Friend confirm that the provision will also apply with trade agreements? Certainly in the early stages of the negotiations for a UK-US trade agreement, the United States Government sought to include various provisions relating to tech policy. In such a scenario, would this legislation take precedence above anything written into a trade agreement?

[Sir John Whittingdale]

That would certainly be my interpretation. I do not see that a trade agreement could possibly overturn an Act of Parliament unless Parliament specifically sets out that it intends that that should be the case. This is a general protection, essentially saying that in all future cases data protection legislation applies unless Parliament specifically indicates that that should not be the case.

Until now, ensuring that any new data protection measures are read consistently with the data protection legislation has relied either on inclusion of express provision to that effect in new data processing measures, or on general rules of interpretation. There are risks to that situation. Including relevant provisions in each and every new data processing provision is onerous and could be inadvertently omitted. General rules of interpretation can be open to different interpretations by courts, particularly in the light of legal challenges following our exit from the European Union. This can create the potential for legal uncertainty and as a result could lead to a less effective and comprehensive data protection legislative framework.

Clause 43 creates a presumption that any future legislation permitting the processing of personal data will be subject to the key requirements of the UK’s data protection legislation unless clear provisions are made to the contrary. This is a technical but necessary measure and I commend it to the Committee.

Data Protection and Digital Information (No. 2) Bill (Fourth sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Tuesday 16th May 2023 Public Bill Committees

[Sir John Whittingdale]

I am very much aware of the concern about automated decision making. The Government share the wish of the hon. Member for Barnsley East for all those who may be affected to be given protection. Where I think we differ is that we do not recognise the distinction that she tries to make between data subjects and decision subjects, which forms the basis of her amendments.

The hon. Lady’s amendments would introduce to the UK GDPR a definition of the term “decision subject”, which would refer to an identifiable individual subject to data- based and automated decision making, to be distinguished from the existing term “data subject”. The intended effect is to extend the requirements associated with provisions related to decisions taken about an individual using personal data to those about whom decisions are taken, even though personal information about them is not held or used to take a decision. It would hence apply to the safeguards available to individuals where significant decisions are taken about them solely through automated means, as amendments 78 to 101 call for, and to the duties of the Information Commissioner to have due regard to decision subjects in addition to data subjects, as part of the obligations imposed under amendment 106.

I suggest to the hon. Lady, however, that the existing reference to data subjects already covers decision subjects, which are, if you like, a sub-group of data subjects. That is because even if an individual’s personal data is not used to inform the decision taken about them, the fact that they are identifiable through the personal data that is held makes them data subjects. The term “data subject” is broad and already captures the decision subjects described in the hon. Lady’s amendment, as the identification of a decision subject would make them a data subject.

I will not, at this point, go on to set out the Government’s wider approach to the use of artificial intelligence, because that is somewhat outside the scope of the Bill and has already been set out in the White Paper, which is currently under consultation. Nevertheless, it is within that framework that we need to address all these issues.

[Damian Collins (Folkestone and Hythe) (Con)]

I have been closely following the speeches of the Minister and the hon. Member for Barnsley East. The closest example that I can think of for this scenario is the use of advertising tools such as lookalike audiences on Facebook and customer match on YouTube, where a company holding data about users looks to identify other customers who are the closest possible match. It does not hold any personal data about those people, but the platform forms the intermediary to connect them. Is the Minister saying that in that situation, as far as the Bill is concerned, someone contacted through a lookalike audience has the same rights as someone who is contacted directly by an advertiser that holds their data?

--- Later in debate ---

[Sir John Whittingdale]

It is certainly our view that anybody who is affected by an automated decision made on the basis of data held about individuals themselves becomes a data subject, so I think the answer to the honourable Lady’s question is no. As I said, the Information Commissioner’s Office will provide guidance in this area. If such a situation does arise, obviously it will need to be considered.The hon. Members for Barnsley East and for Glasgow North West asked about making information available to all those affected, and about safeguards, which we think are contained within the requirements under article 22C.

[Damian Collins]

Further to the point that was made earlier, let us say that a Facebook user was targeted with an advert that was based on their protected characteristics data—data relevant to their sexual orientation, for example—but that user said that they had never shared that information with the platform. Would they have the right to make a complaint, either to the advertiser or to the platform, for inferring that data about them and making it available to a commercial organisation without their informed consent?

[Sir John Whittingdale]

They would obviously have that right, and indeed they would ultimately have the right to appeal to the Information Commissioner if they felt that they had been subjected unfairly to a decision where they had not been properly informed of the fact. On the basis of what I have said, I hope the hon. Member for Barnsley East might withdraw her amendment.

Data Protection and Digital Information (No. 2) Bill (Third sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Tuesday 16th May 2023 Public Bill Committees

[Damian Collins (Folkestone and Hythe) (Con)]

I wish to pose a couple of questions, after two thoughtful and well-presented amendments from those on the Opposition Front Bench. With regard to children and the use of apps such as TikTok, what assurance will the Government seek to ensure that companies that process and store data abroad are abiding by the principles of our domestic legislation? I mention TikTok directly because it stores data from UK users, including children, in Singapore, and it has made clear in evidence to the Joint Committee on the Online Safety Bill that that data is accessed by engineers in China who are working on it.

We all know that when data is taken from a store and used for product development, it can be returned in its original state but a huge amount of information is gathered and inferred from it that is then in the hands of engineers and product developers working in countries such as China and under very different jurisdictions. I am interested to know what approach we would take to companies that store data in a country where we feel we have a data equivalence regime but then process the data from a third location where we do not have such a data agreement.

[Sir John Whittingdale]

I welcome the recognition of the importance of allowing genuine research and the benefits that can flow from it. Such research may well be dependent on using data and the clause is intended to provide clarity as to exactly how that can be done and in what circumstances.

I will address the amendments immediately. I am grateful to the hon. Member for Barnsley East for setting out her arguments and we understand her concerns. However, I think that the amendments go beyond what the clause proposes and, in addition, I do not think that there is a foundation for those concerns. As we have set out, clause 2 inserts in legislation a definition for processing for scientific research, historical research and statistical purposes. The definition of scientific research purposes is set out as

“any research that can be reasonably described as scientific”

and I am not sure that some of the examples that the hon. Lady gave would meet that definition.

The definitions inserted by the clause are based on the wording in the recitals to the UK GDPR. We are not changing the scope of these definitions, only their status in the legislation. They will already be very familiar to people using them, but setting them out in the Bill will provide more clarity and legal certainty. We have maintained a broad scope as to what is allowed to be included in scientific research, with the view that the regulator can add more nuance and context through guidance, as is currently the case. The power to require codes of practice provides a route for the Secretary of State to require the Information Commissioner to prepare any code of practice that gives guidance on good practice in processing personal data.

There will be situations where non-statutory guidance, which can be produced without being requested under regulations made by the Secretary of State, may be more appropriate than a statutory code of practice. Examples of the types of activity that are considered scientific research and the indicative criteria that a researcher should demonstrate are best placed in non-statutory guidance produced by the Information Commissioner’s Office. That will give flexibility to amend and change the examples when necessary, so I believe that the process does not change the provision. However, putting it in the legislation, rather than in the recitals, will impose stronger safeguards and make things clearer. Once the Bill has come into effect, the Government will continue to work with the ICO to update its already detailed and helpful guidance on the definition of scientific research as necessary.

Amendment 66 would prohibit the use of children’s data for commercial purposes under the definition of scientific research. The definition inserted by clause 2 includes the clarification that processing for scientific research carried out as a commercial activity can be considered processing for scientific research purposes. Parts of the research community asked for that clarification in response to our consultation. It reflects the existing scope, as is already clear from the ICO’s guidance, and we have seen that research by commercial bodies can have immense societal value. For instance, research into vaccines and life-saving treatments is clearly in the public interest. I entirely understand the hon. Lady’s concern for children’s privacy, but we think that her amendment could obstruct important research by commercial organisations, such as research into children’s diseases. I think that the Information Commissioner would make it clear as to whether or not the kind of example that the hon. Lady gave would fall within the definition of research for scientific purposes.

I also entirely understand the concern expressed by my hon. Friend the Member for Folkestone and Hythe. I suspect that the question about the sharing of data internationally, particularly, perhaps, by TikTok, may recur during the course of our debates. As he knows, we would share data internationally only if we were confident that it would still be protected in the same way that it is here, which would include considering the possibility of whether or not it could then be passed on to a third country, such as China.

I hope that I can reassure the hon. Lady that emphasising the safeguards that researchers must comply with in clause 22 to protect individuals relates to all data used for these purposes, including children’s data and the protections afforded to children under the UK GDPR. For those reasons, I hope that she will be willing to withdraw her amendment.

--- Later in debate ---

[Damian Collins]

Will my right hon. Friend confirm whether the Information Commissioner’s advice will be published, either by the commissioner, the Minister or Parliament—perhaps through the relevant Select Committee?

[Sir John Whittingdale]

I am not sure it would necessarily be published. I want to confirm that, but I am happy to give a clear response to the Committee in due course if my hon. Friend will allow me.

As well as the advice that the Information Commissioner supplies, the proposal is also subject to the affirmative procedure, as the hon. Member for Barnsley East recognised, so Parliament could refuse to approve any additions to the list that do not respect the rights of data subjects. She suggested that it is rare for an affirmative resolution to be rejected by Parliament; nevertheless, it is part of our democratic proceedings, and every member of the Committee considering it will have the opportunity to reach their own view and vote accordingly. I hope that reassures the hon. Lady that there are already adequate safeguards in place in relation to the exercise of powers to add new activities to the list of recognised legitimate interests.

Amendment 67, which the hon. Lady also tabled, would require data controllers to publish a statement if they are relying on the new recognised legitimate interests lawful ground. The statement would have to explain what processing would be carried out in reliance on the new lawful ground and why the processing is proportionate and necessary for the intended purpose. In our view, the amendment would significantly weaken the clause. It would reintroduce something similar to the legitimate interests assessment, which, as we have heard, can unnecessarily delay some very important processing activities. In scenarios involving national security or child protection, for example, the whole point of the clause is to make sure that relevant and necessary personal data can be shared without hesitation to protect vulnerable individuals or society more generally.

I hope the hon. Lady is reassured by my response and agrees to withdraw her amendments. I commend clause 5 to the Committee.

--- Later in debate ---

[Damian Collins]

The principle that underpinned what happened in the Cambridge Analytica scandal was the connection of Facebook profiles to the electoral register. If I understand my right hon. Friend the Minister correctly, what he is talking about would not necessarily change that situation. This could be information that the political campaign has gained anyway from a voter profile or from information that already exists in accounts it has access to on platforms such as Facebook; it would simply be attaching that, for the purposes of targeting, to people who voted in an election. The sort of personal data that Members of Parliament hold for the purposes of completing casework would not have been processed in that way. These proposals would not change in any way the ability to safeguard people’s data, and companies such as Cambridge Analytica will still seek other sources of open public data to complete their work.

[Sir John Whittingdale]

I think my hon. Friend is right. I have no doubt that we will go into these matters in more detail when we get to those provisions. As the hon. Member for Barnsley East knows, this measure makes a very narrow change to simply extend the existing time limit within which there is protection for elected representatives to conclude casework following a general election. As we will have opportunity in due course to look at the democratic engagement exemption, I hope she will be willing to support these narrow provisions.

--- Later in debate ---

[Damian Collins]

Does my right hon. Friend agree that the provisions will be helpful and important for organisations that gather data about public persons, and particularly oligarchs, who are very adept at using subject access requests to bombard and overwhelm a journalist or a small investigatory team that is doing important work looking into their business activities?

[Sir John Whittingdale]

I completely agree with my hon. Friend. That is an issue that both he and I regard as very serious, and is perhaps another example of the kind of legal tactic that SLAPPs—strategic lawsuits against public participation—represent, whereby oligarchs can frustrate genuine journalism or investigation. He is absolutely right to emphasise that.

It is important to highlight that controllers can already consider resource when refusing or charging a reasonable fee for a request. The Government do not wish to change that situation. Current ICO guidance sets out that controllers can consider resources as a factor when determining if a request is excessive.

The new parameters are not intended to be reasons for refusal. The Government expect that the new parameters will be considered individually as well as in relation to one another, and a controller should consider which parameters may be relevant when deciding how to respond to a request. For example, when the resource impact of responding would be minimal even if a large amount of information was requested—such as for a large organisation—that should be taken into account. Additionally, the current rights of appeal allow a data subject to contest a refusal and ultimately raise a complaint with the ICO. Those rights will not change with regard to individual rights requests.

Amendment 74 proposes adding more detail on the obligations of a controller who refuses or charges for a request from a data subject. The current legislation sets out that any request from a data subject, including subject access requests, is to be responded to. The Government are retaining that approach and controllers will be expected to demonstrate why the provision applies each time it is relied on. The current ICO guidance sets out those obligations on controllers and the Government do not plan to suggest a move away from that approach.

The clause also states that it is for the controller to show that a request is vexatious or excessive in circumstances where that might be in doubt. Thus, the Government believe that the existing legislation provides the necessary protections. Following the passage of the Bill, the Government will work with the ICO to update guidance on subject access requests, which we believe plays an important role and is the best way to achieve the intended effect of the amendments. For those reasons, I will not accept this group of amendments; I hope that the hon. Member for Barnsley East will be willing to withdraw them.

I turn to clause 7 itself. As I said, the UK’s data protection framework sets out key data subject rights, including the right of access—the right for a person to obtain a copy of their personal data. A subject access request is used when an individual requests their personal data from an organisation. The Government absolutely recognise the importance of the right of access and do not want to restrict that right for reasonable requests.

The existing legislation enables organisations to refuse or charge a reasonable fee for a request when they deem it to be “manifestly unfounded or excessive”. Some organisations, however, struggle to rely on that in cases where it may be appropriate to do so, which as a consequence impacts their ability to respond to reasonable requests.

The clause changes the legislation to allow controllers to refuse or charge a reasonable fee for a request that is “vexatious or excessive”. The clause adds parameters for controllers to consider when relying on the “vexatious or excessive” exemption, such as the nature of the request and the relationship between the data subject and the controller. The clause also includes examples of the types of request that may be vexatious, such as those intended to cause distress, those not made in good faith or those that are an abuse of process.

We believe that the changes will give organisations much-needed clarity over when they can refuse or charge a reasonable fee for a request. That will ensure that controllers can focus on responding to reasonable requests, as well as other important data and organisational needs. I commend the clause to the Committee.

Data Protection and Digital Information (No. 2) Bill (Second sitting)

Debate between John Whittingdale and Damian Collins

Committee stage
Wednesday 10th May 2023 Public Bill Committees

[Sir John Whittingdale]

Q Can you say a little about the extent to which you have been a contributor to the design of the new provisions in the Bill and whether you are happy with the outcome of that?

Jonathan Sellors: The short answer would be yes. I was contacted by NHS England about the wording of some of the consent aspects, some of the research aspects and particularly some of the pseudonymisation aspects, because that is an important wall. Most research conducted is essentially on pseudonymised rather than identifiable data. The way it has been worded and clarified, because it makes an incremental improvement on what is already there in the GDPR, is very useful. I think it is a good job.

Tom Schumacher: Yes, I would say the same. NHS Transformation and the Department for Culture, Media and Sport, particularly Owen Rowland and Elisabeth Stafford, have been very willing to hear points of view from industry and very proactive in reaching out for our feedback. I feel like the result reflects that good co-ordination.

[Damian Collins (Folkestone and Hythe) (Con)]

Q Do you think the definition of what public health means in the context of the Bill is clear?

Jonathan Sellors: Yes, I think it is reasonably clear.

--- Later in debate ---

[Sir John Whittingdale]

Q Moving on to the digital identity provisions, clearly some people are already familiar with this, but there is still a degree of suspicion. To what extent do you think that the consumer needs persuasion about the security and the benefits of digital identity services? Do you see that as being addressed by the provisions in the Bill?

Harry Weber-Brown: That is a very good question. I did quite a lot of consumer research in my previous capacity, and consumers are initially quite sceptical, asking “Why are you asking me for identity details and things?” You have to explain fully why you are doing that. Certainly having Government support and things like the trust framework and a certification regime to make sure that the consumer knows whom they are dealing with when they are passing over sensitive data will help to build the trust to ensure that consumers will utilise this.

The second part to that is what types of services are built on top of the identity system. If I have the identity verified to an AML—anti-money laundering—standard for financial services, I could use it for a whole suite of other types of activity. That could be the purchase of age-restricted products, or sharing data with my independent financial adviser; it could reduce fraud in push payments, and so on. There is a whole suite of different types of services; you would not be using it just for onboarding. I think the Government support of this under digital verification services, part 2 of the Bill, is critical to make sure it happens.

It is opt-in. We are not saying to people that they have to get an identity card, which obviously is not hugely popular; but if we can demonstrate the value of having a digital identity, with support and trust—with the trust framework and certification with Government—we will not necessarily need to run a full marketing campaign to make sure that consumers use this.

Look at other territories—for example, Norway with Vipps, or Sweden’s BankID. I think about 98% of the population now use ID in a digital format; it is very commonplace. It is really a question of looking at the use cases—examples of how the consumer could utilise this—and making sure they receive utility and value from the setting up and the utilisation of the ID. The ID by itself is not necessarily compelling enough; the point is what you can use it for.

Phillip Mind: Trust and acceptance are key issues, and the Bill lays the legislative foundations for that. We already assert our identity digitally when we open accounts, but we do so on a one-off basis. The challenge is to go from doing so on a one-off basis to creating a digital token that is safe and secure and that allows us to reuse that digital identity. For that to work, that token has to be widely accepted, and that is a really complex strategic challenge, but the Bill lays the foundations.

We will transact digitally more and more; that is for sure. At the moment, we have a consultation, from the Treasury and the Bank of England, on a central bank digital currency. Arguably, that would benefit hugely from a reusable digital identity, but we need to be able to create the token in the right way. It could be enabling for people who have access to a smartphone but do not have a passport or driving licence; it could also build inclusion, in terms of identity. So we are very supportive of a reusable digital identity, but it is a big challenge, and the challenge is gaining trust and acceptance.

[Damian Collins]

Q Mr Weber-Brown, you in particular have spoken about the consumer benefits of data sharing—having a wider choice of products and services. What do you see as the principal business benefits for financial service providers? How wide would you like the scope of their access to data to be?

Harry Weber-Brown: Financial services obviously rely heavily on data to be able to fashion their products accordingly and make them personal, so I think it is critical to have a smart data regime where everything is collected in a single format—what is known as an API, an application programming interface, which is a common way of securely sharing data.

Some of the other use cases from smart data that would benefit business would be things like sharing data around fact find. For example, if someone wants to instruct an independent financial adviser, could they not use this as a way of speeding up the process, rather than having to wait on letters of authority, which are written and take time? Similarly, with pension providers, if I wanted to move from one pension to another or to consolidate things, could we use the smart data to get an illustration of what impact that might have, so that before I ported it over I could see that?

For big financial services firms—well, for all of them—efficiencies are delivered because, as my colleague said, we are using digital as opposed to having to rely on manual processing. As long as the safeguards are put in place, that spawns a whole array of different types of use case, such as with regulatory reporting. If I need to report things to the regulator, could I use smart data provision to do that? That would benefit businesses. A lot of the financial services industry still relies on reporting on Excel spreadsheets and CSV files, so if we can digitise that, it would certainly make it a much more efficient economy.

--- Later in debate ---

[Sir John Whittingdale]

Q So would you expect that as a result of the Bill, the bar to obtain certification will be higher?

Keith Rosser: Yes. The requirement on DVSs to tackle fraud should be higher than it currently is.

[Damian Collins]

Q I want to follow on from the Minister’s questions. Looking at other legislation that is going through Parliament, particularly the anti-fraud provisions in the Online Safety Bill, one of the important areas is the extent to which regulators should expect companies to have good upstream solutions in place to combat fraud. Rather than chasing every example that they come across, they need things that block it in the first place. Do you see the provisions in this Bill as being helpful? Would you expect regulators to act on that and to direct companies to use systems that are known to be safe?

Keith Rosser: Absolutely. I will give a quick example relating to the Online Safety Bill and hiring, which I am talking about. If you look at people getting work online by applying through job boards or platforms, that is an uncertified, unregulated space. Ofcom recently did research, ahead of the Online Safety Bill, that found that 30% of UK adults have experienced employment scams when applying for work online, which has a major impact on access to and participation in the labour market, for many reasons.

Turning the question the other way around, we can also use that example to show that where we do have uncertified spaces, the risks are huge, and we are seeing the evidence of that. Specifically, yes, I would expect the governance body or the certification regime, or both, to really put a requirement on DVSs to do all the things you said—to have better upstream processes and better technology.

Also, I think there is a big missing space, given that we have been live with this in hiring for eight months, to provide better information to the public. At the moment, if I am a member of the public applying for a job and I need to use my digital identity, there is no information for me to look at, unless the employer—the end user—is providing me with something up front. Many do not, so I go through this process without any information about what I am doing. It is a real missed opportunity so far, but now we can right that to make sure that DVSs are providing at least basic information to the public about what to do, what not to do, what questions to ask and where to get help.

--- Later in debate ---

[Sir John Whittingdale]

Q On a separate issue, at the moment we have a range of bodies responsible for different aspects of surveillance, such as the Biometrics Commissioner, the Investigatory Powers Commissioner and the Surveillance Camera Commissioner. Those are being brought together into either the Information Commissioner or the Investigatory Powers Commissioner. To what extent do you think that will improve the overall oversight of surveillance?

Aimee Reed: Policing thinks that that will significantly simplify things. It will not reduce the level of oversight and scrutiny that will be placed upon us, which is the right thing to do. In terms of the simplicity of that and the regimes that we are under, we are very supportive of that change.

Helen Hitching: Likewise, we are supportive and welcome the simplification. We do note, however, that the Biometrics Commissioner currently has a keen focus on developing technology in a legal manner and consults with the public. We would ask that there remains a focus on that oversight of biometrics, to assure the public that that work remains a priority once the regulation of biometrics transfers to the Information Commissioner’s Office and to make sure that that focus is retained.

[Damian Collins]

Q How easy do you find it to gather data as part of investigations at the moment, particularly if you are working with companies that provide services to individuals? Do you think the provisions in the Bill will make that any easier?

Aimee Reed: On balance, it will make things easier. We are retaining the very different sections of the Act under which different organisations operate, and the sections that look to improve joint working across part 3 and part 4 agencies are very welcome. At the moment that is not about simplifying the relationships between those in, say, part 2 and part 3, albeit data sharing is entirely possible. In essence, it is going to get simpler and easier to share data, but without losing any of the safeguards.

--- Later in debate ---

[Sir John Whittingdale]

Q May I ask a relatively simple question? Obviously your concern is the protection of workers’ rights, and safeguards against discrimination and other potential adverse consequences of technology. We will debate the provisions of the Bill in those areas in the coming weeks—I suspect at some length—but would you nevertheless accept that the overall impact of the legislation, if we get this right, will be beneficial to your members in terms of the promotion of growth and potential future job opportunities?

Andrew Pakes: “If we get this right” is doing a lot of heavy lifting there; I will leave it to Members to decide the balance. That should be the goal. There is a wonderful phrase from the Swedish trade union movement that I have cited before: “Workers should not be scared of the new machines; they should be scared of the old ones.” There are no jobs, there is no prosperity and there is no future for the kind of society that our members want Britain to be that does not involve innovation and the use of new technology.

The speed at which technology is now changing and the power of this technology compared with previous periods of economic change make us believe that there has to be a good, robust discussion about the balances of checks and balances in the process. We have seen in larger society—whether through A-level results, the Post Office or other things—that the detriment is significant on the individuals impacted if legislators get that balance wrong. I agree with the big principle and I will leave you to debate that, but we would certainly urge that checks and balances need to be balanced, not one-sided.

Mary Towers: Why does respect for fundamental rights have to be in direct conflict with growth and innovation? There is not necessarily any conflict there. Indeed, in a workplace where people are respected, have dignity at work and are working in a healthy way, that can only be beneficial for productivity and growth.

[Damian Collins]

Q I have been listening carefully to what you have been saying and it strikes me that there are two issues: the use of technology in the general workplace, and the rights of workers who work through technology to do their jobs. In the workplace itself, data gathering and analysis has always existed to some extent. If we were having this conversation in the 1960s, we would have been talking about people doing time-motion studies of people in factories to work out what efficiency looked like. Is your concern in respect of a general working environment that employers are transparent about what sort of data they gather and how they use it?

Andrew Pakes: That is the first base. The power of technology is changing so quickly, and the informal conversations we have every day with employers suggest that many of them are wrestling with the same questions that we are. If we get this legislation right, it is a win-win when it comes to the question of how we introduce technology in workspaces.

You are right to identify the changing nature of work. We would also identify people analytics, or the use of digital technology to manage people. How we get that right is about the balance: how do you do it without micromanaging, without invading privacy, without using technology to make decisions without—this is a horrible phrase, but it is essentially about accountability—humans in the loop? Good legislation in this area should promote innovation, but it should also have due regard to balancing how you manage risks and reduce harms. That is the element that we want to make sure comes through in the legislation in its final form.

Oral Answers to Questions

Debate between John Whittingdale and Damian Collins

Thursday 20th October 2022 Commons Chamber

[Sir John Whittingdale (Maldon) (Con)]

7. What steps her Department is taking to increase the transparency and accountability of technology platforms.

[The Parliamentary Under-Secretary of State for Digital, Culture, Media and Sport (Damian Collins)]

The Government are driving forward a digital regulatory approach that unlocks growth and boosts trust. As part of that, we are taking steps to improve transparency and accountability, including through the Online Safety Bill; data protection legislation that maintains rules for responsible usage; and digital markets legislation, which will promote competition in digital markets.

[Sir John Whittingdale]

Does my hon. Friend share my concern at the recent behaviour of PayPal in arbitrarily removing certain accounts of campaigning and journalistic organisations without any warning or explanation? Will he consider how the Online Safety Bill can give greater protection for free speech by increasing the accountability of PayPal, Facebook and the other giant tech platforms?

[Damian Collins]

Absolutely. I agree with my right hon. Friend: it is really important that big tech platforms are transparent and accountable to their users in their terms of service for how they trade. That is important in the principle of how the Online Safety Bill works, both in protecting freedom of speech and in ensuring that companies enforce their platform policies correctly. In terms of digital markets, it is also important that customers know what fair access they have to markets and that they will be treated fairly by platforms, and that the platforms make clear what their terms of service are.

BBC

Debate between John Whittingdale and Damian Collins

Tuesday 21st July 2020 Commons Chamber

[Mr Whittingdale]

I sympathise with the right hon. Gentleman. It was of course as a result of the most recent charter renewal that we now know how many people in the BBC are paid over £150,000 per year and who they are. But there will always be scope for change. If his constituents have complaints about political bias or any other content, I would encourage them to proceed those with the BBC and ultimately Ofcom. I can assure him that when we consider the long-term future, the licence fee will very much be a part of that consideration.

[Damian Collins (Folkestone and Hythe) (Con) [V]]

Many of my older constituents will be facing the double blow of being asked to pay more for the BBC while seeing the programmes they value the most and regional news cut back. Is it not time, and should it not be part of the charter review, to ask what licence fee payers want to see? Is it right that regional news programmes should face such a disproportionate burden of cost savings at the BBC?

[Mr Whittingdale]

As I indicated earlier, I am concerned at the extent of the reductions taking place in the regional programming budget. I do not think that savings should be spread equally, and there are other areas where greater savings could have been found. That is something we will continue to discuss with the BBC. I hope that the incoming director-general will also have a look right across the board to see what savings can be made and what areas to prioritise.