Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

2nd reading
Tuesday 19th November 2024 Lords Chamber

[Lord Arbuthnot of Edrom (Con)]

My Lords, it is always rather daunting following the noble and learned Lord, Lord Thomas. I think the safest thing to say, which has the added benefit of being true, is that I agreed with him.

I declare my interests as set out in the register, in particular that I am a member of the Horizon Compensation Advisory Board and the chair of the advisory panel of Thales UK, which makes the British passport. As the noble Lord, Lord Knight, said, this Bill is a wonderful opportunity to talk about everything that is not in it and to discuss further measures that could be included. The noble Baroness, Lady Kidron, mentioned the amendment she moved on 24 April to the predecessor Bill, designed to deal with the presumption that computer evidence is reliable, despite the fact that we all know that it is not. We shall need to come to that presumption in Committee.

I supported the amendment from the noble Baroness in Committee earlier this year, although I accept—as I think she does—that simply returning to the position as it was in 1999, before the presumption existed, may not be the best solution. We need some method, for example, of accepting that breathalysers, on the whole, work as they are intended to do, and that emails, on the whole, work as they are intended to do, and we should not have to get a certificate of accuracy from Microsoft before every trial.

The need to find a solution to the problems so brutally exposed by the Post Office scandal is urgent. In the Post Office cases, in essence, the proper burden of proof was reversed and hearsay evidence that was false was accepted as gospel truth. As a result of Horizon and the appalling human behaviour that accompanied it, the lives of hundreds, perhaps thousands, of postmasters were ruined and the UK and Fujitsu are going to have to pay billions in compensation. So this matter is urgent.

The solution may be, as Alistair Kelman has recommended, a set of seven or so detailed statements setting out what has been done to ensure that the computer evidence is reliable. It may be, as a senior and highly respected judge has recommended, a division between complex cases, such as those involving a system such as Horizon, and simple cases, such as those involving breathalysers and emails, with more stringent evidentiary requirements for the complex cases. It may be, as Professor Steven Murdoch has suggested, that documents designed to test the reliability of computer systems should be made available to the other side and be subject to challenge. It may be something else, but this Bill is an opportunity to consider, examine and test those solutions, and another such opportunity may not come along quickly. I repeat: this matter is urgent.

On a different matter, Part 2 of the Bill establishes a regulatory framework for the provision of digital verification services in the UK. We need to be clear that having a clear and verifiable digital identity is a completely different matter from going down the route of identity cards. This is not an identity card Bill. It is an essential method of establishing, if you want or need to have a digital identity, that you are who you say you are and you have the attributes that you say you have. It is a way of establishing relevant facts about yourself without having to produce gas bills. I do not know about other noble Lords, but I find producing gas bills rather tricky now that they are almost all online.

Sometimes the fact you need to establish will be age: to establish that you are allowed to drink or to drive, or that you are still alive, or whatever. Sometimes it will be your address; sometimes it will be your sex. We do not want men going to women’s prisons, nor men who identify as women working in rape crisis centres. Sex is an issue on which it is necessary to have some degree of factual clarity in those circumstances where it matters. The Bill, again, is an opportunity to ensure that this factual clarity exists in the register of births. It will then be for the individual to decide whether to share the information about their sex, age, or whatever.

An organisation called Sex Matters—I am grateful for the briefing—issued a report yesterday pointing out that, at the moment, data verification services are not authoritative, in that they allow people to change their official records to show them as the opposite sex on request. One consequence is that, for example, transgender people risk being flagged up as a synthetic identity risk and excluded, for example, from banking or travel. Another is that illnesses may be misdiagnosed or that medical risks may fail to be identified.

So this Bill is a rare opportunity to put right some things that currently need to be addressed. Those of us speaking today have received a number of helpful briefings from organisations interested in various issues: I have mentioned only a couple. I hope we will take the opportunity given to us by the Bill to take on board several of those proposals.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Committee stage
Tuesday 3rd December 2024 Grand Committee

[The Deputy Chairman of Committees (Baroness McIntosh of Hudnall) (Lab)]

My Lords, Amendment 5 is in the name of the noble Lord, Lord Lucas, whom I do not see with us. Would the noble Lord, Lord Arbuthnot, like to move it on his behalf?

[Lord Arbuthnot of Edrom (Con)]

I am grateful. I do not know about the amendment in the name of the noble Lord, Lord Lucas, but I wonder whether I might speak to Amendments 34 and 48.

[The Deputy Chairman of Committees (Baroness McIntosh of Hudnall) (Lab)]

Would the noble Lord be prepared to move Amendment 5 first? He need not necessarily speak to it at any length. That said, the noble Lord, Lord Lucas, is now with us, so the problem is solved.

Amendment 5

--- Later in debate ---

[Lord Arbuthnot of Edrom (Con)]

My Lords, I am pleased that my noble friend Lord Lucas managed to make it, because I found him extremely persuasive and I agree with what he said. I shall return to the issue that his second amendment dealt with—namely, the issue of sex. I thank the organisation Sex Matters for its briefing on Amendments 34 and 48. I am not sure why there are no explanatory notes to these but I referred to the point in my speech at Second Reading, and I hope I will be able to explain it adequately now.

The core aim of the digital verification system that we are legislating for is to enable people to prove who they are and to provide information about themselves. The reason this system of digital identity can be trusted with our data, our safety and our personal and economic lives is that the information it contains comes from authoritative sources. It draws on information in my passport or my driving licence, which itself comes from information on my birth certificate, which itself is a certified copy of the entry on the birth register, which before that came from the information recorded at the hospital where I was born. Actually, I was born at home; nevertheless, the issue remains true.

However, if the chain of integrity of data is broken, the system of digital verification is no longer trustworthy. The Bill contains provision to secure the reliability of digital verification services by means of a carefully constructed framework, a register of providers, an information gateway and a trust mark, but there is a flaw, which my noble friend has referred to, and it has been pointed out by the human rights charity Sex Matters. The digital verification system that has recently been published in its gamma edition, after several years of development, assumes that government sources are reliable and accurate, but, when it comes to the attribute of sex—whether someone is male or female—we know that those records are not accurate or reliable.

--- Later in debate ---

Moved by

[Lord Arbuthnot of Edrom]

7: Clause 3, page 5, line 28, at end insert—
(f) provision requiring that third party recipients of customer data publish regular statements on their cyber resilience against specified standards and outcomes.”Member’s explanatory statement
This amendment would give the Secretary of State or the Treasury scope to introduce requirements on third party recipients of customer data to publish regular statements on their cyber resilience against specified standards and outcomes.

[Lord Arbuthnot of Edrom (Con)]

My Lords, Amendment 7, the first in this group is a probing amendment and I am extremely grateful to ISACA, an international professional association focused on IT governance, for drafting it. This amendment

“would give the Secretary of State or the Treasury scope to introduce requirements on third party recipients of customer data to publish regular statements on their cyber resilience against specified standards and outcomes”.

Third parties play a vital role in the modern digital ecosystem, providing businesses with advanced technology, specialised expertise and a wide range of services, but integrating third parties into business operations comes with cyber risks. Their access to critical networks and all the rest of it can create vulnerabilities that cyber- criminals exploit. Third parties are often seen as easier targets, with weaker security measures or indirect connections serving as gateways to larger organisations.

Further consideration is to be given to the most effective means of driving the required improvements in cyber risk management, including, in my suggestion, making certain guidance statutory. This is not about regulating and imposing additional cost burdens, but rather creating the environment for digital trust and growth in the UK economy, as well as creating the right conditions for the sustainable use of emerging technologies that will benefit us all. This is something that leading associations and groups such as ISACA have been arguing for.

The Cyber Governance Code of Practice, which the previous Administration introduced, marks an important step towards improving how organisations approach cybersecurity. Its primary goal is to ensure that boards of directors should take their proper responsibility in mitigating cyber risks.

While that code is a positive development, compliance is not legally required, which leaves organisations to decide whether to put their priorities elsewhere. As a result, the code’s effectiveness in driving widespread improvements in cyber resilience will largely depend on their organisation’s willingness to recognise its importance. The amendment would require businesses regularly to review and update their cybersecurity strategies and controls, and to stay responsive to evolving threats and technologies, thereby fostering a culture of continuous improvement. In addition, by mandating ongoing assessments of internal controls and risk-management processes, organisations will be better able to anticipate emerging threats and enhance their ability to detect, prevent and respond to cyber incidents. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, this is a fairly disparate group of amendments. I am speaking to Amendments 8, 9, 10, 24, 30, 31 and 32. In the first instance, Amendments 8, 9, 10 and 30 relate to the question that I asked at Second Reading: where is the ambition to use the Bill to encourage data sharing to support net zero?

The clean heat market mechanism, designed to create a market incentive to grow the number of heat pumps installed in existing premises each year, is set to be introduced after being delayed a year due to backlash from the boiler industry. If government departments and partners had access to sales data of heating appliances, there would be a more transparent and open process for setting effective and realistic targets.

I have been briefed by Ambient, a not-for-profit organisation in this field. It says that low visibility of high power-consuming assets makes it challenging to maintain grid stability in a clean-power world. Low visibility and influence over future installations of high power-consuming assets make it difficult to plan for grid updates. Inability to shift peak electricity demand leads to higher capacity requirements with associated time and cost implications. Giving the Government and associated bodies access to utility-flexible tariff data would enable the Government and utilities to work together to increase availability and uptake of tariffs, leading to lower peak electricity demand requirements.

Knowing which homes have the oldest and least efficient boilers, and giving public sector and partners access to the Gas Safe Register and CORGI data on boiler age at household level, would mean that they could identify and target households and regions, ensuring that available funds go to those most in need. Lack of clarity on future clean heating demand makes it challenging for the industry to scale and create jobs, and to assess workforce needs for growing electricity demand. Better demand forecasting through access to sales data on low-carbon heating appliances would signal when and where electrification was creating need for workforce expansion in grid management and upgrade, as well as identify regional demand for installers and technicians.

The provisions of Part 1 of the Bill contain powers for the Secretary of State to require the sharing of business data to customers and other people of specified description. It does not indicate, however, that persons of specified description could include actors such as government departments, public bodies such as NISO and GB Energy, and Ministers. An expanded list of suggested recipients could overcome this issue, as stated in Amendment 9 in my name. It makes no provision for the format of information sharing—hence, my Amendments 8 and 10.

In summary, my questions to the Minister are therefore on: whether it has been considered how the primary legislation outlined in the Bill could be exercised to accelerate progress towards clean power by 2030; whether climate missions such as clean power by 2030 or achieving net zero are purposes “of a public nature” in relation to the outline provisions for public bodies; and whether specifying the format of shared business data would enable more efficient and collaborative use of data for research and planning purposes.

Coming on to Amendments 24, 31 and 32, the Bill expands the potential use of smart data to additional public and private sector entities, but it lacks safeguards for sensitive information regularly used in court. It makes specific provision for legal privilege earlier in the Bill, but this is not extended in provisions relating to smart data. I very much hope that the Government will commit to consult with legal professions before extending smart data to courts.

Many of us support open banking, but open banking is being used, as designed, by landlords to keep watching tenant bank accounts for months after approving their tenancy. Open banking was set up to enhance inter- operability between finance providers, with the most obvious example being the recent new ability of the iPhone wallet app to display balances and recent transactions from various bank accounts.

Open banking approval normally lasts six months. While individual landlords may not choose this access, if given a free choice, the service industry providing the tenant-checking service to landlords is strongly incentivised to maximise such access, otherwise their competitors have a selling point. If open banking is to be added to the statute book, the Bill should mandate that the default time be reduced to no more than 24 hours in the first instance, and reconfirmed much more often. For most one-off approval processes, these access times may be as short as minutes and the regulations should account for that.

Coming on to Amendment 31, consumers have mixed feelings about the potential benefits to them of smart data schemes, as shown in polling such as that carried out a couple of years ago by Deltapoll with the CDEI, now the Responsible Technology Adoption Unit, as regards the perceived potential risks versus the benefits. Approximately one-quarter of respondents in each case were unsure about this trade-off. Perhaps unsurprisingly, individuals who said that they trusted banks and financial institutions or telecommunications providers were more likely to support open finance and open communications, and customers who had previous experience of switching services more frequently reported believing that the benefits of smart data outweighed the risks.

Is it therefore the Government’s expectation that people should be compelled to use these services? Open banking and imitators can do a great deal of good but can also give easy access to highly sensitive data for long periods. The new clause introduced by Amendment 31 would make it the same criminal offence to compel unnecessary access under these new provisions as it already is to compel data provision via subject access requests under the existing Data Protection Act.

Amendment 32 is a probing amendment as to the Government’s intentions regarding these new smart data provisions. In the Minister’s letter of 27 November, she said:

“The Government is working closely to identify areas where smart data schemes might be able to bring benefits. We want to build on the lessons learned from open banking and establish smart data schemes in other markets for goods and services.”


I very much hope that the Minister will be able to give us a little taste of what she thinks these powers are going to be used for, and in what sectors the Government believe that business can take advantage of these provisions.

--- Later in debate ---

[Baroness Jones of Whitchurch (Lab)]

The noble Lord is tempting me. What I would say is that, once this legislation is passed, it will encourage departments to look in detail at where they think smart data schemes can be applied and provide a useful service for customers and businesses alike. I know that one issue that has been talked about is providing citizens with greater information about their energy supplies—the way that is being used and whether they can use their energy differently or find a different supplier—but that is only one example, and I do not want people to get fixated on it.

The potential is enormous; I feel that we need to encourage people to think creatively about how some of these provisions can be used when the Bill is finally agreed. There is a lot of cross-government thinking at the moment and a lot of considering how we can empower citizens more. I could say a lot off the top of my head but putting it on the record in Hansard would probably be a mistake, so I will not be tempted any more by the noble Lord. I am sure that he can write to me with some suggestions, if he has any.

[Lord Arbuthnot of Edrom (Con)]

My Lords, one problem with cybersecurity is the fact that, if one company is spending money on it but is worrying that its competitor companies are not, they might feel that an element of compulsion would be helpful. I just raise that with the Minister, who suggests that some of these things might be better in the cybersecurity and resilience Bill. My noble friend Lady Neville-Jones and I think she is right, so I beg leave to withdraw my amendment.

Amendment 7 withdrawn.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Committee stage
Wednesday 18th December 2024 Grand Committee

[Lord Kirkhope of Harrogate (Con)]

My Lords, following on from what I said on earlier amendments, this is worse than what the noble Lord, Lord Clement-Jones, has just expressed. Indeed, I fully support the amendments of my noble friend Lord Holmes. However, this just demonstrates, yet again, that unless we pull ourselves together, with better smart legislation that moves faster, we will never ever catch up with developments in technology and AI. This has been demonstrated dramatically by these amendments. I express concerns that the Government move at a pace that government always moves at, but in this particular field it is not going to work. We are going to be disadvantaged and in serious trouble, unless we can move a bit faster.

[Lord Arbuthnot of Edrom (Con)]

My Lords, I rise briefly but strongly to support my noble friend Lord Holmes. The CyberUp campaign has been banging this drum for a long time now. I remember taking part in the debates in another place on the Computer Misuse Act 34 years ago. It was the time of dial-up modems, fax machines and bulletin boards. This is the time to act, and it is the opportunity to do so.

[Lord Clement-Jones (LD)]

My Lords, we ought to be mindful and congratulate the noble Lord on having been parliamentarian of the year as a result of his campaigning activities.

[Lord Arbuthnot of Edrom (Con)]

My Lords, it has taken 34 years.

[Lord Bethell (Con)]

My Lords, I rise to make a brief but emphatic comment from the health constituency. We in the NHS have been victims of appalling cyber- hacking. The pathology labs in south London were hacked and that cost many lives. It is an example of where the world is going in the future unless we act promptly. The emphatic call for quick action so that government keeps up with world changes is really well made. I ask the Minister to reflect on that.

--- Later in debate ---

[Lord Arbuthnot of Edrom (Con)]

My Lords, I shall speak very briefly. I have a great deal of agreement with what the noble Baroness, Lady Kidron, the noble Lord, Lord Russell, and my noble friend Lord Bethell have said. I am rising to nitpick; I apologise for that, but I suppose that is what Committee is for.

The final line of proposed new subsection (da), to be inserted by Amendment 198, refers to

“different characteristics including gender, race, ethnicity, disability, sexuality, gender”.

On our first day in Committee, I raised the importance of the issue of sex, which is different from gender or sexuality. We need to make sure that we get the wording of this amendment, if it were to be accepted by the Government, absolutely right.

[Lord Knight of Weymouth (Lab)]

My Lords, I shall also speak extremely briefly, as one of the three veterans of the Joint Committee present in Committee today, to reinforce my support for these amendments. The Government should be congratulated on Clause 123. It is welcome to see this movement but we want to see this done quickly. We want to ensure that it is properly enforceable, that terms of service cannot be used to obstruct access to researchers, as the noble Lord, Lord Bethell, said, and that there is proper global access by researchers, because, of course, these are global tech companies and UK users need to be protected through transparency. It is notable that, in the government consultation on copyright and AI published yesterday, transparency is a core principle of what the Government are arguing for. It is this transparency that we need in this context, through independent researchers. I strongly commend these amendments to the Minister.

--- Later in debate ---

I hope we will have a ministerial answer from the Dispatch Box that agrees to deal with this issue as a matter of urgency before Report, not one saying it is complicated. We know it is complicated, but for the postmasters, the nurses or anyone else whose life or livelihood has been taken or threatened by a bug, the status quo is unacceptable. Twenty-five years is too long for the law to assert something that is patently false. The MoJ has been looking at this issue in detail for more than five years and I have sought an urgent answer, along with the noble Lord, Lord Arbuthnot, for the past five months. If it is too complicated for the MoJ, I have a group of eminent lawyers and computer scientists who would happily do the task for it. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, I declare my interest as a member of the Horizon Compensation Advisory Board. When, on 24 April this year, the noble Baroness, Lady Kidron, proposed an amendment to remove the presumption about the reliability of computer evidence, the noble Baroness who is now the Minister added her name to it—oh the perils of moving from opposition to government.

My noble friend Lord Camrose—the Minister at the time—in a sympathetic speech, resisted that amendment on the basis, first, that there were shocking failures of professional duty in the Post Office case. This was quite true, but they were facilitated by the existence of the presumption. His second reason was that taking us back to the law of 1999, as the noble Baroness, Lady Kidron, eloquently set out just now, would risk undermining prosecutions because we would need to get certificates of accuracy in cases such as breathalysers and those involving emails. There may have been something in that, so the noble Baroness has proposed an amendment that is designed to get round that second point.

I suspect that the Minister will resist this amendment too, but for reasons that I hope she will set out clearly, because we may then decide to move a different amendment on Report. We are making all the running on this—or at least the noble Baroness, Lady Kidron, is, with my full support and, I know, that of the noble Lord, Lord Clement-Jones. I take a moment out of this Committee to pay tribute to their work ethic in this Committee, which has been quite phenomenal.

The Government do not seem to have the issue quite as close to the top of their priorities as we suggest. Without repeating all that I said on 24 April, I will summarise it as follows. Paul Marshall, the barrister, has pointed out that computer evidence is hearsay, with all the limitations that that implies. Modern computer programs are too large to be exhaustively tested. If computer programs are inherently unreliable, it is wrong to have a presumption that they are reliable. That issue will grow with the growth of artificial intelligence.

The presumption that computer evidence is reliable leads either to such things as we saw occur in the Post Office scandal, with the Post Office essentially taunting the sub-postmasters, saying, “If you can’t show us what is wrong with the computer evidence, we don’t have to show you that evidence”—a shocking case of Catch-22; or to lawyers and courts voluntarily abandoning the presumption and denigrating all computer evidence, whether or not it deserves to be denigrated. That might lead, for example, to some defendants being acquitted when the evidence would require that they be convicted. We are trying to help the Government find a way through a problem that they recognise and assert exists. Will they please give us some help in return? This is both serious and urgent. Just saying that it is very difficult does not begin the process of putting it right.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Report stage
Tuesday 21st January 2025 Lords Chamber

[Lord Arbuthnot of Edrom (Con)]

My Lords, I support my noble friend. I have a confession to make. Before this Bill came up, I foolishly thought that sex and gender were the same thing. I have discovered that they are not. Gender is not a characteristic defined in UK law. I believe that you are born with a biological sex, as being male or female, and that some people will choose, or need, to have a gender reassignment or to identify as a different gender. I thank the charity Sex Matters, which works to provide clarity on this issue of sex in law.

As my noble friend Lord Lucas said, the digital verification system currently operates on the basis of chosen gender, not of sex at birth. You can change your records on request without even having a gender recognition certificate. That means that, over the last five years, at least 3,000 people have changed their passports to show the wrong sex. Over the last six years, at least 15,000 people have changed their driving licences. The NHS has no records of how many people now have different sexes recorded from those they had at birth. It is thought that perhaps 100,000 people have one sex indicated in one record and a different sex in another. We cannot go on like that.

The consequences of this are really concerning. It means people with mismatched identities risk being flagged up as a synthetic identity risk. It means authorities with statutory safeguarding responsibilities will not be able to assess the risk that they are trying to deal with. It means that illnesses may be misdiagnosed and treatments misprescribed if the wrong sex is stated in someone’s medical records. The police will be unable to identify people if they are looking in the wrong records. Disclosure and Barring Service checks may fail to match individuals with the wrong sex. I hope that the Government will look again at correcting this. It is a really important issue.

[Lord Clement-Jones (LD)]

My Lords, I will speak to Amendments 7 and 9. Amendment 7 would require the Secretary of State to lay the DVS trust framework before Parliament. Given the volume of sensitive data that digital ID providers will be handling, it is crucial for Parliament to oversee the framework rules governing digital verification service providers.

The amendment is essentially one that was tabled in Committee by the noble Viscount, Lord Camrose. I thought that he expressed this well in Committee, emphasising that such a fundamental framework demands parliamentary approval for transparency and accountability, regardless of the document’s complexity. This is an important framework with implications for data privacy and security, and should not be left solely to the discretion of the Secretary of State.

The DPRRC in its ninth report and the Constitution Committee in its third report of the Session also believed the DVS trust framework should be subject to parliamentary scrutiny; the former because it has legislative effect, and it recommended using the affirmative procedure, which would require Parliament to actively approve the framework, as the Secretary of State has significant power without adequate parliamentary involvement. The latter committee, the Constitution Committee, said:

“We reiterate our statement from our report on the Data Protection and Digital Information Bill that ‘[d]ata protection is a matter of great importance in maintaining a relationship of trust between the state and the individual. Access to personal data is beneficial to the provision of services by the state and assists in protecting national security. However, the processing of personal data affects individual rights, including the right to respect for private life and the right to freedom of expression. It is important that the power to process personal data does not become so broad as to unduly limit those rights’”.


Those views are entirely consistent with the committee’s earlier stance on a similar provision in the previous Data Protection and Digital Information Bill. That was why it was so splendid that the noble Viscount tabled that amendment in Committee. It was like a Damascene conversion.

The noble Baroness, Lady Jones, argued in Committee and in correspondence that the trust framework is a highly technical document that Parliament might find difficult to understand. That is a bit of a red rag to a bull. However, this argument fails to address the core concerns about democratic oversight. The framework aims to establish a trusted digital identity marketplace by setting requirements for providers to gain certification as trusted providers.

I am extremely grateful to the Minister, the Bill team and the department for allowing officials to give the noble Viscount, Lord Camrose, and me a tutorial on the trust framework. It depends heavily on being voluntary in nature, with the UK Accreditation Service essentially overseeing the certifiers, such as BSI, Kantara and the Age Check Certification Scheme, certifying the providers, with the installation of ISO 17065 as the governing standard.

Compliance is assured through the certification process, where services are assessed against the framework rules by independent conformity assessment bodies accredited by the UK Accreditation Service, and the trust framework establishes rules and standards for digital identity verification but does not directly contain specific provision for regulatory oversight or for redress mechanisms such as a specific ombudsman service, industry-led dispute resolution or set contract terms for consumer redress or enforcement powers. The Government say, however, that they intend to monitor the types of complaints received. Ultimately, the scope of the framework is limited to the rules providers must follow in order to remain certificated and it does not address governance matters.

Periodic certification alone is not enough to ensure ongoing compliance and highlights the lack of an independent mechanism to hold the Secretary of State accountable. The noble Baroness, Lady Jones, stated in Committee that the Government preferred a light-touch approach to regulating digital verification services. She believed that excessive parliamentary scrutiny would hinder innovation and flexibility in this rapidly evolving sector.

The Government have consistently emphasised that they have no plans to introduce mandatory digital IDs or ID cards The focus is on creating a secure and trusted system that gives citizens more choice and control over their data. The attributes trust framework is a crucial step towards achieving the goal of a secure, trusted and innovative digital identity market—all the more reason to get the process for approval right.

These services will inevitably be high-profile. Digital ID is a sensitive area which potentially also involves age verification. These services could have a major impact on data privacy and security. Public debate on such a critical issue is crucial to build trust and confidence in these systems. Laying the DVS trust framework before Parliament would allow for a wider range of voices and perspectives to be heard, ensuring a more robust and democratic approval process.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

For the reasons that I have given, I think that the trust framework is a technical document and one best dealt with in this technical form. It is built on other assurance processes, with the United Kingdom Accreditation Service overseeing the conformity accreditation bodies that will test the digital verification services. In this case, our view is that it does not need to come under parliamentary scrutiny.

On Amendments 6 and 8 from the noble Lord, Lord Lucas, I am absolutely behind the notion that the validity of the data is critical. We have to get this right. Of course, the Bill itself takes the data from other sources, and those sources have authority to get the information correct, but it is important, for a digital service in particular, that this is dealt with very carefully and that we have good assurance processes.

On the specific point about gender identity, the Bill does not create or prescribe new ways in which to determine that, but work is ongoing to try to ensure that there is consistency and accuracy. The Central Digital and Data Office has started to progress work on developing data standards and key entities and their attributes to ensure that the way data is organised, stored and shared is consistent between public authorities. Work has also been commenced via the domain expert group on the person entity, which has representations from the Home Office, HMRC, the Office for National Statistics—importantly—NHS England, the Department for Education, the Ministry of Justice, the Local Government Association and the Police Digital Service. The group has been established as a pilot under the Data Standards Authority to help to ensure consistency across organisations, and specific pieces of work are going on relating to gender in that area.

The measures in Part 2 are intended to help secure the reliability of the process through which citizens can verify their identity digitally. They do not intervene in how government departments record and store identity data. In clarifying this important distinction, and with reference to the further information I will set out, I cannot support the amendments.

[Lord Arbuthnot of Edrom (Con)]

I would be grateful if the Minister could confirm whether he accepts that, on some occasions, passports and drivers’ licences inaccurately reflect the sex of their holders.

[Lord Vallance of Balham (Lab)]

I can be absolutely clear that we must have a single version of the truth on this. There needs to be a way to verify it consistently and there need to be rules. That is why the ongoing work is so important. I know from my background in scientific research that, to know what you are dealing with, data is the most important thing to get. Making sure that we have a system to get this clear will be part of what we are doing.

Amendment 6 would require the Secretary of State to assess which public authorities can reliably verify related facts about a person in the preparation of the trust framework. This exercise is out of scope of the trust framework, as the Good Practice Guide 45—a standard signposted in the trust framework—already provides guidance for assessing the reliability of authoritative information across a wide range of use cases covered by the trust framework. Furthermore, the public authorities mentioned are already subject to data protection legislation which requires personal data processed to be accurate and, where relevant, kept up to date.

Amendment 8 would require any information shared by public authorities to be clearly defined, accompanied by metadata and accurate. The Government already support and prioritise the accuracy of the data they store, and I indicated the ongoing work to make sure that this continues to be looked at and improved. This amendment could duplicate or potentially conflict with existing protections under data protection legislation and/or other legal obligations. I reassure noble Lords that the Government believe that ensuring the data they process is accurate is essential to deliver services that meet citizens’ needs and ensure accurate evaluation and research. The Central Digital and Data Office has already started work on developing data standards on key entities and their attributes to ensure that the way data is organised, stored and shared is consistent.

It is our belief that these matters are more appropriately considered together holistically, rather than by a piecemeal approach through diverse legislation such as this data Bill. As such, I would be grateful if noble Lords would consider withdrawing their amendments.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

There are many potential uses for generative AI—we are in a period of early exploration—but I ask the Minister to think long and hard before giving up the protection of creatives and innovators with respect to their ideas and their works in the service of the claims of need from generative AI manufacturers. We need to interrogate why they really need copyrighted works in their training sets, and what service they are really going to deliver as a result of having them. If it is a matter of technical difficulties around not being able to differentiate copyrighted works, that is a problem to be solved, not a reason for abandoning copyright protection. And the people who solve problems are the creatives—the people whose livelihoods are under threat.

[Lord Arbuthnot of Edrom (Con)]

My Lords, as a former Chief Whip, I am all too well aware of the dangers of listening to a debate. However, I have to tell my noble friend Lord Camrose that I have been persuaded by what I have heard so far, and I am afraid that he may have a great deal of work to do to persuade me not to vote for this amendment.

[Lord Cashman (Non-Afl)]

My Lords, I have reluctantly stayed out of this debate precisely because I am a copyright holder with copyrights stretching back over several decades. But, having listened to the noble Baroness, Lady Kidron, and others, it would be entirely wrong of me to remain silent.

I have to express deep concern and disbelief that the Labour Party of Jennie Lee and of Chris Smith is proposing such a way forward. You cannot on the one hand talk about the importance to every single member of our country—whether at school or going to the high arts of opera—of the importance of the creative industries, and then, with legislation, begin their demolition.

The Government’s approach is entirely wrong. Yes, they can strip away my rights. Indeed, only last week I received the huge sum of £1.76 for a performance. But that £1.76 represented a contract between an artist and someone who used the artist’s material. We are destroying that principle of contract.

These amendments seem sensible, rational and reasonable, and they open the door for the development of AI in exactly the same way as when, as one of the offices of the British Actors’ Equity Association in the early 1990s, we were tasked with negotiating with the BBC, ITV and Channel 4 on the brilliant and new innovation of cable and satellite. We negotiated in order to try to protect artists, some hugely successful and some not so successful. Those negotiations took two years—although we do not have two years now—and at the start of them we were told that we would never reach an agreement. We reached an agreement, which has been adapted and adopted for all other forms of the use of television and audio material.

Are the Government seriously telling us that we do not have the wit, intelligence or drive as a country to come to an adequate negotiation that protects copyright and advances AI? If they are seriously telling us that, I urge noble Lords to disregard it. I urge your Lordships most of all to vote not for the Elton Johns or the Paul McCartneys but for that one person who might be relying on that £1.76, and support these amendments.

--- Later in debate ---

[Lord Holmes of Richmond (Con)]

My Lords, in moving Amendment 47, I shall speak also to Amendment 48.

Here we are again: the Computer Misuse Act 1990 is another year older. It was put into statute at a time when technology looked nothing like it did 10 or 20 years ago, never mind today. I will give some brief facts. We have a fantastic cyber sector in our country, which adds so much to our economy and safety. The Computer Misuse Act constrains the sector from keeping us as safe as it might and constrains businesses in terms of their growth and what they could be adding today to our economy in terms of—yes—growth.

There is no reason for us to continue with the Computer Misuse Act when we have the solution in our hands, set out, I suggest, in Amendments 47 and 48. Our cyber- security professionals, often working way out of sight, for obvious reasons, do such important work and professionally, diligently, keep us safe and keep our country, assets and economy secure.

When the Minister responds, will he say, even sotto voce, that a Division on these amendments might help him in his discussions within the department to get some movement on this issue? We heard in previous debates how doing this would be premature and how the time was not now. Well, for a statute that came into being at the beginning of the 1990s, I suggest that it is high time that we made these amendments for individuals, for businesses, for our economy and for our society, in an extraordinarily uncertain world and at a time when I imagine that every Minister should be looking to every potential source of economic growth. I look forward to the debate and to the Minister’s response. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, in Committee, the noble Baroness the Minister said there was no consensus on the best way forward to amend the law to provide protection for ethical hackers trying to work against cybercrime. All I ask is that noble Lords should read the amendment, which says:

“It is a defence to a charge … to prove that … the person’s actions were necessary for the detection or prevention of crime or … the person’s actions were justified as being in the public interest”.


What on earth could be wrong with that? I support my noble friend Lord Holmes of Richmond.

Data (Use and Access) Bill [HL]

Lord Arbuthnot of Edrom Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I am pleased to follow the noble Baroness, Lady Morgan, who did so much during the Online Safety Bill—now Act—to champion the issues that are now before us. She should get full credit for the first steps she made. I think I said it before, and I will say it again in her presence, that we thought we had achieved much of what we are talking about today in the final wind-up of that Bill, but we had to swap it for a slightly bigger prize and it fell down slightly on the list, so I feel very guilty about this and want to help to redress somehow the balance of the deficit that was created.

I do not want to get, in this House, any reputation for being a person who asks geeky questions about Third Reading issues, but the Minister will know that getting access to debates at Third Reading is tricky. It often requires the graven head of the clerk to nod very slowly at an appropriate moment, and I wonder if we could just rehearse that slightly so that we are quite clear exactly what the noble Baroness, Lady Morgan, was saying.

Am I right in saying that the intention—and good intentions are great—is that there will be a government amendment at Third Reading? Since it is being produced by the Government, there is not an issue for the clerk to nod at, because that is allowed. If there is a government amendment dealing with all the issues we raised today, then we are all in a good place. It is right that this House, which has done so much to come together to create it, gets the credit for this Bill going down to the Commons. That is appropriate and something that we should get right.

In the absence of the Bill—and I recognise that there are difficulties about drafting, and it may well be that we have a very short time between Report and Third Reading—would it not be appropriate for the Minister to say to the clerk that it is his intention that, if necessary, the noble Baroness, Lady Owen, may bring forward an amendment on these issues so that at least we get, if not all of the package, the parts that are relevant and most important to it in the Bill as it leaves this House? That would be helpful all round, and it would be in accordance with the sentiment of the House.

[Lord Arbuthnot of Edrom (Con)]

My Lords, I share in the congratulations of my noble friend Lady Owen. It has taken me about 10 years to begin to understand how this House works and it has taken her about 10 minutes.

I want to pursue something which bewilders me about this set of amendments, which is the amendment tabled by the noble Baroness, Lady Gohir. I do not understand why we are talking about a different Bill in relation to audio fakes. Audio has been with us for many years, yet video deepfakes are relatively new. Why are we talking about a different Bill in relation to audio deepfakes?

[Lord Clement-Jones (LD)]

My Lords, this has been a very interesting debate. I too congratulate the noble Baroness, Lady Owen, on having brought forward these very important amendments. It has been a privilege to be part of her support team and she has proved an extremely persuasive cross-party advocate, including in being able to bring out the team: the noble Baroness, Lady Kidron, the noble Lord, Lord Pannick, who has cross-examined the Minister, and the noble Lord, Lord Stevenson. There is very little to follow up on what noble Lords have said, because the Minister now knows exactly what he needs to reply to.

I was exercised by this rather vague issue of whether the elements that were required were going to come back at Third Reading or in the Commons. I did not think that the Minister was specific enough in his initial response. In his cross-examination, the noble Lord, Lord Pannick, really went through the key elements that were required, such as the no intent element, the question of reasonable excuse and how robust that was, the question of solicitation, which I know is very important in this context, and the question of whether it is really an international law matter. I have had the benefit of talking to the noble Lord, Lord Pannick, and surely the mischief is delivered and carried out here, so why is that an international law issue? There is also the question of deletion of data, which the noble Lord has explained pretty carefully, and the question of timing of knowledge of the offence having been committed.

The Minister needs to describe the stages at which those various elements are going to be contained in a government amendment. I understand that there may be a phasing, but there are a lot of assurances. As the noble Lord, Lord Stevenson, said, is it six or seven? How many assurances are we talking about? I very much hope that the Minister can see the sentiment and the importance we place on his assurances on these amendments, so I very much hope he is going to be able to give us the answers.

In conclusion, as the noble Baroness, Lady Morgan, said—and it is no bad thing to be able to wheel on a former Secretary of State at 9 o’clock in the evening—there is a clear link between gender-based violence and image-based abuse. This is something which motivates us hugely in favour of these amendments. I very much hope the Minister can give more assurance on the audio side of things as well, because we want future legislation to safeguard victims, improve prosecutions and deter potential perpetrators from committing image-based and audio-based abuse crimes.

--- Later in debate ---

[Lord Lucas (Con)]

My Lords, if we are to live in a data-rich world, we really need a set of well-understood, good definitions for the basic information we are collecting. At the moment, age is about the only stable personal characteristic, in that we generally know where it comes from, where it is recorded and can trust it. Name has become unstable: people are using name changing to hide previous criminal convictions, because we do not have a system of linking one name with another. Residence is widely abused by people who want to get their kids into the school of their preference.

Disability, ethnicity, sexuality and religion are all self-identified. We really need to understand why we are basing policy on something that is self-identified and whether we are collecting the right information for the policy uses we are making of it, particularly when, in areas such as employment, we are encouraging people to make particular choices because they are favoured in the employment advertisements. There is a collection of information there which we really ought to make an effort to be clear about if we are to make proper use of it and understand data going down the decades.

The definition we ought to do something about now is the protected characteristic of sex, because the misuse of sex and its conflation with gender has caused a whole suite of disadvantages and corruptions in the system. Basically, sex is simple: there are only two sexes. For the huge majority of humans, you can easily determine which sex they are. There are some for whom it is harder, but there are still only two sexes. We are in a situation where we record sex and use it to provide safe spaces for women, to have female sports, to know which prison to put someone in, to know how to record crime and, presumably, to know what action to take as a result of it.

Sex and knowing how women are doing is a really important thing to collect accurately, because there is a whole suite of areas in which women have been historically disadvantaged, such as in employment. It is well known that the standards in medical care have been set on men, not women, which has led to a series of disadvantages. We need accurate data. To my mind, rules based on reality and truth that are then adapted to people are much better than rules based on the way we wished things were, then trying to reconcile that with the truth.

We would do better for everybody—women in particular, but also people who identify as trans—if we based our description of them, when it comes to sex, on the truth. We would provide better healthcare, better protection, a much easier attitude to integration into society and proper provision for them. We should seek to do this. Truth should be the base of how we collect data; we should really insist on that. We should not corrupt our data but adapt our practice. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, this one should be easy. Last week, we passed amendments that said that the public authorities, in recording data on matters including sex, should do so accurately. Some might think that that should not be particularly controversial. This amendment says that the Government “may make regulations” about definitions of that sort of thing—that is “may”, not must. It is a negative resolution, not a positive one. It is not difficult, so let us do it.

--- Later in debate ---

[Baroness Kidron (CB)]

My Lords, I move Amendment 68 in my name and those of the noble Lords, Lord Arbuthnot, Lord Holmes and Lord Clement-Jones. This amendment has been debated several times within this Bill and its predecessor; however, this version differs slightly in approach. The objective remains the same: to overturn the common-law assumption in both civil and criminal law that computers are infallible.

This assumption has led to untold injustice. Innocent people have lost their lives, freedom and livelihoods because the law wrongly assumed that computers are never wrong. This of course is nonsense, as explained in detail in our last debate, at column GC 153 of Hansard. In summary, computer systems are very susceptible to both human and technological error. Indeed, the presence of bugs is normal, anticipated and routine in all contexts other than the court.

As with previous iterations of this amendment, Amendment 68 overturns that common-law assumption, but the drafting now closely mirrors provisions under the Electronic Trade Documents Act 2023, which was enacted in recognition that the majority of trade documents are now electronic.

The ETDA ensures and assures the integrity of electronic trade documents. It was put in place to protect those on both sides of the trade, so I am curious, at the very least, as to why we will be able to consider the efficacy of computer evidence in relation to trade but not in our legal system. I am also concerned that the MoJ, under several Governments, has been so slow to recognise the scale of the problem of this assumption, which one of my most experienced computer science colleagues described as “wicked nonsense”.

In brief, the amendment provides that the electronic evidence produced by or derived from a computer may be relied upon as evidence where that evidence is not challenged and where the court is satisfied that the evidence can be relied upon. The rest of the amendment is carefully drafted by legal experts and computer scientists with legal expertise to support the court in coming to a meaningful assessment of whether to be satisfied, or not, that the evidence can be relied upon.

This proposal has been tried and tested within our legal system. We know that it works, and I therefore see no reason why the Government should not simply accept it. However, rather than discuss it, the Government chose to announce, last week, a consultation on computer evidence. The call for evidence is a source of significant frustration for those of us who have championed this issue, as is the fact that the promised meeting with the MoJ did not happen before that announcement, in spite of repeated requests.

In her introductory remarks to the consultation, the Minister for Justice, Sarah Sackman, says that the purpose of the consultation is to help her department

“better understand how the current presumption concerning the admissibility of computer evidence is working in practice, and whether it is fit for purpose in the modern world”.

This is a backward step. The evidence that presumption is not working and is not fit for purpose is overwhelming and decades long; what are needed now are solutions, one of which is before us tonight.

Moreover, the Government’s preference for doing everything behind doors has sunk their own consultation. Had experts been consulted, the first thing they would have pointed out is that the scope is insufficient because it does not address civil proceedings but only criminal proceedings, even though the presumption is the same for both. This means that, at best, the Government’s consultation can lead only to a partial solution.

We in this House have discussed this issue in the case of the postmasters; it is a case that is front of mind. This approach may have spared those postmasters who were subject to criminal prosecutions, but not those such as Lee Castleton who was subject to civil proceedings by the Post Office, which chased him to bankruptcy. He was also branded a thief, spat at and verbally abused in the street. He developed post-traumatic stress disorder. His wife developed epilepsy from stress, his daughter developed an eating disorder and his son remains so traumatised that he cannot be in a room where someone says the words “Post Office”. A solution that does not prevent the injustice done to Lee and his family from happening to others is not fit for purpose. If the MoJ had done us the courtesy of a meeting, this could have been avoided.

I am sure the Minister will assure us that the Government are acting, but for those whose lives have been ruined, those who have fought for too many years on this issue, the consultation creates the spectre of yet another battle and further delay when the solutions are here and at hand. I want nothing more than to be wrong on this, and for the Government to prove me wrong. But for past victims, for lawyers and experts who have given their time so generously, and for those whose lives will be ruined because the computer got it wrong, half a consultation on a matter so well-established and urgent is a pretty poor result. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, as so often, I listened with awe to the noble Baroness. Apart from saying that I agree with her wholeheartedly, which I do, there is really no need for me for me to add anything, so I will not.

[Lord Clement-Jones (LD)]

My Lords, I too am lost in admiration for the noble Baroness, Lady Kidron—still firing on all cylinders at this time of night. Current law is clearly out of touch with the reality of computer systems. It assumes an untruth about computer reliability that has led to significant injustice. We know that that assumption has contributed to miscarriages of justice, such as the Horizon scandal.

Unlike the amendment in Committee, Amendment 68 does not address the reliability of computers themselves but focuses rather on the computer evidence presented in court. That is a crucial distinction as it seeks to establish a framework for evaluating the validity of the evidence presented, rather than questioning the inherent reliability of computers. We believe that the amendment would be a crucial step towards ensuring fairness and accuracy in legal proceedings by enabling courts to evaluate computer evidence effectively. It offers a balanced approach that would protect the interests of both the prosecution and the defence, ensuring that justice is served. The Government really must move on this.