Digital and Technology Policy: National Sovereignty

Lord Moraes Excerpts

Thursday 23rd July 2026 Lords Chamber

[Lord Moraes (Lab)]

My Lords, I, too, welcome the initiative from the noble Baroness, Lady Kidron. I have just finished her book, and it is a good read, but I have only one niggle: I really gasp at the cost of hardbacks. Maybe I am stingy, but they told me it is a whole year or so until there is a paperback so more people can read it. That was just a thought—I digress and should get back to the point. I welcome my noble friend the Minister back to her place, and I am happy that she can continue her work in this important area.

Digital sovereignty means agency. It is such a profound thing: the capacity for we in this country to make choices about everything, from the online safety of our children to the smooth running of our economy. That is a vast area in which to have damaged sovereignty, or a sovereignty gap. Yet, we are now in the simple position whereby a handful of US firms own the digital infrastructure the UK economy runs on, including search browsers, the cloud, app distribution and business software. As my noble friend said, those same companies are now also monopolising the AI stack. In simple terms, this leaves UK firms, public services and consumers dependent on suppliers who are governed elsewhere. That is a very profound thing. We need to understand it, but the more difficult part is how we deal with that reality.

This process did not begin with this Government—it is of neither their making, nor the last Government’s, nor the Government before that. It began in one country in the 2010s, with another country slightly catching up. An extraordinary thing happened in the 2010s: the US tech companies determined that they would weaken oversight of the digital space and not have federal legislation. Today, there is the extraordinary position in the United States whereby there is no federal regulation, as the noble Baroness, Lady Kidron, said, or regulation at all in this space. I repeat that because it is hard to believe. It all exists at state level, with the weakened oversight of the Federal Trade Commission and all the other organs which are traditionally very powerful in American democracy. Congress has no say and does not want to have a say—that is a whole other debate. This reality affects our reality, because those are the organisations that exist in relation to our economy. This is a factual situation, and I want to get on to the issue of how we at least try to deal with this sovereignty gap.

I also want to mention what has happened to this country and its sovereignty in the digital space from that period up until today. We were in the European Union, which has a regulatory weakness. Unlike the United States and China, it does not have the digital infrastructure, and yet it is the best regulator we have globally—there are only three global regulators. When were in the EU, we had that benefit of not only EU legislation and regulation but the protection in court of limiting the cross-border transfers of our citizens, because that is what those companies are monetising. That is point of all this.

In the 2010s, I chaired the Facebook inquiry and I met Mark Zuckerberg. He literally said to us that GDPR is a great thing. He went to Congress and said so—you can see it on YouTube. He admitted that regulation was essential for human beings in the United States, China, here and all around the world. However, they determinedly went on an opposite path, and we are now left with this situation.

There are a number of things we can start doing, because we have to do something—there is no point in just throwing up our hands and saying that this is how it is going to be. I will suggest a couple of things. First, we have to understand what we can do as a country to re-establish that kind of sovereignty. They seem small things, but they are within our capacity. I ask a specific question of the Minister. Take Palantir, which at least everyone knows about. Palantir is trying to take health data, make a cross-border transfer to the United States and sell it. That is what it is doing, and why it is paying us very little for the contract. Even the public, and certainly those who work in the NHS, are aware that the systems are not even that good.

One of the things we need to do, which is within our capacity, is a cost-benefit analysis of the contracts we undertake, because there will be sovereignty issue to that. Are we actually doing that? Secondly, we need to be really clear about what is happening here and what we can do about the blockages. For example, the US CLOUD Act grants US authorities the power to request access to data held anywhere in the world from providers subject to US jurisdiction, with no legal requirement for providers to inform customers. The whole issue of the US CLOUD Act has been raised in Parliament, and I know the Minister in the other place has commented on it, but DSIT has not made any central assessments of what the US CLOUD Act is or what it is doing to our infrastructure and sovereignty. These are the kinds of questions we need to try to answer and make progress on.

Another area—very quickly—is EU alignment; we have safety in numbers if we align. We have good data adequacy agreements with Europe and the European Union. We do not have a good data adequacy agreement with the US, for obvious reasons. Can we at least align on regulatory aspects that help us in this country, and our sovereignty: not everything from the European Union, but at least those aspects where we can align with a data adequacy agreement to help our sovereignty position?