Telecommunications (Security) Bill

Lord Parkinson of Whitley Bay Excerpts

Committee stage
Tuesday 13th July 2021 Grand Committee

[Lord Parkinson of Whitley Bay (Con)]

My Lords, I am grateful to noble Lords who have taken part in the debate on these amendments, which seek to require regulations and codes to reflect advice provided by technical advisory boards and a judicial commissioner. The amendment to Clause 2, tabled by the noble Baroness, Lady Merron, requires any regulations made under new Section 105D to reflect advice provided by the existing Technical Advisory Board to the Home Office and a judicial commissioner. Similarly, the two amendments tabled by the noble Lord, Lord Clement-Jones, would require regulations to reflect advice provided by a new technical advisory board and a judicial commissioner.

Each of these amendments concern regulations made under new Section 105D and codes of practice issued under new Section 105E. I appreciate that noble Lords are seeking to ensure that any regulations and codes of practice are appropriate and proportionate before they are made or issued. However, there are several difficulties with what they propose. First, Clause 2 already requires the Secretary of State to make these measures only when he actively considers that they are appropriate and proportionate, under the wording of subsections (2) and (4) of new Section 105D. To ensure that is the case, the Secretary of State would have to consider relevant advice, which could include technical security assessments provided by the National Cyber Security Centre. The noble Baroness, Lady Merron, asked whether the advice would be published. As is usual practice, we would not publish advice given to the Secretary of State on the new framework, but we will consult on the code, and we feel that is the best and appropriate way in which to draw together the views of all relevant parties and their expert advice.

Advice to the Secretary of State could also include relevant representations by public telecoms providers. To reassure the Committee on this point, we have received helpful feedback from telecoms providers on the illustrative draft measures that were published in January. DCMS continues routinely to engage with telecoms providers about this Bill and telecoms security more widely.

Similarly, Clause 3 requires that any codes of practice are finalised only after consultation with affected providers. The process of consultation, when taken together with the fact that codes can only give guidance on legal obligations and not expand their scope, as noble Lords noted, means that any final codes in effect will be appropriate and proportionate. The noble Lord, Lord Fox, asked whether it was enforceable by law. It is guidance, not law, but the code has certain legal effects, as set out in Clause 3. In that context, further advice from a technical or judicial panel would therefore be unnecessary.

We understood the amendment proposed by the noble Baroness, Lady Merron, to refer to the Technical Advisory Board to the Home Office. That board provides advice regarding the reasonableness of obligations imposed on telecoms providers under the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016. Each of these amendments risks confusing two separate sets of security arrangements.

Section 227 of the Investigatory Powers Act provides for the Prime Minister to appoint the Investigatory Powers Commissioner and judicial commissioners. The role of the Investigatory Powers Commissioner is to authorise and oversee the use of the investigatory powers, in the public. The Investigatory Powers Act regime is not comparable with the new framework set out by this Bill. Oversight of the Investigatory Powers Act regime by the Investigatory Powers Commissioner is considered appropriate because of the potential intrusion into the private lives of individuals as a result of the use of covert powers.

The powers to make regulations under this Bill are very different to those in the Investigatory Powers Act. They are focused on protecting public telecoms networks and services by improving the security practices of telecoms providers—so those two sets of arrangements should not be confused. Indeed, there are specific provisions in the Bill designed to ensure that it does not adversely affect lawful activity carried out by law enforcement authorities and the intelligence services under the Investigatory Powers Act. The judicial commissioner would therefore be the wrong body to advise the Government on the Bill’s regulation-making and code-issuing powers. For those reasons, the Government are not able to accept these amendments, but I hope that that explains why and reassures the noble Lords sufficiently for them to be content not to press their amendments today.

--- Later in debate ---

[Lord Fox (LD)]

I thank the Deputy Chairman and apologise for speaking across him. I am a bit intrigued by the comment of the noble Lord, Lord Parkinson, on the subject of legal enforceability. He is correct to say that, as new Section 105H states, the

“provision of a code of practice does not of itself make the provider liable to legal proceedings”

—but it would not be liable only when the provision was not in force in time or when it was not legal. However, you would not bring a legal case anyway when it was not relevant or in force, so, to all intents and purposes, where the code is in force and relevant, it is legally enforceable. Therefore, it is legally enforceable.

[Lord Parkinson of Whitley Bay (Con)]

First, if I may, I will take back the point made by the noble Lord, Lord Fox, about new Section 105H under Clause 3; I will write to him to, I hope, alleviate any concerns and confusion. There are certain legal effects set out; I will write to him to clarify the point about legal enforceability.

I am grateful to the noble Lord, Lord Clement-Jones, for his appreciation. Part of the confusion here may be that two technical advisory boards are mentioned in these groups of amendments. As I think he noted, the one set up under RIPA has a different function, but we are certainly not being dismissive of the points that have been raised. Indeed, as I said, we have spoken to the industry and received helpful feedback from telecoms providers on the illustrative draft measures that were published in January. We will also be glad to look at the information that he mentioned—the views that have come his way—to make sure that these are reconciled; if he is happy to share them, we will look at them and come back him.

[Baroness Merron (Lab)]

I thank all noble Lords for their contributions. In view of the pandemic restrictions on the numbers that might sing in a choir inside, it is dangerous now to say that we are singing from the same hymn sheet—as the noble Baroness, Lady Barran, will recall from her time at the Dispatch Box. I do not know whether we would count as amateur or professional, so perhaps I could venture in that direction, but there is a sense among noble Lords of wanting to strengthen the Bill by ensuring that the Secretary of State has the best technical advice.

I thank the Minister, the noble Lord, Lord Parkinson, for his response. However, I take from it that a technical advisory board is not required. I share the confusion that was referred to earlier by the noble Lord, Lord Clement-Jones. On the one hand, in the previous set of amendments, we were advised that this is so technical that it is not appropriate for a particular aspect of parliamentary scrutiny, yet suddenly, it seems, it is not quite as technical but we need further advice. I am reminded of the words of the then Lord Chancellor, Michael Gove, who we will recall commenting in a debate over Brexit that we have “had enough of experts”; I suspect the Minister will have picked up from the amendments today that we feel we have not had enough of experts. I hope he will reflect on the fact that these amendments seek to assist the Secretary of State, and to assist this Bill to do the job it is here to do to very best effect. With that, I beg leave to withdraw the amendment.

--- Later in debate ---

[Baroness Merron (Lab)]

I thank the noble Lords, Lord Fox and Lord Clement-Jones, for these amendments. As before, it is a pleasure to follow their contributions and that of the noble Earl, Lord Erroll.

On the codes of practice and Amendment 10, I understand the importance of not wanting to put undue burdens on businesses. We should make particular reference to the exceptionally difficult and testing times that businesses and the economy have had to suffer over the past year due to the pandemic. Obviously, a balance needs to be considered. We have to ensure that if the codes are going to be used, they are the most effective way of implementing security measures. How will the Government consider the impact of codes on businesses? For example, will there be specific consultation about undue costs in respect of businesses?

The concerns that we have heard in this debate give a further nod to concerns about lack of parliamentary oversight, which is missing from the codes. I again say gently to the Minister that by giving parliamentarians the opportunity to provide scrutiny there might also be the ability to review the impact on businesses.

Amendments 16, 17 and 21 would ensure that Ofcom’s new powers in the Bill were subject to requirements in Sections 3 and 6 of the Communications Act 2003. Section 3 focuses on the general duties of Ofcom, while Section 6 focuses on reviewing regulatory burdens. It would be helpful to hear from the Minister whether the Bill has been deliberately drafted for the new powers to fall out of scope of those sections in the Communications Act and, if so, why.

What review process will be faced in respect of Ofcom’s new powers? It is very important that, when new powers are given, there is an opportunity to review, reflect and amend, and to keep a close eye on whether those new powers are doing the job intended.

[Lord Parkinson of Whitley Bay (Con)]

I thank the noble Lords, Lord Fox and Lord Clement-Jones, for these amendments, and all noble Lords who have spoken in the debate. The amendments focus on the need for the regulations and code of practice to be proportionate, and to ensure that the duties of Ofcom are carried out in a transparent and similarly proportionate way.

I turn first to Amendment 10, tabled by the noble Lord, Lord Fox. This amendment to Clause 3 seeks to ensure that codes of practice are necessary and proportionate to what they are intended to achieve, and do not place an undue burden on telecoms providers. The Bill already includes provisions in Clauses 1 and 2 to ensure that security duties placed on public telecoms providers in the primary legislation and specific security measures set out in regulations must be considered to be appropriate and proportionate by the Secretary of State. The code of practice will provide the technical guidance on the steps that public telecoms providers should take to meet their security duties. I certainly agree with the noble Baroness, Lady Merron, about the extra—and indeed extraordinary—work that providers have done over recent months to keep us all in contact during the pandemic.

To help ensure that technical guidance in the code of practice is appropriate and proportionate, Clause 3 requires the Secretary of State to publish a draft version of the code of practice before it is issued, and to consult on its contents. This public consultation will take place after the Bill has attained Royal Assent; it will enable the voices of telecoms providers of all sizes—as noble Lords rightly pointed out—the wider sector, Ofcom, and any other affected groups to be heard and taken into account before the code of practice is finalised. Subsequent versions of the code of practice, which will be revised as technology evolves and new threats emerge, will also be subject to the same process of consultation before being issued.

An impact assessment is also being conducted for proposed secondary legislation to be laid as part of the new framework, which will take into account the initial cost assessments from providers to ensure that the framework is balanced and proportionate. The precise make-up and design of each provider’s network remains a commercial decision. The Bill makes it clear that providers are responsible for the security of their own networks and services; providers also remain responsible for deciding how they recover their costs. As such, we expect the costs of ensuring adequate security to be met by individual providers.

I turn to Amendments 16, 17 and 21, tabled by the noble Lord, Lord Clement-Jones. These seek to apply Sections 3 and 6 of the Communications Act 2003 to Ofcom’s duties and powers under Clauses 5, 6 and 19 of this Bill. Section 3 of the Communications Act sets out Ofcom’s general duties; these include a duty on Ofcom to have regard to the need for transparency, accountability and proportionality when carrying out its functions. Section 6 of the Communications Act requires Ofcom to review the burden of its regulation on telecoms providers. These are all principles that we think are essential to the functioning of the new security regime created by this Bill. I am glad to repeat the reassurance given by my noble friend in her letter, which the noble Lord, Lord Clement-Jones, mentioned, that Ofcom is already bound by its general duties in Sections 3 and 6 of the Communications Act when carrying out its security function under new Section 105M, and when using any of its powers in this Bill. This will include Ofcom’s power to carry out an assessment of public telecoms providers’ compliance with their security duties under Clause 6 of this Bill, and powers for Ofcom to give inspection notices under Clause 19. As my noble friend said in her letter, if Ofcom fails to carry out its security functions in line with these duties, it could be subject to legal challenge.

The provisions in the Bill already ensure that the regulations, code of practice and duties of Ofcom are proportionate. Therefore, we do not think that these amendments are necessary, and we hope that noble Lords will be happy not to press them.

[Lord Clement-Jones (LD)]

My Lords, I thank the Minister for that—he pierced through the gloom of the afternoon, giving an assurance that existing duties of Ofcom will cover the new powers.

I think we have a Pepper v Hart situation that works for the other aspects on the code of practice. It is not just the regulations and the duties and powers of Ofcom that are subject to it; the way in which the code of practice will be drawn up is covered also by the duties under Sections 3 and 6 of the existing Act. I very much hope so, and I need to take away and read what the Minister had to say.