Data Protection and Digital Information Bill

Lord Stevenson of Balmacara Excerpts

Committee stage
Wednesday 24th April 2024 Grand Committee

[Viscount Younger of Leckie (Con)]

Indeed, I think we are going back to the debates that we had on Monday. However, this chimes with a question from the noble Lord, Lord Clement-Jones, so it might be helpful briefly to rehearse what we are doing here and to be clear about the limitations and the checks and balances on the power that we are bringing forward.

As per paragraph 1(2) of Schedule 11 to the draft legislation, the DWP can use this power only for the purposes of checking whether someone is eligible for the benefit that they are receiving. In practice, this means that the DWP will request information only on specific criteria, which I laid out on Monday, linked to benefit eligibility rules, which, if met may—I emphasise “may”—indicate fraud or error. If accounts do not match these criteria, no data will be shared with the DWP. The effect of paragraphs 1 and 2 of the draft legislation is that the DWP can ask for data only where there is this three-way relationship between the DWP, the third party and the recipient of the payment. In addition, the DWP can ask for data only from third parties designated in secondary legislation, subject to the affirmative procedure. There are debates to come as further reassurance to your Lordships.

As per paragraph 4(2) of Schedule 11 to the draft legislation, the power does not allow the DWP to share personal information with third parties, which means that the power can be used only with third parties who are able to identify benefit recipients independently. Just to add further to this, we are obliged, under Article 5(1)(c) of the UK GDPR, to ask only for the minimum of information to serve our purposes. In accordance with the DWP’s existing commitments on the use of automation, no automatic benefit decisions will be taken based on any information supplied by third parties to the DWP. As I said earlier and on Monday, a human will always be involved in decision-making. I hope that helps.

[Lord Stevenson of Balmacara (Lab)]

I am sorry to interrupt the noble Viscount, but I just want to be clear about what he is saying in relation to the code of practice, which obviously is at the heart of this section of the debate, although there will be other things to come. Am I right that he said—obviously he has to cover himself—that there is a chance that the Report stage of this Bill might be entered into before we have sight of the draft code of practice? He makes the point that that is not an unusual occasion. I understand that—we have both served in Parliament long enough to know that that is the case—but this is clearly an issue on which the Committee has made very strong representations to the Government. Will he do what is in his power to make sure that we do not enter Report without seeing at least an early draft, if that is possible, of the code of practice?

[Viscount Younger of Leckie (Con)]

I will certainly take that back. I do not want to make any commitments today. I have already set out our stall as to where we are. I make the further point—I am perhaps repeating myself—that given the sensitivities that there clearly are, which I have been listening to carefully, it is important that this code of practice is developed at a pace that is right for what is needed, in bringing those involved along and making sure that it is right, secure, safe and with all the safeguards involved. It is quite a serious piece of work, as noble Lords would expect me to say. I will take that back. I will certainly not be able to guarantee to produce anything before Report, which may disappoint the noble Lord, but at least I have gone as far as I can. I hope that that is helpful.

[Lord Stevenson of Balmacara (Lab)]

I am grateful to the noble Viscount. This is just a thought, but we are happy to help, as we often have done in the past on other Bills. If there is any opportunity for us to be shown early drafts, to give some help and assurance to the noble Viscount that he is on the right track, I am sure that that would be accepted.

[Viscount Younger of Leckie (Con)]

I appreciate the tone of the noble Lord and, if there is anything that comes from behind me before I conclude my remarks, to be helpful, I will certainly do that.

Our debates on this measure have covered many issues. This group, as mentioned earlier, focuses primarily on the operational delivery of the power, so it would be quite good to move on. Just before I do, for the benefit of the noble Lord, Lord Anderson, in terms of the late introduction—his words—of this measure, as mentioned on Monday the DWP published a fraud plan in May 2022, where it outlined a number of new powers that it would seek to secure when parliamentary time allowed. In the parliamentary time available, DWP has prioritised our key third-party data-gathering measure, which will help it to tackle one of the largest causes of fraud and error in the welfare system. That is a short version of what I said on Monday, but I hope that it might be helpful.

Before I turn to the amendments, it might be helpful to set out how the legislation will frame the delivery of this measure. When we issue a request for data to a third party or, as it is set out, an account information notice or AIN, which is in the Bill, we can only ask it to provide data where it may help the DWP to establish whether benefits have been properly paid in accordance with the rules relating to those benefits. As mentioned earlier, this is defined clearly at paragraph 1(2) of the new schedule. This is where the data that DWP receives may signal—to use the word raised by the noble Lord, Lord Clement-Jones—potential fraud and error. The noble Lord asked for further clarification on that point. To be clear, a signal of fraud and error is where the rules of benefit eligibility appear not to be met. For example, this might be where a claimant has more capital than the benefit rules allow. As I made clear on Monday, all benefits and payments have rules that determine eligibility, which Parliament has agreed are the right rules in its consideration of other social security legislation. To issue an AIN, we must also have designated a third party in affirmative regulations, which need to be passed by both Houses.

As has been covered, we can also only request data from third parties where there is this relationship, which I will not repeat again and which I think the Committee will be familiar with. Our intention is to designate banks and financial institutions as the first third parties that we can approach, enabling us to request information on accounts only held in the UK. Just to clarify that point, we will not be able to request information on overseas accounts.

On the question raised by the noble Baroness, Lady Sherlock, on examples of non-financial organisations that the power could appropriately be used on, we will bring forward regulations to specify the data holders in scope. I hope that this is helpful. In the first instance, this will be, as mentioned, banks and financial institutions. The power also has potential use cases with other third parties, such as housing or childcare providers, but, just to reassure the Committee, this would be subject to further parliamentary approval.