Data (Use and Access) Bill [HL]

Lord Vallance of Balham Excerpts

3rd reading
Wednesday 5th February 2025 Lords Chamber

[The Minister of State, Department for Science, Innovation and Technology (Lord Vallance of Balham) (Lab)]

My Lords, I will make a brief statement on the devolution status of the Bill. Parts 1, 2, 3 and 7 of the Bill include provisions within the legislative competence of the Northern Ireland Assembly, the Senedd Cymru and the Scottish Parliament. On 22 October, the Secretary of State for Science, Innovation and Technology wrote to counterparts in Northern Ireland, Scotland and Wales, seeking their agreement to initiate the legislative consent process and to support a legislative consent Motion in the Northern Ireland Assembly, the Scottish Parliament and the Senedd Cymru. Since the beginning of the Bill’s passage, my officials have been in regular contact with the Northern Ireland Civil Service, the Welsh Government and the Scottish Government. We are hopeful that the legislative consent process will progress swiftly over the coming weeks, ahead of Report in the other place.

Although it has not been possible to secure consent by this time, I take this opportunity to thank officials in Northern Ireland, Scotland and Wales and express my gratitude for the close working throughout the passage of the Bill. We remain committed to sustained engagement on the Bill with all three devolved Administrations as it progresses through Parliament.

Amendment 1

Moved by

[Lord Vallance of Balham]

1: After Clause 80, insert the following new Clause—
“Data protection by design: children’s higher protection matters(1) Article 25 of the UK GDPR (data protection by design and by default) is amended as follows.(2) After paragraph 1 insert—“1A. In the case of processing carried out in the course of providing information society services which are likely to be accessed by children, when assessing what are appropriate technical and organisational measures in accordance with paragraph 1, the controller must take into account the children’s higher protection matters.1B. The children’s higher protection matters are—(a) how children can best be protected and supported when using the services, and(b) the fact that children—(i) merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing, and(ii) have different needs at different ages and at different stages of development.”(3) In paragraph 3, for “1 and 2” substitute “1 to 2”. (4) At the end insert—“4. Paragraphs 1A and 1B are not to be read as implying anything about the matters that may be relevant to the assessment of what are appropriate technical and organisational measures for the purposes of paragraph 1 in cases other than those described in paragraph 1A.5. In this Article, “information society services” does not include preventive or counselling services.””Member’s explanatory statement
This amendment imposes duties to take account of matters relating to children on controllers involved in providing information society services which are likely to be accessed by children. The duties apply when these controllers are designing the means of processing personal data and when carrying out the processing.

[Lord Vallance of Balham (Lab)]

I will now speak to the government amendment tabled in my name. The Government are firmly committed to protecting children’s personal data and ensuring that online services likely to be accessed by children are designed with their safety and privacy in mind. We have listened carefully to the concerns raised in this House during earlier debates and have worked quickly to bring forward this amendment, which reflects those discussions. During the debate on 21 January, I made clear that, while we could not accept Amendment 22 from the noble Baroness, Lady Kidron, which would have placed new duties on all data controllers, the Government were open to a more targeted approach that addressed the areas of greatest concern.

This amendment delivers on that commitment. It amends Article 25 of the UK GDPR, which already requires data controllers to design appropriate organisational and technical measures to implement the data protection principles. The amendment strengthens these obligations for information society services providers, such as social media and the streaming sites likely to be accessed by children.

They will be required to give extra consideration when deciding which measures are appropriate for online services likely to be accessed by children. Specifically, information society services providers must consider

“the children’s higher protection matters”

set out in the clause when designing their processing activities. These are:

“how children can best be protected and supported when using the services, and … the fact that children … merit specific protection with regard to their personal data because they may be less aware of the risks and … their rights in relation to such processing, and … have different needs at different ages and at different stages of development”.

The new duty expressly applies to

“information society services which are likely to be accessed by children”.

They are the same organisations that should already be following the ICO’s age-appropriate design code. Organisations that are already complying with the code should not find it difficult to comply with the new duty, but organisations that have treated compliance with the code as optional will now be under a clear legal duty to design their services with children’s rights and interests in mind.

I also want to make it clear that other organisations that process children’s personal data may need to consider these matters on a case-by-case basis and depending on the context. Although this amendment creates an express duty on information society services providers, those matters may sometimes be relevant in other contexts. Proposed new subsection (4) makes that clear.

I take this opportunity to thank the noble Baroness, Lady Kidron, and other noble Lords who have contributed to this important debate. I hope this amendment, together with the other steps we are taking in the Bill to protect children, including the new duty on the ICO to consider children’s interests when carrying out its regulatory functions, will be welcomed across the House. I beg to move.

[Baroness Kidron (CB)]

My Lords, I support the amendment in the name of the Minister, to which I have added my name, and welcome his words from the Dispatch Box. As he said, this new duty provides a direct and unequivocal legal duty on all information society services likely to be accessed by a child and acknowledges in the Bill that services outside the definition of ISS must also consider children—indeed, they must consider children’s specific protections when determining how to process their data.

For the last decade, I and others have fought to establish minimum standards to ensure the safety and privacy of children in the UK and, over time, we have learned that we cannot assume a trajectory of progress. Standards can go down as well as up, and we cannot be sure that the intentions of Parliament will always be interpreted as robustly as promised.

I am concerned about the impact of tech lobbying on this Bill, the regulator and the Government’s wider digital strategy. I hope that the companies represented by those lobbyists will take note of this amendment as a sign that, when it comes to children, they have absolute responsibilities under the law. The Bill team has persuaded me that the child-specific duties on the ICO in the Bill, in combination with its new reporting duties, mean that the ICO will report separately about steps it has taken and will take to uphold children’s heightened data rights. I would be grateful if the Minister could confirm that that is also the Government’s expectation.

--- Later in debate ---

[Viscount Camrose (Con)]

My Lords, I thank the Minister for bringing forward this amendment. I too welcome the return of the noble Baroness, Lady Jones, and wish her a speedy end to her recovery.

Most of all, I congratulate the noble Baroness, Lady Kidron, on her successful campaigning to deliver better protections for children during the passage of this Bill. Throughout our consideration of the Bill, we on these Benches have firmly supported stronger protections for children in the Bill, which build on the important and collaborative work done by so many of us in the tech team under the previous Government and this one. Although we had some specific concerns about the drafting of some previous amendments on this topic, we are delighted that the Government have listened to the noble Baroness and brought forward their own amendment, which the noble Baroness is able to support. We firmly agree that children merit specific protection regarding their personal data, as they may be less aware of the risks and consequences of data processing. We support the amendment.

[Lord Vallance of Balham (Lab)]

My Lords, I thank noble Lords who have contributed to this debate. I have noted the points about the left hand and the right hand, and about institutional memory. I echo other noble Lords in their thanks to the noble Baroness, Lady Kidron, for her persistence and insight. I can confirm that we would expect the ICO to update its regulatory action policy to reflect the changes and report against this duty. I will also write to that effect. I am glad that we have reached consensus on this very important matter.

Amendment 1 agreed.

--- Later in debate ---

Moved by

[Lord Vallance of Balham]

That the Bill do now pass.

[Lord Vallance of Balham (Lab)]

My Lords, this Bill has had a lively and long previous life, with many of these areas having been debated over the years by noble Lords sitting here today. I would like to give a brief summary of some of the changes that have been made to the Bill, as well as reflecting on some of Bill’s core aims.

I start by giving thanks. I hope I will be forgiven for not naming every noble Lord who has spoken on this Bill to date. I extend my gratitude to my noble friend Lady Jones, who I am sure everyone here is delighted to have back. She laid excellent foundations in getting the Bill through its initial stages in the House. I am sure that noble Lords will want to join me in wishing my noble friend a swift and full recovery.

This has been my first experience leading on legislation in this House. I apologise for when I got things wrong. I have learned a great deal. I am grateful for both the support and the many shades of advice that I have been given.

On the deepfakes point, I join the many noble Lords who have expressed their admiration for the work of the noble Baroness, Lady Owen. It is her first time bringing an issue of such great importance to a debate. She has done so with great skill, determination and passion. The Government have undoubtably heard your Lordships’ clear views on this crucial issue.

The other area of the Bill that has been strengthened today is on children’s data. We have put into law the children’s higher protection matters. I extend thanks to the noble Baronesses, Lady Kidron and Lady Harding.

The noble Lord, Lord Bethell, raised excellent points about online harms research, and we had a robust discussion of automated decision-making thanks to the noble Baroness, Lady Freeman of Steventon, the noble Lords, Lord Clement-Jones and Lord Markham, and the noble Viscount, Lord Camrose.

More broadly, many noble Lords contributed to the debates on AI and copyright, including the noble Lords, Lord Bassam, Lord Freyberg and Lord Holmes, and the noble Earl, Lord Clancarty. I agree that AI poses some of the most pressing questions of our time, and the strength of feeling on copyright is clear. I emphasise that we have heard this House. We are listening, including with our open consultation, and, as I have said several times, we are committed to making the right decision on this—and right means right for all parties.

We wholeheartedly agree with the noble Viscount, Lord Colville, on the importance of scientific research and that scientific research is in the public interest, even though we still have some concerns on the formulation and unintended consequences of the specific amendment. I thank him for raising the debate and bringing different opinions to the table.

As my noble friend Lady Jones said at Second Reading, data is

“integral to almost every aspect of our society and economy, from NHS treatments and bank transactions to social interactions”.—[Official Report, 19/11/24; col. 146.]

I will use this final part of my speech to highlight some of the areas where there has been agreement across the House and which highlight some of the huge potential that data and the contents of the Bill can have on our lives.

We have new provisions for smart data schemes and new digital verification services to provide new ways for people to prove and verify identities. The maps provided by the creation of the national underground asset register will improve the efficiency and safety of the way we install, maintain, operate and repair our buried infrastructure. We have a new soft opt-in mechanism for charities, which will help them raise vital funds by allowing them to continue to reach out to supporters.

The contents of the Bill support delivery of every one of the five missions set out by the Prime Minister. I know that in the other place there will be further discussions on the Bill and on the changes that noble Lords have made. I am in no doubt that there will be further disagreements, but I am sure that Members will be grateful for the time and scrutiny afforded to the Bill. That will only make it a better Bill and will ultimately help it achieve its aims to harness the power of data, drive economic growth, support modern digital government and improve people’s lives.

Finally, I thank the officials who worked on the Bill, including the Bill team: Simon Weakley, Lois Clement, Ryan Jones, Robyn Connelly and Joy Aston.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I was very pleased to hear my noble friend Lord Vallance’s words in relation to what we have been doing today and also taking a broader conspectus of what we have been doing in the longer periods of Committee and Report. I think he has answered the question I was going to leave him with, which was on whether the Government were in listening mode when the House took such determined decisions, as it has done on a number of issues, which I know he was opposed to. I hope that I am right in assuming that he is saying that he understands the motivation behind them, which is in no sense to try to wreck the Bill but, in the best interests of this House, to try to make sure that what comes out of it reflects the wider experience and range of views that can come from those who have knowledge and understanding of this Bill.

As he said, this is not the first data protection Bill we have—I was going to say “endured”, but that is not right—enjoyed, and we have been through a number of the issues that have surfaced again in the past few weeks at other times. As we heard in Committee—a number of people have said this and I think it is still true—this is really not the data protection and data processing Bill that we need. What we have is an attempt to try to bridge some of the infelicities that have occurred in recent years because of the combination of legislative processes that have happened within the GDPR, Brexit and the Data Protection Act 2018. That does not make it the Bill we could have had. I am not forecasting, but I suspect that we will probably have to return to this within a few years to try to bring forward some of the issues that are still buried in this, which do not come out quite as well as they could do, and I look forward to that.

The Minister was right to say that this is his first major piece of legislation. I think he has done extraordinarily well to be able to pick up the mantle and the first steps taken by my noble friend Lady Jones, who we welcome back. I also pay tribute to the Bill team, who have been exemplary in trying to provide the information we need to make the best decisions.

We will see the Bill back in due course. It will have, presumably, changes to some of the issues on creative copyright, scientific research and some other points that the noble Lord mentioned. I hope that, when that happens, we will have an opportunity to reflect on that together, and I make an open invitation to the Minister to engage with some of the people he has named already, whose clear interest in this has been flagged to him. I am sure they would want to try to continue the discussion before we go into the formal processes.