Data Protection and Digital Information Bill

Lord Vaux of Harrowden Excerpts

2nd reading
Tuesday 19th December 2023 Lords Chamber

[Lord Vaux of Harrowden (CB)]

My Lords, it is a great pleasure to follow my noble friend Lord de Clifford and to congratulate him on an excellent and insightful maiden speech. I am pleased that he has chosen this important Bill for this occasion. Data protection is something of a minority sport and it is great to add another person to the select group in this Chamber.

Data protection is about finding the right balance between protecting individuals’ privacy and the bureaucracy and costs that go with it, for small businesses and others. My noble friend’s long experience in managing small and medium-sized businesses gives him great insight into how these regulations will impact the businesses that typically find it most difficult to deal with greater bureaucracy, as he so rightly pointed out. SMEs are often overlooked more generally, so having such an experienced voice to remind us of their importance during our deliberations will be a great asset to the House, and from a personal point of view it is a great pleasure to welcome a fellow finance professional to join us.

The noble Lord’s experience in the veterinary sector should also be of enormous value to the House. I hope that my noble friend Lord Trees will not mind having his monopolistic position in the field broken. It seems that the noble Lord has also been hiding another light under a bushel: I believe that he has also competed for Great Britain in equestrianism, so he is clearly a man of many talents. I tried to find a joke to do with horsing around, but I am afraid that inspiration completely deserted me. I—and, I am sure, all noble Lords—look forward to his future contributions, both on this Bill and more widely.

I turn now to the specifics of the Bill. As I mentioned, data protection is about finding the right balance between individual privacy and the costs, processes and rules that must be in place, alongside the ability to carry out essential criminal investigations and national security. I think it is generally agreed that the GDPR has its flaws, so an effort to look again at that balance is welcome. There is much in the Bill to like. However, there are a number of areas where the Bill may move the balance too far away from individual privacy, as a number of other noble Lords have already mentioned. In fact, there is not much that I have disagreed with in the speeches so far.

It is a long and very complex Bill; the fact that the excellent Library briefing alone runs to 70 pages says a lot. It will not be possible to raise all issues; noble Lords are probably grateful for that. I am going to concentrate on four areas where I can see significant risks, but the Minister should not take that as meaning that I disagree with other things that have been said so far; I agree with almost everything that has been raised.

First, a general concern raised a number of times, in particular by the noble Lord, Lord Allan, is that the Bill moves us significantly away from our existing data protection rules, which were based clearly on the EU regulations. We are currently benefiting from an EU data adequacy ruling which allows data to be transferred freely between the EU and the UK. This was a major concern at the time of the Brexit discussions. At that time, data adequacy was not a given. This ruling comes to an end in July 2025, but it can be ended sooner if the EU considers that our data protection rules have diverged too far.

The impact assessment for the Bill—another inch-thick document—says:

“Cross-border data transfers are a key facilitator of international trade, particularly for digitised services. Transfers underpin business transactions and financial flows. They also help streamline supply chain management and allow business to scale and trade globally”.


It is good that the impact assessment recognises that. The loss of data adequacy would therefore have significant negative impacts on trade and on the costs of doing business. Without it, alternative and more costly methods of transferring data would be required, such as standard contractual clauses. There are also implications for investment, as the noble Lord, Lord Allan, pointed out. Large international financial services organisations would be much less likely to establish data processing activities in the UK if we were to lose data adequacy. Indeed, they may decide that it is worth moving their facilities away from here.

The impact assessment suggests surprisingly low costs that might arise: one-off costs of £190 million to £460 million, and annual lost trade of £210 million to £420 million. However, these are only the direct reduction in trade with the EU; as the impact assessment points out, they will likely be larger when taking into account interactions with onward supply chains.

The impact assessment does not judge the probability of losing the data adequacy status. I find that rather extraordinary, possibly even shocking, as it is so important. The New Economics Foundation and UCL conservatively estimate the cost of losing data adequacy at £1 billion to £1.6 billion; however you look at it, these are very large numbers.

What can the Minister tell us that could set our minds at rest? What discussions have taken place with the EU? What initial indications have been received? What changes have been made to the original draft Bill to take account of concerns raised by the EU around data adequacy? What is the Government’s assessment of this risk? The Bill has been on the blocks for a long time now. I have to assume that a responsible Government must have had discussions with the EU around data adequacy in relation to these proposals.

Secondly, as we have heard, Clause 129 would enable Ofcom to require social media companies to retain information in connection with an investigation by a coroner into the death of a child, where the child was suspected to have died by suicide. This is a welcome addition but, as we have heard, it does not go far enough. It does not include all situations where a death was potentially related to online activity; for example, online grooming. My noble friend Lady Kidron has, as always, covered this with much greater eloquence than I could. I suspect the Minister already knows that the Government have got this wrong. As the noble Lord, Lord Knight, pointed out, it would be a brave Minister who tried to hold the current line in the face of opposition from my noble friend. I welcome the words that the Minister said at the beginning of this debate—that he is willing to engage on this matter. I hope that engagement will be constructive.

Thirdly, the Bill introduces draconian rules that would enable the DWP to access welfare recipients’ personal data by requiring banks and building societies to conduct mass monitoring without any reasonable grounds for suspecting fraudulent activity. As the noble Baroness, Lady Young, pointed out, this includes anyone receiving any kind of benefit, including low-risk benefits such as state pensions, so, as she has pointed out, most noble Lords will be subject to this potential intrusion into their privacy—although, fortunately, not me yet. The Government argue that this power is required to reduce levels of benefit fraud. My enthusiasm to tackle fraud is well known, but the Government already have powers to require information where they have grounds to suspect fraudulent behaviour. This new power, effectively enabling them to trawl any bank account with no grounds at all, is a step too far, and constitutes a worrying level of creep towards a surveillance society.

That brings me neatly on to my fourth concern, which the noble Lord, Lord Kamall, raised earlier. The Bill will abolish the post of Biometric and Surveillance Camera Commissioner—currently it is one person—as well as the surveillance camera code. It was interesting that the Minister did not mention this in his opening speech. It is extremely important.

The Government argue that these functions are covered elsewhere or would be moved elsewhere—for example, to the ICO—but that does not seem to be the case. An independent report by the Centre for Research into Information, Surveillance and Privacy, commissioned by the outgoing commissioner, sets out a whole range of areas in which there will be serious gaps in the oversight of handling biometric data and, in particular, the use of surveillance cameras, including facial recognition.

The independent report concludes that none of the Government’s arguments that the functions are adequately covered elsewhere “bear robust scrutiny”. It notes in particular that the claim that the Information Commissioner’s Office will unproblematically take on many BSCC functions mistakes surveillance as a purely data protection matter and thereby limits

“recognition of potential surveillance-related harms”.

Given the ever-widening use of surveillance in this country, including live and retrospective facial recognition, and the myriad other methods of non-facial recognition being developed, such as gait recognition or, as I was reading about this morning, laser-based cardiac recognition—it can read your heartbeat through your clothing—alongside the ability to process and retain ever greater amounts of data and the emerging technology of AI, having clear rules on and oversight of biometrics and surveillance is more important than ever. We see how the misuse of surveillance can go—just look at China. Imagine, for example, if this technology, unfettered, had been available when homosexuality was illegal. Why do the Government want to remove the existing safeguards? With the advances in technology, surely these are more important than ever. We should be strengthening safeguards, not removing them.

The outgoing commissioner—if the Government get their way, the last surveillance camera commissioner —Professor Sampson, put it best:

“There is no question that AI-driven biometric surveillance can be intrusive, and that the line between what is private and public surveillance is becoming increasingly blurred. The technology is among us already and the speed of change is dizzying with powerful capabilities evolving and combining in novel and challenging ways … The planned loss of the surveillance camera code is a good example of what will be lost if nothing is done. It is the only legal instrument we have in this country that specifically governs public space surveillance. It is widely respected by the police, local authorities and the surveillance industry in general. It’s one of those things that would have to be invented it didn’t already exist, so it seems absolutely senseless to destroy it now, junking the years of hard work it took to get it established”.


These are just four of the areas of concern in the Bill. There are many more, as we have heard. In the other place, following the failure of the recommittal Motion after all the new amendments were dropped in at the last minute, David Davis MP said that the Commons had

“in effect delegated large parts of the work on this important Bill to the House of Lords”.—[Official Report, Commons, 29/11/23; col. 888.]

That is our job, and I believe that we do it well. I hope the Minister will engage constructively with the very genuine concerns that have been raised. We must get this Bill right. If we do not, we risk substantial damage to the economy, businesses, individuals’ privacy rights—especially children—and even, as far as the surveillance elements go, to our status as a free and open democratic society.

Data Protection and Digital Information Bill

Lord Vaux of Harrowden Excerpts

Committee stage
Wednesday 17th April 2024 Grand Committee

[Lord Kamall (Con)]

My Lords, I speak in favour of Amendment 195ZA in my name and that of the noble Lords, Lord Vaux of Harrowden and Lord Clement-Jones, and Amendments 289 and 300 on digital identity theft. I am also very sympathetic to many of the points made by the noble Baroness, Lady Jones of Whitchurch, particularly about the most disadvantaged people in our society.

As many noble Lords know, I am a member of the Communications and Digital Committee of this House. A few months ago, we did a report on digital exclusion. We had to be quite clear about one of the issues that we found: even though some people may partly use digital—for example, they may have an email address—it does not make them digitally proficient or literate. We have to be very clear that, as more and more of our public and private services go online, it is obvious that companies and others will want to know which people are claiming to use these services. At the same time, a number of people will not be digitally literate or will not have this digital ID available. It is important that we offer them enough alternatives. It should be clear, and not beyond the wit of man or clever lawyers, that there are non-digital alternatives available for consumers and particularly, as was said by the noble Baroness, Lady Jones of Whitchurch, people from disadvantaged communities.

As we found in the report on our inquiry into digital exclusion, this does not concern only people from deprived areas. Sometimes people get by in life without much digital literacy. There are those who may be scared of it or who do not trust it, and they can come from all sorts of wealth brackets. This drives home the point that it is important to have an alternative. I cannot really say much more than the amendment itself; it does what it says on the tin. The amendment is quite clear and I am sure that the noble Lord, Lord Vaux, will speak to it as well.

I will briefly speak in favour of Amendments 289 and 300. Digital identity theft is clearly an issue and has been for a long time. Even before the digital days, identity theft was an issue and it is so much easier to hack someone’s ID these days. I have had bank accounts opened in my name. I received a letter claiming this but, fortunately, the bank was able to deal with it when I walked in and said, “This wasn’t me”. It is quite clear that this will happen more and more. Sometimes, it will simply be stealing data that has been leaked or because a system is not particularly secure; at other times, it will be because you have been careless. No matter why the crime is committed, it must be an offence in the terms suggested by the amendments of the noble Lord, Lord Clement-Jones. It is clear that we have to send a strong signal that digital identity theft is a crime and that people should be deterred from engaging in it.

[Lord Vaux of Harrowden (CB)]

My Lords, I have added my name to Amendment 195ZA—I will get to understand where these numbers come from, at some point—in the name of the noble Lord, Lord Kamall, who introduced it so eloquently. I will try to be brief in my support.

For many people, probably most, the use of online digital verification will be a real benefit. The Bill puts in place a framework to strengthen digital verification so, on the whole, I am supportive of what the Government are trying to do, although I think that the Minister should seriously consider the various amendments that the noble Baroness, Lady Jones of Whitchurch, has proposed to strengthen parliamentary scrutiny in this area.

However, not everyone will wish to use digital verification in all cases, perhaps because they are not sufficiently confident with technology or perhaps they simply do not trust it. We have already heard the debates around the advances of AI and computer-based decision-making. Digital identity verification could be seen to be another extension of this. There is a concern that Part 2 of the Bill appears to push people ever further towards decisions being taken by a computer.

I suspect that many of us will have done battle with some of the existing identity verification systems. In my own case, I can think of one bank where I gave up in deep frustration as it insisted on telling me that I was not the same person as my driving licence showed. I have also come up against systems used by estate agents when trying to provide a guarantee for my student son that was so intrusive that I, again, refused to use it.

Therefore, improving verification services is to be encouraged but there must be some element of choice, and if someone does not have the know-how, confidence, or trust in the systems, they should be able to do so through some non-digital alternative. They should not be barred from using relevant important services such as, in my examples, banking and renting a property because they cannot or would prefer not to use a digital verification service.

At the very least, even if the Minister is not minded to accept that amendment, I hope that he can make clear that the Government have no intention to make digital ID verification mandatory, as some have suggested that this Part 2 may be driving towards.

[Lord Clement-Jones (LD)]

My Lords, this is quite a disparate group of amendments. I support Amendment 195ZA, which I have signed. I thought that the noble Baroness, Lady Jones, and the noble Lords, Lord Kamall and Lord Vaux, have made clear the importance of having a provision such as this on the statute book. It is important that an individual can choose whether to use digital or non-digital means of verifying their identity. It is important for the liberty and equality of individuals as well as to cultivate trust in what are essentially growing digital identity systems. The use of the word “empower” in these circumstances is important. We need to empower people rather than push them into digital systems that they may not be able to access. Therefore, a move towards digitalisation is not a justification for compelling individuals to use systems that could compromise their privacy or rights more broadly. I very much support that amendment on that basis.

I also very much support the amendments of the noble Baroness, Lady Jones, which I have signed. The Delegated Powers and Regulatory Reform Committee could not have made its recommendations clearer. The Government are serial offenders in terms of skeleton Bills. We have known that from remarks made by the noble Lord, Lord Hodgson, on the Government Benches over a long period. I am going to be extremely interested in what the Government have to say. Quite often, to give them some credit, they listen to what the DPRRC has to say and I hope that on this occasion the Minister is going to give us some good news.

This is an extremely important new system being set up by the Government. We have been waiting for the enabling legislation for quite some time. It is pretty disappointing, after all the consultations that have taken place, just how skeletal it is. No underlying principles have been set out. There is a perfectly good set of principles set out by the independent Privacy and Consumer Advisory Group that advises the Government on how to provide a simple, trusted and secure means of accessing public services. But what assurance do we have that we are going to see those principles embedded in this new system?

Throughout, it is vital that the Secretary of State is obliged to uphold the kinds of concerns being raised in the development of this DVS trust framework to ensure that those services protect the people who use them. We need that kind of parliamentary debate and it has been made quite clear that we need nothing less than that. I therefore very much support what the noble Baroness, Lady Jones, had to say on that subject.

--- Later in debate ---

[Lord Clement-Jones (LD)]

My Lords, in essence, the Minister is admitting that there is a gap when somebody who does not have access to digital services needs an identity to deal with the private sector. Is that right?

[Lord Vaux of Harrowden (CB)]

In the example I gave, I was not willing to use a digital system to provide a guarantee for my son’s accommodation in the private sector. I understand that that would not be protected and that, therefore, someone might not be able to rent a flat, for example, because they cannot provide physical ID.

[Viscount Camrose (Con)]

The Bill does not change the requirements in this sense. If any organisation chooses to provide its services on a digital basis only, that is up to that organisation, and it is up to consumers whether they choose to use it. It makes no changes to the requirements in that space.

I will now speak to the amendment that seeks to remove Clause 80. Clause 80 enables the Secretary of State to ask accredited conformity assessment bodies and registered DVS providers to provide information which is reasonably required to carry out her functions under Part 2 of the Bill. The Bill sets out a clear process that the Secretary of State must follow when requesting this information, as well as explicit safeguards for her use of the power. These safeguards will ensure that DVS providers and conformity assessment bodies have to provide only information necessary for the functioning of this part of the Bill.

--- Later in debate ---

All this paints a picture, I hope, and it is not one of rigorous and open reporting, which the Government’s own net-zero review called for. In March 2021, the Public Accounts Committee also highlighted that government was not clear on how net zero would be given adequate weight in the assessment of government policies and projects. This amendment and reporting requirement would help to fill a little of that gap. It does not require huge additional analysis by the Government simply to report what analysis has been done on the climate and other environmental impacts of the announcements. As I said previously, if that report simply is that no analysis has been done, that would be equally illuminating.

[Lord Vaux of Harrowden (CB)]

This is a slightly disparate group of amendments. I have added my name in support of Amendment 296, tabled by the noble Baroness, Lady Jones of Whitchurch, which once again probes the question of whether this Bill risks causing the loss of the data adequacy ruling from the EU. This was an issue raised by many, if not most, noble Lords during Second Reading, and it is an area in which the Government’s position feels a little complacent.

The data adequacy ruling from the EU is extremely important, as the impact assessment that accompanies the Bill makes clear. It says:

“Cross-border data transfers are a key facilitator of international trade, particularly for digitised services. Transfers underpin business transactions and financial flows. They also help streamline supply chain management and allow business to scale and trade globally”.


The impact assessment then goes on to estimate the costs of losing data adequacy, and indicates a net present value cost range of between £1.6 billion and £3.4 billion over the next 10 years. As an aside, I note that that is a pretty wide range, which perhaps indicates the extent to which the costs are really understood.

The impact assessment notes that these numbers are the impact on direct trade only and that the impact may be larger still when considering supply chain impacts, but it does not make any attempt to calculate that effect. There are big potential costs, however we look at it. It therefore seems extraordinary that the impact assessment, despite running to 240 pages, makes no attempt at all to quantify the probability that the EU might decide—and it is a unilateral EU decision—to withdraw the data adequacy ruling, which it can do at any time, even before the current ruling comes to an end in July 2025. I find it extraordinary that no attempt has been made to estimate the probability of that happening. You would think that, if the Government were as confident as they say they are, they should have some evidence as to the probability of it happening.

Noble Lords should be aware that this means that the potential cost of the loss of data adequacy is not included in the NPV analysis for the Bill. If that loss did occur, the net present value of the Bill would be largely wiped out, and if the lower end of the IA range is taken, the Bill’s overall financial impact becomes a net present cost to the tune of £2.1 billion. The retention of the EU data adequacy ruling is therefore key to retaining any real benefit from this Bill at all.

On Monday, the Minister said:

“We believe they are compatible with maintaining our data adequacy decisions from the EU. We have maintained a positive, ongoing dialogue with the EU to make sure that our reforms are understood. We will continue to engage with the European Commission at official and ministerial levels with a view to ensuring that our respective arrangements for the free flow of personal data can remain in place, which is in the best interests of both the UK and the EU”.—[Official Report, 15/4/24; col. GC 261.]


By “they”, he means the measures in the Bill. So far, so good. But your Lordships will remember that, at the time of Brexit, there was actually considerable doubt as to whether we would be granted a data adequacy ruling at that time, when our rules were almost entirely convergent. This Bill increases divergence, so the approach at the moment seems complacent at best.

I do not think it is any surprise at all that our European Affairs Committee recently launched an inquiry into this very subject. While the Minister has said how confident he is, noises being made in the EU are less encouraging. For example, the chair of the European Parliament’s Civil Liberties, Justice and Home Affairs Committee wrote in February to the European Commissioner for Justice outlining his concerns about this Bill and questioning whether it will meet the requirements of “essential equivalence”, which is the test that we have to meet. He highlighted, in particular, the lack of independence of the Information Commissioner’s Office, and the elimination of the Biometrics and Surveillance Camera Commissioner, something we will come on to a little later.

It does not seem to be a given that data adequacy will be retained, despite the frankly rather woolly assurances from the Minister about his confidence. Given the enormous importance of the data adequacy ruling, and the fact that the impact assessment makes no attempt at all to assess the probability of retaining or losing it—something one would think to be really fundamental when deciding the extent of divergence we wish to follow—it must make sense to introduce the assessment proposed in Amendment 296. In the absence of something much stronger than the assurances the Minister has given so far, I urge the noble Baroness, Lady Jones, to return to this matter on Report: it is really fundamental.

[Lord Bassam of Brighton (Lab)]

My Lords, this group has three amendments within it and, as the noble Lord, Lord Vaux, said, it is a disparate group. The first two seem wholly benign and entirely laudable, in that they seek to ensure that concerns about the environmental impacts related to data connected to business are shared and provided. The noble Baroness, Lady Bennett, said hers was a small and modest amendment: I agree entirely with that, but it is valuable nevertheless.

If I had to choose which amendment I prefer, it would be the second, in the name of my noble friend Lady Young, simply because it is more comprehensive and seems to be of practical value in pursuing policy objectives related to climate change mitigation. I cannot see why the disclosure of an impact analysis of current and future announcements, including legislation, changes in targets and large contracts, on UK climate change mitigation targets would be a problem. I thought my noble friend was very persuasive and her arguments about impact assessment were sound. The example of offshore petroleum legislation effectively not having an environmental impact assessment when its impacts are pretty clear was a very good one indeed. I am one of those who believes that environmental good practice should be written all the way through, a bit like a stick of Brighton rock, and I think that about legislation. It is important that we take on board that climate change is the most pressing issue that we face for the future.

The third amendment, in the name of my noble friend Lady Jones, is of a rather different nature, but is no less important, as it relates to the UK’s data adequacy and the EU’s decisions on it. We are grateful to the noble Lords, Lord Vaux of Harrowden and Lord Clement-Jones, for their support. Put simply, it would oblige the Secretary of State to complete an assessment, within six months of the Bill’s passing,

“of the likely impact of the Act on the EU’s data adequacy decisions relating to the UK”.

It would oblige the Secretary of State to lay a report on the assessment’s findings, and the report must cover data risk assessments and the impact on SMEs. It must also include an estimate of the legislation’s financial impact. The noble Lord, Lord Vaux, usefully underlined the importance of this, with its critical 2025 date. The amendment also probes

“whether the Government anticipate the provisions of the Bill conflicting with the requirements that need to be made by the UK to maintain a data adequacy decision by the EU”.

There is widespread and considerable concern about data adequacy and whether the UK legislative framework diverges too far from the standards that apply under the EU GDPR. The risk that the UK runs in attempting to reduce compliance costs for the free flow of personal data is that safeguards are removed to the point where businesses and trade become excessively concerned. In summary, many sectors including manufacturing, retail, health, information technology and particularly financial services are concerned that the free flow of data between us and the EU, with minimal disruption, will simply not be able to continue.

As the noble Lord, Lord Vaux, underlined, it is important that we in the UK have a relationship of trust with the European Commission on this, although ultimately data adequacy could be tested in the Court of Justice of the European Union. Data subjects in the EU can rely on the general principle of the protection of personal data to invalidate EU secondary and domestic law conflicting with that principle. Data subjects can also rely on the Charter of Fundamental Rights to bring challenges. Both these routes were closed off when the UK left the EU and the provisions were not saved in UK law, so it can be argued that data protection rights are already at a lower standard than across the European Union.

It is worth acknowledging that adequacy does not necessarily require equivalence. We can have different, and potentially lower, standards than the EU but, as long as those protections are deemed to meet whatever criteria the Commission chooses to apply, it is all to the good.

However, while divergence is possible, the concern that we and others have is that the Bill continues chipping away at standards in too many different ways. This chipping away is also taking place in statutory instruments, changes to guidance and so on. If His Majesty’s Government are satisfied that the overall picture remains that UK regulation is adequate, that is welcome, but it would be useful to know what mechanism DSIT and the Government generally intend using to measure where the tipping point might be achieved and how close these reforms take us to it.

The Committee will need considerable reassurance on the question of data adequacy, not least because of its impact on businesses and financial services in the longer term. At various times, the Minister has made the argument that a Brexit benefit is contained within this legislation. If he is ultimately confident of that case, what would be the impact on UK businesses if that assessment is wrong in relation to data adequacy decisions taken within the EU?

We are going to need more than warm words and a recitation that “We think it’s right and that we’re in the right place on data adequacy”. We are going to need some convincing. Whatever the Minister says today, we will have to return to this issue on Report. It is that important for businesses in this country and for the protection of data subjects.

--- Later in debate ---

[Lord Clement-Jones (LD)]

Before the Minister stands up, let me just say that I absolutely agree with what the noble Lord, Lord Bassam, said. Have the Government taken any independent advice? It is easy to get wrapped up in your own bubble. The Government seem incredibly blithe about this Bill. You only have to have gone through our days in this Committee to see the fundamental changes that are being made to data protection law, yet the Government, in this bubble, seem to think that everything is fine despite the warnings coming from Brussels. Are they taking expert advice from outside? Do they have any groups of academics, for instance, who know about this kind of thing? It is pretty worrying. The great benefit of this kind of amendment, put forward by the noble Baroness, Lady Jones, is that nothing would happen until we were sure that we were going to be data adequate. That seems a fantastic safeguard to me. If the Government are just flying blind on this, we are all in trouble, are we not?

[Lord Vaux of Harrowden (CB)]

My Lords, can I point out, on the interests of the EU, that it does not go just one way? There is a question around investment as well. For example, any large bank that is currently running a data-processing facility in this country that covers the whole of Europe may decide, if we lose data adequacy, to move it to Europe. Anyone considering setting up such a thing would probably go for Europe rather than here. There is therefore an investment draw for the EU here.

[Viscount Camrose (Con)]

I do not know what I could possibly have said to create the impression that the Government are flying blind on this matter. We continue to engage extensively with the EU at junior official, senior official and ministerial level in order to ensure that our proposed reforms are fully understood and that there are no surprises. We engage with multiple expert stakeholders from both the EU side and the UK side. Indeed, as I mentioned earlier, a number of experts have submitted evidence to the House’s inquiry on EU-UK data adequacy and have made clear their views that the DPDI reforms set out in this Bill are compatible with EU adequacy. We continue to engage with the EU throughout. I do not want to be glib or blithe about the risks; we recognise the risks but it is vital—

--- Later in debate ---

[Baroness Bennett of Manor Castle (GP)]

My Lords, I thank the Minister for his answer. This has been a fairly short but fruitful debate. We can perhaps commend the Minister for his resilience, although it feels like he was pounded back on the ropes a few times along the way.

I will briefly run through the amendments. I listened carefully to the Minister, although I will have to read it back in Hansard. I think he was trying to say that my Amendment 195A, which adds energy and carbon intensity to this list, is already covered. However, I really cannot see how that can be claimed to be the case. The one that appears to be closest is sub-paragraph (iv), which refers to “performance or quality”, but surely that does not include energy and carbon intensity. I will consider whether to come back to this issue.

The noble Baroness, Lady Young of Old Scone, presented a wonderfully clear explanation of why Amendment 218 is needed. I particularly welcome the comments from the noble Lord, Lord Bassam, expressing strong Labour support for this. Even if the Government do not see the light and include it in the Bill, I hope that the noble Lord’s support can be taken as a commitment that a future Labour Government intend to follow that practice in all their approaches.

[Lord Vaux of Harrowden (CB)]

Good try.

[Baroness Bennett of Manor Castle (GP)]

It was worth a try.

--- Later in debate ---

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to take part in today’s Committee proceedings. I declare my technology interests as an adviser to Boston Limited. It is self-evident that we have been talking about data but there could barely be a more significant piece of data than biometrics. In moving the amendment, I shall speak also to Amendments 197B and 197C, and give more than a nod to the other amendments in this group.

When we talk about data, it is always critical that we remember that it is largely our data. There could be no greater example of that than biometrics. More than data, they are parts and fragments of our very being. This is an opportune moment in the debate on the Bill to strengthen the approach to the treatment and the use of biometrics, not least because they are being increasingly used by private entities. That is what Amendments 197A to 197C are all about—the establishment of a biometrics office, a code of practice and oversight, and sanctions and fines to boot. This is of that level of significance. The Bill should have that strength when we are looking at such a significant part of our very human being and data protection.

Amendment 197B looks at reporting and regulatory requirements, and Amendment 197C at the case for entities that have already acted in the biometrics space prior to the passage of the Bill. In short, it is very simple. The amendments take principles that run through many elements of data protection and ensure that we have a clear statement on the use and deployment of biometrics in the Bill. There could be no more significant pieces of data. I look forward to the Minister’s response. I thank the Ada Lovelace Institute for its help in drafting the amendments, and I look forward to the debate on this group. I beg to move.

[Lord Vaux of Harrowden (CB)]

My Lords, I have added my name in support of the stand part notices of the noble Lord, Lord Clement-Jones, to Clauses 147, 148 and 149. These clauses would abolish the office of the Biometrics and Surveillance Camera Commissioner, along with the surveillance camera code of practice. I am going to speak mainly to the surveillance camera aspect, although I was taken by the speech of the noble Lord, Lord Holmes, who made some strong points.

The UK has become one of the most surveilled countries in the democratic world. There are estimated to be over 7 million CCTV cameras in operation. I give one example: the automated number plate recognition, ANPR, system records between 70 million and 80 million readings every day. Every car is recorded on average about three times a day. The data is held for two years. The previous Surveillance Camera Commissioner, Tony Porter, said about ANPR that it,

“must surely be one of the largest data gatherers of its citizens in the world. Mining of meta-data—overlaying against other databases can be far more intrusive than communication intercept”.

Professor Sampson, the previous commissioner, said about ANPR:

“There is no ANPR legislation or act, if you like. And similarly, there is no governance body to whom you can go to ask proper questions about the extent and its proliferation, about whether it should ever be expanded to include capture of other information such as telephone data being emitted by a vehicle or how it's going to deal with the arrival of automated autonomous vehicles”.


And when it came to independent oversight and accountability, he said:

“I’m the closest thing it’s got—and that’s nothing like enough”.


I am not against the use of surveillance cameras per se—it is unarguable that they are a valuable tool in the prevention and detection of crime—but there is clearly a balance to be found. If we chose to watch everything every person does all of the time, we could eliminate crime completely, but nobody is going to argue that to be desirable. We can clearly see how surveillance and biometrics can be misused by states that wish to control their populations—just look at China. So there is a balance to find between the protection of the public and intrusion into privacy.

Technology is moving incredibly rapidly, particularly with the ever-increasing capabilities of Al. As technology changes, so that balance between protection and privacy may also need to change. Yet Clause 148 will abolish the only real safeguards we have, and the only governance body that keeps an eye on that balance. This debate is not about where that balance ought to be; it is about making sure that there is some process to ensure that the balance is kept under independent review at a time when surveillance technologies and usage are developing incredibly rapidly.

I am sure that the Minister is going to argue that, as he said at Second Reading:

“Abolishing the Surveillance Camera Commissioner will not reduce data protection”.—[Official Report, 19/12/23; col. 2216.]


He is no doubt going to tell us that the roles of the commissioner will be adequately covered by the ICO. To be honest that completely misses the point. Surveillance is not just a question of data protection; it is a much wider question of privacy. Yes, the ICO may be able to manage the pure data protection matters, but it cannot possibly be the right body to keep the whole question of surveillance and privacy intrusion, and the related technologies, under independent review.

It is also not true that all the roles of the commissioner are being transferred to other bodies. The report by the Centre for Research into Surveillance and Privacy, or CRISP, commissioned by the outgoing commissioner, is very clear that a number of important areas will be lost, particularly reviewing the police handling of DNA samples, DNA profiles and fingerprints; maintaining an up-to-date surveillance camera code of practice with standards and guidance for practitioners and encouraging compliance with that code; setting out technical and governance matters for most public body surveillance systems, including how to approach evolving technology, such as Al-driven systems including facial recognition technology; and providing guidance on technical and procurement matters to ensure that future surveillance systems are of the right standard and purchased from reliable suppliers. It is worth noting that it was the Surveillance Camera Commissioner who raised the issues around the use of Hikvision cameras, for example—not something that the ICO is likely to be able to do. Finally, we will also lose the commissioner providing reports to the Home Secretary and Parliament about public surveillance and biometrics matters.

Professor Sampson said, before he ended his time in office as commissioner:

“The lack of attention being paid to these important matters at such a crucial time is shocking, and the destruction of the surveillance camera code that we’ve all been using successfully for over a decade is tantamount to vandalism”.


He went on to say:

“It is the only legal instrument we have in this country that specifically governs public space surveillance. It is widely respected by the police, local authorities and the surveillance industry in general … It seems absolutely senseless to destroy it now”.


The security industry does not want to see these changes either, as it sees the benefits of having a clear code. The Security Systems and Alarms Inspection Board, said:

“Without the Surveillance Camera Commissioner you will go back to the old days when it was like the ‘wild west’, which means you can do anything with surveillance cameras so long as you don’t annoy the Information Commissioner … so, there will not be anyone looking at new emerging technologies, looking at their technical requirements or impacts, no one thinking about ethical implications for emerging technologies like face-recognition, it will be a free-for-all”.


The British Security Industry Association said:

“We are both disappointed and concerned about the proposed abolition of the B&SCC. Given the prolific emergence of biometric technologies associated with video surveillance, now is a crucial time for government, industry, and the independent commissioner(s) to work close together to ensure video surveillance is used appropriately, proportionately, and most important, ethically”.


I do not think I can put it better than that.

While there may be better ways to achieve the appropriate safeguards than the current commissioner arrangement, this Bill simply abolishes everything that we have now and replaces the safeguards only partially, and only from a data protection perspective. I am open to discussion about how we might fill the gaps, but the abolition currently proposed by the Bill is a massively retrograde and even dangerous step, removing the only safeguards we have against the uncontrolled creep towards ever more intrusive surveillance of innocent people. As technology increases the scope for surveillance, this must be the time for greater safeguards and more independent oversight, not less. The abolition of the commissioner and code should not happen unless there are clear, better, safeguards established to replace it, and this Bill simply does not do that.

--- Later in debate ---

Overall, these clauses will support the police to retain biometric data from international partners, including Interpol, ensuring that biometrics are retained in a proportionate way, while protecting the public from national security-related risks, such as terrorism. Given the positive impact these changes will have on national security—changes which, in part, have the support of the relevant independent reviewers and which are being pursued only following a formal request from policing—I cannot support the noble Lord’s opposition to Clauses 130, 131 and 132 standing part of the Bill, and I hope that he will not press it.

[Lord Vaux of Harrowden (CB)]

My Lords, to go back to some of the surveillance points, one of the issues is the speed at which technology is changing, with artificial intelligence and all the other things we are seeing. One of the roles of the commissioner has been to keep an eye on how technology is changing and to make recommendations as to what we do about the impacts of that. I cannot hear, in anything the noble Viscount is saying, how that role is replicated in what is being proposed. Can he enlighten me?

[Viscount Camrose (Con)]

Yes, indeed. In many ways, this is advantageous. The Information Commissioner obviously has a focus on data privacy, whereas the various other organisations, particularly BSCC, EHRC and the FINDS Board, have subject-specific areas of expertise on which they will be better placed to horizon-scan and identify new emerging risks from technologies most relevant to their area.

[Lord Vaux of Harrowden (CB)]

Is the noble Viscount saying that splitting it all up into multiple different places is more effective than having a single dedicated office to consider these things? I must say, I find that very hard to understand.

[Viscount Camrose (Con)]

I do not think we are moving from a simple position. We are moving from a very complex position to a less complex position.

Data Protection and Digital Information Bill

Lord Vaux of Harrowden Excerpts

Committee stage
Monday 22nd April 2024 Grand Committee

[Baroness Lister of Burtersett (Lab)]

My Lords, it is a great pleasure to follow the noble Lord, Lord Kamall. Although we probably come from very different positions on the role of the state, I agree with virtually everything that he said. I apologise for popping up at this late stage of proceedings on the Bill but, as someone with a long-standing concern about social security matters, I was shocked by the inclusion of these powers and want to add my support to those opposing them and, should this opposition prove unsuccessful, to the very sensible set of recommendations made by my noble friend Lady Sherlock.

The Child Poverty Action Group, of which I am honorary president, and Z2K warn that the stakes are high for claimants, as getting caught up in an error and fraud investigation can lead to the wrongful suspension and/or termination of their benefits. They give some horrendous examples of where this has happened. I will read just one: “A claimant with severe mental health problems whose main carer had recently passed away had his UC suspended in October 2023 by the UC case review when he was unable to obtain and upload bank statements on request. The suspension continued for four months and he was unable to pay for food, electricity or heating. When he was referred for benefits advice and his welfare rights adviser contacted the UC case review team, she was told that claims under review are randomly chosen and they are not targeted in any way”. This is someone with mental health problems left without any money; this could become the norm under this proposal.

The briefing from the CPAG and Z2K also cites the perspective of Changing Realities—families with experience in claiming low-income benefits. One warns that

“it will put folk off claiming altogether”.

I always remember, when I worked at the CPAG, getting a phone call from a woman who started by saying, “Please don’t think I’m a scrounger”. I am afraid that is still very much how people often feel about claiming benefits. Treating all social security recipients as potentially fraudulent can but increase the stigma associated with claiming. Amendment 219 in the name of my noble friend Lord Sikka is highly pertinent here. The point has already been made, but how would we feel if we knew that our bank accounts could well be scrutinised for potential tax evasion? I realise that I should declare an interest: as a pensioner, ultimately my bank account will be trawled, but that is down the line. Underlying this is a double standard that has operated year after year in social security and tax fraud.

The CPAG and Z2K also warn that some of the most marginalised people in our society could get caught up in these speculative searches. Given this, can the Minister explain why—I believe this is still the case—there is no equalities impact assessment for these provisions? Disabled people’s organisations are very worried about the likely implications for their members, such as in the case of disabled people who set up bank accounts to pay for their social care. They warn of the potential mental health impact as existing mental distress and trauma could be exacerbated by the knowledge that they are under surveillance—a point made by the noble Baroness, Lady Kidron.

The Government state that they

“are confident that the power is proportionate and would operate in a way that it only brings in data on DWP claimants, and specifically those claimants where there is a reasonable suspicion that something is wrong within their claim”.

Given the evidence of people already being wrongfully targeted for fraud and the strongly expressed view of organisations such as Justice, as well as the Information Commissioner, that the measures are disproportionate and therefore arguably unlawful, can the Minister say on what evidence that confidence is based? Given this confidence, I hope that the Government will accept without demur Amendments 220 to 222 in the next group from my noble friend Lady Sherlock.

Picking up what my noble friend Lord Sikka said, what is the breakdown between suspected fraud and error? It is not helpful that they are always talked about as though they are one and the same thing. The Government have argued that one reason the power is necessary is to provide the tools to enable the DWP to

“minimise the impact of genuine mistakes that can lead to debt”.

Try telling that to recipients of carer’s allowance who have been charged with fraud as a result of genuine mistakes relating to the earnings threshold. The fact that the DWP already has the information and power it needs to act to ensure that debts do not accrue in this situation, yet in countless cases has not used it until the point where very large sums may be owing, does not instil confidence, as mentioned by the noble Baroness, Lady Kidron.

On Amendment 303, which relates to Amendment 230, one of the criticisms of these provisions has been the lack of consultation. Has the Social Security Advisory Committee been consulted? If so, what was its response; if not, why not?

In conclusion, I support the opposition to Clause 128 and Schedule 11 standing part of the Bill, but so long as they do stand part, I hope very much that the Minister will take seriously the amendments in the name of my noble friend in this group and the next two.

[Lord Vaux of Harrowden (CB)]

My Lords, I was also too late to put my name to these stand part notices for Clause 128 and Schedule 11. There must have been a stampede towards the Public Bill Office, meaning that some of us failed to make it.

At Second Reading, I described Clause 128 as “draconian”. Having dug into the subject further, I think that was an understatement. Data protection is a rather dry subject and, as the debates throughout this Committee stage have shown, it does not generate a lot of excitement. We data protection enthusiasts are a fairly select group, but it is nice to see a few new faces here today.

The Bill runs to 289 pages and is called the Data Protection and Digital Information Bill. Nothing in that name suggests that around 20 pages of it relate, in effect, to giving the Government unlimited access to the bank accounts of large swathes of the population without suspicion of any wrongdoing—20 pages is larger than many Bills. I wonder what the reaction in this Committee and the other place might have been if those 20 pages had been introduced as a stand-alone Bill—called, perhaps, the government right to access bank account information Bill. I suspect that we might have had a few more people in this Room. It feels as if this draconian clause is being hidden in the depths of a Bill that the Government perhaps felt would not generate much interest. It is particularly concerning that it was dropped into the Bill at the last minute in the other place and has not, therefore, received scrutiny there either. This sort of draconian power deserves much more scrutiny than on day 6 in Committee in the Moses Room.

I hope that my desire to stamp out fraud is well known—indeed, I think I can probably describe myself as rather boring on the subject—so I have a lot of sympathy for the Government’s underlying intention here. However, a right to require banks to carry out suspicionless surveillance over the bank accounts of anybody who receives pretty much any kind of benefit, directly or indirectly, is a huge intrusion into privacy and feels completely disproportionate. Others have covered the detail eloquently, so I just want to ask a number of questions of the Minister—I see that we have had a viscount swap at this stage.

I have been trying to work out exactly which accounts could be covered by this requirement. Schedule 11 is not the easiest document to read. It seems clear that if, for example, I am a landlord receiving rent directly from the benefit system on behalf of a tenant, the account of mine that receives the money would be covered, as would any other account in my name. However, would it also catch, for example, a joint account with my wife? I think it would. Would it catch a business account or an account for a charity where I am a signatory, a director or a trustee? I am not sure from reading it, I am afraid. Can the noble Minister clarify that?

Once received, the information provided by the banks may be used

“for the purposes of, or for any purposes connected with, the exercise of departmental functions”.

That seems extremely broad, and I cannot find anything at all setting out for how long the information can be retained. Again, can the Minister clarify that?

As well as being a data protection enthusiast, I am also an impact assessment nerd. I have been trying to work out from the impact assessment that accompanies the Bill—without much success—how much money the Government anticipate recovering as a result of these proposed rights, as well as the cost to the banks, the department and any other parties in carrying out these orders. The impact assessment is rather impenetrable—I cannot find anything in it that covers these costs—so I would be grateful if the Minister could say what they are and on what assumptions those numbers are based.

The noble Lord, Lord Kamall, mentioned unintended consequences. I echo his points: this is really important. Putting additional onerous obligations on banks may make them decide that it is too difficult to provide accounts to those in receipt of benefits. Access to bank accounts for vulnerable people is already an issue, and any incentive to make that worse is a real problem. As the noble Lord pointed out, we have a good example of that with PEPs. All of us have, I suspect, experienced finding it at least difficult to open an account. Some of us have had accounts refused or even closed simply because we have made it difficult for the banks to act for us. The same risk applies to landlords. Why would a landlord want to receive money from housing benefits directly when it will mean that all of his bank accounts and linked accounts will be looked at? He will simply say no. We are therefore reducing the pool of potential accommodation available to housing benefit claimants.

--- Later in debate ---

[Baroness Buscombe (Con)]

I am sorry; I have spent a lot of time listening to others, and a lot of it has been slightly interesting to listen to, I have to say.

The measure will not enable the DWP to access any accounts, and the DWP will not be able to use this measure to check what claimants are spending. The DWP can request information only where there is a link between the DWP, the third party and the benefit claimant or recipient of a payment, and will receive only minimum information on those cases where potential fraud and error are signalled. Once received, the DWP will look at each case individually through its business-as-usual processes and by using existing powers. That work will carefully be undertaken by a human and no automated decisions will be made. That is a really interesting and important point in terms of this measure. I now turn to my noble friend.

[Lord Vaux of Harrowden (CB)]

I am grateful to the noble Baroness, but could she point out where those restrictions actually are in the Bill? It says that an account information notice can include

“the names of the holders … other specified information relating to the holders … and … such further information in connection with those accounts as may be specified”.

It basically allows the DWP to ask for any information relating to those accounts. I do not see the restrictions that she has just spoken about.

[Baroness Buscombe (Con)]

It is important that my noble friend answers that question. The point is that if we find—I am sorry, I still speak as if I am involved with it, which I am not, but I promise noble Lords that I have spent so much time in this area. If the DWP finds that there is a link that needs pursuing then that obviously has to be opened up to some degree to find what is going on. Remember, the most important thing about this is that the right people get the right benefits. That is what the Government are trying to achieve.

--- Later in debate ---

To address another misconception, it is not a surveillance or investigations power, as was alluded to by the noble Lord, Lord Vaux. This measure does not meet the legal definition of surveillance, as the data gathering will be neither covert nor the purpose of an investigation. This is solely a data-gathering power that will help us to check whether individuals appear to meet the eligibility rules for the benefit that they are receiving. This should not be confused with powers that the DWP already holds under the Investigatory Powers Act 2016 to investigate individual cases where there is a suspicion of criminality.

[Lord Vaux of Harrowden (CB)]

I apologise for interrupting, but can the Minister show us in the Bill where those restrictions on the information that can be requested reside? As I read it, as I mentioned to the noble Baroness, Lady Buscombe, paragraph 2(1) of new Schedule 3B, as inserted by Schedule 11 of the Bill, is pretty wide when it refers to

“names of holders … other specified information relating to the holders … and … such further information in connection with those accounts as may be specified”.

So it appears that the DWP can ask for whatever it wants, rather than what the Minister just described.

[Viscount Younger of Leckie (Con)]

That is a fair challenge and I will certainly be coming on to that. I have in my speech some remarks and a much more limited reassurance for the noble Lord.

It is only when there is a signal of potential fraud or error that the DWP may undertake a further review, using our business-as-usual processes and existing powers—an important point. DWP will not share any personal information with third parties under this power, and only very limited data on accounts that indicate a potential risk of fraud or error will be shared with DWP in order to identify a claimant on our system. As I said earlier, I will say more about the limited aspects of this later in my remarks.

--- Later in debate ---

[Viscount Younger of Leckie (Con)]

Yes, I am aware of that. I think the noble Lord was alluding to the point about proportionality. I listened carefully and took note of that, but do not entirely agree with it. I hope that I can provide further reassurances, if not now then in the coming days and weeks. The point is that there is no other reasonable way to independently verify claimants’ eligibility for the payment that they are receiving.

I turn to the amendments raised, starting with the stand part notice from the noble Baronesses, Lady Kidron and Lady Chakrabarti, the noble Lord, Lord Anderson of Ipswich, who is not in his place, and the noble Lord, Lord Clement-Jones. They and my noble friend Lord Kamall, who is not in his place, interestingly, all made their case for removing the clause, of which I am well aware. However, for the reasons that I just set out, this clause should stand part of the Bill.

In raising her questions, the noble Baroness, Lady Kidron, made some comparisons with HMRC. There are appropriate safeguards in place for this data-gathering power, which will be included in the code of practice. The safeguards for this measure will be equivalent to those in place for the similar HMRC power which Parliament approved in the Finance Act 2011.

[Lord Vaux of Harrowden (CB)]

When might we see the code of practice? It would be extremely helpful to see it before Report, as that might short-cut some of these discussions.

[Viscount Younger of Leckie (Con)]

I will need to get back to the noble Lord on that, but perhaps can reassure him that it is already being worked on. You can imagine that, because of the sensitivity of these powers, we are working very carefully on this and making sure that it will be fit for purpose.

--- Later in debate ---

The Minister, the noble Viscount, Lord Younger, quoted a survey from 2023 on the public’s views of these powers. I point out that, as the noble Baroness, Lady Sherlock, said on the last group, we have recently heard a great deal about how recipients of carer’s allowance have been absolutely hammered by its cliff-edge nature and the way that the DWP has been chasing them. I suggest to the Minister that, after all those revelations, public views might have changed quite a lot.

[Lord Vaux of Harrowden (CB)]

My Lords, I was not intending to speak on this group, but another question occurs to me. We have been assuming throughout this that we are talking about requests of information to banks, but the Bill actually says that:

“The Secretary of State may give an account information notice to a person of a prescribed description”.


Could the Minister explain what that is?

[Lord Clement-Jones (LD)]

My Lords, I would of course much prefer Clause 128 not to stand part, but we were just privileged by a master class from the noble Baroness, Lady Sherlock. She talked about these being probing amendments, but I do not think that I have seen a schedule so expertly sliced and diced before. If those are probing, they are pretty lethal. I agree with so many of those elements. If we are to have provisions, those are the kinds of additions that we would want and the questions that we would want to ask about them. I very much hope that the Minister has lots of answers, especially for the noble Baroness, Lady Sherlock, but also for the other noble lords who have spoken.

--- Later in debate ---

[Viscount Younger of Leckie (Con)]

I am not sure I agree with that. I hope I can reassure the noble Baroness, as I tried to on the previous group. Using our test and learn process, which is already under way working closely with the banks, bringing them along with us and them bringing us along with them—there is a good relationship there—we are working through these important matters.

The point made by the noble Baroness, Lady Kidron, is important, as is that of the noble Baroness, Lady Jones. Again, it is important to give those reassurances. They will be forthcoming, and that is all part of our test and learn process, which I hope provides some reassurance.

[Lord Vaux of Harrowden (CB)]

I want to be absolutely clear on this point, because I am still not totally sure I am—I raised this the first time around on the last group. If I, as a landlord, have been paid rent as housing benefit directly, my accounts are caught. If I am a trustee of a charity and a cosignatory on a bank account, is the Minister saying that that charity’s account will be caught or not? I want to be absolutely crystal clear on that.

[Viscount Younger of Leckie (Con)]

This is part of the filtering discussions that are already taking place at the moment.

[Lord Vaux of Harrowden (CB)]

Under the terms of the Bill, would this allow that to be caught?

[Viscount Younger of Leckie (Con)]

Yes it would. Landlords are in scope. We will filter this through in terms of the business as usual. If we receive any information—

--- Later in debate ---

[Baroness Kidron (CB)]

How many accounts of “signalling” already exist in the current backlog in the business-as-usual version? What kind of investment will it take when you supercharge these powers and get many more tens of thousands of signals?

[Lord Vaux of Harrowden (CB)]

I will add to the Minister’s grief. He has talked a number of times about the limited information that will be provided to the DWP, but that is not what the Bill says. The Bill refers to

“such further information in connection with those accounts as may be specified”.

There is no limitation in the Bill to the information that the DWP can request from the bank—assuming that it is a bank, after my previous question. I am struggling to understand how we get from that to “limited”.

[Viscount Younger of Leckie (Con)]

Right. A number of questions have been asked. I am not sure that I can give too much more clarity—only that I will go back to what I said on the first group in terms of the limited nature of what we are trying to do. I was very clear about its limited nature, I think.

This leads on to the numbers that noble Lords are asking me about. Of course, I cannot give that figure, as we do not honestly know it. Until we move forward on bringing the measure in, we will not know it. What is certain is that we need this power to be able to gain the limited data that we need. When we receive the data, it may be the case that we need to follow up. I am sure that we will not need to follow up in the vast majority of cases but we must have this power.

To the noble Lord, Lord Vaux, I say this: this measure is for UK accounts only. I hope that that is also helpful to the noble Baroness, Lady Bennett.

[Lord Vaux of Harrowden (CB)]

This is the problem. We have been talking about limited information, a limited nature and the limited things that we will look at, but that is not what the Bill says. We need to think seriously about how we should limit the rights in the Bill to match the requirements of the DWP. At the moment, there seems to be a huge gap.

[Viscount Younger of Leckie (Con)]

That point is very much noted. I will certainly take it back. Clearly, we need to provide greater reassurance on the limits and scope, as well as on what we are trying to do. I regret that I am not able to give those answers in full to the Committee now but I hope that, today, I have already taken us further forward than we were before we started. That is quite an important point to make.

I shall touch on the benefits that are in scope of this measure, a point that was raised by the noble Baroness, Lady Sherlock. I think the noble Baroness wishes to restrict the power to working-age benefits, but pension-age benefits are not immune to fraud and error—I wanted to address that—and it is our duty to ensure that these benefits are paid correctly and in line with the benefit eligibility rules that Parliament has previously agreed. Every payment that the DWP makes has eligibility criteria to it. Parliament has considered these criteria in the passage of the relevant social security legislation, and the Government have a responsibility to check that payments are being made in line with those rules so that taxpayers’ money is spent responsibly.

Data Protection and Digital Information Bill

Lord Vaux of Harrowden Excerpts

Committee stage
Wednesday 24th April 2024 Grand Committee

[Lord Clement-Jones (LD)]

My Lords, we have talked about proportionality and disproportionality throughout the debate on this Bill. Is it not extraordinary that that figure is not on the table, given the extent of these powers?

[Lord Vaux of Harrowden (CB)]

My Lords, the Minister was kind enough to mention me a little earlier. Can I just follow up on that? In the impact assessment, which I have here, nowhere can I find the £600 million figure, nor can I find anywhere the costs related to this. There will be a burden on the banks and clearly quite a burden on the DWP, actually, if it has got to trawl through this information, as the noble Viscount says, using people rather than machines. The costs are going to be enormous to save, it would appear, up to £120 million per year out of £6.4 billion per year of fraud. It does seem odd. It would be really helpful to have those cost numbers and to understand in what document they are, because I cannot find in the impact assessment where these numbers are.

[Viscount Younger of Leckie (Con)]

I hope I can help both noble Lords. Although I must admit that I have not read every single page, I understand that the figure of £500 million is in the IA.