Digital Economy Bill (Eighth sitting)

Louise Haigh Excerpts

Committee Debate: 8th sitting: House of Commons
Tuesday 25th October 2016 Public Bill Committees

[The Chair]

We are catapulted into part 5 of the Bill.

Clause 29

Disclosure of information to improve public service delivery

[Louise Haigh (Sheffield, Heeley) (Lab)]

I beg to move amendment 98, in clause 29, page 28, line 25, leave out “had regard to” and insert “complied with”.

This amendment provides stronger compliance with the code of practice on the disclosure of information.

[The Chair]

With this it will be convenient to discuss the following:

Amendment 100, in clause 30, page 29, line 33, leave out “had regard to” and insert “complied with”.

This amendment provides stronger compliance with the code of practice on the disclosure of information.

Amendment 99, in clause 32, page 30, line 13, at end insert—

‘(1A) In determining whether to make regulations under section 29, 30 or 31 the appropriate national authority must ensure that—

(a) the sharing of information authorised by the regulations is minimised to what is strictly necessary,

(b) the conduct authorised by the regulations to achieve the “specified objective” is proportionate to what is sought to be achieved by that conduct,

(c) a Privacy Impact Assessment compliant with the relevant code of practice of the Information Commissioner’s Office has taken place and been made publicly available,

(d) the proposed measures have been subject to public consultation for a minimum of 12 weeks, and responses have been given conscientious consideration.

(1B) As soon as is reasonably practicable after the end of three years beginning with the day on which the regulations come into force, the relevant Minister must review its operation for the purposes of deciding whether these should be amended or repealed.

(1C) Before carrying out the review the relevant Minister must publish the criteria by reference to which that determination will be made.

(1D) In carrying out the review the relevant Minister must consult—

(a) the Information Commissioner, and

(b) open the review to public consultation for a minimum of 12 weeks, and demonstrate that responses have been given conscientious consideration.”

This amendment seeks to reduce the risk of successful legal challenges. Challenges are often made on grounds of privacy and this would amend that to increase privacy safeguards.

Amendment 96, in clause 32, page 30, line 33, at end insert—

‘(3A) A particular person identified in personal information disclosed under sections 29, 30 or 31 is able to request to a specified person under subsection 29(1) that the personal information is modified and corrected if necessary.”

Amendment 95, in clause 32, page 30, line 34, leave out

“(including a body corporate)”

and insert

“, a group of persons, a private company or a publicly traded company irrespective of their size and revenue, but”.

Amendment 105, in clause 35, page 32, line 31, leave out “have regard to” and insert “comply with”.

[Louise Haigh]

I am very grateful to my hon. Friend the Member for Cardiff West for giving me some much-needed time off. I do not wish to disappoint the Minister by not being as brief as we were earlier, but I am not sorry, because part 5 really does require some further scrutiny. I think the Government know that it was not ready for Committee, not least because they have tabled several dozen amendments to it, but also because the codes of practice were not in good enough shape last week, according to the Information Commissioner, but were published just a few days later—some civil servants were clearly working overtime in the intervening period.

Clause 29 allows specified persons to share data for a specified objective. All national authorities will be enabled to lay regulations through secondary legislation for exactly what those data-sharing arrangements will be and what they will be for. In doing so, this clause lays out that they will be required to ensure the secure handling of information and to have regard to the codes of practice. Our amendments seek to strengthen this and to ensure that anyone involved in the sharing of data under these new powers is in full compliance with the codes of practice that were published last week.

I want to be very clear here: the Opposition do not oppose the Government’s sharing data among themselves to improve policy making and public services, but we must get this absolutely right and we are still a long way away from that, given the state of the current proposals. This is a key point: the public support the sharing of data to better enable the Government to provide services and to better enable the public to make use of those services, but public trust is fragile and has been rocked in recent years by varying degrees of incompetence in managing those data. Before Government Members point out that previous Labour Administrations were just as guilty, I should say that I fully accept that. This is not a political but rather an administrative point, which is why such proposals need to proceed with the utmost caution.

The Information Commissioner produced a very instructive report on this very point, which is extremely important to this part of the Bill, because it demonstrates the circumstances in which the public are happy for their data to be shared. The commonly recurring themes of what the public want regarding data could not be clearer: they want control over their data; they want to know what organisations are doing with those data; and they want to understand the different purposes and benefits of sharing their data. In that context, 63% of people agreed that they had lost control over the way in which their data are being used. This demonstrates that if there is to be sharing of data, which we support, there must be very clearly defined safeguards based on consent and transparency.

This part of the Bill gives considerable powers to Government to share data, but there are essentially no safeguards built in to ensure privacy, data protection, proportionality and a whole host of other principles that should sit alongside data sharing. It is vital that these reforms go ahead and we are completely in favour of effective data sharing across Government to achieve public sector efficiencies, value for money, improved public sector services, take-up of benefits for the most vulnerable, such as the warm home discount or free school meals, and, most importantly, an improved experience for those who use public services.

The Minister for Digital and Culture claimed in an evidence session that the safeguards are in the Bill, but that is simply not the case. I would be grateful if the Parliamentary Secretary, Cabinet Office outlined what safeguards he thinks there are. As I, a relatively amateur observer, as well as those who are much more expert in the matter read it, the safeguards are to be added at a later date, written up by the Government and consulted on with people whom the Government deem fit to consult. Furthermore, there is absolutely nothing the public sector does that is not covered by the clause. I would be grateful, therefore, if the Minister gave give us a single example that that—I quote from the clause—for the purposes of

“the improvement of the well-being of individuals or households”,

or of improving

“the contribution made by them to society”,

would not deliver.

--- Later in debate ---

[Calum Kerr]

It is good to see the shadow Minister back in her place. She is making an excellent start to this section of the debate, pulling out many of the key issues. I am afraid that the ministerial team might not like the scrutiny that the process is supposed to provide—and essentially does. The point about transparency is critical and there is a confidential submission that points out that transparency does not prevent people from doing anything; it simply requires them to be accountable for what they do. We have recently seen the case of HMRC outsourcing to Concentrix the ability to collect tax credits. Data from another source were used, and we all know the damage that can be done when that is not done well.

[Louise Haigh]

I am grateful for that intervention. I am very aware of the Concentrix case and will come on to it shortly.

On the inclusion of non-public sector authorities and the Government’s intention to strictly define the circumstances and purposes under which data sharing with such organisations will be allowed, their statement of intent was clear. However, only one paragraph in the 101-page draft code mentions non-public sector organisations. That paragraph says that an assessment should be made of any conflicts of interest that the non-public authority may have but it does not give any examples of what those conflicts of interest might look like, so perhaps the Minister will elaborate on that when he responds. It states that a data-sharing agreement should identify whether any unintended risks are involved in disclosing data to the organisation—the risk regarding Concentrix was just highlighted—but the code of practice does not list any examples or set out how specified persons might go about ascertaining those. It also states that non-public authorities can only participate in a data-sharing agreement once their sponsoring public authority has assessed their systems and procedures to be appropriate for the secure handling of data, but it does not give any sense of what conditions they will be measured against or how officials should assess them.

That is not the kind of reassurance that was provided in the Government’s consultation response. Given that these are draft codes, I hope the Minister will take what I have said away and improve them, not least because of the recent scandal relating to the US multinational company, Concentrix, which was contracted by HMRC to investigate tax credit error and fraud. Concentrix sent letters to individuals—mostly working single mothers across the country receiving tax credits—in what was essentially a large-scale phishing exercise. Not only did it get things catastrophically wrong by cancelling benefits that it should not have cancelled and leaving working mothers destitute over many weeks and months in some cases, but it performed serious data breaches in sending multiple letters to the wrong individuals and disclosing personal information.

We have made it very clear that the Bill could have done with considerably more work before it was brought before the House. I understand that the civil servant who wrote part 5 has now left, or is in the verge of leaving, the employ of the civil service, so there is even more reason for us to work cross party and with expert organisations on improving the proposals.

As I have said, public trust in Government handling of data is not strong. Unfortunately, the public have not been given any reason to put their concerns to rest. The recent National Audit Office report, “Protecting information across government”, revealed the prevalence of weak controls on the protection and management of personal information in Government. Any continuation of the existing poor information management identified by the NAO, or the further weakening of cyber-security and data protection implied by part 5, is likely to have negative economic and social impacts.

As the Information Commissioner’s Office commented:

“It is important that any provisions that may increase data sharing inspire confidence in those who will be affected. Our research shows that the public are concerned about who their data is shared with and reflects concerns that they have lost control over how their information is used. Even apparently well-meaning sharing of data such as GP patient records for research purposes can arouse strong opinions.”

This is an important time to strengthen cyber-security and the minimisation and protection of data, which is why it is so important to get this part of the Bill right. A huge prize is on offer, but this has the potential of going the way of the care.data scandal. Frankly, it is astonishing that neither Ministers nor civil servants have learnt their lessons from that very regrettable episode, because there was absolutely nothing wrong with the principle of care.data either; it attempted to achieve exactly the kind of aims as the Bill’s reforms.

The idea was to create a database of medical records showing how individuals have been cared for across the GP and hospital sectors. Researchers believed that the information would be vital in helping them to develop new treatments as well as assessing the performance of NHS services. The records would be pseudo-anonymised, meaning that the identifiable data would be taken out. Indeed, they would just contain the patient’s age range, gender and the area they lived in. However, researchers could apply for the safeguards to be lifted in exceptional circumstances, such as during an epidemic. That would have needed the Health Secretary’s permission.

The concept had the backing of almost the entire medical community, many charities and some of the most influential patient groups. The UK’s leading doctors told us how access to so many NHS records would help them to understand the causes of disease, quickly spot the side effects of new drugs and detect outbreaks of infectious diseases.

The problem with care.data was that the advantages and the principles upon which the data would be shared were simply not communicated by the Government or by NHS England, and so it attracted the criticism of bodies as disparate as the British Medical Association, the privacy campaign group Big Brother Watch and the Association of Medical Research Charities. Such was the botched handling of the publicity surrounding care.data that, by April 2014, the launch was aborted. However, it emerged the following June that nearly 1 million people who had opted out of the database were still having their confidential medical data shared with third parties, because the Health and Social Care Information Centre had not processed their requests.

A review by the National Data Guardian, Dame Fiona Caldicott, found that care.data had caused the NHS to lose the trust of patients, and recommended a rethink. That prompted the then Life Sciences Minister, the hon. Member for Mid Norfolk (George Freeman), to announce that the scheme was being scrapped altogether, even though £7.5 million had already been spent on constructing a database, printing leaflets, setting up a patient information helpline and researching public attitudes to data sharing.

The Caldicott review established a set of Caldicott principles, with the primary one being that the public as well as the professionals should be involved in data-sharing arrangements. Dame Fiona Caldicott proposed a simple model that gives people the option to opt out of any of their information being used for purposes beyond care. She said:

“We made it slightly more complicated by saying it was worth putting to the public the choice of having two separate groups of information to opt out of – [those being] research and information used for running the health service. If you put all of the possible uses of data currently in the system together and asked people to opt in or out of that, it’s actually asking them to make a choice about a very big collection of information. [People] may want to have the possibility of saying, ‘Yes, I’d like my data to be used for the possibility of research, but I don’t want it to be used for running the health service’.”

She also made it very clear that the benefits of data sharing and what it means need to be communicated clearly to the public, as there is a lot of confusion around how the data are shared.

Absolutely nothing has changed since that disaster and the subsequent review, so it is concerning not to see those basic principles included in the Bill. I am interested to hear the Minister’s response to those principles laid out by the National Data Guardian. The public need to be able to trust organisations that handle their data and they need to retain control over those data. Both those things are essential to build confidence and encourage participation in the digital economy. The principles have been debated over the past several years at the European level, and we should be told here and now—today—whether the Government intend to implement the EU’s General Data Protection Regulation. If they are, why is the Bill not compliant with it?

The new EU GDPR and the law enforcement directive were adopted in May and will take effect from May 2018. The GDPR includes stronger provisions on: processing only the minimum data needed; consent; requirements on clear privacy notices; explicit requirements for data protection by design and by default; and on carrying out data protection impact assessments.

Although the Government’s arrangements for exiting the European Union have yet to be decided, it seems likely that the GDPR will take effect before the UK leaves, so the Government will have to introduce national level derogations prior to its implementation. If that is the case, there will have to be a thorough consideration of the impact of the new legal framework on all aspects of the Bill affecting data sharing, including implementation arrangements. Indeed, as the Information Commissioner said when giving evidence to the Committee two weeks ago:

“There may be some challenges between the provisions and the GDPR… There would ?be a need to carefully review the provisions of this Bill against the GDPR to ensure that individuals could have the right to be forgotten, for example, so that they could ask for the deletion of certain types of data, as long as that was not integral to a service.”––[Official Report, Digital Economy Public Bill Committee, 13 October 2016; c. 112-13, Q256.]

The GDPR states that data are lawfully processed only if consent has been given by the individual, which is completely lacking in this section of the Bill. It also gives data subjects that right to withdraw consent at any time:

“It shall be as easy to withdraw as to give consent.”

Controllers must inform data subjects of the right to withdraw before consent is given. Once consent is withdrawn, data subjects have the right to have their personal data erased or no longer used for processing.

--- Later in debate ---

[The Chair]

Order. May I gently assist the hon. Lady by saying that I am not sure she has referred to her amendments much yet? She is making an excellent clause stand part speech. This will certainly now be the clause stand part debate, but it might help the Committee if she came on to her amendments as soon as possible.

[Louise Haigh]

Of course. Thank you very much, Mr Streeter.

Our amendments would ensure that the codes of practice, which have been vastly improved over the past week, are statutory. It is important that the principles and safeguards outlined so far are included and are statutory. That is what I have been alluding to so far in my speech. It seems pointless for civil servants to have put all this work into the codes for them merely to be regarded, rather than statutorily complied with. The codes must be improved further, and we hope that Ministers and officials will work with the industry and organisations to do just that, but we want to see them referenced properly in the legislation and properly complied with. Anything less means that the powers enabled in the clause dwarf any safeguards or checks included in the codes.

Amendment 99, in my name and that of my hon. Friend the Member for Cardiff West, would help to build trust in the Government’s data-sharing provisions—trust that has been rocked over a number of years. That trust is absolutely essential if this extension of the Government’s data-sharing powers is to be effective. It is worth noting again that the draft regulations allow a significant extension of data-sharing powers with a significant number of Departments. That extension is rightly set within defined and strict criteria, but some of the definitions contained within those criteria are at best vague.

Subsection (8) of clause 29 allows for the sharing of data if it is of defined “benefit” to the individual or households. Subsection (9) allows for the sharing of data if it

“has as its purpose the improvement of the well-being of individuals or households.”

While the extension is ostensibly for tightly defined reasons, those reasons are in fact so broad that they could refer to anything at all.

We again come back to the point about public trust. The public want to know why their data are being shared and that it is strictly necessary. Amendment 99 would help build that trust by ensuring that, under clauses 29, 30 and 31,

“the sharing of information authorised by the regulations is minimised to what is strictly necessary…the conduct authorised by the regulations to achieve the “specified objective” is proportionate…”

and that

“a Privacy Impact Assessment…has taken place”.

The amendment would require the Minister to establish a review that consults the Information Commissioner and the public on the effectiveness of the measures. The amendment would require the Minister, after a three-year period, to review the operation of these provisions to decide whether they should be amended or repealed.

A similar measure is included in the Bill in the provisions relating to data sharing for the purposes of the collection of public debt, so it is puzzling that it is not included in this part, too, as these provisions are so much broader and just as risky, if not riskier. Individuals are right to be anxious about their sensitive data being shared. The amendment would allow for the public to be reassured that their data are being handled within the strictest confines.

Amendment 96 would give individuals a right to access and correct their own data. Empowering citizens to have access to and control over their own personal data and how they are used would clearly help improve data quality. Citizens could see, correct and maintain their own records. Data need to work for people and society. Citizens need to be actively engaged in how their data are secured, accessed and used. Again, that needs to be put on the face of the Bill.

Part 5 does not make clear how proposals to data share comply with the Government policy of citizens’ data being under their own control, as set out in paragraph 3 of the UK Government’s technology code of practice. Indeed, the proposals appear to weaken citizens’ control over their personal data in order for public bodies and other organisations to share their data. Weakening controls on the protection of their data is likely to undermine trust in the Government and make citizens less willing to share their data, challenging the move towards digital government and eroding the data insights needed to better inform policy making and related statistical analysis. That type of organisation-centred, rather than citizen-centred, approach characterised the failure of the top-down imposition of care.data in the NHS. That is why we tabled these amendments.

[The Parliamentary Secretary, Cabinet Office (Chris Skidmore)]

It is an honour to serve under your chairmanship, Mr Streeter, and to be standing here making my Committee debut. The hon. Member for Sheffield, Heeley is obviously new to the business as well, and I hope to follow her example. She has been gracious and proportionate in holding the Government to account. I hope we can have a full and frank exchange—hopefully, a rapid one—as we move through part 5.

The Government share information every day. Like every organisation, we rely on information to deliver the support and services that everybody relies on. These proposals will not do anything radical. They are simple measures designed to provide legal clarity in uncontroversial areas. The hon. Lady said that the Bill’s objectives are too broad, but I am afraid I disagree. We have made available draft regulations that set out three clear objectives, which are constrained and meet the criteria. I believe it is possible to strike a balance between the regulations and the evidence to set out specific objectives on identifying individuals and households that have multiple disadvantages, improving fuel poverty schemes and helping citizens retune their televisions when the broadcasting frequency is changed in a couple of years’ time.

The hon. Lady mentioned some specific examples. I want to turn to the fuel poverty schemes. When we look at those several years down the line, I genuinely believe that we will be proud to have sat here and legislated in a Committee that introduced data-sharing measures that enable, for instance, a significant number of vulnerable people to benefit from the warm home discount scheme. At the moment, about 15% of warm home discount scheme recipients are classed as fuel poor, according to the Government’s definition. By utilising Government-held data on property characteristics to benefit the recipients, we estimate that that figure could be at least tripled. That could mean that an additional 750,000 fuel poor households receive a £140 rebate off their electricity bill each year.

We know that some vulnerable households miss out on the warm home discount because they need to apply and they either do not know the scheme exists or, for one reason or another, are unable to complete an application. Our proposed changes could result in the majority of the 2.1 million recipients receiving the rebate automatically. It will come straight off their energy bills without the need to apply. That is simply an extension of the data-sharing measures that already exist in the Pensions Act 2014 for pension credit. It is evolution, not revolution.

That example clearly sets out how we will require data to be shared among Government organisations and for there to be a flag to suppliers of eligible customers. In that instance, we will require the suppliers to use data only to support customers. Each objective will require a business case setting out the purpose and participants, which will be approved by Ministers and subject to parliamentary scrutiny.

I note that we are debating clause 29 stand part as well as the amendments, so after talking generally about part 5, let me move on to the clause. I believe that these powers do not erode citizens’ privacy rights. They will operate within the existing data protection framework. The new powers explicitly provide that information cannot be disclosed if it contravenes the Data Protection Act 1998 or part 1 of the Regulation of Investigatory Powers Act 2000. Further, they are carefully constrained to allow information to be shared only for specified purposes and in accordance with the 1998 Act’s privacy principles.

The new codes of practice, which the hon. Lady mentioned—I have been assured that they are on the parliamentary website—have been developed to provide guidance to officials in sharing information under the new powers in respect to public service delivery, fraud and debt, civil registration, research and statistics. The codes are consistent with the Information Commissioner’s data sharing code of practice. Transparency and fairness are at the heart of the guidance. Privacy impact assessments will need to be published, and privacy notices issued, to ensure that citizens’ data are held transparently. I was delighted that the Information Commissioner wrote to the Committee on 19 October saying:

“Transparency is key to building people’s trust and confidence in the government’s use of their data. I am pleased to see that further safeguards such as references in some of the codes to the mandatory implementation and publication of privacy impact assessments (PIAs), and reference to my privacy notices code of practice, have been highlighted in the Bill’s codes of practice.”

[Louise Haigh]

The Information Commissioner also said that she wanted the privacy impact notices to be included in the Bill, and the codes to be explicitly subordinate to her code on data-sharing practices. Will the Minister confirm that those codes are indeed subordinate? Will he also explain why the codes are not included in the Bill if they are so central to the process?

[Chris Skidmore]

I will come to the second point later. On the Information Commissioner’s desire to include privacy impact assessments, it is clear to me from her letter that she is now content with the situation as it stands:

“I am content that the codes all now reference and better align with the guidance on sharing personal data set out in our statutory code and include effective safeguards to protect people’s information.”

[Louise Haigh]

The Information Commissioner was referring to the codes being improved since she gave evidence to the Committee. Later in that letter, which I think the Minister has in his hand, she goes on to say that she stands by the other evidence, both the oral evidence that she gave the Committee and her written evidence, which included her view that privacy impact notices should be in the Bill.

[Chris Skidmore]

The Information Commissioner also mentions that, on privacy impact assessments and with reference to her privacy notices code of practice:

“This will build in transparency at two levels:—”

in the current situation—

“greater accountability through the publication of PIAs and timely and clear information for individuals so they can understand what is going to happen to their data.”

The Government remain committed to working with the Information Commissioner’s Office. When it came to the evidence sessions, I was aware of the fact that we had a long process discussion around the codes of practice and when their publication dates were due. It was very important for me, as a Minister, to ensure that we had the confidence of the ICO going forward and that we could publish those draft codes. We will continue those conversations.

When looking at putting the codes or privacy impact assessments in the Bill, it comes back to the key point of being able to continue that conversation when it comes to a transformational technology that we may not even know exists at the moment and that may radically change our ability to look at how we data share. At the moment we are looking at specified portals through which we will data share for the benefit of the most vulnerable in society, but there may be a new technology that allows the Government to expand our scope. If that new technology comes into being and we write the codes and privacy impact assessments into the Bill, we will have the chilling effect of ossifying the practice; it will impact on our ability to adapt and to be able to look at new technology, to move fast and to realise the opportunities that we may have to data share for the benefit of the most vulnerable in society.

[Louise Haigh]

I completely agree that we should not tie ourselves down in the Bill, particularly to technology. It came through loud and clear from the evidence sessions that part 5 seems to tie us to a very outdated approach to data sharing. It does not talk about data access; we heard that an awful lot in the evidence sessions. The Bill goes against the Minister’s own guidance on that. We should look not at bulk sharing, which takes us back to when we had filing cabinets or were sending across spreadsheets and databases on USB sticks, but at using application programming interfaces and canonical datasets, on which the Cabinet Office is leading the way. I would appreciate it if the Minister commented on that.

[Chris Skidmore]

The hon. Lady highlights the argument I am trying to make, which is that the data-sharing measures in the Bill are proportionate, constrained and there to ensure that we can bring public confidence with us, which she mentioned. That is why we have highlighted specific portals through which we will be able to share Government information across Departments. In future, there will be secondary legislation powers to review and expand that, but there will be a whole process for which we need scrutiny.

That is why the Bill is so important: by highlighting how we can help those most in need and how, when it comes to data and consent, some people are in circumstances, by virtue of being in deprived communities or particularly vulnerable, of not knowing that they can benefit from their data being shared. It is the Government’s responsibility to act in this particular area to ensure that data are shared for the benefit of the most vulnerable. That is why the Bill is designed as it is. We have the secondary regulations in place, limited as they are at the moment, going through impact assessments and everything that we need to ensure that we have a proportionate response to sharing data.

I fully appreciate what the hon. Lady said but I hope that she will accept that the Government have pulled out all the stops to ensure that we can take public confidence with us. That is why, for instance, under clause 33, new criminal sanctions have been developed to protect information shared under the new powers in respect of public service delivery, fraud, debt and research, so those convicted of offences could face a maximum penalty of up to two years imprisonment for illegal data sharing, a heavy fine or both.

No statutory restrictions that currently exist on sharing of data, such as in the Adoption and Children Act 2002, will be affected by these data measures. When it comes to audits, which the hon. Lady mentioned, data-sharing agreements entered into under the power will set out a governance structure of how audits will take place. This structure will oversee the arrangement and what participating bodies are required to do under data sharing. The Information Commissioner’s Office also has a general power to conduct audits, including compulsory audits of Departments and organisations to check that they are complying with the law in relation to the handling of personal information. All bodies are required to comply with the ICO’s request for assistance so that it can determine whether data have been processed lawfully in data-sharing arrangements. The ICO can pursue criminal proceedings where necessary.

[Louise Haigh]

Will the Minister confirm that every Department that undergoes a data-sharing arrangement will complete a full audit of all data-sharing arrangements in that Department? Will that be available under the Freedom of Information Act?

[Chris Skidmore]

On the individual point of audit, I will have to write to the hon. Lady. I will further consider her amendments and speak about them when we discuss three-year reviews. I want to ensure that bodies sharing information under the public service delivery power, for instance, strictly observe and follow codes of practice. Although I welcome the intention of the amendments, I think they are unnecessary. The Bill sets out the key conditions for disclosing and using information, including what can be shared by whom and for what purposes. We followed the common approach taken by the Government to set out details of how data are shared in the code of practice.

I want to return to the hon. Lady’s question of whether we use “have regard to” or “comply with”. The wording, “have regard to” already follows common practice in legislation, as illustrated in section 25 of the Immigration Act 2016 and section 77 of the Children and Families Act 2014. As the power covers a range of public authorities and devolved territories we want the flexibility that I mentioned about how the powers are to be operated, so that we can learn what works and adapt the code as necessary. To put it into the Bill, as I mentioned, would hamper that ability to adapt for future purposes. If bodies fail to adhere to the code, the Minister will make regulations that remove their ability to share information under that power, as is indicated, indeed, in part 11 of the code of practice, which states:

“Government departments will expect public authorities wishing to participate in a data sharing arrangement to agree to adhere to the code before data is shared. Failure to have regard to the Code may result in your public authority or organisation being removed from the relevant regulations and losing the ability to disclose, receive and use information under the powers”.

Amendment 106 requires the Minister to run a public consultation for a minimum of 12 weeks before issuing or reissuing a code of practice. The code of practice is essentially a technical document that sets out procedures and best practice with guidance produced by the ICO and Her Majesty’s Government. Clause 35 requires the Minister to consult the Information Commissioner and other persons, as the Minister thinks appropriate. I think that that strikes a good balance. Indeed, as I mentioned, we have been working closely with the ICO to ensure that there is confidence in the codes and the Information Commissioner states:

“I am pleased to report that significant progress has been made since my evidence session and I am content that my main concerns about the codes have now been addressed”.

I think it is very important to put that on record.

--- Later in debate ---

[Chris Skidmore]

To respond to the hon. Gentleman on his specific point, we will update the lists of bodies able to share information of the public service delivery power, and the PSD power allows for new objectives to be added by regulations if they meet the conditions specified in primary legislation. So the issue of the pupil premium, which he mentioned, may be one of the many worthy purposes for which new objectives could be created.

I would like also to draw the hon. Gentleman’s attention to the disclosure of information in the draft regulations, which I hope will reassure him. Paragraphs 21 and 22 of schedule 1 to the Bill refer to the organisations that will be sharing data, or that will be permitted to do so once they have applied to do so, including the county councils of England, the district councils in England and even the council of the Isles of Scilly. We recognise that there is that local government fracture that he mentioned and we hope that when it comes to data-sharing measures we will be able to heal that.

[Louise Haigh]

It was disappointing not to hear the Minister mention the General Data Protection Regulation and explain why this legislation has not been written in compliance with it, or my points about non-public sector authorities. I hope that he can return to those issues later in his remarks.

On the point about the Information Commissioner, in her evidence she supported statutory codes of practice. She also recommended that Parliament should review all aspects of data-sharing, and not just the clauses relating to fraud, after an appropriate time, which is what informed our amendment.

As our amendment says, we would also like the codes to make it clear that good cyber-security practice should not be about data sharing and that it should be about leaving the data with their original owner. I hope that the Minister will return to those issues when he comments on later stages of the Bill.

With that in mind, I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 29 ordered to stand part of the Bill.

Clause 30

Disclosure of information to gas and electricity suppliers

[Chris Skidmore]

I beg to move Government amendment 108, in clause 30, page 29, line 21, at end insert “, or

() the making of grants (by any person) under section 15 of the Social Security Act 1990 in accordance with regulations under that section made by the Scottish Ministers or the Welsh Ministers.”

This amendment enables information to be disclosed by a specified person to a licensed gas or electricity supplier for the purposes of a scheme in Scotland or Wales for the payments of grants to improve energy efficiency under section 15 of the Social Security Act 1990.

This clause enables the person specified in regulations to disclose information to gas and electricity suppliers. The disclosure must be for the purpose of reducing energy costs, or improving energy efficiency or the health or financial wellbeing of those living in fuel poverty, and it must be disclosed for use in connection with one of the fuel poverty support schemes listed in the clause.

The schemes referenced are the warm home discount scheme and the energy company obligation. Although the territorial extent of both these schemes is GB-wide, fuel poverty itself is a devolved matter. Officials in the devolved Administrations, including Labour-run Wales, have asked for Scottish and Welsh fuel poverty schemes to be included in the provisions of the clause. That is because there are grant schemes that fall under section 15 of the Social Security Act 1990 that address fuel poverty in Scotland and Wales. Those schemes would also benefit from the ability to share information between public authorities, and with gas and electricity suppliers, for the provision of assistance to fuel-poor households. The schemes are Nest and Arbed in Wales, and Scotland’s home energy efficiency programme. They help to reduce energy costs, or to improve energy efficiency or the health and financial wellbeing of people living in fuel poverty. The same safeguards will be in place as for all data disclosed under the clause—that is, data can only be disclosed by persons specified in regulations and for the specific purposes identified in the clause. All persons involved in a data-share must have regard to the code of practice.

The inclusion of these grant schemes will strengthen the ability to deliver better targeted, cost-effective fuel poverty schemes in Wales and Scotland.

Amendment 108 agreed to.

Question proposed, That the clause stand part of the Bill.

[Louise Haigh]

May I welcome the Minister to his position? It was remiss of me not to do so earlier; he is the model of a patient Minister and very polite with it, too.

As with clause 29, we very much support the objective behind the proposals in clause 30—to identify the individuals most in need of warm home funding and any other grant or benefit that will alleviate fuel poverty. As we heard from Citizens Advice, energy firms have found it difficult to establish whether people are entitled to funding, so people who should get the help do not get it. Sharing the data should smooth that process. We know that fuel poverty is a significant contributor to debt. StepChange said that about 10% of its clients would be within the old definition of fuel poverty—they spend more than 10% of their income on fuel—and it has seen the number of people in gas and electricity arrears rise sharply from where things were in 2010.

However, there are concerns about disclosing personal data to gas and electricity suppliers, again with no detail on what personal information might be disclosed or how. There is none of the legal or technical detail essential to ensure data security, the ethical use of data and the necessary trust framework essential to protect the rights, privacy and security of citizens. The same problems plague the rest of part 5, not least that the general data protection regulation explicitly bans the use of data to monitor the behaviour of people in a way that could be seen as profiling, so we would appreciate the Minister’s comments on that point.

As we have seen, the warm home discount can work well, but it must be set within strict safeguards. The initial legislation was introduced to allow data sharing to be carried out, and we know that the Department of Energy and Climate Change was extremely careful with the idea, and concerned about public perceptions about trust and private sector companies’ use of data. There was a great deal of anxiety about the public view when the proposal was put as a theoretical proposition. The public are not convinced about the sharing of data with private companies—let alone between Departments—and particularly with private providers such as energy companies who have a potential commercial stake in the data.

That is why the warm home scheme currently works through data from the DWP and energy suppliers going to a third party, which crunches the data to identify the matches. The energy suppliers are then sent onward a list of their eligible customers and the data are deleted from the third party’s computers. The data are not held on any computers; that provides an appropriate safeguard for all individuals concerned. That is critical to alleviating concerns about the sharing of personal information.

At present, therefore, companies with no public accountability learn nothing of any commercial value to their activities, which is a crucial point. The sharing of data cannot be done if there is a company with a potential conflict of interest. However, clause 30 allows for the disclosure of information to gas and electricity suppliers to help people living in fuel poverty and within other tightly defined criteria. Although the clause is clear that data may be used only for the purposes intended, unease will remain about why, in this instance, the Government have allowed personal information to be shared with electricity suppliers rather than with a third-party trusted provider.

There will be a serious concern that electricity and gas suppliers are being passed information whose content could present a potential conflict of interest. Nobody is suggesting that the electricity or gas suppliers would do anything in breach of their obligations, but the risk is certainly there. That was the basis behind the creation of a third-party supplier in relation to the warm home scheme.

We therefore welcome the creation of an offence for passing on any of this information and we welcome the maximum sentence of two years. It provides a clear steer from Government on the sensitivity of the data, yet clearly we would prefer that the disclosure would not happen directly at all.

--- Later in debate ---

[Chris Skidmore]

These Government amendments concern sanctions for unlawful disclosure and the disclosure and use of data to prevent and detect crime or prevent antisocial behaviour. A person receiving personal information under the public service delivery, debt, fraud and research powers cannot disclose that personal information unless it is for one of the exceptional reasons listed in the Bill, such as preventing loss of life or for national security. Technical amendments will ensure that it is clear that the list of exceptional reasons includes the prevention or detection of crime, or the prevention of antisocial behaviour.

The Bill provides that any person who contravenes the prohibition on further disclosure is guilty of an offence, which carries a penalty of imprisonment, a fine, or both. The introduction of criminal sanctions shows how seriously we take our responsibility to protect personal information, and we consider that it represents a key safeguard to accompany the new powers. It is imperative that individuals handling personal information under the powers take great care in handling that information.

We do not think that mistakes when handling personal data are acceptable, but we do not want to criminalise honest mistakes. The current drafting is slightly overzealous, so amendments 117, 128, 139 and 158 ensure that criminal liability arises only where there has been intent to disclose information. In circumstances involving disclosures made in error, we consider that other sanctions would be more appropriate, such as those set out in the Data Protection Act 1998 or internal disciplinary action.

The remaining amendments are minor technical amendments to ensure that information received under the powers can be shared to assist legal proceedings or criminal investigations outside the United Kingdom where necessary, while maintaining consistency across our clauses and aligning with other similar provisions in other legislation.

[Louise Haigh]

These Government amendments are technical and seem absolutely fine, apart from the provision to prevent antisocial behaviour. It is not clear to me why the disclosure would be necessary for the purposes of antisocial behaviour as defined under Anti-social Behaviour, Crime and Policing Act 2014. Can the Minister provide a clearer explanation of why any data that are ostensibly there to be shared for the purposes of alleviating fuel poverty and managing public sector debts would be used to prevent antisocial behaviour? Does that point to the concern I expressed earlier about the provisions leading to a broader scope for the use of information?

[Chris Skidmore]

The exemption has been included to ensure that if information received under the powers points to possible antisocial behaviour, it can be shared. That is intended to avoid any risk that by failing to refer explicitly to antisocial behaviour we cause ambiguity about whether certain information on antisocial behaviour can be shared. That ambiguity would have a chilling effect on multi-agency responses to antisocial behaviour, thereby undermining one of the key purposes of the 2014 Act.

[Louise Haigh]

Can the Minister give an example of how data relating to fuel poverty shared between a Government agency and a gas and electricity company could possibly relate to antisocial behaviour?

[Chris Skidmore]

We are talking about public service delivery powers, which do not just cover the warm home discount, attractive though that is. I know that all members of the Committee will be grateful, when this legislation goes through, to go back to their constituents and talk about being on this Bill Committee and how they delivered savings for millions of pensioners, but there are other key aspects of the Bill in relation to the troubled families programme and those living in communities blighted by antisocial behaviour. Data sharing around those programmes could create data matches that point to antisocial behaviour taking place or flag that up. We have a public duty to ensure that we have that power so that we can protect those vulnerable people whose lives are blighted in communities affected by particular types of antisocial behaviour.

Amendment 109 agreed to.

Amendments made: 110, in clause 32, page 30, line 19, leave out

“(whether or not in the United Kingdom)”.

This amendment removes the provision stating that a criminal investigation for the purposes of clause 32(2) may be within or outside the United Kingdom. This is for consistency and on the basis that a reference to a criminal investigation covers an investigation overseas in any event.

Amendment 111, in clause 32, page 30, line 21, leave out

“and whether or not in the United Kingdom”.

This amendment removes the provision stating that legal proceedings for the purposes of clause 32(2) may be within or outside the United Kingdom. This is for consistency and on the basis that a reference to legal proceedings covers proceedings overseas in any event.

Amendment 112, in clause 32, page 30, line 28, at end insert—

“( ) In subsection (2)(ba) “anti-social behaviour” has the same meaning as in Part 1 of the Anti-social Behaviour, Crime and Policing Act 2014 (see section 2 of that Act).”—(Chris Skidmore.)

See the explanatory statement for amendment 109.

Clause 32, as amended, ordered to stand part of the Bill.

Clause 33

Confidentiality of personal information

[Louise Haigh]

I beg to move amendment 101, in clause 33, page 31, line 19, leave out “or permitted”.

[The Chair]

With this it will be convenient to discuss the following:

Amendment 102, in clause 33, page 31, line 25, leave out “made” and insert “necessary”.

This amendment and amendments 103 and 104 seek to place a stricter requirement to reduce the risk of non-compliance with data protection.

Amendment 103, in clause 33, page 31, line 27, leave out “made” and insert “necessary”.

See the explanatory statement for amendment 102.

Amendment 104, in clause 33, page 31, line 30, leave out “made” and insert “necessary”.

See the explanatory statement for amendment 103.

--- Later in debate ---

[Louise Haigh]

The amendments would restrict the onward disclosure of data. As we know, the public value their data, and the amendments would place a higher test on onward disclosure.

It is important that data disclosures of information as sensitive as we have been discussing are appropriately considered; they must not simply be nodded through. Introducing a principle of necessity would mean that organisations have to make a case, rather than merely tick a box. Crucially, that would help to make the Bill more consistent with existing data protection. As the Information Commissioner’s data sharing code of practice clearly states:

“You should employ ‘need to know’ principles, meaning that other organisations should only have access to your data if they need it, and that only relevant staff within those organisations should have access to the data. This should also address any necessary restrictions on onward sharing of data with third parties.”

The ICO’s data sharing code of practice could not be any clearer. It is designed to protect an individual’s data and to prevent any onward disclosure to the organisations that have access to those data.

The Data Protection Act is also framed in terms of necessity. The ICO’s code of practice states:

“The processing is necessary because of a legal obligation that applies to you (except an obligation imposed by a contract)…The processing is necessary to protect the individual’s “vital interests”. This condition only applies in cases of life or death, such as where an individual’s medical history is disclosed to a hospital’s A&E department treating them after a serious road accident…The processing is necessary for administering justice, or for exercising statutory, governmental, or other public functions.”

The amendments, which would insert the word “necessary”, ask a simple question: why are the exemptions in the Data Protection Act set aside when there is disclosure of confidential personal data for certain public interest purposes? That is already clearly well established. For example, in the context of policing, section 29(3) of the Data Protection Act states that:

“Personal data are exempt from the non-disclosure provisions in any case in which”

the disclosure is for any of the purposes of a criminal investigation, and failure to disclose

“would be likely to prejudice”

that investigation. One element of the application of that exemption from the non-disclosure provisions has the effect of excluding the lawfulness of the disclosure. It therefore protects the disclosing body from action for breach of confidence.

To disclose under the Data Protection Act, there has to be prejudice to an investigation before a disclosure of personal data can occur. Clause 33(2)(e) refers to disclosures

“made for the purposes of a criminal investigation”,

with no test of prejudice. The advantage of the amendments is that they would bring in the word “necessary”. That minor shift would at least ensure that the disclosure of personal data is proportionate.

Similarly, section 35(2) of the Data Protection Act permits disclosure of personal data for legal proceedings without risk of the disclosing party being subject to an action for breach of confidence if the disclosure of personal data

“is necessary… for the purpose of, or in connection with, any legal proceeding”.

In contrast, clause 33(2)(f) does not include the word “necessary” and reduces the threshold of disclosure to one that could facilitate speculative disclosures that could not be made under the Data Protection Act. We would be grateful if the Minister explained why the necessity is removed and why the DPA provisions are not sufficient when personal data are disclosed, but only when it is necessary in connection with any legal proceedings. The amendments would align disclosure with the provisions of the DPA.

The changes to clause 33(2)(h)(i) to (iv) are proposed to make it clear why the DPA is insufficient. Schedule 2(4) permits disclosure of personal data if it

“is necessary in order to protect the vital interests of the data subject.”

Schedule 2(5)(b) allows disclosure that is necessary

“for the exercise of any functions conferred on any person by or under any enactment”.

Can the Minister describe what disclosures of personal data do not fall within those two provisions? The amendments insert the word “necessary” and simply align the disclosure with the Data Protection Act.

--- Later in debate ---

[Louise Haigh]

I am concerned about why the Minister thinks the amendments will provide confusion; they will actually bring the clause into alignment with the Data Protection Act 1998—currently, large swathes of the Bill are not. Personal information is not defined as in the Data Protection Act, and nor are other clauses in this part. With your leave, Mr Streeter, I will test the will of the Committee.

Question put, That the amendment be made.

--- Later in debate ---

[Chris Skidmore]

These are minor and technical amendments to clauses on the code of practice and statements of principles that will be issued under part 5 of the Bill. The amendments will require that the code of practice be consistent with the data sharing code of practice issued by the Information Commissioner under the Data Protection Act 1998, ensuring greater clarity for practitioners and increased transparency for citizens about the relationship between the provisions in the Bill and the DPA. The amendments have been tabled with our conversations with the ICO in mind; we have the Information Commissioner’s confidence that the codes are right. I commend the amendments to the Committee.

Amendment 118 agreed to.

[Louise Haigh]

I beg to move amendment 106, in clause 35, page 32, line 42, at end insert—

“(ea) the public for a minimum of 12 weeks, and the relevant Minister, must demonstrate that responses have been given conscientious consideration, and”.

The amendment relates simply to the fact that the Opposition would like a full public consultation on the draft codes of practice. A much better version has been put before the Committee, and I understand that it is now on the parliamentary website, but we would like a proper consultation period, not just a consultation with whomever the Government see fit to consult.

[Chris Skidmore]

Amendment 106 would introduce a requirement for the Minister to publicly consult for a minimum of 12 weeks before issuing or reissuing the code of practice under clause 35.

Many details of the code of practice are drawn from the ICO data sharing code of practice. Others were drawn from two years of open policy making with civil society and other groups. We have just discussed a Government amendment intended to ensure that our codes will be consistent with the ICO’s data sharing code of practice. On that basis, we see no need for a compulsory public consultation before issuing the code, and even less need to make it a requirement in respect of any reissue. Some future changes to the code may be minor. We do not see a need to run a public consultation in those instances—indeed, to do so would be disproportionate in a great number of such cases.

Clause 35 requires that the Minister consult the Information Commissioner and other persons as the Minister thinks appropriate. Those other persons will include civil society groups and experts from the data and technology areas. We will run a full public consultation when a significant revision is expected, such as before the EU data protection regulation comes into effect, which I believe will be in May 2018. The clause as drafted provides the flexibility required. On that basis, the amendment is unnecessary and I invite the hon. Lady to withdraw it.

[Louise Haigh]

I am pleased to hear that the Government intend to consult on major revisions, and I hope that the draft codes, although much improved, will improve further in Committee, particularly in the areas outlined earlier relating to non-public authorities. As the Government have not listened to many of the recommendations made in their own consultation earlier this year, perhaps it is a futile amendment. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Question proposed, That the clause stand part of the Bill.

[Louise Haigh]

I will just lay some further concerns about the draft codes. Clause 35 requires specified authorities and specified persons to have regard to the code of practice. We have conducted our own mini-consultation. One member of the Government’s own open policy group described the codes of practice as “discursive and poorly constructed”, another as “empty waffle”. Agreement was widespread that they still require significant legal and technical improvements, and that safeguards should be included in the Bill itself.

Part 5’s provisions for personal data sharing enable officials to decide unilaterally when they may access and share citizens’ personal data without consent and for purposes other than that for which it was provided. It raises serious concerns about how the UK will be able to host any EU citizens’ personal data post-Brexit. If UK officials are able to access and use their data without consent, it is highly unlikely that the EU will regard that as approaching anything like “adequacy” with respect to the general data protection regulation.

It is an incredibly worrying aspect of the Bill and the accompanying codes of practice that nowhere do they refer to the EU’s GDPR, which will not come into effect until 2018, as the Minister said, although the Information Commissioner’s Office has stated that organisations must comply with the GDPR if they wish to continue to do business across the EU or with EU citizens’ data. Although we are referring to Government agencies and Departments, there is every likelihood that they will process EU citizens’ data.

Where consent is to be overridden by officials, the approach is not well defined. There is no consideration of or support for alternative approaches, such as empowering citizens to be helped by letting them nominate someone other than officials to act on their behalf, rather than officials doing so. There is inadequate attention to transparency and accountability. We have many lessons to learn from the Estonian Government, as we heard in evidence sessions.

Furthermore, the personal data-sharing code perpetuates errors from the two-year consultation. For example, when the code refers to application programming interfaces, it incorrectly implies that they are a new thing. They are not, with modern web APIs generally recognised as having been in existence since around 2002—hardly state of the art. The code also displays no apparent awareness of, for example, zero knowledge proof, a method by which one party can prove to another that a given statement is true without conveying any information apart from the fact that the statement is true.

For that reason, both technical and legal safeguards must be within the Bill, not the lengthy and vaguely drafted codes of practice relating to personal data. Quite simply, none of the codes contains the safeguards alluded to earlier in the consultation and Bill process. In the interests of time, I simply say to the Minister that we will revisit concerns about the codes of practice. We have serious concerns about the lack of transparency still built into the codes of practice, let alone on the face of the Bill, and we would like some updated technological references in those codes.

Question put and agreed to.

Clause 35, as amended, accordingly ordered to stand part of the Bill.

Clauses 36 and 37 ordered to stand part of the Bill.

Clause 38

Disclosure of information by civil registration officials

[Louise Haigh]

I beg to move amendment 97, in clause 38, page 36, line 15, at end insert—

‘(2A) An authority or civil registration official requiring the information must specify the reasons for requiring the information to be disclosed.

(2AA) Information disclosed under this section shall not be shared with any other public or private body beyond those specified in subsection (1).”

[The Chair]

With this it will be convenient to discuss amendment 107, in clause 38, page 36, line 12, leave out from “that” to end of subsection and insert—

“(a) the authority or civil registration official to whom it is disclosed (the “recipient”) requires the information to enable the recipient to exercise one or more of the recipient’s functions and,

(b) the data subjects whose information is being disclosed have given valid consent under data protection legislation.”

This amendment would remove bulk sharing while allowing certificates to be shared to support electronic government services.

[Louise Haigh]

These provisions, more than any others in relation to civil registration officials, have surprised and confused those involved in the data-sharing proposals and the open data policy-making process, as they were never mentioned in the more than two years of discussion about data sharing in that open policy-making group. In the Government’s consultation response, they said that

“a large number of individual respondents and representatives from civil society stated strong opposition to the proposed power providing the ability for the bulk sharing of data, believing that the power would effectively create an identity database and enable personal data to be shared between public authorities even where there is no public benefit to do so.”

The amendments would address exactly that.

The publicly stated policy intent of the clause is to allow a citizen interacting with the Department to allow that Department to confirm their civil registration information electronically. That could undeniably enable better informed decision making, allocation of resources and service delivery, and would support the modernisation of public services. However, as drafted, the legislation also allows the entire civil registration database to be copied over to arbitrary locations for arbitrary purposes. That is not the same thing as a citizen allowing access when using digital services.

There are further concerns about the clause’s lack of compliance with the Data Protection Act 1998. Civil registration documents will be shared in bulk to improve service delivery where there is a clear and compelling need, according to the Bill. However, “clear and compelling” remains a lower test than the Data Protection Act’s “necessary and proportionate”, and is likely to be challenged. The use of bulk data runs counter to the Centre for the Protection of National Infrastructure guidance, which warns of the risks associated with bulk data, particularly from hostile foreign intelligence services.

The example given by Government that would require the sharing of civil registration data is around child reference numbers, which become national insurance numbers. National insurance numbers used to be attached to child benefit. It worked on the assumption that every parent would claim child benefit for their child and, when that child reached 15 and a half years of age, their national insurance number would be dispatched.

When the Government changed their policy on child benefit and effectively restricted it to parents who earned less than £50,000 per year, that created a potential problem for the assigning of national insurance numbers. The proposals will presumably address the problem by using birth-certificate data to inform who should be issued with NI numbers and when. That seems a perfectly reasonable and sensible method to correct an unintended consequence of the changes to child benefit policy, but can the Minister give us any other examples of when and why such bulk data sharing would ever be necessary or proportionate? The example I have just run through is incredibly specific and I hope that it would not be and is not repeated across Government.

Digital Economy Bill (Third sitting)

Louise Haigh Excerpts

Committee Debate: 3rd sitting: House of Commons
Thursday 13th October 2016 Public Bill Committees

[The Chair]

We will hear oral evidence first from StepChange, Citizens Advice and Dr Jerry Fishenden from the Cabinet Office’s privacy and consumer advisory group. Before I call Louise Haigh to ask the first question, I remind all hon. Members that questions should be limited to matters within the scope of the Bill and that we must stick to the timings in the programme motion that the Committee agreed to. For this session, we have until 12 o’clock. Will the witnesses please introduce themselves for the record?

Peter Tutton: Hello everybody. My name is Peter Tutton and I am from StepChange Debt Charity.

Dr Fishenden: Good morning. My name is Jerry Fishenden. I am a technologist working with private and public sector clients. Today, I am here in my capacity as co-chair of the Cabinet Office’s privacy and consumer advisory group.

Alistair Chisholm: Hello. My name is Alistair Chisholm and I am here from Citizens Advice.

[Louise Haigh (Sheffield, Heeley) (Lab)]

Q 214 I will start with part 5 and ask about debt collection. My questions are particularly aimed at StepChange and Citizens Advice. What concerns do you have about the principles of public authority debt collectors when dealing with their creditees?

Peter Tutton: Sorry, did you say local authorities?

[Louise Haigh]

No, just the public sector.

Peter Tutton: We recently did a poll of our clients and asked them which of the different types of creditor they face treats them the most unfairly. Our clients are all people in heavy financial difficulty; they are really struggling and under pressure. Of the top five creditors that treated them the most unfairly, four were Government Departments or agents collecting Government debt.

We are concerned that the way in which public debt is collected is not subject to the same sort of oversight and scrutiny as private sector debt. Organisations from banks to payday lenders are part of a regulated sector that still has problems, but those problems can be addressed. In the public sector, we do not see the same kind of control and oversight, or even any sense of regulation about how that should be done. As a result, we see a lot of problems, with the sort of debt collection practices that we might have seen 20 years ago from banks now coming from the collection of public debt.

[Louise Haigh]

Q Can you give us an example of those kinds of problems?

Peter Tutton: With central Government debt, it will be things such as persistent aggressive phone calls; old debts suddenly popping up with no explanation; and people trying to arrange affordable payment, getting short shrift and being told, “Pay this or else.” With local government debts, bailiffs are used and there is a lack of any kind of mechanism to make affordable, sustainable payments, which are at the core of what people need.

Our clients typically have six debts. They are often in difficulty because they have lost their job or become ill, and they need a period to recover control of their finances. We need creditors to show some forbearance and help people to make affordable, sustainable repayments. When that happens, about 60% of people say that their finances start to recover straight away. When that does not happen, none say that.

If people get shouted at and told to pay money they cannot afford, they actually go and borrow somewhere else—about a third of our clients went to a payday lender when they received an aggressive payment demand that they could not afford—or they do not pay another bill. The financial chaos continues, and gets worse and worse.

Alistair Chisholm: There is a particular issue around the way in which debts can be disputed. There is a difference between the way in which that is dealt with in the public sector and in the private sector. I certainly agree that the Government need to apply to their own collection activities the standards and protections they have asked financial, energy and water services to offer to consumers. The Bill is an opportunity to make that change and, if they do, sharing data can be helpful.

We see a lot of cases in which bad data sharing has a wasteful effect on Government and a detrimental effect on our clients. For example, in a survey of our advisers last year, 55% of them had seen more than one case the previous 12 months in which a debt was sent to a bailiff but in which the debtor’s council tax benefit had actually not been processed. It is a common, systemic problem that bits of Government do not use their own data to try to resolve people’s problems. That is an opportunity for the Government, but there are big risks.

Take the recent debacle with Concentrix and Her Majesty’s Revenue and Customs, in which the Government were using credit reference data and, it seems to me, tracing data to find people who were guilty of cohabiting. They were accusing those people of having a tax credit debt and it turned out they were not guilty of that at all. If mistakes like that are ricocheting around public sector debt collectors, the detriment could be much worse. For this power to work we need a shift in the way the Government collect debt. It needs to be allied with the best practices in the private sector, particularly—

[Louise Haigh]

Q Sorry, but what precisely could the Bill do to address that?

Alistair Chisholm: The Bill says that people who are sharing data should “have regard to” a statement of good practice, but we do not have that statement of good practice and “have regard to” does not seem to me to be very forceful. There are three particular things I think would help to change Government debt collection so they could use data sharing more safely. They could set affordable payments in the way the private sector does; the Government could introduce the standard financial statement that the banks, energy and water companies and the advice sector are going to be using from March next year. They could introduce fair dispute resolution; if the debt is reasonably disputed, stop collecting it until the complaint is investigated. Banks are not allowed to collect it then but public sector creditors routinely do it.

Finally, the big shift we have seen in commercial credit in recent years is the decision to place the legitimate interests of the consumer at the centre of debt collection activities, which means to help them rather than to have an unnecessary adversarial relationship. So, fair payments, fair disputes and being helpful could transform debt collection from being aggressive, adversarial and often wasteful to being helpful and to helping people to rehabilitate themselves.

[Louise Haigh]

Q Dr Fishenden, if we can move on to you in relation to part 5, specifically the measures on data sharing. Do the proposals reassure you that the Government have given sufficient consideration to privacy, data security and data ethics?

Dr Fishenden: The policy intent is clear and I suspect you will not hear much disagreement with that. The consultation did not find that either; people were broadly in agreement. The measures described in part 5 are fairly general and vague. There is a lot of reference to the codes of practice, which have still not have appeared.

In general, given that it is about seven years since the previous data sharing proposals were withdrawn for being too wide-ranging and vague and for work to be done on them to make them more specific and build in protections and controls, I am quite surprised that we are back with a Bill that seems aspirationally in the right place but that has none of the detail that allows us to check the sort of security, data protection and controls that will be needed.

There is not even any definition in the Bill of what data sharing means, which gives me a problem. Some people seem to assume it means people copying data around, and I guess that is implied in the bulk data provisions—it seems to imply movement of data between parties. Good cyber-security practice would be to leave the data with their original owner, who can gate access to those data or, as I described in my written submission, can confirm aspects of them.

A specific example could be applying for a blue badge. All that is needed to process that claim is to confirm with the DVLA that a person is a registered driver, that they have a legitimate driving licence and that they own the vehicle for which they are applying for the blue badge; to know from the DWP that they are registered disabled; and the local authority undertaking that process needs to check that person is a resident. There is not actually a flow of data going on there; it is merely a process whereby, to get a blue badge, you confirm the person is disabled, is a registered driver and is living within the local authority boundaries.

I find it quite surprising that the Bill does not have a definition of what data sharing is, either legally or technically. In the absence of the codes of practice, it is very hard to know what it actually means.

[Louise Haigh]

Q In your experience, is it unusual for the Government not to have published at least draft codes of practice alongside legislation of this nature?

Dr Fishenden: I would have assumed that they would be drafted in concert with the Bill, because to test the provisions in the Bill, you would need to run them back past the codes of practice to check that the two work together. I am a bit confused about why they have not appeared, because I cannot see how the Bill would have been drafted without them.

[Rishi Sunak (Richmond (Yorks)) (Con)]

Q I have a question for Mr Chisholm. I put on record my thanks to your organisation for the wonderful work that it does in my constituency—and in everyone else’s, I am sure—in helping some of the more vulnerable people in society. It is a fantastic organisation. We hear a lot about the big picture of how technology can help people and make their lives better, but you guys are at the coalface, helping vulnerable people. Will you explain how some of the measures in the Bill on data sharing are going to make your life easier and deliver tangible benefits to vulnerable people?

Alistair Chisholm: As I said before, there are definitely cases in which the Government or local authorities do not use their own data to help people when they could. For example, when somebody is paying their magistrate’s fine directly from their benefits, sometimes the benefits change, so the flow is disrupted and the payments stop.

We often see cases in which somebody then has a bailiff at their door and they are threatened with imprisonment when, in fact, they want to pay. The Government actually know that there has been a temporary interruption to their benefits, or that somebody is shifting from jobseeker’s allowance to employment and support allowance. If those data were joined up—obviously in a way that protected consumers as they need to be protected—the debt would continue to be paid, the problem would not be escalated, and the person would have a stable financial arrangement that enables them to meet their obligations. There are opportunities like that.

It is really important to say that it is now time for the Government to do what they have asked the private sector to do in the way they collect data. They need to adapt their systems so that payments are affordable and debts can be reasonably disputed, and so that people are helped.

--- Later in debate ---

[Chris Skidmore]

Q I have a final question. We have touched, in previous evidence hearings, on the nature of consent and individual knowledge about data sharing. What are the challenges with using consent-based data-sharing models? Do you accept that there is a necessity for data sharing to be used for the benefit of particular vulnerable groups in society without the need for consent?

Elizabeth Denham: The provision in part 5—the kind of data sharing that is envisioned—is not a consent regime. In many cases, citizens do not have a choice. There is one provider and the data need to be shared for good public interest purposes. Consent is not a silver bullet.

If, as is the case here, you are not using consent as a basis for sharing information, the other obligations rise. The need for transparency, safeguards, parliamentary scrutiny and independent oversight are even more important when you are not relying on consent. Those other obligations need to be strengthened.

[Louise Haigh]

Q Apologies for my brief absence from the Committee. Ms Denham, do you believe that the proposals in part 5 comply with the EU’s general data protection regulation?

Elizabeth Denham: There may be some challenges between the provisions and the GDPR. Obviously the GDPR will come into effect in 2018 unless we leave Europe before that date. There are some new controls for individuals that are built into the GDPR. There would be a need to carefully review the provisions of this Bill against the GDPR to ensure that individuals could have the right to be forgotten, for example, so that they could ask for the deletion of certain types of data, as long as that was not integral to a service. That is one example.

Steve Wood: To build on those points, the GDPR will strengthen the rights of individuals, particularly in the area of transparency that the commissioner has mentioned already. Article 12 talks about the importance of clear and accessible information to individuals. This Bill will need to operate alongside the GDPR’s enhanced and strong requirements to make sure that the key concepts in that legislation are upheld. The other key concepts we take from European data protection more generally are the those of necessity and proportionality, which is where there will be some important areas to measure the intention of the Bill against the GDPR.

[Louise Haigh]

Q We have heard your concerns about the draft codes of practice, which I also find very concerning. Of course, we do not know because we have not seen any draft codes of practice. Would you advise Members to vote on Government powers of that nature without seeing such draft codes of practice? Who else should be consulted on such codes before they are made law?

Elizabeth Denham: We have seen some of the draft codes of practice, and we have been making comments, but I think it would be preferable for Parliament to review all the codes of practice so that they can see and discuss the entire framework before the passage of the Bill. The codes are an important part of the framework.

[Kevin Brennan]

Q To follow up on that, do you believe that we ought to see the draft codes of practice prior to consideration of these parts of the Bill in Committee?

Elizabeth Denham: That is my view, yes.

[Louise Haigh]

Q In your first speech as Information Commissioner you made much of the need for businesses to establish trust in relation to data sharing, with which I obviously completely agree. Do you think this Bill could have done more to put safeguards around data sharing in the commercial space?

Elizabeth Denham: Again, I think that trust and transparency go hand in hand. Part 5 is about Government data sharing and sharing with Government providers, so the focus there needs to be on transparency and trust. All Governments are really struggling with this issue, especially in the face of new technologies. How can you make transparency easy and understandable? We have just issued a privacy notice code of practice, which we introduced last Friday. What would help this Bill is if there was a reference to following our privacy notice code of practice, which again is across the public and the private sector and would lend more trust among the public.

[Nigel Huddleston]

Q The UK is one of the most advanced digital economies in the world, yet we heard from witnesses on Tuesday that, in terms of Government data sharing, we are well behind the curve, well behind other countries—that is partly because they are probably more focused on the opportunities. Does this Bill, in your experience, bring us more in line with the best practice you are seeing in other countries?

Elizabeth Denham: I think the approach that the UK is taking in this Bill is a responsible approach. My recommendations are to up the safeguards and improve the transparency. Breaking down the data sharing by type, function and purpose of data is a good way forward. There are some draconian data-sharing regimes in other parts of the world, which are concerning to data protection commissioners. I generally think that the approach here is right, but there could still be some strengthening of the Bill. That would go a long way to assuring more public trust and therefore more buy-in and participation in the digital economy and digital services.

Digital Economy Bill (Second sitting)

Louise Haigh Excerpts

Committee Debate: 2nd sitting: House of Commons
Tuesday 11th October 2016 Public Bill Committees

[The Chair]

Q 83 For this session we have until 2.45 pm. Will the witnesses please introduce themselves for the record?

David Austin: My name is David Austin. I am the chief executive of the British Board of Film Classification.

Alan Wardle: I am Alan Wardle, head of policy and public affairs at the National Society for the Prevention of Cruelty to Children.

[Louise Haigh (Sheffield, Heeley) (Lab)]

Q David, am I right in interpreting the amendments that the Government tabled last night as meaning that you are intended to be the age verification regulator?

David Austin: That is correct. We reached heads of agreement with the Government last week to take on stages 1 to 3 of the regulation.

[Louise Haigh]

Q Are you sufficiently resourced to take on that role?

David Austin: We will be, yes. We have plenty of time to gear up, and we will have sufficient resource.

[Louise Haigh]

Q Will it involve a levy on the porn industry?

David Austin: It will involve the Government paying us the money to do the job on our usual not-for-profit basis.

[Louise Haigh]

Q What risks do you envisage in people handing over their personal data to the pornographic industry?

David Austin: Privacy is one of the most important things to get right in relation to this regime. As a regulator, we are not interested in identity at all. The only thing that we are interested in is age, and the only thing that a porn website should be interested in is age. The simple question that should be returned to the pornographic website or app is, “Is this person 18 or over?” The answer should be either yes or no. No other personal details are necessary.

We should bear in mind that this is not a new system. Age verification already exists, and we have experience of it in our work with the mobile network operators, where it works quite effectively—you can age verify your mobile phone, for example. It is also worth bearing in mind that an entire industry is developing around improving age verification. Research conducted by a UK adult company in relation to age verification on their online content shows that the public is becoming much more accepting of age verification.

Back in July 2015, for example, this company found that more than 50% of users were deterred when they were asked to age verify. As of September, so just a few weeks ago, that figure had gone down to 2.3%. It is established technology, it is getting better and people are getting used to it, but you are absolutely right that privacy is paramount.

[Louise Haigh]

Q Are you suggesting that it will literally just be a question—“Is the user aged 18?”—and their ticking a box to say yes or no? How else could you disaggregate identity from age verification?

David Austin: There are a number of third-party organisations. I have experience with mobile phones. When you take out a mobile phone contract, the adult filters are automatically turned on and the BBFC’s role is to regulate what content goes in front of or behind the adult filters. If you want to access adult content—and it is not just pornography; it could be depictions of self-harm or the promotion of other things that are inappropriate for children—you can go to your operator, such as EE, O2 or Vodafone, with proof that you are 18 or over. It is then on the record that that phone is age verified. That phone can then be used in other contexts to access content.

[Louise Haigh]

Q But how can that be disaggregated from identity? That person’s personal data is associated with that phone and is still going to be part of the contract.

David Austin: It is known by the mobile network operator, but beyond that it does not need to be known at all.

[Louise Haigh]

Q And is that the only form of age verification that you have so far looked into?

David Austin: The only form of age verification that we, as the BBFC, have experience of is age verification on mobile phones, but there are other methods and there are new methods coming on line. The Digital Policy Alliance, which I believe had a meeting here yesterday to demonstrate new types of age verification, is working on a number of initiatives.

[Claire Perry (Devizes) (Con)]

Q May I say what great comfort it is to know that the BBFC will be involved in the regulatory role? It suggests that this will move in the right direction. We all feel very strongly that the Bill is a brilliant step in the right direction: things that were considered inconceivable four or five years ago can now be debated and legislated for.

The fundamental question for me comes down to enforcement. We know that it is difficult to enforce anything against offshore content providers; that is why in the original campaign we went for internet service providers that were British companies, for whom enforcement could work. What reassurance can you give us that enforcement, if you have the role of enforcement, could be carried out against foreign entities? Would it not be more appropriate to have a mandatory take-down regime if we found that a company was breaking British law by not asking for age verification, as defined in the Bill?

David Austin: The BBFC heads of agreement with the Government does not cover enforcement. We made clear that we would not be prepared to enforce the legislation in clauses 20 and 21 as they currently stand. Our role is focused much more on notification; we think we can use the notification process and get some quite significant results.

We would notify any commercially-operated pornographic website or app if we found them acting in contravention of the law and ask them to comply. We believe that some will and some, probably, will not, so as a second backstop we would then be able to contact and notify payment providers and ancillary service providers and request that they withdraw services from those pornographic websites. So it is a two-tier process.

We have indications from some major players in the adult industry that they want to comply—PornHub, for instance, is on record on the BBC News as having said that it is prepared to comply. But you are quite right that there will still be gaps in the regime, I imagine, after we have been through the notification process, no matter how much we can achieve that way, so the power to fine is essentially the only real power the regulator will have, whoever the regulator is for stage 4.

For UK-based websites and apps, that is fine, but it would be extremely challenging for any UK regulator to pursue foreign-based websites or apps through a foreign jurisdiction to uphold a UK law. So we suggested, in our submission of evidence to the consultation back in the spring, that ISP blocking ought to be part of the regulator’s arsenal. We think that that would be effective.

--- Later in debate ---

[Matt Hancock]

Q Yes. Given that there is a big problem that is hard to tackle and complicated, I was just trying to get a feel for how much of the problem you think, with your expertise and the Bill, we can fix.

David Austin: We can fix a great deal of the problem. We cannot fix everything. The Bill is not a panacea but it can achieve a great deal, and we believe we can achieve a great deal working as the regulator for stages 1 to 3.

[Louise Haigh]

Q My question follows on neatly from that. While I am sure that the regulation will tackle those top 50 sites, it obviously comes nowhere near tackling the problems that Mr Wardle outlined, and the crimes, such as grooming, that can flow from those problems. There was a lot of discussion on Second Reading about peer-to-peer and social media sites that you have called “ancillary”. No regulation in the world is going to stop that. Surely, the most important way to tackle that is compulsory sex education at school.

Alan Wardle: Yes. In terms of online safety, a whole range of things are needed and a whole lot of players. This will help the problem. We would agree and want to work with BBFC about a proportionality test and identifying where the biggest risks are to children, and for that to be developing. That is not the only solution.

Yes, we believe that statutory personal, social and health education and sexual relationships education is an important part of that. Giving parents the skills and understanding of how to keep their children safe is also really important. But there is a role for industry. Any time I have a conversation with an MP or parliamentarian about this and they have a child in their lives—whether their own, or nieces or nephews—we quickly come to the point that it is a bit of a nightmare. They say, “We try our best to keep our children safe but there is so much, we don’t know who they are speaking to” and all the rest of it.

How do we ensure that when children are online they are as safe as they are when offline? Of course, things happen in the real world as well and no solution is going to be perfect. Just as, in terms of content, we would not let a seven-year-old walk into the multiplex and say, “Here is ‘Finding Nemo’ over here and here is hard core porn—off you go.”

We need to build those protections in online so we know what children are seeing and to whom they speaking and also skilling up children themselves through school and helping parents. But we believe the industry has an important part to play in Government, in terms of regulating and ensuring that spaces where children are online are as safe as they can be.

[Christian Matheson (City of Chester) (Lab)]

Q To follow on from the Minister’s question, you feel you are able to tackle roughly the top 50 most visited sites. Is there a danger that you then replace those with the next top 50 that are perhaps less regulated and less co-operative? How might we deal with that particular problem, if it exists?

David Austin: When I said “the top 50”, I was talking in terms of the statistics showing that 70% of people go to the top 50. We would start with the top 50 and work our way through those, but we would not stop there. We would look to get new data every quarter, for example. As you say, sites will come in and out of popularity. We will keep up to date and focus on those most popular sites for children.

We would also create something that we have, again, done with the mobile operators. We would create an ability for members of the public—a parent, for example—to contact us about a particular website if that is concerning them. If an organisation such as the NSPCC is getting information about a particular website or app that is causing problems in terms of under-age access, we would take a look at that as well. In creating this proportionality test what we must not do is be as explicit as to say that we will look only at the top 50.

First, that is not what we would do. Secondly, we do not want anyone to think, “Okay, we don’t need to worry about the regulator because we are not on their radar screen.” It is very important to keep up to date with what are the most popular sites and, therefore, the most effective in dealing with under-age regulation, dealing with complaints from members of the public and organisations such as the NSPCC.

Alan Wardle: I think that is why the enforcement part is so important as well, so that people know that if they do not put these mechanisms in place there will be fines and enforcement notices, the flow of money will be stopped and, crucially, there is that backstop power to block if they do not operate as we think they should in this country. The enforcement mechanisms are really important to ensure that the BBFC can do their job properly and people are not just slipping from one place to the next.

--- Later in debate ---

[The Chair]

Q We have roughly 45 minutes for this group of witnesses, if necessary. Will the witnesses please introduce themselves?

Dr Whitley: My name is Dr Edgar Whitley. I am an academic at the London School of Economics. Of particular importance for this session is the fact that I am the co-chair of the privacy and consumer advisory group of the Government Digital Service.

Scott Coates: Good afternoon. My name is Scott Coates and I am the CEO of the Wireless Infrastructure Group, an independent British wireless infrastructure company that builds and operates communication towers and fibre networks.

[Louise Haigh]

Q In your written evidence, Mr Coates, you talked about the need for greater diversity in the ownership of mobile infrastructure. Does the Bill go far enough on that?

Scott Coates: We welcome the measures in the Bill to improve the speed at which infrastructure can be deployed and to improve the economics of deploying the infrastructure. It is critical to understand that there are different ways of deploying infrastructure. There are different ownership models, for which the Bill could have different impacts. When I say “infrastructure”, I mean the kind of mobile and fixed infrastructure that you see in the field, whether that is cables, ducts, cabinets or communication tower facilities.

There are two different types of owners of those types of infrastructure. First, the vertically integrated players are effectively building and operating that infrastructure for their own networks, primarily, and their business case is based on their economic use of that infrastructure. Secondly, you have a growing pool of independent infrastructure companies, of which we are one. We are very different from the traditional, vertically integrated players in that we are investing in infrastructure not for our own network, but to provide access, on a shared basis, to all other networks.

[Louise Haigh]

Q What are the current proportions for ownership?

Scott Coates: If I talk about mobile infrastructure, around a third of the UK’s communications towers—of which we think there are around 27,000 in the UK—are independently operated. It is really interesting that, globally, there has been a very firm shift over the past decade towards more independent operation of such upstream digital infrastructure.

Currently, more than 60% of all communication towers globally are held in an entity separate from the networks that use them. In countries such as India or the US, that figure is somewhere between 80% and 90%. There are real benefits that flow from the independent ownership of infrastructure. We are trying to do more in the UK, but the UK currently lags behind in the global statistics I mentioned.

[Louise Haigh]

Q Does the Bill do anything to address that?

Scott Coates: One of the things that we acknowledge and welcome in the Bill is that it is very clear about maintaining investment incentives—not just for the vertically integrated players, but for the independent infrastructure players such as ourselves—

[Louise Haigh]

Q It will not do anything to address the proportion, will it? It will only entrench the division already there.

Scott Coates: I do not think that the Bill does anything to encourage more independent infrastructure. The Government’s policy position at the moment is very clear: they want to maintain investment incentives for independent infrastructure. To achieve clarity on this requires that the Bill is worded very carefully.

When we deploy our tariff facilities and infrastructure on or adjacent to land, as things are now one of the definitions of UK land often covers things that sit on that land. One of the potential risks is that if the activities we engage in and the facilities that we deploy are not carefully carved out, they risk being treated as land. Under the new valuations principles in the communications code, that potentially risks giving them no value or low value, which would obviously be devastating to investment appetite. The consequence of that would be further concentration of infrastructure ownership in the hands of the larger, vertically integrated players who have different incentives from us when they approach this.

[Louise Haigh]

Q So there is potential for this to get worse, but what could be done to actually encourage more independently owned infrastructure?

Scott Coates: We would like to see a carve-out that is as clear as possible for the activities that we are engaged in. We would like to see it made absolutely clear that the communications code, which is a compulsory purchase tool to bring land into the telecoms sector, does not drift beyond that focus and risk entering into what is really Ofcom’s territory, which is to govern the relationships between telecoms companies.

[Louise Haigh]

Q Dr Whitley, if I may jump to part 5 of the Bill, we heard earlier that there were concerns that the Government have not taken sufficiently into account safeguards around privacy and personal data. Do you think that this strikes the right balance between open policy-making and privacy?

Dr Whitley: My main concern with part 5 is that the detail is just not there. The codes of practice that one would expect to have there, which would give the details about how privacy might be protected, are not present. We have been involved with the privacy and consumer advisory group. As far as I can tell, we had our first meeting with the team who were developing these proposals back in July 2013. We said from the very beginning that we want detail, because when we have specific details we can give advice and suggestions and review it, but we have never had that level of specific detail.

[Louise Haigh]

Q So the proposals do not reflect at all the three years of consultation that have taken place?

Dr Whitley: Obviously, that is reflected in some parts of the proposals, but we asked for more details specifically on how privacy will be protected regarding the data-sharing proposals, and that is still not there.

[Louise Haigh]

Q Should that detail be in primary legislation?

Dr Whitley: Whether it is in primary legislation or in codes of practice, my personal view is that you need a certain level of detail to be able to make an informed decision. Otherwise there will be some vague position of, “We will share some data with other people within Government. Trust us, because we are going to develop some codes of practice that will be consulted on and will then be put in front of Parliament. There will be protections and it will all be fine”. We are saying that there are lots of different ways of doing that. The earlier you give us at least a first attempt at those details, the better we can improve it.

[Louise Haigh]

Q In that period of consultation, was the detail around transparency never discussed?

Dr Whitley: It depends. There has been talk along the lines of there being codes of practice and liaison with the Information Commissioner’s Office, so at a very high level there has obviously been some discussion. But at the very specific level—for example, the civil registration clauses talk both about allowing a yes/no check around whether there is a birth certificate associated with a family, while on the other hand there will be bulk data sharing within Government so that different Departments can know stuff and possibly make things better for society.

One half of that seems to be quite specific, and you can see how it could well be designed as a simple “Does a birth certificate exist for this person?” and the answer is yes or no. The privacy protections around that are reasonably well known and not very much data is being shared. Then the other illustration just says, “we will share these data with other bits of Government” and there is nothing there about what kind of privacy protections might be put in place. There are many different ways in which that can be done, but until we have some specific details, we cannot give you sensible reviews as to whether that is a good or not so good way of doing it.

[Nigel Huddleston]

Q Mr Coates, what role should wireless technologies play in achieving the universal service obligation?

Scott Coates: There is no doubt that for the last 5%, maybe a greater proportion than that, wireless technologies have a significant role to play. Six of the seven trials run by the Department for Culture, Media and Sport earlier this year were of a wireless-based structure. I think there is a role for it. It is also interesting, as you look beyond 10 megabits to the future when universal service means something far more substantial than that, that a new disruptive technology is coming.

Everyone is talking about 5G; it does not really exist at this stage, but we know it is going to be ultra-high bandwidth, ultra-low latency, with the potential to be a disruptive technology and replace fixed line to the home. Some countries around the world that have not had the wave of fixed line technology roll-out will be moving straight to wireless as their domestic broadband service.

--- Later in debate ---

[Nigel Huddleston]

Q Once we work that out, which I am confident we will, where are the opportunities? Where is the up side? Where is the positive stuff coming out of this? How can Government be better as a result of this? I am always an optimist.

Dr Whitley: Done right, there are fantastic opportunities. Government is digitising. The GDS has got lots of experience about how to manage and handle and do attributes checking, which is what most of this is. There are definitely opportunities and the skills, but somehow something has gone wrong with regard to these proposals.

It is not as if the proposals have been rushed through in the past few minutes. We have been looking at these and asking for more details since July 2013 and we are still here without even a resemblance of a code of practice. Part 5 has six codes of practice that need to be developed and none of them is here. Yes, please, but some detail. I am academic; I want to see the detail.

[Louise Haigh]

Q As you say, it is an enormous shift in terms of data sharing within Government. Clause 29 would allow personal data on citizens to be shared if there is a

“contribution made by them to society”

or wellbeing to be gained. That basically covers anything, doesn’t it? Why have the Government not produced even a draft code of practice at this stage? How can we possibly be expected to vote on this while plainly placing blind faith in the Government?

Dr Whitley: You are basically saying what I was going to say. If you compare the comprehensive replies that Mr Coates has been able to give, talking about very specific details, with the vague “we don’t know anything” comments that I have made, you see that it is a real problem and also an issue for more general scrutiny of technological issues. If you do not have details about the different mobile phone frequencies that you are talking about, you cannot make detailed policy. Yet when it comes to data sharing, there is a sense that it will all work out in the end because we have the right people to do it.

[Louise Haigh]

Q How would you advise the Government to achieve that code of practice?

Dr Whitley: We have consistently said—the Privacy and Consumer Advisory Group particularly, because we have this existing relationship with Government, but civil society and experts more generally—that we are more than happy to engage. We have repeatedly said, “Give us some detail. Don’t just come and talk about high-level stuff. Give us the detail and we will give you detailed comments to improve the process.”

That has worked very well in relation to the Verify scheme; that is privacy friendly and has a lot of support from the kinds of people who are very concerned about privacy. So the expertise is there and the working relationships are there. Give us an opportunity to help; we want to. It is just that we need something to work on.

[Louise Haigh]

I hope the Minister has heard that.

[The Chair]

Thank you very much to Mr Coates and Dr Whitley for some excellent evidence. We are very grateful. We will now move on to our next set of witnesses.

Examination of Witnesses

Jim Killock and Renate Samson gave evidence.

--- Later in debate ---

[The Chair]

Thank you. I turn first to Louise Haigh.

[Louise Haigh]

Q I will pick up where we left off, if that is okay. You were both involved in the consultation process for part 5 of the Bill. Did the proposals come as a surprise to you? Do they make sense to you as data experts?

Renate Samson: No, they do not make very much sense, if I am honest. As I said, we were a member of the open policy making process and we also submitted to the consultation. I am genuinely surprised that after a two-year process, all of a sudden it felt very rushed. There were conversations and meetings happening right up to the Queen’s Speech; there was still a general lack of clarity, particularly on safeguards, and many questions were still being asked, such as how, why, when and so on. The next thing we knew, it was in the Queen’s Speech and the Bill was published.

Reading through part 5—and I have read through it a lot and scratched my head a great deal, mainly for the reasons given in evidence earlier today—you see that the codes of practice, which would explain an awful lot of what we imagine is meant or may not be meant, just have not been published. I have repeatedly asked for them and been given various expected dates, and we are sitting here today without them but with the Bill already having been laid before Parliament.

We have also done a lot of work on the Investigatory Powers Bill, for which the codes of practice were there right from the start. There was clarity as to what was intended and what was going to be legislated for, straight up. So, I am profoundly disappointed, because data sharing and digital government are hugely important and we seem to be very far away after a very long process.

Jim Killock: It is worth considering why the open policy making process was put in place. Data sharing is known to be potentially controversial. It was knocked out of at least one previous Bill a few years back when proposed by Labour because of the lack of privacy safeguards. Everyone understood that something more solid was needed. Then the Cabinet Office was very keen to ensure it did not raise hackles, that it got the privacy and the safeguards right, that trust was in place. It was therefore a surprise, after that intense process, to get something back that lacked the safeguards everybody had been saying were needed.

We are particularly concerned not only about the lack of codes of practice, but the fact that a lot of these things should be in the Bill. Codes of practice are going to develop over years. We need to know about things like sunsetting, for instance—that these things are brought to a close, that you do not just have zombie data sharing arrangements in place, where everyone has half-forgotten about them and then suddenly they are revived. You need to have Parliament involved in the specifics.

As we have heard, data sharing has a huge range of possibilities, starting with the benign and the relatively uncontroversial: statistics and understanding what is happening to society and Government policy, where privacy is relatively easy to protect. You use the data once, you do the research and that is it. It ranges from that through to the very intrusive: profiling families for particular policy goals might be legitimate, but it also might be highly discriminatory. Getting to the specifics is important.

You need the safeguards in place to say, “These are the kinds of things we will be bringing back; these are the purposes that we may or may not share data for.” That way, you know there is a process in place. At the moment, it feels like once this has passed, the gate is opened and it is not necessarily for Parliament to scrutinise further.

[Louise Haigh]

Q We talked earlier about the bulk transfer and bulk sharing of data, and an earlier witness talked about providing data access, rather than data sharing. Should the Government not be pursuing trials on that basis, rather than these enormous powers without any kind of assurances to the public or parliamentarians about how they will be using them?

Renate Samson: It was very specific at the end of the open policy making process that, for example—put the bulk to one side for a moment—but regarding the fraud and debt aspect of the Bill, it had been agreed that three-year pilot projects would take place with subsequent review and scrutiny potentially by the OPM or by another group. They are in the Bill as a piece of legislation with the Minister deciding whether or not it is okay and potentially asking other groups, which are not defined. That is half an answer to half your question. Pilots are an excellent idea if they are pilots, not immediate legislation.

With regards to the bulk powers in the Bill, civil registration documents were a late addition. We are still not clear as to their purpose. The purpose given in the consultation to the OPM process, but also in the background documents relating to the Bill, is a whole mix of different reasons, none of which, I would argue, are clear and compelling or, indeed, necessary and proportionate. But again, as you have heard a lot today, without detail, how can we properly answer your question?

Jim Killock: I have a quick observation on this. We currently have a data protection framework. The European Union is revising its data protection laws; they are somewhat tougher, which is quite a good thing, but we do not know what the future of data protection legislation is in the UK. It might be the same or it might be entirely different in a few years’ time.

That is a very good reason for ensuring that privacy safeguards are quite specific and quite high in some of these sensitive areas, because we do not know whether the more general rules can be relied on and whether they are going to be the same. That is not to say that we do not need higher safeguards in any case here, because you are not dealing with a consent regime. People have to use Government and Government have to look at the data, so it is not a mutual agreement between people; you have to have higher safeguards around that.

[Thangam Debbonaire]

Q My questions are directed at Mr Killock and relate to paragraphs 37 and 38 of your submission, “Definition of pornographic material”. We heard earlier that both the NSPCC and the British Board of Film Classification support a provision to require ISPs to block websites that are non-compliant. There was also discussion of widening the scope to apply the restrictions to other harmful material that we would not allow children access to in the offline world. Here, you seem to be questioning the value of that:

“This extension of the definition…also raises questions as to why violent—but not sexual—materials rated as 18 should then be accessible online.”

I also question this consistency but the solution, to me, seems to be that we should include other material, such as violent material and pro-anorexic websites, as we talked about earlier. Will you tell us a bit more about what your objection is to creating a framework to keep children as safe online as they are offline?

Jim Killock: We have no objection; it is a laudable aim and something we should all be trying to do. The question is, what is effective and what will work and not impinge on people’s general rights? As soon as you look a little beyond pornography, you are talking about much more clear speech issues.

There will be a need to look at any given website and make a judgment about whether it should or should not be legally accessed by various people. That starts needing things like legal processes to be valid. Some of the things you are talking about are things that might not be viewed by anybody, potentially. The problem with all these systems is that they just do not work like that. They are working on bulk numbers of websites, potentially tens of thousands, all automatically identified, as a general rule, when people are trying to restrict this information. That poses a lot of problems.

I also query what is the measure of success here. Because I feel, I suspect, that the number of teenagers accessing pornography will probably not be greatly affected by these measures. There is more of an argument that small numbers of children who are, perhaps, under 12 may be less likely to stumble on pornographic material, but I doubt that the number of teenage boys, for instance, accessing pornographic material will be materially changed. If that is the case, what is the measure of success here? What harm is really being reduced? I just feel that, probably, these are rather expensive and difficult policies which are likely to have impacts on adults. People are saying it is not likely to affect them, but I rather suspect it might, and for what gain?

--- Later in debate ---

[The Chair]

We are better informed.

[Louise Haigh]

Q Paul, the Government have delayed by a year outlining their digital strategy. Could you give the Ministers a hand here? What would you like to see in a digital industrial strategy?

Paul Nowak: There are a number of points in the Bill where we think there are positive steps forward: things like the universal service obligation. I am happy to talk about some of those points. The missed opportunity for us is really getting a handle on what the emerging digital economy means for working people. Tomorrow, we will have the outcome of the court decision on Uber. That is just one example of where changing technology potentially affects working people’s lives. We believe there should be a proper framework and employment law should properly reflect the change in the world of work. The point was made by a number of MPs on Second Reading that the Bill missed a trick in terms of that new framework of rights and responsibilities for people who work.

[Louise Haigh]

Q What would that framework look like?

Paul Nowak: It would tackle issues around, for example, employment status. We have this curious interface between the new, emerging digital economy and what I would characterise as some old-fashioned exploitative employment practices. It is great that we can all order new goods and services online via eBay, but often the person who delivers that package will be working so-called to an app and they will be so-called self-employed, driving their own vehicle and with no rights to paid holidays, maternity or paternity leave and so on.

So a framework of laws that is fit for the digital age. It is welcome that the Government have announced that Matthew Taylor will be looking at some of these issues, but I would have thought that for a Digital Economy Bill there is a gap in the Bill itself.

[Louise Haigh]

Q Has the TUC been consulted on that by the Government?

Paul Nowak: We have had no engagement in terms of the process I described with Matthew Taylor and, as far as I am aware, we have had no input in terms of the Bill and the thinking around what a decent framework of employment rights will look like to respond to that emerging digital economy.

[Louise Haigh]

Q What about the digital skills gap—where could the Bill go further there?

Paul Nowak: That is not something that we have looked at particularly, but I think it goes without saying that the need for digital skills will go well beyond those core digital industries. The proof of the pudding will be in the eating. We are pleased that the Government are now talking about industrial strategy, and we think that the digital economy should play a key role at the heart of that industrial strategy. It is not just about digital industries themselves; it is about how those digital industries can support jobs in our manufacturing, engineering and creative industries, but you need to make sure that people have the skills—not just at one moment in time, but ongoing skills throughout their working lives—to enable them to adapt to the changing world of work. For example, one of the things that we have pushed heavily through our Unionlearn arm is equipping people with those skills, but making the case that people should have access to careers advice and guidance all the way through their working lives rather than just at the point at which they leave school, college or university.

[Louise Haigh]

Q Sarah and Chris, I do not know whether you were here for the earlier sessions, but we have heard quite a few concerns about the data-sharing proposals in part 5 of the Bill. Do you share the concerns about the lack of privacy safeguards in those proposals?

Sarah Gold: I do. There are quite a few pieces of information missing that I would like to see in the Bill to protect individuals’ privacy. I think I heard Jeni Tennison talk earlier about openness and transparency, and I agree with her that one of the major pieces that is missing from the Bill is transparency about how people’s information will be used.

For me, this is also a missed opportunity to talk about consent, which is increasingly becoming a design issue, not necessarily just one of policy. That means making sure that there are steps in place to ensure that people understand how their data will be used, by whom, for how long and for what purpose. That is really important, because currently, the only models of consent we seem to default to are terms and conditions, and I have to ask the Committee: when was the last time any of you read or understood a set of terms and conditions?

[Louise Haigh]

Q Claire Perry brought up the poor standards in the private sector earlier. Presumably you agree that the Bill misses an opportunity to deal with consent for the private sector’s use of data as well.

Sarah Gold: It does, because I think the Government should set best standards on this. There is a real opportunity to do that, and I cannot see that on the face of the Bill.

Chris Taggart: I broadly agree. There was a comment in one of the submissions that despite this being a Digital Economy Bill, it felt like it was from almost 10 years ago. We have the ability to treat data in a much more granular way—dealing with permissions, rights and so on; having things selectively anonymised; having things almost time-boxed, and so on. It struck me that it felt like the Bill was using the broad brush of how we used to exchange data 10 years ago. That seemed like a missed opportunity, particularly given that what we are talking about here is Government to Government. While it is very difficult for the private sector—or even between the Government and the private sector—to come up with some of those solutions, when you are talking essentially about one organisation, particularly one where there is the ability to legislate that everything should happen in the right way, it seems to be a missed opportunity.

I was asked a couple of years ago to be on the Tax Transparency Sector Board, which talked about opening up some of the tax data. Of course, pretty much no data were actually opened up, but some of the discussions were interesting. For example, the Bill talks a lot about individuals, which is absolutely right—I believe that we have innate human rights—but from a tax point of view, individuals and companies are exactly the same thing. There is no difference. HMRC was saying, “Hey, look, whatever we think and whatever we would like to do, we have no ability to treat individuals and companies as the same.” The idea of allowing companies to tick a box and say, “Yes, we’d like our tax to be reported and to be open about it,” or saying, “These offenders will be treated differently if they are corporate offenders,” for example—many countries do report tax offences by companies—was not even possible because of the underlying legislation. There is a sense that that sort of attitude slightly pervades some of this. Again, I am extremely in favour of the Government being more effective and efficient and using information sharing for that, but I would like the Bill to be as good as it possibly can be.

Finally, there are little things—I used to be a journalist but now I am a full-time geek—such as what is being reported? What things have been shared? How are those organisations being identified? The Government do not even have a coherent way of identifying Government Departments or non-departmental public bodies. Those sorts of things. There is a lot more that could be done to make this a genuinely effective Bill.

[Thangam Debbonaire]

Q Mr Taggart, you mentioned something about its feeling like it is 10 years out of date. I want to bring us bang up to date by chucking in a Brexit question. Is there anything that the three of you could very quickly add to the discussion about what might need to be in the Bill given that we are now in Brexit? Brexit has implications for the digital economy, about which I am sure you know more than me.

Chris Taggart: I will try to be brief. One is to do with policy aspects of what happens. I believe you are hearing from the Information Commissioner later. What happens to data protection in a post-EU UK? From our perspective, the UK has generally taken a slightly different perspective on data protection from the information commissioners in some other countries and is generally taking things like public interest into account and treating paid-for and free information the same, which we welcome. We have some concerns about the general data protection regulations because of that sort of stuff and some of the stuff that is coming from the EU. There are some potential benefits, but there are also some downsides about whether people’s rights will be defended. I think the digital economy becomes much, much more important, and my position here is as an advocate of open data and the potential for open data in driving a thriving digital economy. As a digital entrepreneur, I think we are missing some significant opportunities for that. If you were to sit down today and do a digital economy Bill with the knowledge that in a couple of years we perhaps would not be part of the EU, I think we would be doing something quite different.

Paul Nowak: May I pick up the point about post-Brexit? I think there is growing political consensus that one of the implications of the decision on 23 June is that we need to think seriously about how we invest in our national infrastructure. For the TUC that goes beyond Heathrow, Hinkley, High Speed Rail. It talks to issues around, for example, high-speed broadband. It is about thinking about how this Bill would interface with, for example, announcements that might come in the autumn statement about investment in high-speed broadband. I note that the Chair of the Committee talked about the interface between rail and high-speed broadband, which is something that should be borne in mind. Again, valid points were made on Second Reading about requirements for developers to incorporate high-speed broadband into new housing developments, which is absolutely essential. I reiterate the point I made earlier about seeing this in the context of the wider approach to industrial strategy and how the digital economy can support other parts of the economy that are going to be even more important as we move forward post-Brexit.

Sarah Gold: For me, particularly looking at privacy, security and personal data, it is about the age of some of the language used in the Bill. Even talking about data sharing feels to me like the wrong language. We should be talking about data access. Data sharing suggests duplication of databases, with data being slopped around different Departments, whereas data access suggests accessing minimum data via APIs or by using the canonical Government registers, which is an excellent project that is not mentioned in the Bill but should be.

--- Later in debate ---

[Louise Haigh]

Q Thinking about algorithms beyond the workplace, we know that Uber, for example, will charge more if your battery is low. Having worked for an insurer before I was elected, I know that the amount of data that is available to insurers to set prices would make your hair curl. How much transparency should there be around the algorithms that companies use to set prices, while protecting the intellectual property of those algorithms?

Chris Taggart: That is a fantastic question, and it comes to the heart of our ability to understand our world and influence it. I take quite strong, almost like democratic first principles with this: you need to be able to understand the world and have the ability to understand the world, and then to be able to influence it. That is what democracy is about. If we do not understand the world—if we do not understand that we are being given this particular news story in this particular way; that we are being given this particular price; that we are being influenced to walk down this street rather than that street in order to do this—then we really do not have that possibility. A question that is not asked often enough but that is starting to be asked more in academic circles is: what are the algorithms on which our lives depend? If we do not understand that we are being driven by algorithms, still less what those algorithms are, how do we have agency? How do we have free will, if you like? I think it is a really important question.

I think that increasingly we will see that we need transparency around that, and that with transparency there is always the ability for there to be negative downsides. You could argue that, by having courts open, people can just walk in off the street and see that this person over there is being prosecuted; some neighbour, or whatever. But if we are not starting to ask those sorts of questions and staring to come up with some informed answers, we will be in a world where we have lost the ability to ask those sorts of questions.

Paul Nowak: I am not particularly well versed in this area, but I suppose that it is a little bit like the terms and conditions question. You could provide so much transparency that it would give the illusion of people being informed, and I think what you want to do is to allow people to understand what are the potential implications of those algorithms. So, if you are using Uber you know that if there is a spike in demand or a lack of supply, you are likely to pay more, and what the implications of that might be, and what the parameters of that are. I do not think that means that Uber needs to make all of its software open source—frankly, that would mean nothing to me—but I want to know when I get in what the fair contractual exchange is between me and the company that is providing the service.

Sarah Gold: I am very well versed in this area but I have very little time to talk about it, which is very frustrating. However, I think that looking at how individuals can question algorithms is very important; I agree with both of your comments. Particularly in GDPR, there is a clear piece that is about people being able to question automated decisions that are made about them.

As a design problem, that is really fascinating. For instance, if you think about when you buy flights on browsers, I think that everyone has probably seen that when you go back to book the flight again, your IP address has been tracked, you are a cookie, and so you see the same flight booked for—it costs you more. So you go into kind of incognito mode to check that.

What I am quite interested in at the moment is that sort of incognito testing of algorithms, so that you can see how your inputs might change an output. In the context of Uber and insurance, I am very interested in this emergence of insurance for, say, a single day of driving or for a particular route, and being insured—say, it costs you far more to go down the M1 than just the A1. And you should be able to understand why that decision has been made about you, because it has a significant consequence for your life.

However, that comes down to the quality of the training data, too, and that comes back to some of the terms of the Bill—we should be working towards greater data minimisation, I think, and also the ability for people to be able to audit not only those data, to correct those when they go wrong, but to provide an audit of data access. While it may not mean everything to all of us, because not all of us are developers, I think that for those individuals who are able to scrutinise the code and check for digital rights management or security vulnerabilities, or biases in data sets, that information is really crucial, because it is those individuals who are our greatest defence against data misuse or fraud.

[The Chair]

Thank you very much indeed; that is a high note on which to conclude. I thank our three witnesses for your evidence. We may now release you and we will call our final two witnesses for the afternoon to come forward.

Examination of Witnesses

Professor Sir Charles Bean and Hetan Shah gave evidence.

[The Chair]

Welcome to our two final witnesses today; I am sure you will keep us on our toes in our final session. Could you please introduce yourselves for the record?

Hetan Shah: I am Hetan Shah, Executive Director of the Royal Statistical Society.

Professor Sir Charles Bean: Charlie Bean, London School of Economics and soon to be Office for Budget Responsibility.

[Louise Haigh]

Q We have heard from witnesses today about a lot of the negatives and potential pitfalls of data sharing across Government. I have nothing against the Government’s intentions here, but do you share the concerns of previous witnesses about the lack of safeguards for privacy in part 5 of the Bill?

Professor Sir Charles Bean: You will have to excuse me; since I was not here for your earlier discussions, I am obviously not aware of what earlier witnesses have said and what their reservations are. My interest obviously is in the use of the information for statistical purposes. It is important that there is a clear and well understood framework that governs that, and there clearly need to be limitations around it.

I have to say that I think the current version of the Bill strikes a reasonably sensible balance, but there are bits that will clearly need to be filled in. The Office for National Statistics will need to spell out a set of principles that govern the way it will access administrative data, and so forth.

[Louise Haigh]

Q Do you think there is any framework in part 5 around the sharing of data?

Professor Sir Charles Bean: Sorry—

[Louise Haigh]

You said you are satisfied that it strikes the right balance. Do you believe there is any framework in terms of the principles for data sharing in part 5?

Professor Sir Charles Bean: By “appropriate balance”, I mean in terms of the statistical authority having in-principle access to the administrative data that it needs to do its work, subject to certain limitations.

[Louise Haigh]

Q Do you believe there should be transparency for—

Professor Sir Charles Bean: I certainly believe in transparency. I am a big fan of transparency. Anyone who has worked at the Bank of England would like transparency.

Hetan Shah: May I come in and build on this? Privacy is absolutely critical to maintaining public trust, and in a sense we think the Bill has missed a trick here. On the research side, the framework is embedded on the face of the Bill. In our view, the ONS has a very good track record—it has maintained 200 years of census data, it has the best transparency, it publishes all the usage of the data and it has already criminalised the proceedings of misuse of data—but that has not been put on the face of the Bill. A tremendous amount could be done to reassure by taking what is already good practice and putting it on the face of the Bill, and I think that will answer the issue for the statistics and research purposes.

[Louise Haigh]

Q My full question was not, “Do you believe in transparency?” It was going to be: do you believe in transparency in terms of how citizens’ data will be shared with the Government and between Government agencies? That principle, as you say, is not only not on the face of the Bill but not anywhere in the Bill. We have been asked by the Government to rely on codes of practice that have not even been drafted yet.

Professor Sir Charles Bean: I agree that transparency about the principles that will govern sharing of information makes a lot of sense.

[Louise Haigh]

Q As you say, Mr Shah, for Government data sharing to work requires public trust, and digital government and the use of your statistics absolutely requires trust that the Government will handle data with due purpose and cause.

Hetan Shah: Another thing is that the UK Statistics Authority is directly accountable to Parliament, not the Government. That actually makes the statistics and research strand more accountable compared with other parts of the Bill. I remind you of that, which is very important.

[Matt Hancock]

Q I would be interested if you could explain and put on the record some of the consequences you see of having this Bill and the underlying secondary legislation on the statute book. What impact will that have on the areas in which you are experts?

Professor Sir Charles Bean: The key thing is that it greatly improves the gateways that enable the Office for National Statistics to use administrative data—tax data and the like—in the construction of official economic statistics. We are well off the pace compared with many other countries. Scandinavian countries, Canada, the Irish and the Dutch make very heavy reliance on administrative data and only use surveys to fill in the gaps. Here, the Office for National Statistics is essentially an organisation that turns the handle, sending out 1.5 million paper forms a year and processing those. Essentially, you are acquiring the same information again that you have already got in some other part of the public sector, where the information is being collected for other purposes.

The key gains here I see as twofold. First, because you access something close to the universe of the sample population rather than just a subset, which would normally be the case with a survey, you potentially get more accurate information. It is potentially also more timely, which for economic policy purposes is important.

The other side of the coin is that by enabling you to cut back on the number of surveys you do, there is a cost gain, which I should say would probably not mainly be a gain to the ONS, because they have to do the processing of the administrative data, but a gain to the businesses and households who are currently spending time filling in forms that they would not need to do if more use was made of administrative data.

--- Later in debate ---

[The Chair]

We have two questioners left: Louise Haigh and then Claire Perry.

[Louise Haigh]

Q Mr Shah, you keep mentioning access to data, but the problem we heard earlier is that the Bill talks not about access to data but about data sharing, which implies duplication. We should really be moving towards data minimisation. Do you think that the language of the Bill should reflect access to data, rather than data sharing?

Hetan Shah: My view is that for the clauses on statistics and research the Bill is pretty clear that it is about data access.

[Louise Haigh]

Q It discusses the transfer of data. It does not talk about your accessing data. It does not mention the technology through which you would do it. There are no codes of practice alongside how it would happen. It is very broad and explicitly talks about data sharing in certain areas.

Hetan Shah: I think I said this earlier, but in case I was not clear I shall repeat it. For statistical and research purposes, statisticians and researchers are interested only in aggregates; they are not interested in us as individuals. It is a key point that the relevant clauses are quite different from some of the other parts of the Bill. Others have indicated in their evidence that this area should be seen as slightly different.

It is also worth noting that there are safeguards that have been tried and tested over many years. There is the security surrounding the data—the ONS will not even let me into the vault where they hold the data. You need to be accredited and to sign something saying that you will not misuse the data. If you do, you will go to jail. The trick that has been missed has been not saying all that, because it is almost assumed that that is how the ONS works. My suggestion is that if you want to strengthen that part of the Bill, you should just lay out the safeguards that are already common practice in the ONS.

[Claire Perry]

Q Thank you both for setting out some very factual and helpful arguments as to why the provisions are a good thing, particularly when it comes to aggregate statistics. I was struck by a quote in your report published in March, Professor Sir Charles. You mentioned the

“cumbersome nature of the present legal framework”,

which the Bill will clearly help to solve, and you also said that there was a

“cultural reluctance on the part of some departments and officials to data sharing”

and, in many ways, to working together, as we know from experience. How do we solve that problem and get Departments to realise how helpful some of these datasets might be?

Professor Sir Charles Bean: A key thing about the Bill is that it shifts the onus of presumption. There is a presumption of access unless there is a good reason not to comply or explain, if you like, as opposed to the current arrangement, which is that the data owner has the data and you say, “Can you please let us have a look at it?” There is civil service caution. I was a civil servant very early on in my career, so I am aware of how civil servants think. Inevitably, you are always worried about something going wrong or being misused or whatever. That plays into this, as well.

In the review I said there are really three elements and I think they are mutually reinforcing. There is the current legal framework, which is not as conducive as it could be; there is this innate caution on the part of some civil service Departments, or even perhaps on the part of their Ministers on occasion; and then the ONS has not been as pushy as it might have been. It is partly that if you know it is very difficult to get in—people are not very co-operative at the other end and the legal frameworks are very cumbersome—you are less inclined to put the effort in, and you think, “Oh, well, let’s just use the surveys, as we’ve always done.” So I think you need to act on the three things together, but they are potentially mutually reinforcing if you get the change right.

Hetan Shah: This is one area where I think the Bill could be strengthened. At the moment, the ONS has the right to request data; similarly, the researchers have the right to request data. The Department can still say, “No”, and in a sense the only comeback is that there is a sort of name-and-shame element of, “Parliament will note this”, as it were. My worry, given the cultural problems that have been seen in the past, is that that may not be enough. So why do we not do what Canada does? It just says, “The ONS requests”, and the Department gives.

Digital Economy Bill (First sitting)

Louise Haigh Excerpts

Committee Debate: 1st sitting: House of Commons
Tuesday 11th October 2016 Public Bill Committees

[The Chair]

Q That is now on the record. Does anyone else wish to declare an interest? No. Could the witnesses please introduce themselves for the record?

David Dyson: David Dyson. I am the CEO of Three UK.

Baroness Harding: Dido Harding, chief executive of TalkTalk.

Sean Williams: Sean Williams, chief strategy officer at BT Group.

[Louise Haigh (Sheffield, Heeley) (Lab)]

Q Thank you for coming to give evidence today. May I start with you, Sean? First, do you think that 2020 and 10 megabits per second are sufficiently ambitious targets for the universal service obligation?

Sean Williams: Yes, I do. We have made clear our willingness to deliver 10 megabits to every premises in the country by the end of 2020 without any further public funding and without even really progressing the USO regulations. On the way to doing that, we will be building on the fact that by the end of next year we should have fibre broadband coverage to 95% of the country.

As we get towards 2020, we will be building further fibre networks, so we expect to be getting more than 24 megabits to 97% or 98% of the country, and then fixed broadband of 10 megabits to 99%. We think that the last 1% needs to be done by 4G and satellite. Although we think about the issue as getting 10 megabits by 2020, in our view the vast majority will actually be getting a lot more than 10 megabits by then.

[Louise Haigh]

Q Baroness Harding, should the USO not have been an open tender process? If it had been, would it not have been right for it to have gone to more than one contractor, given the differences between the problems in inner city areas and those in rural areas?

Baroness Harding: Yes, maybe. I presume that you refer to the BDUK process that has taken place. I am actually very supportive of a universal service obligation. I do not agree with Sean Williams that 10 megabits will be sufficient as we look forward; it is very dangerous to try to set that number through primary legislation because technology is moving so fast. I fear that the rural communities who are furious that they do not have 10 meg today will be furious that they do not have 1 gigabit in three or four years’ time. I think you should be more ambitious, otherwise the political problem will never go away.

In terms of how then to get value for money for any form of Government subsidy, taxpayers’ money or levy going towards the final few per cent., I agree with the premise of your question. The more competition there is, the better, and it is a huge shame that there was none in the last process. To be fair to the Government of the time, I do not think that was because of how it was designed. The good news is that the market has changed quite a lot since then, and there are now a number of quite small providers building proper fibre-to-the-premises 1 gig services in rural areas, such as Gigaclear. I would be much more hopeful that, looking forward, it will be possible to design a process that is not reliant on one large incumbent.

[Claire Perry (Devizes) (Con)]

Q As you know, I represent a very rural constituency. I support what has happened; it is clearly far better than it was five years ago. However, what happens if no USO provider is willing to come forward to deal with the last 500 houses in the Devizes constituency? What should happen then?

--- Later in debate ---

[The Chair]

Welcome to this session of the Digital Economy Bill Committee. We will now hear oral evidence from Sky, Virgin Media and Vodafone. We will finish this session at 10.30 am. The time is very tight. May I ask the witnesses to identify themselves?

Paul Morris: I am Paul Morris, head of government affairs and sustainability at Vodafone.

Daniel Butler: I am Dan Butler, head of public affairs and policy at Virgin Media.

David Wheeldon: I am David Wheeldon, group director of policy and public affairs at Sky.

[Louise Haigh]

Q I will start with the question that I asked the last panel. Do you think that 10 megabits per second by 2020 is ambitious enough?

David Wheeldon: That is a very hard question to answer. The flexibility within the Bill for the universal service obligation threshold to change makes sense, in order to address the likely customer needs. Our view—we have said it very publicly—is that we have to be much more ambitious in terms of connectivity in this country.

We would like to see ubiquitous fibre to the premise, and we believe ultimately that the economy is going to depend on that. The USO will be a useful interim measure until we can get there, but one might hope that, over time, a USO will not be necessary if we have full connectivity across the country.

[Louise Haigh]

Q Are you saying fibre to 100% of premises?

David Wheeldon: Eventually, that is the ambition we should aim for.

[Louise Haigh]

Q How would that be achievable?

David Wheeldon: We believe there is an opportunity to create the right market structure to bring a lot more investment into the industry. We are being held back at the moment by relying on the copper network. There is an argument we have made, as you know, about Ofcom’s communications review with regard to the structure of Openreach. That is not directly relevant to this Bill, but ultimately, as far as the USO is concerned, it makes a lot of sense to be able to set a threshold that you may want to vary over time.

Daniel Butler: Virgin Media’s starting point is to ask what the purpose of a USO is and what it is designed to achieve. The definition is quite clear: it is to underpin a series of activities that produce some economic and social externalities that are to the broader benefit of society. Ofcom defines those as email, web browsing, maybe a little bit of video streaming and maybe some IP voice. Its use case for a four-person household is that 10 megabits is sufficient to enable all those activities to happen simultaneously.

We view 10 megabits as appropriate for that definition of a universal service obligation. We think that more bandwidth-intensive activities, such as HD streaming and real-time gaming, have a looser connection to the underlying principles of a universal service obligation, because the benefits of those types of activity are primarily to the individual, not to society as a whole, so why should they be subsidised?

I will make one final point, which is that the debate around future-proofing the USO lacks one crucial bit of analysis. Bandwidth requirements might increase over time, but so too does the sophistication of networks in processing higher bandwidth applications. Video streaming is a case in point. When video streaming became ubiquitous, companies started investing in better video compression, and as a result video compression rates have halved every seven years. Networks are getting better at dealing with higher bandwidth applications.

[Louise Haigh]

Q Why should we be limiting ourselves to something that is barely sufficient now? What changes could we see in the Bill that would give us anything like the connectivity that Mr Wheeldon just mentioned?

Paul Morris: You have to make sure that the USO does not get in the way of future ambition. We have to think about how we move from what we have today, which is largely a copper and fibre mix, with the exception of Virgin. We still have telephone lines running broadband, essentially; as David says, we have to move on and be more ambitious. The point is to make sure that the USO does not get in the way of that ambition to do better and to use fibre for homes and businesses. We should make sure that the smaller networks have an option to be involved in the USO, and, if they have the ambition, that they know that a USO provider is not going to over-build them.

There is lots to be done outside the legislation, and clearly we do not need to repeat the mistakes of BDUK. We need to know where the assets are, who can do the work and where the green cabinets are. It needs to make sense and we need to have some kind of register. We need a practical approach and money needs to follow results—not the other way round, which was the other issue with BDUK. We can learn from some issues from the past, and we need to make sure that this USO does not get in the way of what we need to do next, which is to have much more fibre in the ground across the whole country.

[Claire Perry]

Q I represent a fairly rural constituency and I was interested to know what would happen if no USO provider came forward to do the right thing. What should happen in that case? How will the Government be able to mandate that provision?

Daniel Butler: We are not convinced that that situation will arise. What Mr Williams from BT just outlined was that BT was willing to enter into a legal obligation in which it would be the national provider for a universal service obligation. That is how it works today under the fixed telephony USO. Up to a relatively high cost threshold, BT is not allowed to pick and choose which areas and premises it connects and which it does not; it has a legal obligation to fulfil. The model does not need to radically change as we move to a broadband USO.

Paul Morris: Basically, you have to remember that most of these premises will have a telephone line—although not all, I grant you. That is a good start. It is about how we use what is already there well, and how we upgrade it.

--- Later in debate ---

[The Chair]

We will now hear evidence from Which? and the Countryside Alliance. We have until 11 am for this session. Would the witnesses please introduce themselves for the record?

James Legge: I am James Legge, and I am head of political at the Countryside Alliance.

Pete Moorey: I am Pete Moorey, and I am head of campaigns at Which?

[Louise Haigh]

Q Should this Bill not contain a USO for mobile coverage?

James Legge: Yes, we think that it should.

[Louise Haigh]

Q What should that USO be?

James Legge: I think that a minimum at the moment should probably be about 3G but, a little like the USO for broadband, we need to be a bit more ambitious. We also have to realise that there is a big infrastructure problem for about 50% of rural premises. The infrastructure is not there to carry more than 10 megabits per second, and for one in five premises it will not carry more than 5 megabits. So there is not only the level at which the USO is set to begin with, but also the issue of upgrading infrastructure.

[Louise Haigh]

Q Do you think that there is potential for the USO to actually limit the investment for infrastructure in the future?

James Legge: It is important that it is seen in addition to the Government’s ambition to deliver superfast broadband at—at the moment—a speed of 24 megabits to 90% to 95% of premises. In my opinion it should really be seen as a safety net, as opposed to a situation in which we say, “Well, we’ve reached 10 megabits, we can leave it there.” If you take into consideration that universal access in the EU is being set at 30 megabits by 2020, and Sweden is looking at 100 megabits in the same timeframe, where we are is good but we have a way to go yet.

Pete Moorey: There is clearly a big issue in terms of mobile coverage. You may have seen the research we did with OpenSignal last week which pointed to the fact that in many parts of the country you can get access to a 4G signal only 50% of the time, while in London it is 70% of the time. Obviously, that is way behind countries such as the US and Canada where it is 80% of the time, and countries such as South Korea and Japan where it is 90% of the time. We have not specifically taken a position on a USO for mobile, but it is definitely something that needs consideration.

The other issue here is around what mobile operators themselves are doing with customers when they are in the phone shop and choosing a package. This includes the information that operators are providing to customers about the signal that they can expect, and indeed the opportunity that customers have to be able to get out of the contract when they are unable to get a signal.

[Louise Haigh]

Q What could the Bill do to achieve the level of investment in infrastructure that is necessary? Is separation of BT from Openreach absolutely vital for this?

Pete Moorey: We are satisfied with the position that Ofcom is taking on Openreach at this stage. One area where we are more concerned is around the way that Ofcom is seeking to regulate the standards for Openreach. We think there is a danger that actually regulators are not often well placed to do that and, as they set very prescriptive rules that operators have to achieve, operators are driven by those rules rather than good consumer outcomes. We would like to see Ofcom flip the way that they are looking at the new standards for Openreach and ensure that they are much more focused around consumer outcomes. That would drive the business to achieve against those measures rather than a set of prescriptive standards, which Openreach or others can say that they have achieved but actually has not resulted in a better service for customers.

--- Later in debate ---

[Louise Haigh]

Q Mike, to what extent do you think the Government have achieved their stated objective of open policy making by default?

Mike Bracken: I do not have a strong opinion on that. You would have to ask the person responsible overall for policy in Government or the Minister responsible.

[Louise Haigh]

Q Do the proposals on Government data sharing give you assurance that the Government have sufficiently considered safeguards on privacy, personal data and criteria for data sharing and time limitations?

Mike Bracken: In short, no. The sentiment behind many aspects of the Bill is to be applauded. The Co-op is a big supporter of open data and we see it as the catalyst of a digital economy. There are many complicated issues in this space, privacy and security being highest among them. While we applaud the sentiments of the Bill, there is much detail in the operational management of how data can and should be shared around Government Departments.

While we, of course, are looking for our members’ interests in accessing open sets of public data, it is not yet clear that the current sharing agreements of data within Government are appropriate and it would appear that the move away from open registers of data may hamper the appropriate levels of sharing data in Government. It also may be the case that the friction that our members and members of society feel in dealing with duplicate sets of data, inconsistent sets of data and so on, which lead to substantial problems in accessing Government and their services, may not be improved by the current sharing policies as set out.

[Louise Haigh]

Q Do you think it is a backward step in public trust in Government data handling?

Mike Bracken: We think the Bill is a positive forward step in terms of the sentiment behind it—

[Louise Haigh]

Q But in terms of public trust in Government data handling?

Mike Bracken: I could not comment on that. The sentiment of the Bill overall is a positive one, but there is not enough detail on the sharing arrangements within Government and within Government Departments.

[Louise Haigh]

Q Jeni, my first two questions to you, please.

Jeni Tennison: I agree with much of what Mike has said. The important thing for securing public trust in the measures in the Bill is to have them clearly communicated to the public. Currently, the way they are written is quite complicated and it is quite hard to understand what they really mean.

It is also hard to understand the measures in the Bill in the context of the existing data-sharing agreements in the public sector. We would like to see a lot more transparency around what existing measures there are within Government for data sharing and how the Bill fits with those existing measures so that people can really get to grips with the way in which data are flowing through Government.

Mike Bracken: May I add to that? I completely support what Jeni has said. The issue is that, while we agree that making services and data better and easier to access—the current sharing arrangements are opaque at best—we question the sentiment behind widening those sharing arrangements when they are currently not fully understood. It would appear that that sentiment is driven more by the operational structures of Whitehall and Government agencies than by the needs of users accessing that data.

[Rishi Sunak]

Q Jeni, do you mind giving us some specific examples that I can explain to my constituents about where increased use of data sharing can help their lives, and where public services can be improved, especially for those who are more vulnerable and benefit from public services? Where will data sharing help them to get the right policies to them?

Jeni Tennison: I tend to work in the open data area rather than around data sharing so many of the examples I tend to use are around data that are openly available for anyone to access using Share. The example I tend to use, which helps people to get to grips with it, is Citymapper, which makes data available to us to enable us to navigate around cities very easily.

When you look at the public sector and the kind of decisions it needs to make, such as planning decisions about where to place schools or transport links, where to put more infrastructure, such as physical infrastructure like mobile masts, for example, you can see that having better access to data about people’s needs—who they are and what their requirements are—might enable it to make better decisions about where those facilities are needed.

Q Thangam Debbonaire: This is for Jeni Tennison about the evidence in the Open Rights Group’s submission. In points 37 and 38 in your objections to the definition of pornographic material, you objected to the inclusion of all 18 materials.

[Louise Haigh]

That is a different witness. That is the Open Rights Group.

[Thangam Debbonaire]

I am sorry. I mixed you up with someone else. I withdraw my question.

--- Later in debate ---

[Matt Hancock]

Q And in terms of the data measures to tackle fraud?

Jeni Tennison: I have not looked at the detail of the individual measures for those kinds of benefits.

[Louise Haigh]

Q Is the point not that these benefits cannot be achieved unless the risks are tackled head-on, which is exactly what happened with the care.data issue in the last Parliament? That health data could not be shared because the public did not trust the Government or insurers with that risk. I worked in insurance at the time and that came as quite a blow. Is the point not that the Government need to take on the issues around transparency and trust in this Committee? Mike, on your point about data access, do you think Government are currently geared up to allow that, rather than bulk data sharing?

Mike Bracken: “Government” is a very broad organisation. There are promising moves around registers of data and around reinstating an address register. I do not know quite where that is now. There was a promising move but that now seems to be a little on the backburner—I am not sure. The point is that that question needs to be asked to 20-plus Government Departments and more than 300 agencies and non-departmental public bodies, each of which has a different answer. It is hard to summarise where “government” is at any one point without any open standards between those and without any clear framework under which Government data are already being shared.

[The Chair]

Order. That brings us to the end of the time allotted to the Committee to ask questions. On behalf of the Committee, I thank the witnesses for their evidence.

UK's Nuclear Deterrent

Louise Haigh Excerpts

Monday 18th July 2016 Commons Chamber

[Mr Adrian Bailey (West Bromwich West) (Lab/Co-op)]

I rise to support the motion. The Prime Minister said earlier that the first duty of a Government is to protect their citizens. I would add that the first duty of an Opposition, if they hope to become a Government, is to convince the electorate and the public at large that they will, and above all that they can, do the same. The Opposition cannot be ambiguous on that commitment. I fully understand those in our party who feel that their ethical values and the values of the Labour party are incompatible with that stance, but the public—the electorate—do not feel that our values and ethics are an adequate defence in the face of military aggression from countries that might threaten us.

I am old enough to remember campaigning in the days when Labour’s policy was unilateralism. I remember the cruel caricature of Labour’s defence policy, which was somebody standing with their hands up, labelled “Labour’s defence policy.” Regrettably, it resonated with many of Labour’s traditional voters. The feeling that, above all, people are entitled to security transcends voting behaviour, social class and income. It goes right across the piece, and Labour paid a very high price for failing to recognise that in the 1980s.

My hon. Friend the Member for Ilford South (Mike Gapes) talked about how we succeeded in changing Labour’s former policy. Change it we did, and since then, whatever disagreements the electorate have had with Labour, they have not been about defence. We have won three general elections with a multilateral defence policy. In fact, multilateral defence and an independent nuclear deterrent have been our policy for the last six general elections and were a manifesto commitment in the last general election. That is backed by trade unions, which recognise that any removal of Trident would have a huge impact on levels of employment and skills, which are absolutely essential to people’s welfare.

[Louise Haigh (Sheffield, Heeley) (Lab)]

Will my hon. Friend give way?

[Mr Bailey]

I am sorry, I will not give way, because too many others want to speak.

Above all, the policy is backed by the public. For that policy to be overturned, four thresholds have to be met. The first is that there must be a huge improvement in international relations. That has quite clearly not happened—things have deteriorated. Russia’s lowering of the threshold for the use of nuclear weapons, its activities in Ukraine, the situation in North Korea and the ability of terrorists to take over a country and possibly acquire nuclear technology mean that the world is much more dangerous.

The second threshold is that there must a compelling change of technology that would render nuclear submarines irrelevant. That has not happened. The third is a financial capacity that renders us unable to build them. That has not happened. The last is overwhelming evidence of public support shifting against the deterrent. That clearly has not happened.

--- Later in debate ---

[Margaret Greenwood (Wirral West) (Lab)]

I believe we should oppose the maintenance of the continuous at-sea deterrent. For me, the arguments are both moral and practical. I will take the moral argument first. I believe it is important that we all give full consideration to the scale of destruction that modern nuclear weapons can deliver. I want to read out a message from the mayor of Hiroshima in a recent statement:

“On August 6, 1945, a single atomic bomb rendered Hiroshima a scorched plain and tens of thousands were burned in flames. By year’s end, 140,000…lives had been taken. Those who managed to survive, their lives grotesquely distorted, were left to suffer serious physical and emotional after effects compounded by discrimination and prejudice. Nuclear weapons are an absolute evil and ultimate inhumanity.”

[Louise Haigh]

In the same statement, the mayor of Hiroshima called on us all to share the sincere message of their hibakusha:

“No one else should ever suffer as we have”.

Does my hon. Friend not share my concern that this latest round of renewal makes it difficult to ignore the fact that we are moving against our international duty into an era of permanent armament?

[Margaret Greenwood]

My hon. Friend makes a good case, and I agree with her.

Contemporary nuclear weapons are capable of delivering much greater levels of devastation, and they are eight to 10 pounds heavier than those that hit Hiroshima and Nagasaki. One modern missile with 12 warheads could wipe out a city of 10 million people and leave it uninhabitable. As the International Court of Justice put it back in 1996:

“The destructive power of nuclear weapons cannot be contained in either space or time. They have the potential to destroy all civilization and the entire ecosystem of the planet.”

That is chilling, and it is important to keep hold of that vision of horror when considering Trident renewal.

I recently visited Woodchurch high school in my constituency, where I met the school council, which comprises pupils from each of the different year groups aged between 11 and 16. I asked them who felt that we should renew Trident. There was a slight sense of agitation in the room, and I wondered whether they were just a little shy on the topic. I then asked if anyone was definitely opposed to the renewal, and every hand shot up in the air without hesitation. The decisions that we make about nuclear deterrence today will have an impact on our children for decades, and it is important to remember that we are making a decision for the next generation.

The defence challenges that we now face are different from those in the post-1945 era when the world seemed divided into ideological blocs and the threat came primarily from other states, principally the Soviet Union. An attack was thought of in terms of a conventional military attack or a nuclear strike. Yes, there are concerns over the intentions of President Putin’s Russia. The annexation of Crimea and Russian involvement in the civil war in Ukraine has had a destabilising effect on security in central and eastern Europe, but we must also counter the threat from non-state actors such as terrorist groups. Nuclear weapons will not enable us to meet that threat, and money allocated to Trident could mean that the defence budget is not focused on the most serious challenges that we face. Trident’s replacement is projected to be operational for 30 years from the early 2030s. Is it possible to be sure that it will be an effective deterrent in 2060? There is plenty of evidence to suggest that it will not.

I recently attended a meeting addressed by Lord Browne, the Labour Defence Secretary in 2006-07. He made a compelling argument against the renewal of Trident, focusing particularly on two practical issues: cyber-security and the detection of submarines by enemy forces. He warned that NATO countries cannot be confident that their nuclear defence systems would be able to survive an attack from a sophisticated and well-resourced opponent that was utilising cyber-capabilities in combination with its military and intelligence capabilities.

The Prime Minister spoke about the value of nuclear submarines patrolling our seas unseen and undetected. That may well be the case today, but it is not a given for the future. There is a real threat that with the increase in under-sea detection technology, the location of submarines is more likely to be compromised, thus undermining the fundamental rationale of continuous at-sea deterrence, which relies on submarines remaining undetected. There is also a real risk that advancement in detection technology will outpace any advancement in counter-measures.

It is important to take into account all the jobs that are reliant on Trident, and that a credible industrial strategy is created and a cogent plan signed off before any action is taken to not renew it. Jobs, skills, and incomes should be protected. I believe, however, that there is a real risk that these expensive weapons may become obsolete over the period of their lives, and we would be better off investing in a defence strategy that addresses the real dangers that we face from current strategic threats.

Oral Answers to Questions

Louise Haigh Excerpts

Wednesday 15th June 2016 Commons Chamber

[Mr Letwin]

The hon. Lady is right. As a matter of fact, the situation is even slightly worse than she suggests. The percentage of disabled senior civil servants—or, at any rate, of senior civil servants who have registered themselves as disabled in staff surveys—is only 3.4%. That is much too low, and it reflects the fact that we have not yet been able to remove all the barriers that we need to remove. I am sitting next to the Minister without Portfolio, my right hon. Friend the Member for Harlow (Robert Halfon), who has shown that it is perfectly possible for someone who suffers from a significant disability to reach the highest level in politics, but we need that to be true throughout our public administration because we need to draw on talent from wherever it comes.

[Louise Haigh (Sheffield, Heeley) (Lab)]

As the Minister confirmed, since the Prime Minister gave himself the power to appoint, 80% of permanent secretaries are men. In the spirit of open government, will the Minister commit to publish the shortlists from which the Prime Minister has made appointments?

[Mr Letwin]

I will go back and talk to colleagues about the methods by which we publish what happens under that procedure. I would like to point out to the Opposition spokesman—[Laughter.] I would like to point out to the Opposition spokesperson that we draw permanent secretaries from the pool of directors general. If we are to draw on that talent, we have to encourage more women to be directors general. As I have said, I am glad that the percentage of women directors general is now up to 37%. We would like to get up to 50% or beyond, and as we do so we will have the talent from which to draw into the permanent secretary ranks, which is obviously where we want women of talent to end up.

Voter Registration

Louise Haigh Excerpts

Wednesday 8th June 2016 Commons Chamber

[Matthew Hancock]

That is an incredibly important question. The eligibility requirements were debated extensively in this House. After someone applies to register online, the application is not taken at face value but is checked against Government data to make sure that that person meets the eligibility rules set by this House. That is one reason why there needs to be time between the deadline and polling day—to make sure that exactly the concerns that my hon. Friend raises are met.

[Louise Haigh (Sheffield, Heeley) (Lab)]

The Minister keeps saying that yesterday’s significantly higher numbers were unprecedented. There were 525,000 applications yesterday and 485,000 on deadline day in 2015. Why then was the system not prepared and able to cope, and is it not now time for automatic registration?

[Matthew Hancock]

The spike was much bigger than the hon. Lady’s figures, which are accurate for the whole day, I suggest, because there was an intense spike after 9 pm. The question for the system is how many people are trying to apply at once, and that figure was three times higher than in the peak before the 2015 general election.

Debate on the Address

Louise Haigh Excerpts

Wednesday 18th May 2016 Commons Chamber

[Mr Hanson]

On this occasion—and on the day Plaid Cymru supported the Labour First Minister in Wales—I am grateful for Plaid Cymru’s support. The issue jumps out of the Gracious Speech as one that will cause political controversy. The voice of the right hon. and learned Member for Harborough is therefore valuable because it sends a signal to the Government that the Bill will not have an easy passage.

The Gracious Speech also covers strengthening the economy to deliver security for working people, increasing the life chances of the most disadvantaged and supporting the development of the northern powerhouse. The Government have support on all three issues, but I ask them to consider what they mean in practice. In my part of the world, we have a claimant count of 2.8% of the population; 23.6% of the population are deemed as being incapacitated, and unemployment is 4.8%. We have major challenges in the steel industry, and with zero-hours contracts and second bedroom occupancy—the so-called bedroom tax. We still have 690,000 people living in poverty in Wales. If the Government are serious about some of the issues that they claim to be serious about in the Gracious Speech, they need to consider some real policy changes to support business and industry, work with the National Assembly and tackle poverty, which is partly caused by current Government policy. In my constituency and elsewhere, poverty is increasing because of Government policy on benefits and unemployment, while taxes for some of the richest people in our society are cut.

If the Government are serious about the northern powerhouse, they need to work closely with the Mersey Dee Alliance in north-east Wales and north-west England to ensure that we get the benefits from whatever the northern powerhouse means. I am pleased to see the Minister for Children and Families in his place. He knows the importance of Crewe and HS2 to north-east Wales. He knows the importance of electrification of the line from Crewe to Chester and onwards to north Wales. He will also know the importance of direct links to Manchester airport to ensure that not only Cheshire but north Wales benefits from the northern powerhouse, and he knows that it is important to reopen the Halton curve quickly to link north Wales to Liverpool airport and Liverpool. Those are all infrastructure projects that are technically badged “the northern powerhouse”. I am still not sure what the northern powerhouse means to the people of Cheshire and north Wales, particularly Flintshire in my constituency, but if it is to mean something, the Government need to flesh out carefully the finances and the long-term infrastructure projects that benefit Cheshire and north-east Wales and contribute to supporting the cities of Manchester, Liverpool, Sheffield, Leeds and others that are critical to the economic success of the north.

If the decision goes wrong on 23 June and we leave the European Union, the north will be particularly hit by that loss of European influence. I am pleased that the referendum is mentioned in the Gracious Speech and I hope that there will be a yes vote on 23 June.

[Louise Haigh (Sheffield, Heeley) (Lab)]

The decision to close the BIS office in Sheffield and move it to central London has already been mentioned, and my right hon. Friend talks about the infrastructure projects necessary for the northern powerhouse to succeed. Does he agree that senior civil servant and policy-making jobs must be in the north and across the regions, so that they can be the eyes and ears of the northern powerhouse and deliver those vital projects?

[Mr Hanson]

I am grateful to my hon. Friend for that point, and it is important that the northern powerhouse is not just about the Chancellor of the Exchequer in Tatton. That appears to be the northern powerhouse, but in my view it must be backed up and supported by civil servants, and I support my hon. Friend’s wish to maintain a strong presence in Sheffield and the north. North-east Wales looks to Liverpool and Manchester as much as it does to Cardiff for economic growth and activity, and we need cross-regional support on infra- structure projects, and people on hand to work with that.

Those are my initial observations on important issues, but I wish to focus on the points about prisons that were raised by the right hon. and learned Member for Harborough. He was gracious enough to acknowledge that for two years and one month I was prisons Minister when he was the shadow Minister, so I hope that I speak with some experience of dealing with what are difficult challenges in the prison system.

In the Gracious Speech the Justice Secretary indicated that there will be a prisons Bill, and I look forward to that—perhaps I may even make a bid for pre-legislative scrutiny by the Justice Committee, on which I sit. The Bill as trailed so far suggests that there will be a lot of discussion about the autonomy of prison governors to consider a range of issues, and six prisons have been identified by the Government to pilot and trail those reforms. We have prisons with “potential for reform”—whatever that might mean—and the potential for new-build prisons. That comes on a day when the Coates review has announced two statistics that put into context the points made by the right hon. and learned Member for Harborough. For example, today’s review shows that 42% of adult prisoners were excluded from school, and 24% of adult prisoners currently in the prison estate spent some or all of their time as young people in care before they reached the prison system.

Long-term, deep-seated issues have been highlighted by the Coates review and need to be examined by the Prison Service as part of the prisons Bill, but that raises some questions. I will not rule out support for the Bill—I do not yet know what my hon. Friends on the Opposition Front Bench will think about it—but we must test what it will mean in practice, and now is as good a time as any to do that. What real autonomies will prison governors have at a local level? Will they have autonomy over pay and conditions? If so, that would be a matter of great concern. Will they have autonomy over procurement, education and employment practices? What autonomies will they have, and how will they exercise them in the Prison Service when the Ministry of Justice in central London is managing the prison population and sector as a whole—the hon. and learned Gentleman mentioned many of the pressures on prison population movements.

Who will judge prison governors and monitor their activity? What benchmarks will we set on that prison service, and how will we judge and monitor them? What will be the relationship with the chief inspector of prisons? What outcomes are expected from the six potential reform prisons? How will we judge whether prison governors have made a difference, particularly given that many prisoners in many prisons—I will speak about Wandsworth prison in a moment—have mental health problems or long-standing drug or alcohol problems. Many prisoners had long-standing unemployment problems before being imprisoned, and perhaps do not spend sufficient time in prison to benefit from schemes such as the Timpson scheme in Liverpool, which I had the pleasure of opening in 2006 or 2007 with the brother of the Minister for Children and Families, the hon. Member for Crewe and Nantwich (Edward Timpson). It is a great scheme—I cannot walk past a Timpson establishment without wondering whether the person working there has been trained and supported by the family and firm. [Interruption.] I do go in sometimes as well.

Oral Answers to Questions

Louise Haigh Excerpts

Wednesday 11th May 2016 Commons Chamber

[The Prime Minister]

May I first—one of my many unforced errors in the past 24 hours—apologise to the hon. Member for Sheffield, Brightside and Hillsborough (Gill Furniss)? I should of course have welcomed her to the House of Commons and congratulated her on her by-election victory. She has lost no time in speaking up for her constituents in a very powerful and very accomplished way.

Let me say to my hon. Friend the Member for St Austell and Newquay (Steve Double) that, as we announced earlier this year, there are air quality issues that need to be resolved. We are on our way to working out how to resolve them, and when we do, we can come back to the House and announce what will happen next.

[Louise Haigh (Sheffield, Heeley) (Lab)]

My constituent’s mother was killed in 1981. At the time, it was covered up as a suicide pact, but 18 years later it was uncovered that she had actually been murdered by my constituent’s father and his mistress. I do not think that anyone in this House will be able to imagine the pain and suffering that she and her family have had to endure. They are now having to relive that pain, because ITV is dramatising their whole ordeal, completely against her wishes, using not only the real names of her family but her own real name. I have raised this with ITV and with Ofcom, and, as far as I can see, no rules have been broken, but does the Prime Minister agree that victims’ voices should have a far greater role in any account of their tragedy? Will he meet me and my constituent to discuss what more could have been done in this case and how we can strengthen regulation in future to protect victims?

[The Prime Minister]

I was not aware of the case that the hon. Lady rightly raises. I remember from my time working in the television industry that there are occasions when decisions are made that can cause a huge amount of hurt and upset to families. I will discuss this case with the Culture Secretary to bring it to his attention and see whether there is anything more—apart from the conversations that she has had with ITV and with Ofcom, which is a powerful regulator—that can be done.

Oral Answers to Questions

Louise Haigh Excerpts

Wednesday 9th March 2016 Commons Chamber

[Robert Halfon]

I could not have put it better myself. As I have said, there are 800 civil service buildings outside London. We have important targets for developing important strategic hubs for the civil service all over the country, and more people who get out of the Westminster bubble, the better.

[Louise Haigh (Sheffield, Heeley) (Lab)]

We know that the Minister’s friend the Paymaster General is very close to the Chancellor, and that he therefore likes to insert the words “northern” and “powerhouse” into every speech he makes. However, as we heard from my hon. Friend the Member for Newport East (Jessica Morden), 98% of senior jobs in the northern powerhouse department are now based in London, and—with no sense of irony—Sheffield policy-making jobs in the Department for Business, Innovation and Skills have been moved to Whitehall. The test for the Minister, when he finally gets the promotion that he has been seeking and that he so richly deserves, will be whether he has more senior and policy-making civil servants in London or fewer. Does he have it within him to live up to our expectations?

[Robert Halfon]

I genuinely cannot understand the premise of the hon. Lady’s question. She should be proud, as are councils in the north of England, that the northern powerhouse is devolving powers right across the region. We are one of the most radical Governments when it comes to devolution. Her councils in the north support it, and I am sad that she does not.