Draft National Security and Investment Act 2021 (Monetary Penalties) (Turnover of a Business) Regulations 2021 Draft National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021

Peter Grant Excerpts

Wednesday 20th October 2021 General Committees

[Peter Grant (Glenrothes) (SNP)]

It is a pleasure to serve under your chairmanship, Sir George.

I, too, will support the draft regulations, but I have a couple of points for the Minister to pick up on in his summing up. First, on the turnover of a business regulations, he said earlier that they had been drafted to prevent a business from moving its turnover out of the reach of United Kingdom legislation. Is he completely satisfied that the regulations are tight enough to prevent turnover from simply being moved around in a circle between different companies, whether officially in the same group or under the same ownership?

We see that kind of thing happening all the time when a business is about to become insolvent: all the turnover and assets get moved into a business that will continue, and all the debts and liabilities get dumped on the company that is about to go into liquidation. If companies are able to find ways of doing that in order to avoid paying the debts of the liquidated company, they can also find ways of doing it to minimise the financial impact of failing to comply with the regulations. I would appreciate an assurance from the Minister that the loophole that exists in relation to businesses about to put themselves into liquidation will not also be there for businesses that want to understate their turnover to avoid the size of the penalty that they should incur.

My second question is about the Specification of Qualifying Entities Regulations. I am looking in particular at the schedule dealing with data infrastructure, and I do not think that anyone would query any of the designated public sector authorities that are included, but some appear to be missing. It may simply be that I have misheard, or it may be that some of them are included within a wider umbrella designation elsewhere in the list, but, for example, the National Audit Office is there but, as far as I can see, Audit Scotland is not. Audit Scotland does not audit UK Government functions, but it does carry out a lot of public audit work in Scotland; I do not know what the exact arrangements are for Wales and Northern Ireland.

As far as I can tell, the vast majority of local authorities and health authorities are not included. It might not be immediately obvious that the data infrastructure for a health authority could be critical to national security, but if we think first of all about what happens to national wellbeing if that goes badly wrong, and secondly about the data that health authorities hold on every citizen on these islands, it becomes quite clear that we need to protect health authorities from malign foreign influence. On local authorities, we should remember that in most parts of the UK, local authorities are responsible for critical transport infrastructure. Apart from motorways, most of the transport infrastructure is controlled and managed by local authorities, and considering the potential harm to wellbeing—not quite to national security, but certainly to national wellbeing—if something goes badly wrong with the data infrastructure of a social services authority or an education authority, the implications could be quite significant.

Could the Minister perhaps outline what the thinking is, not so much about the authorities being included at this stage, but about the examples that I gave just now—the kinds of public authorities that do not appear to be included? Do the Government intend to keep that list under review? If it becomes obvious that there is an issue with data infrastructure supplies to local authorities, for example, how quick and easy will it be to close that loophole before it can be exploited?

[Paul Scully]

I thank hon. Members from both sides of the room for their valuable contributions. First, let me have another go at responding to my hon. Friend the Member for North East Bedfordshire: turnover does not include stock and assets, but it does include any income that derives from their use. The hon. Member for Newcastle upon Tyne Central raised with my right hon. Friend the Member for Stratford-on-Avon (Nadhim Zahawi), now Education Secretary, when he was covering this subject in Committee, the question of where the fines go. As she knows, the fines are going to the Consolidated Fund, but none the less, she makes her case powerfully.

In terms of what changes have been made to the definitions since the consultation, the scope of a number of descriptions—communications, critical suppliers to Government, data infrastructure, energy, suppliers to the emergency services, and synthetic biology—was narrowed following the publication of the consultation response, and a few descriptions were amended. For example, in the area of communications, qualifying entities carrying on activities in the UK that related to public communications supply chains were removed from the definition, substantially narrowing the activity of the qualifying entities captured. For critical suppliers to Government, two of the five limbs of the definition set out in the Government response to the consultation were removed, again to narrow the scope of the definition. Those two limbs were the provision of services to facilitate the security of network and information systems, and the guarding of premises to insure against unauthorised access or occupation and against outbreaks of disorder or damage.

In the area of data infrastructure, as was mentioned by the hon. Member for Glenrothes, the Government response to the consultation provided a definition of a public sector authority using the meaning of “contracting authority” in the Public Contracts Regulations 2015. The final regulations revised the definition of a public sector authority to a much narrower list of authorities, set out in a table within the regulations. I understand the hon. Gentleman’s point: I would say that first of all, the purpose of that table is to make sure that the notifications to the Secretary of State are proportionate and balanced. None the less, we will review this SI within three years, rather than the normal five years, to ensure that we lean into this and get it right, to give certainty to businesses and to ensure that we capture the whole gamut of the areas that he raised.

In terms of energy, changes were made to clarify the infrastructure activities carried on in the UK and captured within this description. Suppliers to the emergency services, as the hon. Lady mentioned, and several meanings in the definition, published in the Government response to the consultation, have since been amended and narrowed to provide an objective list of activities, captured for the purposes that require self-identification. The applicability of each activity to each type of emergency service listed has been narrowed to ensure that the activities of qualifying entities, captured by mandatory notification, are as targeted and proportionate as possible.

Finally, on synthetic biology, new paragraph 6 was added to the definition to create exceptions relating to human or veterinary medicines, or immunomodulatory approaches, which is not easy to say.

The hon. Lady also asked who was consulted on this and what was said. We are proactively and extensively engaging across all the relevant sectors. For example, our policy colleagues at the Department for Business, Energy and Industrial Strategy have attended meetings with techUK members, the AI Council, an aerospace, defence, security and space group webinar, and an electricity industry forum. We conducted targeted and extensive engagement with organisations most likely to be affected by the NSI Act, including companies that invest in or acquire entities in the 17 mandatory areas of the economy, and those providing legal or financial advice in UK acquisitions.

We have met and spoken to more than 200 cross-economy organisations through workshops, teaching and presentations, including the Law Society, the Institute of Chartered Accountants in England and Wales, techUK, international investors and UK universities. Tailored communications have been sent out to more than 100 industry bodies in those mandatory areas of the economy, including 70 major law and financial services firms, 36 international investors and 550,000 businesses via Companies House.

Additional care has been taken to ensure that we can reach small and medium-sized enterprises, because the hon. Lady is absolutely right that they need to have the capacity to be ready and will be affected by the regulations. We have used associations, such as the Federation of Small Businesses, the British Chambers of Commerce and the Confederation of British Industry, so together there is a network of 580,000 businesses. We will continue to ensure that we work with SMEs in particular, to give them guidance ahead of time, because we need to keep on engaging directly with businesses around this Act, ahead of the full commencement.

The first tranche of detailed guidance has already been published to assist businesses, investors and advisers in understanding the Act and how to comply with its requirements. We have established a BEIS expert panel, which includes business representative organisations, higher education bodies, investment associations, law societies and others, that has provided detailed feedback on the draft guidance, ensuring that the guidance is fit for purpose, rather than rushing it.

Our second tranche of guidance will be published ahead of regime commencement, to continue to aid the interaction of parties with the new investment security unit and to ensure compliance, including how to submit a notification form and guidance around notifiable acquisitions. A communications campaign will focus on delivering teaching and guidance to that cross-section of businesses in the UK and internationally.

The hon. Member for Glenrothes asked about turnover and whether we were confident about getting this right; absolutely, we are. If the Secretary of State and a business disagree on the business’s turnover, the Secretary of State can overrule the business. Clearly, the Secretary of State has to act reasonably under public law duty, so it does not give him a free pass, but it is a fallback option if there is a disagreement on business turnover for the reasons mentioned.

[Peter Grant]

I am grateful for that answer. When assessing a business’s turnover, can the Minister confirm whether sufficient attention will be paid to previous years? If a business has a big turnover for several years and it suddenly drops, looking at a single year will not necessarily flag that up. However, if that is noticed, it may well raise suspicions that turnover is being artificially depressed. Will that kind of examination be standard practice whenever a business’s turnover is being examined?

[Paul Scully]

As is set out in the statutory instrument, annual turnover is calculated by taking the turnover for the available period and scaling it up to a full year—if there is not even information for one year. None the less, the Secretary of State will have to take a view, albeit under his public law duties, to ensure that turnover is a realistic. There must be an effective deterrent against a breach of the rules, which is why in some cases the Secretary of State may even deal with a subsidiary business with a small turnover that is funded and controlled by a large, wealthy parent business. Indeed, the subsidiary may have been established specifically to carry out the acquisition in question and may not even have a turnover, full stop, at the point when the Secretary of State is calculating a penalty. That is why there is scope for the Secretary of State to overrule and take the wider view that he is asking for.

I hope that I have covered most of the areas that were raised and provided sufficient clarifications and assurances to hon. Members on today’s statutory instruments. Both SIs are essential for the effective operation and running of the NSI Act and the provision of a safeguard for the UK, and I commend them to the Committee.