Data (Use and Access) Bill [Lords]

Sam Carling Excerpts

2nd reading
Wednesday 12th February 2025 Commons Chamber

[Sir John Whittingdale]

If my hon. Friend is referring to data protection, it is a careful balance. People are rightly concerned that their data is protected and that they should have privacy rights, and there are campaigning organisations out there that have examined the Bill and expressed concern. We were careful to ensure that the standards of data protection required were maintained, and I am sure this Government take the same view.

At the same time—this is where there are small differences between the previous Bill and this Government’s Bill—we were keen to ensure that data protection did not impose unnecessary burdens, particularly on small businesses. There were one or two areas where we were able to slightly relax the definitions and to reduce the burden on business, but this Government have taken a different view. They are relatively minor and relatively technical areas, but there are things such as the definition of “vexatious and excessive”, which was an issue that occupied a lot of discussion. The Government have now removed that and reverted to the previous definition, which we felt was unnecessarily burdensome. There is also the whole area of subject access requests that would occupy a huge amount of firms’ time in trying to respond to them. We felt there needed to be at least some safeguard to prevent those becoming, as we defined it, vexatious, so I regret the fact that the Government have not proceeded with that element.

However, those are relatively minor areas, and in large part the Bill is one that previously enjoyed cross-party consensus when it went through this Chamber in the last Parliament and that I suspect will continue to enjoy cross-party consensus as it moves into Committee in this Parliament. The Secretary of State is no longer with us, but I hasten to add that I am not volunteering to serve on the Public Bill Committee. Having previously endured many hours doing so, I do not particularly want to repeat that experience.

Perhaps in part because the Bill enjoys a lot of support across the House, there is inevitably a particular element about which there is real concern, and that is the area of copyright protection and artificial intelligence. It is worth saying that that was not originally in the Bill at all, and I congratulate Baroness Kidron, who managed to persuade the Clerks in the other place to allow her to move the amendments to insert it into the Bill, and it is now part of the Bill. I think those amendments are very important, and I very much welcome them.

The hon. Member for Bury North (Mr Frith) referred to the fact that the previous Government had not acted in this area, and he is right. The Conservatives did not act because we felt, and continue to feel, that the law on copyright is clear and does not need changing. This Government have proposed to change the law to bring in the text and data mining exception. That will create the opportunity for AI to take, scrape and ingest creative content, of the kind the hon. Member for Scarborough and Whitby mentioned, using an exception that the Government are bringing in. It was proposed under the last Government, but I can tell the House that the last Government rejected it precisely because we felt it would drive a coach and horses through copyright law and do real damage to the creative industries.

[Sam Carling (North West Cambridgeshire) (Lab)]

The right hon. Gentleman’s speech is very helpful, and he is making some useful points. The shadow Minister would not give us any clarity about his party’s position on the opt-out mechanism, so could he help: what is the Opposition’s position on that? Do they support it—yes or no?

[Sir John Whittingdale]

I am very happy to address that. I am not on the Front Bench, but I will tell the hon. Member my view, which is very clear: I have profound reservations about the opt-out, which reverses the whole principle of copyright law. The owners of rights will have to go and say that they do not want to have their rights taken away from them, otherwise there is a right for others to use their content. I would prefer to see an opt-in or, in actual fact, a licensing method whereby rights holders could agree, if they wished to do so, that their content could be used.

--- Later in debate ---

[Iqbal Mohamed (Dewsbury and Batley) (Ind)]

I stand in support of the objectives and aims of the Bill. Having worked with data and technology for more than 30 years, I wholeheartedly support the ethical, responsible and equitable use of technology and data to benefit and make easier the lives of the people of the UK, and to increase the efficiency of service delivery in the public sector. I also pay tribute to campaign groups including Big Brother Watch and Justice for their work to protect the vital privacy and data protection rights of people in the UK.

I want to share some concerns I have on the Bill, focused on two areas: clause 70 and clause 80. I urge the Government to take note and amend the Bill to ensure that the British public’s privacy rights and rights to equality and non-discrimination are not compromised. Clause 70 will weaken protections around personal data processing, thereby reducing the scope of the data that is protected by safeguards in data protection law. I am particularly concerned about the executive power to determine recognised legitimate interests, which will allow for more data to be processed with fewer safeguards than is currently permitted and reduce existing protections that ensure the lawful use of data. I am also concerned about the increased power of the Secretary of State to amend the definition of “recognised legitimate interest” through secondary legislation without appropriate parliamentary scrutiny.

Currently, automated decision making is broadly prohibited, with specific exemptions. Clause 80 will permit it in all but a limited set of circumstances. That will strip the public of the right not to be subject to solely automated decisions, which risks exacerbating the likely possibility of unfair, opaque and discriminatory outcomes from ADM systems; limiting individuals’ rights to challenge ADM; permitting ADM use in law enforcement and intelligence, with significant carve-outs in relation to the existing safeguards; and giving the Secretary of State executive control over the ADM regulatory framework through secondary legislation. They may not be direct examples, but Horizon and the many Department for Work and Pensions scandals show the failings and risks of relying solely on automation and AI.

The Bill introduces a new regime for digital verification services. It sets out a series of rules governing the future use and oversight of digital identities as part of the Government’s road map towards digital identity verification. The framework currently lacks important safeguards and human rights principles that prevent the broad sharing of the public’s identity data beyond its original purpose. Further, the Bill misses the opportunity to take a positive, inclusive step to codify a right for members of the public to use non-digital ID where reasonably practicable. Such a right is vital to protect privacy and equality in the digital age. The right to use a non-digital ID where practicable would protect accessibility, inclusion and people’s choice in how they choose to verify their identities when accessing public and private services, legally protecting the millions of people who cannot or do not want to hand over personal identity data online where an alternative is reasonably practicable.

Returning to automated decision making, it is clearly insufficient to move the burden of safeguards from the data controller, who is currently responsible for preventing harm, to the individual to complain if the ADM is unfair, since people may not complain due to a lack of knowledge or confidence, intimidation and various intersecting vulnerabilities.

[Sam Carling]

I understand the point the hon. Gentleman is making, but does he not accept that the Bill very clearly explains that in cases where any automated decision is taken, there would have to be the right to a proper explanation of the decision, which would probably address a lot of his concerns, and that there must always be a right for an individual to make representations about the decision and obtain human intervention if that is what they want?

[Iqbal Mohamed]

I welcome the limited protections in the Bill, but I know from experience that many applications for benefits—especially disability benefits and personal independence payments—that are processed through automated systems are refused, and the applicants have to go through a complicated and laborious appeals process in order to overturn those automated decisions.

Clause 70 introduces significant changes to the lawful bases for processing personal data. While the aim of those changes is to streamline data processing for legitimate interests, they also present challenges relating to privacy protection, parliamentary oversight, and the potential for misuse. It is essential to balance the facilitation of legitimate data processing with the safeguarding of individual rights and freedoms. Although the Bill is intended to modernise data protection laws, the proposed changes to automated decision-making rights in clause 80 raise significant concerns. The potential erosion of individual protections, increased power imbalances, reduced transparency and the risk of discrimination highlight the need for a more balanced approach that safeguards individual rights while accommodating technological advances.

While I welcome the positive elements of the Bill, I urge the Government to ensure that it does not deliver the proposed benefits along with diminished human rights and rights to privacy, increased discrimination and other unintended harms to individuals, the wider public, minorities, artists and creatives, public services, or our country as a whole.

[Sam Carling (North West Cambridgeshire) (Lab)]

I welcome the Bill. Given its potential to boost the economy by £10 billion, it is a huge win for so many sectors, and a brilliant example of the difference that this Labour Government can make. Technological innovation will improve efficiency and reduce unnecessary administration, allowing our key workers to focus more on the things that matter most. Police officers and NHS workers, for example, protect us and save lives, and in freeing up 1.5 million hours of police time and 140,000 NHS staff hours every year by cutting out excess administration work, the Bill will help them to do that. How many police officer equivalents could we make from 1.5 million hours of additional work? It is incredible.

Our NHS has been broken by the Conservative party. That requires funding to fix, which is why, in the Budget, this Government rightly pledged an additional £22.6 billion in resource spending for our health service. However, it also needs reform, and I have been pleased to hear that message clearly understood and prioritised by the Government through Bills such as this. At present, each part of the system finds it difficult to communicate with the others, partly because of issues relating to data sharing, which puts more strain on patients and more strain on our NHS staff. The Bill would change that. Medical records would be shared between health professionals, which would mean quicker diagnosis and treatment, and those records would be subject to strict security protocols: only the most relevant staff would have access to non-anonymised patient data.

These changes are hugely important, and cannot come soon enough. In North West Cambridgeshire, the improved data access in the Bill will allow for greater connectivity between all the health services that my constituents use. Whether they have an appointment at Peterborough city hospital, at Hinchingbrooke hospital or further afield, and whether their GP’s surgery is at Old Fletton, Lakeside, Botolph Bridge or beyond, the Bill will ensure that their healthcare professionals have all the information they need to do their jobs quickly and effectively.

On our streets, people are rightly concerned about crime. Police were stretched to the limit and stripped to the bone under the last Government, and the percentage of people seeing officers on the beat has dropped by two thirds over the past 14 years. We are giving police their time back by reducing the administration burden and allowing them to do their actual jobs, protecting the public and making our communities safer.

As someone from a science background, I am particularly interested in the Bill’s reforms to data access for researchers. This has huge potential to help scientists to conduct more impactful research and drive critical innovation in everything from pharmaceuticals to manufacturing, technology and more, and the benefits that that could bring to our economy are enormous. When working in the research space, I could see significant problems with data sharing and access, so I know that this Bill will make a real difference. Colleagues in the university sector have given me their feedback on the Bill, emphasising that providing researchers with secure access to Government data is crucial for research that drives economic growth, productivity and inclusivity.

Linking academic and Government data enables better research. Take my field of pathology, critical work is going on to understand the genetic causes of diseases so that we can develop new treatments. We need huge datasets for that, and it makes complete sense for the Government to work with partners to provide them. In response to the hon. Member for Dewsbury and Batley (Iqbal Mohamed), a lot of our scientists, particularly those working in genetics, rely on datasets from other countries, particularly Nordic countries, which have known about this issue for quite a long time and have made a lot of data available to researchers.

We need enormous datasets to be able to do the necessary analysis, particularly around drug development. There are a lot of inclusivity problems, because particular ethnic groups are lacking from the countries on which we are dependent for the data. For example, there is often not enough information about how particular drugs affect black people. In order to deal with that, we need the data to be available so that we can look at the genetics. If we get too caught up in not allowing anonymised data to be shared with researchers for that purpose, it will really harm inclusivity; it will not help at all. It is worth making those points.

University colleagues have highlighted the new national data library, spearheaded by the Department. If designed effectively, it has the potential to facilitate research from the outset, and to help drive improvements in public services for the benefit of all UK citizens. I hope the Government will make sure that we get universities and private sector research partners around the table when we set up the library, to make sure that it will work for them and their needs.

This Bill will allow researchers to seek broad consent for areas of scientific research, while ensuring high standards of data protection. Notably, personal data will be able to be used for research purposes only if it was processed in a manner that does not permit the identification of the data subject. That goes back to the points made by my hon. Friend the Member for Makerfield (Josh Simons). We talk about risks to privacy and personal rights, but this is anonymised data, usually at a very large scale; no one is looking at individuals’ records. In my field, we look at thousands and thousands of genomes at the same time to identify associations between certain areas of genetics and diseases. This Bill poses no risk to patients, and we do people a disservice if we engage in scaremongering, so I am glad that Members have not done that. The Bill will give scientists more tools for innovation and discovery, and people can be reassured that their data is safe and their privacy respected. The quantity of data that we need to draw strong conclusions in research is huge, which has historically been a barrier.

I am really pleased that the Government have published a 250-page impact assessment with this Bill. I welcome the particular emphasis on trust, but we need to make sure that we get the comms right, particularly around protecting privacy and ensuring that what we have said in this House becomes more widely known by the public.

The Bill makes important clarifications about the use of AI in decision making. We know that this is the direction in which a lot of organisations are moving, and there is a lot of potential, but strong safeguards are essential, so I am pleased to see the Bill place a serious emphasis on putting them in place.

[Ann Davies (Caerfyrddin) (PC)]

Wales’s creative industry is a cornerstone of our culture and economy. It generated £3.8 billion in the last financial year—5.3% of our GDP—and much of that success relies on strong copyright protections. Creatives must be paid when their work is used, including for AI training. Too often creative data is being scraped without permission, undermining livelihoods. Does the hon. Member agree that clauses 95 and 135 to 139 of this Bill are a vital step in safeguarding our creative industries?

[Sam Carling]

The hon. Lady makes her point well, and we have already heard from the Minister about the rationale behind those clauses. There are real issues with putting such measures through in secondary legislation, because this House should have more ability to scrutinise them. We know there is a consultation at the moment, and we have heard from the Secretary of State that he is very open to having a conversation on this issue and making sure that we address it. I am sure we all agree that we need to do that properly.

On safeguards, the Bill makes it very clear that where an organisation makes automated decisions, an individual has the right to a proper explanation of those decisions and the right to make representations about the decision taken, to obtain human intervention and to contest the automated decision. Those are really robust safeguards, but they are key provisions that must be shown to work in practice. We cannot enter a situation in which automated decisions are made wrongly, with no recourse. I strongly support the Bill and these safeguards, but I note that the British Medical Association has raised concerns around clause 77 and clause 70. I would be grateful for the Minister’s response to those concerns around diluting protections for health data held by non-public bodies. I am sure that he has a response, and it would be good to hear it.

To wrap up, the innovative use of data, following strict guidelines and data protection rules, will massively improve the efficiency of public services and grow our economy. It is right that the Government take this route. The UK should be leading the way in innovative technology and fully utilising technological developments to improve people’s lives, and I believe that this Bill will do that.

[Madam Deputy Speaker (Judith Cummins)]

I call the shadow Minister.