Data (Use and Access) Bill [ Lords ] (Fourth sitting)

Victoria Collins Excerpts

Committee stage
Tuesday 11th March 2025 Public Bill Committees

[Victoria Collins (Harpenden and Berkhamsted) (LD)]

On a point of order, Mr Turner. I want to make a point about new clause 30, which I know was not selected for debate. Many will be familiar with the story of the constituent of my hon. Friend the Member for Cheltenham (Max Wilkinson), Ellen Roome, who lost her 14-year-old son Jools in 2022. Jools was a happy boy. He died in tragic circumstances. In her search for answers about the circumstances leading up to Jools’s death, Ellen has come up against outdated laws and social media giants taking an intransigent approach to sharing data that should naturally be hers as a bereaved parent. We are talking about things that, in the past, she would have been able to find out by looking through her child’s bedroom—things that might have been in wardrobes, stored under the bed or in scrawled notes. These days, those bits of data could be on multiple social media accounts, but parental access is denied.

That is the subject of new clause 30, tabled by my hon. Friend the Member for Cheltenham (Max Wilkinson), Ellen’s Member of Parliament. The change to the law would be known as Jools’ law, in his memory. It would give parents access rights to their deceased child’s data automatically, with certain safeguards to respect third parties, so that other grieving parents will never face the challenges and the huge legal costs that Ellen has had to endure. I know that this new clause has not been chosen for discussion, but I would welcome a meeting with the Minister and my hon. Friend the Member for Cheltenham to discuss the issue further.

[The Minister for Data Protection and Telecoms (Chris Bryant)]

Further to that point of order, Mr Turner. The reason new clause 30 has not been selected is not that anybody has wanted to rule it inadmissible; it is simply because we are cracking through the Bill at such a speed that, although it was anticipated we would still be sitting on Thursday, it seems likely we will finish today, and new clause 30 therefore cannot be reached today because of its late tabling.

I know that Ellen is in the room, and I am very happy to facilitate a meeting with her, which I think is still outstanding with the Department. We will make sure that happens before the Bill gets to Report stage. If the hon. Member for Cheltenham or other Members want to be present at that meeting, I will make sure that happens. This is not a slight of any kind; it is just an accident of fortune in terms of the tabling of amendments.

--- Later in debate ---

[Dr Ben Spencer (Runnymede and Weybridge) (Con)]

I rise to speak to clause 117, the first clause in part 6, on reforming the information commission. Part 6 sets out provisions to abolish the Information Commissioner’s Office and transfer its functions to a new body, the information commission, with a chief executive and board of directors. His Majesty’s Opposition welcome the fact that the Government are substantially taking forward some measures on reform of the ICO envisaged in previous iterations of this Bill, including the previous Government’s Data Protection and Digital Information Bill. Indeed, the ICO has said that the changes under the Bill will bring its governance structure into line with that of comparable regulators. Given some of the challenges and opportunities that our data-driven economy will present, the new information commission must be set up in the right way to perform its regulatory functions as effectively as possible.

There is no doubt that the scope of the information commission’s role will grow, commensurate with the changes brought in by the Bill—for example, the obligation to have regard, in the performance of its role, to factors such as promoting innovation and competition. We are supportive of those aims, but it would be helpful if the Minister could briefly address some of the concerns raised by my noble Friend Lord Holmes of Richmond in the other place, particularly the Minister’s strategy for ensuring that the information commission is provided with clarity as to its responsibilities and obligations when it comes to economic growth, and how he will ensure that that remains consistent with the information commission’s primary functions relating to data protection.

[Victoria Collins]

I will speak only briefly about amendment 52, but I would like to think that after all the Liberal Democrat interventions today, no one will have any doubt that we take data very seriously. I realise that we have outlined a lot of proposals, but they are all in the spirit of helping to shape the data vision and of saying how important we feel it is. Amendment 52 is about the questioning of scrutiny. I am happy not to press the amendment, but again it is important to make sure we have trust in line with innovation.

[Chris Bryant]

The Government are, of course, committed to the independence of the ICO. As the hon. Member for Runnymede and Weybridge said, the recommendations about changing the structure were entirely ones that were advanced in the previous version of the Bill and supported by the previous Government. We think that it will just make it more efficient, more effective and more transparent.

As I have said, we are committed to the ICO’s independence; it is a vital part of its role. That is why the new role of the chair of the information commission will be appointed by His Majesty, by letters patent— the same approach taken for the current Information Commissioner role. Furthermore, the Secretary of State has agreed with the Chancellor of the Duchy of Lancaster that the role of chair will be listed as a significant appointment with the Commissioner for Public Appointments and be subject to pre-appointment scrutiny by the Science, Innovation and Technology Committee.

The shadow Minister’s questions about how the Information Commissioner can balance those two requirements are perfectly legitimate. I think that they are questions for the Information Commissioner, and they are the kind of questions that could legitimately be asked in a pre-appointment session with the Select Committee. I do not, therefore, believe that the amendment from the hon. Member for Harpenden and Berkhamsted is necessary.

However, I would like to put on record that the Government intend to maintain the title of the Information Commissioner in respect of the chair of the information commission, acknowledging the fact that the identity and brand of the Information Commissioner is valued and recognised domestically and internationally. We do not want to lose that, so we intend to preserve it.

Question put and agreed to.

Clause 117 accordingly ordered to stand part of the Bill.

Schedule 14 agreed to.

Clauses 118 to 120 ordered to stand part of the Bill.

Clause 121

Information standards for health and adult social care in England

Question proposed, That the clause stand part of the Bill.

--- Later in debate ---

[Victoria Collins]

I will speak specifically on new clause 3. On the question of trust, I know that even the British Medical Association has highlighted concerns over transparency and ensuring that we unlock that innovation and bring that data—in other words, that people are willing, ready and happy to be part of this. New clause 3 therefore highlights that health and social data, when used for research, should have clear data categories that are properly recorded, and that individuals have a right to understand how their data is used. However, I appreciate the comments from the Minister, and I am happy not to press the new clause.

[Chris Bryant]

The hon. Member for Runnymede and Weybridge nearly caught me out because I had to look up “iatrogenic”. Basically, I think it means that when someone is being treated for something, it can lead to harmful effects. I am worried about that, because I have a PET CT scan tomorrow afternoon and an MRI scan on Saturday, so I am worried that I am being subjected to more risk because of all this imaging.

The truth of the matter is that a patient wants to be able to access as many of their records as possible—whether it is their blood tests or whatever else. That is a significant change that has happened in the last few years. It is about putting the patient back in a key role in the NHS, and them being able to manage their own data, but that simply cannot happen unless we pass this legislation and roll out changes across the whole of the NHS.

The hon. Gentleman asked me a specific question, although he admitted that it is not really my plan to develop these things; I might have to get the Department of Health and Social Care to write to him to lay some of that out. That is part of the work that we need to do at the moment. This is not in the Bill, but as a Welsh MP, I would like us to have shared standards across the whole of the United Kingdom, because there are people using different parts of the NHS across the different nations. That would make simple, common sense.

I also worry sometimes about cyber-security, with every different part of the NHS buying its own systems, and whether those systems all have the necessary cyber-security to make sure that data is preserved safely. I believe that the Bill will enable us to get a much more secure set of data provisions on the way health information can be shared between different parts of the NHS in England.

Question put and agreed to.

Clause 121 accordingly ordered to stand part of the Bill.

Schedule 15

Information standards for health and adult social care in England

Amendment made: 14, in schedule 15, page 255, line 35, at end insert—

“(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).

(6) In this section, ‘the data protection legislation’ has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”—(Chris Bryant.)

This amendment provides that information may not be processed for the purposes of new section 251ZC of the Health and Social Care Act 2012 (public censure of relevant IT providers) if that would contravene the data protection legislation.

Schedule 15, as amended, agreed to.

Clause 122 ordered to stand part of the Bill.

Schedule 16 agreed to.

Clause 123 ordered to stand part of the Bill.

Clause 124

Retention of information by providers of internet services in connection with death of child

Question proposed, That the clause stand part of the Bill.

--- Later in debate ---

[Dr Spencer]

This is not the appropriate place to discuss new clause 30, but I hope that there will be ample opportunity on Report for further discussion of the broader issue, which is of great importance.

[Victoria Collins]

Clause 124 concerns the retention of information by internet service providers in the deeply tragic event of a child’s death. It rightly acknowledges the potential need to access such data for crucial investigations and to understand the circumstances surrounding such a loss. However, mere provision for data retention is insufficient without a mechanism to ensure its effective implementation in line with broader online safety efforts. That is why we have proposed new clause 29, which ensures Government oversight by requiring the Secretary of State to publish a compliance report within 12 months. The report will assess whether social media platforms, including category 1 services under the Online Safety Act 2023, are preserving data when needed for investigations, regulatory actions and legal proceedings. I appreciate the comments from the Minister.

Although it is not in this Bill, this is an opportunity to highlight the Liberal Democrat’s belief that category 1 services should not be linked to the size of online platforms alone and that platform functionality and other characteristics should determine whether a regulated provider is classed as category 1 or 2. We know that harmful content, abuse and illegal activity leave a digital footprint but, without enforcement, key evidence may be erased before authorities can act. The new clause ensures that platforms are held accountable, preventing data from being lost if needed. It is about not just policy, but ensuring that social media companies meet their legal obligations and that enforcement is transparent and effective. Once again, I appreciate the open discussion of these issues that the Minister has put forward.

Question put and agreed to.

Clause 124 accordingly ordered to stand part of the Bill.

Clause 125 ordered to stand part of the Bill.

Clause 126

Retention of biometric data and recordable offences

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss the following:

Amendment 54, in clause 127, page 161, line 36, at end insert—

“(6A) An authority which retains biometric data under this Part must—

(a) review the necessity and proportionality of retention every 12 months, and

(b) erase the biometric data unless continued retention is strictly necessary for a lawful purposes, the reasons for which must be recorded and reviewable by the Information Commission.

(6B) The Secretary of State must publish an annual report on the retention and use of biometric data under this Part, including statistical data on the number of records retained, the time period of retainment, and the purposes of retainment.”.

This amendment would introduce mandatory periodic reviews of retained biometric data, requiring erasure unless the authority can demonstrate ongoing necessity. It also would mandate annual transparency reporting to Parliament on biometric use and retention.

Clauses 127 and 128 stand part.

[Victoria Collins]

I did not realise that we would be debating all these amendments today. I appreciate that my voice is probably being heard loud and clear, which was not the original intention, but these are important issues. Clause 126 addresses the sensitive issue of biometric data retention, particularly for law enforcement purposes. Amendment 54 strengthens safeguards by requiring judicial review methods before data can be retained beyond a defined period. That is where we are raising the alarm to ensure that there is a defined period, and that there is cause to ensure that data is not kept beyond that. It is a crucial protection to prevent undue encroachment on civil liberties.

The use of biometric data must be carefully regulated to prevent misuse and overreach: while we acknowledge the role of such data in tackling crime, we must ensure that retention policies are both proportionate and necessary. Amendment 54 aligns the UK’s approach with best practices, ensuring that security does not come at the cost of fundamental rights.

[Chris Bryant]

The hon. Lady has tabled another amendment that calls for the Secretary of State to report to Parliament. I hope that I am proving that the requirement to put those reports in the Bill is unnecessary.

The amendment would introduce a new duty on the police to review the retention of biometric data under clause 127, and a duty for the Secretary of State to report to Parliament on the use of that data. Clause 127 does not alter the existing duty in the Data Protection Act 2018, which ensures that the police retain only personal data, including sensitive personal data such as biometrics, as long as it is considered “necessary and proportionate”—precisely the terms that she advocated.

The biometrics commissioner already has independent oversight of biometric data retained under the Counter-Terrorism Act 2008, and has a statutory duty to report to Parliament annually. The independent reviewer of terrorism legislation also has statutory oversight of all the powers in the 2008 Act, and reports annually to Parliament. For those reasons—without doubting the hon. Lady’s intent—I hope that she will not press the amendment to a vote.

Question put and agreed to.

Clause 126 accordingly ordered to stand part of the Bill.

Clauses 127 to 134 ordered to stand part of the Bill.

Clause 135

Compliance with UK copyright law by operators of web crawlers and general-purpose AI models

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[Dr Spencer]

I start by congratulating my noble Friend Baroness Owen of Alderley Edge for her hard work and tenacity in raising the profile of the harms caused to victims of sexually explicit deepfakes, and ensuring that clauses criminalising that activity were inserted into the Bill in the other place. We very much welcome the Government’s engagement in this important area, and we broadly support their amendments, which substantially deliver the changes to the Sexual Offences Act 2003 that Baroness Owen sought in the other place.

In particular, we welcome Government amendment 31, which substantially reflects the offence of solicitation under clause 141, but could the Minister put a bit more flesh on the bones of the reasoning and necessity behind substituting the term “requesting” for “solicitation”? Does he regard those terms as having equivalent meaning in this context? If not, what is the material difference in the approach to terminology?

I am thankful for the Minister’s comments on the “reasonable excuse” defence, but I have some questions about what exactly a reasonable excuse looks like in this context. Does he have any examples to aid our understanding of what constitutes a reasonable excuse in these circumstances? Based on that, do the Government intend to publish guidance on the scope of this defence and its explanation?

We are pleased to see the inclusion of Government amendment 38, inserting among other things an extended limitation period of three years from the date of creation, or request for creation, of a purported intimate image for bringing criminal charges. This will increase the scope for victims to seek justice where these images come to light some time after creation.

[Victoria Collins]

The Liberal Democrats very much welcome clause 141 and action taken on violence against women and girls in particular, including online. However, the clause talks about creating or soliciting the creation of purported intimate images of adults, but it does not necessarily deal with the sharing of them. How do we hold to account those who are sharing intimate images that they should not be?

[Chris Bryant]

I should have put on the record, as the shadow Minister did, my gratitude and congratulations to Baroness Owen for her tenacity; that point was absolutely right.

[Victoria Collins]

Hear, hear.

[Chris Bryant]

Excellent: we all agree that Baroness Owen has done a great piece of work for us, and we are grateful. Incidentally, I am also grateful to Ministry of Justice officials who worked with DSIT officials on the amendments before us today, which provide a more comprehensive version of what was originally argued for.

The hon. Member for Runnymede and Weybridge asked me about the difference between solicitation and requesting. Often, it is considered that solicitation would require some form of exchange of money. Obviously, that would not necessarily be the case in this context, which is why we have “requesting”, a broader category than solicitation. A request includes doing an act that could reasonably be taken to be a request—for example, nodding or otherwise indicating agreement in response to an offer or complying with conditions of an offer. It also includes both making a request directed to a particular person or persons and making a request available to one or more people, or people generally, without directing it to a particular person or people. In other words, that is broader than what solicitation would have required. I think Baroness Owen agrees with us that this is therefore a more comprehensive offence.

The hon. Gentleman asked about the “reasonable excuse” defence. Let us say that a software developer wants to ensure that he or she—probably “he” in this case—has developed the right safeguards in his software to stop people generating intimate deepfakes without the consent of the person depicted. In some circumstances, he will have a reasonable excuse where, in the course of the testing to ensure that the software does not create such images, he creates a purported intimate image. That might be an instance of a reasonable excuse. I do not want to lay out what reasonable excuses might be, because the courts are so used to dealing with the concept of a reasonable excuse. There are many offences to which it applies, and the courts, as I have said, are used to dealing with them.

The hon. Member for Harpenden and Berkhamsted asked me about sharing—is sharing a deepfake an offence? Sharing a deepfake intimate image without consent is already an offence under section 66B of the Sexual Offences Act 2003. I hope that, without further ado, we can agree the amendments and the clause.

Amendment 28 agreed to.

Amendments made: 29, in clause 141, page 173, line 35, leave out from beginning to end of line 8 on page 174.

This amendment removes a new offence of soliciting the creation of a purported intimate image of an adult. For a replacement offence, see Amendment 31.

Amendment 30, in clause 141, page 174, line 26, at end insert—

“(7A) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.”

This amendment adds a defence of reasonable excuse to the new offence of creating a purported intimate image of an adult.

Amendment 31, in clause 141, page 174, line 29, at end insert—

“66EA Requesting the creation of purported intimate image of adult

(1) A person (A) commits an offence if—

(a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms),

(b) B does not consent to A requesting the creation of the purported intimate image, and

(c) A does not reasonably believe that B consents.

(2) A person (A) commits an offence if—

(a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else),

(b) B does not consent to A requesting the inclusion or exclusion of that thing, and

(c) A does not reasonably believe that B consents.

(3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer).

(4) References in this section to making a request (however expressed) are references to—

(a) making a request directed to a particular person or persons, or

(b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons.

(5) References in this section to consent to a person requesting something are—

(a) in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and

(b) in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate.

(6) An offence under this section is committed—

(a) regardless of whether the purported intimate image is created,

(b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and

(c) regardless of where in the world the person or persons mentioned in subsection (4)(a) and (b) is or are located.

(7) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request.

(8) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both).

(9) In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E.”

This amendment makes it an offence to request the creation of a purported intimate image of an adult without consent.

Amendment 32, in clause 141, page 174, line 30, leave out “soliciting” and insert “requesting”.

This amendment is consequential on Amendments 29 and 31.

Amendment 33, in clause 141, page 174, line 32, leave out “section 66E” and insert “sections 66E and 66EA”.

This amendment provides that the definitions in new section 66F of the Sexual Offences Act 2003 apply for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E).

Amendment 34, in clause 141, page 174, line 33, leave out “the creation of a purported intimate image” and insert “an act”.

This amendment, and Amendments 35 and 36, adjust the definition of “consent” in new section 66F of the Sexual Offences Act 2003 so that it works for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E).

Amendment 35, in clause 141, page 174, line 34, leave out “of creation”.

See the explanatory statement for Amendment 34.

Amendment 36, in clause 141, page 174, line 35, at end insert

“(and see also section 66EA(5))”.

See the explanatory statement for Amendment 34.

Amendment 37, in clause 141, page 175, line 10, at end insert—

“(8) The “maximum term for summary offences” means—

(a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months;

(b) if the offence is committed after that time, 51 weeks.”

This amendment explains what is meant by the “maximum term for summary offences” in new sections 66E and 66EA of the Sexual Offences Act 2003. (New section 66EA is inserted by Amendment 31).

Amendment 38, in clause 141, page 175, line 10, at end insert—

“66G Creating, or requesting the creation of, purported intimate image of adult: time limit for prosecution

(1) Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66EA if the information is laid or the charge is issued—

(a) before the end of the period of 3 years beginning with the day on which the offence was committed, and

(b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge.

(2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact.”

This amendment extends the period during which a person may be prosecuted for an offence under new section 66E or 66EA of the Sexual Offences Act 2003 (creating, or requesting the creation of, purported intimate image of adult).

Amendment 39, in clause 141, page 175, line 12, after “66E” insert “, 66EA”.

This amendment provides that references to an image of a person in new section 66EA of the Sexual Offences Act 2003 (see Amendment 31), like references to such an image in new section 66E of that Act, do not include an image of an imaginary person.

Amendment 40, in clause 141, page 175, line 12, at end insert—

“(3A) In the Armed Forces Act 2006, after section 177D insert—

‘177DA Purported intimate images to be treated as used for purpose of certain offences

(1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

(2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).’”

This amendment provides that deprivation orders can be made under the Armed Forces Act 2006 in connection with an offence under new section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

Amendment 41, in clause 141, page 175, line 12, at end insert—

“(3B) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—

‘Sexual Offences Act 2003

38ZA An offence under section 66EA of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).’”

This amendment provides that a person cannot be guilty, under Part 2 of the Serious Crime Act 2007, of encouraging or assisting the offence under new section 66EA of the Sexual Offences Act 2003 (requesting the creation of a purported intimate image) (see Amendment 31).

Amendment 42, in clause 141, page 175, line 17, leave out

“or soliciting the creation of”.—(Chris Bryant.)

This amendment is consequential on Amendment 29.

Clause 141, as amended, ordered to stand part of the Bill.

Clause 142

Power to make consequential amendment

Question proposed, That the clause stand part of the Bill.

[Chris Bryant]

I will speak only to Government amendment 16, which is highly technical—there will be a test on it afterwards. It removes the privilege amendment inserted at Lords Third Reading to clause 147, which was necessary given the Bill was introduced in the Lords.

Question put and agreed to.

Clause 142 accordingly ordered to stand part of the Bill.

Clause 143 ordered to stand part of the Bill.

Clause 144

Extent

Amendments made: 43, to clause 144, page 177, line 25, leave out “141” and insert

“141(1) to (3) and (4)”.

This amendment, and Amendment 44, are consequential on Amendments 40 and 41.

Amendment 44, in clause 144, page 177, line 26, leave out “extends” and insert “extend”.

See the explanatory statement for Amendment 43.

Amendment 45, in clause 144, page 177, line 26, at end insert—

“(d) section 141(3A) (amendment of the Armed Forces Act 2006) extends to—

(i) England and Wales, Scotland and Northern Ireland,

(ii) the Isle of Man, and

(iii) the British overseas territories, except Gibraltar;”

This amendment provides for the amendment of the Armed Forces Act 2006 made by Amendment 40 to have the same extent as that Act.

Amendment 46, in clause 144, page 177, line 26, at end insert—

“(d) section 141(3B) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.”

This amendment provides for the amendment of the Serious Crime Act 2007 made by Amendment 41 to have the same extent as that Act.

Amendment 47, in clause 144, page 177, line 26, at end insert—

“(5A) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 141(3A) of this Act).”—(Chris Bryant.)

This amendment provides that the new section inserted in the Armed Forces Act 2006 by Amendment 40 may, like the other provisions of that Act, be extended to the Channel Islands and modified as it extends to those Islands, the Isle of Man and British overseas territories other than Gibraltar.

Clause 144, as amended, ordered to stand part of the Bill.

Clause 145 and 146 ordered to stand part of the Bill.

Clause 147

Short title

Amendment made: 16, in clause 147, page 179, line 10, leave out subsection (2).—(Chris Bryant.)

This amendment removes the privilege amendment inserted by the Lords.

Clause 147, as amended, ordered to stand part of the Bill.

New Clause 2

Impact of this Act and other developments at national and international level on EU data adequacy decision

“Within three months of this Act receiving Royal Assent, the Secretary of State must carry out an assessment of the likely impact on the European Union data adequacy decisions relating to the United Kingdom of the following—

(a) this Act;

(b) other changes to the United Kingdom’s domestic frameworks which are relevant to the matters listed in Article 45(2) of the UK GDPR (transfers on the basis of an adequacy decision);

(c) relevant changes to the United Kingdom’s international commitments or other obligations arising from legally binding conventions or instruments, as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.”—(Victoria Collins.)

This new clause requires the Secretary of State to carry out an assessment of the impact of this Act and other changes to the UK’s domestic and international frameworks relating to data adequacy.

Brought up, and read the First time.

[Victoria Collins]

I beg to move, That the clause be read a Second Time.

It will be no surprise that the Liberal Democrats support greater collaboration with our European partners. Local people and businesses across Harpenden and Berkhamsted, as well as up and down the country, continue to highlight the importance of working with the EU and for ever closer union.

New clause 2 seeks to ensure that any changes in our data laws or international commitments do not jeopardise our data adequacy, which is due to be reassessed by the EU in June this year. The Minister may be pushing through the Bill to ensure that we get our adequacy in line with that requirement, which is crucial, because the UK’s ability to transfer data internationally underpins business, research and security partnerships.

Data adequacy is what allows personal data to flow freely between the UK and the EU without the need for costly and complex additional safeguards. A report by the New Economics Foundation put the cost of data inadequacy with the EU at between £1 billion to £1.6 billion for British businesses, highlighting the importance of aligning with our European neighbours on this. The UK is also party to various international agreements and conventions relating to data protection.

New clause 2 ensures that we assess how our international commitments may impact the EU’s view of our data protection framework. If we fail to maintain strong data protections, we risk losing our EU data adequacy status, an outcome that could cost billions in compliance burdens, disrupt cross-border operations and hinder UK businesses from accessing global markets. That would be a hammer blow to the UK businesses, particularly small and medium-sized enterprises, that rely on seamless data exchange with our European partners.

Supporting new clause 2 is about ensuring that Britain continues to lead on data governance, innovation and global collaboration. Data adequacy is not just a legal issue; it is a fundamental element of maintaining economic growth, international trust and our competitive edge. We welcome assurances—and indeed the discussions I have already had with the Minister—on data adequacy with Europe being maintained.

--- Later in debate ---

[Chris Bryant]

First, I should have also thanked the Under-Secretary of State for Justice, my hon. Friend the Member for Pontypridd (Alex Davies-Jones), because she has been intimately involved in bringing forward the measures that we debated in the last group. My apologies for forgetting that, Mr Turner.

On new clause 2, I completely agree that EU data adequacy is vital, but I completely disagree with the new clause, because I think it is technically deficient. One reason for that is the timeline that it lays out of three months, by which time I hope we might be able to have made progress. I also think that it undermines the independence of the process that the European Commission has to go through. The European Commission has already confirmed that its review of its two adequacy decisions for the UK are currently under way—ahead of the deadline, which is good. As Lord Vallance stated in the House of Lords, DSIT and the Home Office have dedicated teams supporting the European Commission’s technical review, as required.

I acknowledge the unilateral nature of the adequacy assessment made by the European Commission. For that reason, it is important to provide the European Commission with the discretion needed to complete its process, which I am afraid new clause 2 would undermine. So, for that reason, I am resisting the blandishments of the Liberal Democrats.

[Victoria Collins]

I beg to ask leave to withdraw the motion.

Clause, by leave, withdrawn.

New Clause 6

Public-interest data trusts and communities

“(1) The Secretary of State must, within 12 months of this Act being passed, lay before Parliament a strategy for promoting data trusts and community data governance models for the public interest (referred to in this section as ‘data trusts’).

(2) That strategy must include—

(a) a definition of data trusts or data communities which prioritise ethical and responsible use of personal data,

(b) mechanisms for ensuring meaningful participant control and governance over shared datasets,

(c) potential incentives for organisations to participate in or develop such data trusts,

(d) safeguards to protect individuals’ rights and freedoms when data is shared,

(e) requirements for transparency in data trusts’ decision-making, including governance arrangements and any commercial partnerships,

(f) arrangements for ongoing independent oversight and review, and

(g) an assessment of how these models might advance innovation, economic growth, and data-driven research in socially beneficial areas such as health, climate resilience, and energy.

(3) The Secretary of State must consult the Information Commission, UK Research and Innovation, relevant civil society groups, and such other persons as the Secretary of State considers appropriate prior to laying the strategy under subsection (1).

(4) The Secretary of State must, at least once every three years, publish a progress report on how data trusts and data communities are being used and how they have contributed to the public interest, including any recommendations for further legislative or policy changes.”—(Victoria Collins.)

This new clause would require the Secretary of State to develop a formal strategy for data trusts and to report periodically on progress. Encourages innovative but responsible data use.

Brought up, and read the First time.

[Victoria Collins]

I beg to move, That the clause be read a Second time.

[The Chair]

With this it will be convenient to discuss the following:

New clause 25—Promotion of public-interest data trusts and communities—

“(1) The Secretary of State must, within 12 months of this Act being passed, lay before Parliament a strategy for promoting data trusts and community data governance models for the public interest (referred to in this section as ‘data trusts’).

(2) That strategy must include—

(a) a definition of data trusts or data communities which prioritise ethical and responsible use of personal data;

(b) mechanisms for ensuring meaningful participant control and governance over shared datasets;

(c) potential incentives for organisations to participate in or develop such data trusts;

(d) safeguards to protect individuals’ rights and freedoms when data is shared;

(e) requirements for transparency in data trusts’ decision-making, including governance arrangements and any commercial partnerships;

(f) arrangements for ongoing independent oversight and review; and

(g) an assessment of how these models might advance innovation, economic growth, and data-driven research in socially beneficial areas such as health, climate resilience, and energy

(3) The Secretary of State must consult—

(a) the Information Commission,

(b) UK Research and Innovation,

(c) relevant civil society groups, and such other persons as the Secretary of State considers appropriate prior to laying the strategy under subsection (1).

(4) The Secretary of State must, at least once every three years, publish a progress report on how data trusts and data communities are being used and how they have contributed to the public interest, including any recommendations for further legislative or policy changes.”

This new clause would require the Secretary of State to develop a formal strategy for data trusts and to report periodically on progress. Encourages innovative but responsible data use.

New clause 28—Public-interest data altruism—

“(1) The Secretary of State must, within 12 months of this Act being passed, establish a framework to recognise and register ‘data altruism organisations’ that manage personal data voluntarily contributed for public-interest objectives.

(2) A data altruism organisation registered under this section must—

(a) demonstrate enhanced governance, transparency, and accountability measures;

(b) publish clear terms on how personal data is used or shared; and

(c) uphold safeguards protecting data subjects’ rights.

(3) The Secretary of State may by regulations—

(a) provide for eligibility criteria and the application process for data altruism organisations;

(b) specify ongoing compliance and auditing requirements;

(c) establish processes for revocation of registration where an organisation fails to meet the criteria.

(4) In developing the framework under this section, the Secretary of State must consult the Information Commission, data subjects, civil society organisations, and such other persons as the Secretary of State considers appropriate.

(5) Regulations under this section are subject to the affirmative resolution procedure.”

This new clause would require creation of a statutory framework for data altruism allowing organisations to register as data altruism organisations where they collect and process personal data for public-interest purposes under enhanced transparency, governance, and accountability standards.

[Victoria Collins]

This is my last intervention, which I am sure the Committee will all be very sad about, and it is on data. I know that we have talked a lot about public trust, but I also want to highlight that, as Liberal Democrats, we are also excited about unlocking the opportunities from data. These new clauses speak to that.

New clauses 6, 25 and 28 together would ensure that we harness the benefits of data while upholding fundamental rights. Too often, data is seen as something that happens to people rather than something that they have a say in. We have an opportunity here to unlock even more opportunities, not just in Government data systems but in how data is used across research, public services and wider society.

New clause 6 calls on the Government to develop a clear strategy for public-interest data trusts and community data governance. That means allowing individuals and communities to contribute their data for socially beneficial purposes while retaining meaningful control. Imagine if patients suffering from rare diseases could securely share their data for medical research, knowing that it would be used solely for public good, not commercial gain; that is a future we can build.

New clause 25 would ensure that the Government take a proactive role in shaping public-interest data governance, setting clear ethical guidelines for how data can be shared securely and fairly. This is about moving beyond reactive regulation. Instead, we should actively create frameworks that allow innovation to flourish while protecting those rights. If we want the UK to be a leader in responsible AI and data stewardship, we need clear structures that allow businesses, researchers and civil society to work together with confidence.

New clause 28 would establish a framework for data altruism, ensuring that those who wish to donate their data for public interest projects can do so safely and transparently. Consider a family in my constituency of Harpenden and Berkhamsted who want to contribute to a dementia research project. Right now, there is no clear framework guaranteeing that their data will be protected from misuse. By formalising ethical data-sharing models, we can enable research and innovation without compromising trust. These new clauses share a simple principle: data must serve people, not the other way around. We must strike the right balance, harnessing data to drive innovation while ensuring that public confidence and ethical standards remain at the core of our approach.

We have a huge economic opportunity. The UK has led the way in setting high regulatory and Government standards in sectors such as fintech, law and insurance, where trust, transparency and compliance are critical. We should build on those strengths and apply the same principles to emerging fields such as AI, healthtech and responsible data sharing. By learning from what works and setting clear guidelines now, we can unlock investment, support start-ups and ensure that the UK becomes a hub for innovative, data-driven businesses. That is why I urge colleagues to consider new clauses 6, 25 and 28, as well as the principles put forward in them, to ensure that we build a data-driven future that is transparent, accountable and a gold standard for responsible innovation and public involvement.

[Dr Spencer]

I listened carefully to the hon. Lady’s comments, and I want to reflect on one point. She presented, or at least seemed to present, a tension between public interests and the commercial use of data. It is really important that we recognise that a lot of health research, particularly pharmaceutical development, is for commercial purposes, with a huge amount of benefits for health as a consequence.

I do not think it is to right to try to sabotage the use of data for commercial purposes, because it has huge benefits for the care and treatment of people. We depend on pharmaceutical companies to spend the risk money, for which a state organisation would never have the appetite, to develop the new drugs of the future. It is important to be quite careful when one is thinking about commercial interests versus non-commercial interests for scientific research.

[Chris Bryant]

The hon. Member for Harpenden and Berkhamsted said that this is her last contribution to the debate, so in the words of the “The Little Mermaid”, I suppose we are poor, unfortunate souls. I thank her for tabling these new clauses, and she raised issues that were also discussed in the other place.

On new clause 6, as my noble Friend Baroness Jones noted in the House of Lords, the Government support giving individuals greater agency over their data and a robust regime of data subject rights. We have already announced our intention to publish a call for evidence on the potential role of data intermediaries. It is important that we establish a firm evidence base before we make any changes to people’s data rights, so I hope that that makes new clause 6 unnecessary.

On new clause 25, as I have just said, we have already published a call for evidence on the potential role of data intermediaries, which is why we need to proceed carefully before going down the route offered by the new clause. Finally, on new clause 28, the Government acknowledge that there are various models of data intermediaries, including those that manage voluntarily contributed personal data for the common good, such as data co-operatives and trusted research environments.

We have already announced our call for evidence, which will seek views on various aspects relevant to data intermediaries, including the delegation of data subject rights to third parties, barriers preventing data intermediaries from operating at full capacity and risk factors associated with significant growth in their activities. This will also include views on different models of data intermediaries, including those focused on data altruism, as the hon. Lady mentioned. Given that we have already announced our intention to act in these areas, I very much hope that the hon. Lady will be content to withdraw the motion.

[Victoria Collins]

I beg to ask leave to withdraw the motion.

Clause, by leave, withdrawn.

New Clause 9

Right to use non-digital verification services

“(1) This section applies when an organisation—

(a) requires an individual to use a verification service; and

(b) uses a digital verification service for that purpose.

(2) Where it is reasonably practicable for an organisation to offer a non-digital method of verification, the organisation must—

(a) make a non-digital alternative method of verification available to any individual required to use a verification service; and

(b) provide information about digital and non-digital methods of verification to those individuals before verification is required.”—(Steff Aquarone.)

This new clause would create a duty upon organisations to support digital inclusion by offering non-digital verification services where practicable.

Brought up, and read the First time.

Question put, That the clause be read a Second time.

--- Later in debate ---

[Victoria Collins]

I thank the Clerks, as well as you, Mr Turner, and other Chairs who have been on this Committee. I also thank the Government and Committee members for working together to get through the Bill very quickly.

Question put and agreed to.

Bill, as amended, accordingly to be reported.