Digital Markets, Competition and Consumers Bill

Viscount Colville of Culross Excerpts

Committee stage
Wednesday 7th February 2024 Grand Committee

None of the amendments that I have put forward would in any way dilute the protection for customers that we all want to see but they would protect British businesses, particularly in the vital creative economy, which we all want to see grow and prosper. If the issues that I have raised are not to be remedied here in Committee, I encourage the Government to commit to looking further into this issue as we approach Report. I beg to move.

[Viscount Colville of Culross (CB)]

My Lords, I tabled Amendment 190, and I thank the noble Baroness, Lady Jones of Whitchurch, and the noble Lord, Lord Clement-Jones, for adding their names to it. I also thank Professor Christian Twigg-Flesner from the University of Warwick for his help in creating this amendment.

Clause 259 sets out the obligations of a trader when a consumer is entitled to cancel or bring a subscription contract to an end. They are limited to providing various types of notice and dealing with potential overpayments by the consumer. Many subscription contracts relate to all digital content. These will involve the provision of both personal and non-personal data under the contract. On ending the contract for a digital service, there needs to be clarity about what should happen to all the subscriber’s data.

The whole point of this amendment is that it lays duties on a trader, on the cancellation or end of a subscription contract, to ensure that the consumer gets all their data back, not just that narrowly defined as personal data. At the moment, only personal data is covered under the UK GDPR. This is defined very narrowly in Article 4. “Personal data” is defined as only

“information relating to an identified or identifiable natural person … an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier”.

Under Article 20, which covers the right of portability of data, the user can end a contract, which is tantamount to withdrawing their consent for the continuing processing of personal data. It ensures that the trader cannot use this personal data any more. Article 17 provides the consumer with the right to have the personal data erased after exercising the Article 20 portability right to download their personal data. Personal data, therefore, as narrowly defined, is well protected under the law at the end of a subscription.

However, the consumer might have a lot of other data that is not within the narrow definition of “personal data”. This is non-personal data. There is no provision under UK consumer law that deals with non-personal data following the end of a contract. This would have been covered by the 2019 EU directive on digital content and digital services, in Article 16, but that came into force only on 1 January 2022, long after the UK had left the EU.

Amendment 190 will deal with the absence of protection for non-personal data in English law. It will give the user control over all their data, both personal and non-personal. Proposed new subsection (7) protects all the consumer’s data created under the contract. This covers both personal and non-personal data. Proposed new subsection (8) allows for all this data to be returned to a user within a “reasonable period” after the end of the contract. Proposed new subsection (9) gives a balance to these consumer rights by creating exemptions for the trader to have to return the data, especially if it is part of a bigger dataset that cannot be easily separated out. Proposed new subsection (10) is particularly important, because it prevents the trader continuing to use the consumer’s non-personal data at the end of the contract.

As I have explained, “personal data” is very narrowly defined. This leaves a mass of data created by the consumer during the contract that will need to be protected at the end of the contract. It will be if this amendment is adopted. Surely, the Minister would want the trader to return all the digital data that the consumer created on the platform, and to prevent the trader continuing to exploit it for financial gain.

To give noble Lords an example of the dangers to consumers if this amendment is not adopted, a consumer might want to end their subscription to their account at Flickr, the photo-sharing platform. At the moment, the clause will ensure that all the photos that identify the user will be regarded as personal data and returned to them. However, it might well not cover all the other photos that do not directly identify them. They could be holiday pictures of beaches in Greece, historic buildings or wildlife that they placed on the Flickr platform during their contract.

Once the contract is finished, Flickr can currently keep all the other photographs that the consumer has taken and refuse to return them. Furthermore, it can use them for financial gain. Likewise, a user’s comments placed against somebody else’s photos can be retained on the site by the trader after the end of the contract. On Flickr, the original author’s name is changed to a randomly chosen two-word alternative. However, the comments can be detailed and the consumer might well want to retrieve them, but they currently will not be able to.