Digital and Technology Policy: National Sovereignty

Baroness Kidron Excerpts

Thursday 23rd July 2026 Lords Chamber

Moved by

[Baroness Kidron]

That this House takes note of the impact of digital and technology policy on national sovereignty.

[Baroness Kidron (CB)]

My Lords, I am grateful to all noble Lords taking part in this debate. I pay particular tribute to the right reverend Prelate the Bishop of Oxford for his leadership in advocating for digital systems to reflect our ethics and values, who today makes his valedictory speech.

Anyone who has heard me speak about technology over the past 15 years could be forgiven for thinking that I do not much like it. Nothing could be further from the truth. I love what technology makes possible. I rely on it for my health; I use artificial intelligence every day; and I still marvel that I can speak face to face with people on the other side of the world as though they were in the room. My criticism has never been of what technology can do, but rather of the political and economic choices that we have allowed to shape its development.

Technology is not an independent force that arrives from nowhere. It reflects the interests, incentives and values of those who build it, finance it and control it. Technology now underpins every area of public and private life, so digital policy is no longer simply about innovation, information or efficiency. It is a constitutional issue that raises serious questions about sovereignty, including whether Governments retain the practical ability to govern in the interests of their own citizens. That is why I secured this debate. At heart, sovereignty is the capacity to choose. Sovereignty means that Parliament makes the laws, government governs, regulators regulate and courts enforce our law, and that Britain is free to pursue its national interest without coercion or dependence. Yet we have allowed that capacity to be eroded by the tech sector in four distinct ways.

First, we have surrendered political leverage: on copyright, where the Government put their proposed UK-US technology deal above our own copyright law— a deal that, incidentally, never materialised; on child safety, where, as the former Minister Jess Phillips observed, it took a year simply to persuade the Government just to threaten legislation, not to legislate; and on data protection, competition policy and consumer protection, and across government departments, where public lobbying and private pressure have urged officials not to upset the Americans.

That pressure is increasingly reinforced by an activist White House. We are threatened with sanctions for any policy that might impact on US tech. The US tech sector is uniquely concentrated in a small number of companies and beholden to the views of a small number of powerful funders who possess dual-class shares that give them total control. They tell us that Britain will be left behind, that innovation and growth depend on abandoning our own laws, or that complying with them is technically unfeasible. That is very hard to take from companies that promise immortality and colonies on Mars—the very same companies that insisted that age assurance, two-factor authentication and the right to be forgotten would break the internet. Backed by unprecedented wealth and unparalleled political access, they have exercised extraordinary influence over government policy.

Secondly, we have surrendered economic leverage. For years, we have tolerated economic arrangements that place British businesses at a structural disadvantage. Our high streets pay taxes that e-commerce does not, black taxis are subject to obligations while ride-hailing is not, hotels meet standards that short-term letting platforms do not—each is a transfer of wealth overseas. The Government have poured billions of pounds of public money into global technology companies, while British firms that employ people here, pay taxes here and invest here—and, importantly, train the next generation—struggle to gain a foothold in public procurement.

An investigation in last week’s London Review of Books describes how, after years of recruiting former officials and consultants with access to Ministers and senior decision-makers, Palantir secured its position at the heart of the NHS, culminating in a £330 million contract for its federated data platform. Many trusts either have chosen not to use it at all or regard it as inferior to cheaper alternatives. Leeds Teaching Hospitals NHS Trust warned that it would

“lose functionality rather than gain it”,

while NHS Greater Manchester said that its own system

“exceeds anything the FDP currently offers”.

The issue is not only quality or value of money but that, over time, the NHS will become bound to Palantir: it will continue to own its own data but will depend on Palantir’s software to use it. Similarly, the Ministry of Defence admits that replacing one of its Palantir systems

“would involve rebuild of the underlying data analytics architecture”.

That is not simply vendor lock-in; it is a strategic dependency at the heart of our national security. Choice exists in theory but increasingly disappears in practice. Palantir is not unique. Across Whitehall, the same pattern is emerging in cloud computing, enterprise software and artificial intelligence. Sovereignty is not simply the freedom to make a decision; it is the freedom to make a different decision in the future.

Thirdly, we have surrendered technological capability. Every procurement decision is also an investment decision. Buying technology elsewhere means investing in someone else’s industrial future rather than our own. I have spoken to sources in health, defence and policing, who all told me they had been forced to contract AWS because no UK cloud provider was considered financially secure. Yet when I asked whether the combined purchasing power of government could itself create financial resilience for a British provider, the answer was an unqualified yes. Parliament has already provided tools to the competition regulator to challenge entrenched digital market power. The problem is not legislative capacity but political strategy. Cloud computing is only one example. The same logic applies wherever government buys technology. Procurement does not simply purchase capability; it determines where future capability is built.

Fourthly, we have created strategic vulnerability: from Microsoft, which suspended services used by the chief prosecutor of the International Criminal Court and refused to answer questions from Police Scotland about where sensitive law enforcement data was being processed; to Elon Musk withdrawing Starlink access from Ukraine’s military operations; President Trump’s decision to limit access to AI models Fable and Mythos 5 to US nationals only; and this week’s news that an OpenAI agent has autonomously hacked Hugging Face, just weeks after OpenAI’s chief executive argued that frontier AI should be regulated under US leadership. The US has no such regulatory regime, and the risks are imminent.

Together, these reveal the problem of allowing critical public capacity to depend entirely on infrastructure controlled offshore. I fear that those who argue that Britain must wait for global agreement are whistling in the wind. History suggests that meaningful international regulation follows major incidents rather than prevents them. Meanwhile, across government, hospitals, schools, critical infrastructure, and security and intelligence communities, we are replacing technologies whose risks we broadly understand with systems whose capabilities and failures remain, at best, uncertain. A nation that depends on decisions beyond the reach of its own Parliament and Government and its own regulators and courts has, in practice, surrendered its sovereignty.

We have a new Government, and that is an opportunity to lead. Britain begins from a position of enormous strength. We have world-leading universities, exceptional scientists, some of the richest and most trusted datasets in the world in the NHS, the BBC, the Met Office and beyond, and institutions, such as the AI Security Institute, that have demonstrated international leadership. These are not simply public services; they are strategic national assets that we could capitalise on to drive prosperity and independence across some of the technology stack—from AI and quantum to specialist models, medical advances, infrastructure and even a new media environment.

During the passage of the Data (Use and Access) Bill, I argued that these unique datasets should be formally categorised as sovereign datasets. Those working at the frontier of artificial intelligence accept that high-quality data is the scarce resource of the future, but it is a resource that we have in abundance. That is why my noble friend Lord Tarassenko has repeatedly argued that Britain should develop a publicly supported foundation model, so that data generated by the British people continues to create value for Britain. The objective is not to build the world’s largest model. Systems that may or may not be sentient and that foment unemployment for half the world’s population, with no corresponding plan for humankind, are Silicon Valley’s vision, not ours. The objective is to build models that are responsible and trusted, trained on known data, capable of audit, secure by design and, most of all, tailored to the needs of British businesses, public services, legal frameworks and security requirements. A trusted AI ecosystem also requires robust systems of transparency that protect our national security and present an opportunity for licensing at scale.

Government must get off the fence. Companies that refuse to respect British intellectual property should not expect access to public contracts. Britain should create conditions for its intellectual property to be licensed and commercialised across the global economy.

It is time for government procurement to support British values and build national capability: a “sovereign as service” unit across government, promoting British business, including SMEs, enabling pre-authorised procurement and ensuring that public money develops future skills and capability. We want procurement that rewards openness, interoperability, competition and genuine exit strategies, so that the Government never again mistake convenience for resilience or political access for innovation. They should always ask, “Efficient for whom?”—not just whether savings are made but where value is created and where it stays, so that public spending strengthens regional and household prosperity, not simply the market cap of overseas firms. Above all, government contracts should go only to companies that commit to respecting British law.

Finally, we must transform sovereignty from a strapline into a measurable strategy. Ministers speak about reducing strategic dependence, increasing resilience and retaining leverage. They have spoken about building British capability and working with trusted partners. Yet in practice they have pursued the logic of dependence, buying, subsidising and valorising foreign technology, in the belief that being close to power is the same as exercising it. It is not.

I have been working with colleagues at the British Computer Society to develop a national sovereignty dashboard so that we have objective measures of resilience, dependency and capability. Governments already measure inflation, productivity, emissions and debt, because what gets measured gets managed. To ensure sovereignty, we must have a way of measuring it. France, Switzerland, India, Brazil, UAE and South Korea have all made sovereign decisions about aspects of their technology infrastructure. They are investing in their capability and simultaneously protecting their future security. For too long, our approach has been subservient to the lobbying trope that all but America and China are too late. In fact, the vast majority of the world’s population live outside those two superpowers, and tech multilateralism offers the UK a powerful role.

Sovereignty never meant doing everything ourselves; it means retaining the freedom choose now and to make another decision tomorrow. Sovereignty is not protectionism; it is statecraft. There is a different sovereign future available to Britain, built on capability, confidence, trusted systems, respectful partnerships and, above all, the capacity to choose. I beg to move.

--- Later in debate ---

[Baroness Kidron (CB)]

My Lords, I start by disappointing the noble Lord, Lord Holmes: there will be no biopic about me, but Oxford University is currently building a “Baroness Bee” chatbot that might help my productivity. I apologise for the cost of the hardback book, but let me say that I have donated one to the Library; that is the importance of culture and sharing in our communities.

I am very often met with a level of surprise at the sophistication of this House on this subject. There are a lot of people inside and outside the technology sector who do not quite believe that there is such a depth of knowledge and passion—I mean that in the best possible way—on this subject. Today’s debate is indicative of that.

A number of noble Lords used the words “full stack”—we do not have enough capacity to do the full stack. Then I realised that I had written it down as “full-fat” sovereignty. I think we can all agree that we are not going to have full-fat sovereignty, but there were so many ideas in today’s debate that it adds up to a strategy. I say to the Minister, with deepest respect, that the list that she was asked to give us is a series of activities. Some of them are very important and some are very welcome, but it is not yet a strategy.

Across the House, there were only two disagreements. The first was on whether “Take back control” was a good slogan. I think we can leave that to one side. The other was on whether we should have open-weight models and regulation, or just open-weight models. We can probably walk forward on the basis that there is cross-party agreement that we desperately need an urgent strategy. Whether these responsibilities sit within DSIT or another department is ultimately a machinery of government question, but it cannot be the case that we wait for a strategy on sovereign tech. I absolutely agree with those who say that it goes beyond AI to all kinds of technology. Without a strategy, we cannot put into practice all the brilliant ideas that noble Lords have put forward today. I thank all noble Lords for their contributions.

Motion agreed.

EU Technological Sovereignty Package

Baroness Kidron Excerpts

Monday 20th July 2026 Lords Chamber

[Baroness Lloyd of Effra (Lab)]

Northern Ireland is an incredibly important region for us. It has, as the noble Baroness knows, very high levels of digital connectivity, which puts it in a great place. I know that it also benefits from a thriving and growing cyber security sector and is thus able to tap into many of the adjacent industries that are part of the AI economy as it grows. We are backing cyber businesses in Northern Ireland and supporting them to export and scale.

[Baroness Kidron (CB)]

My Lords, the EU’s tech sovereignty package recognises the importance of procurement in developing a wider sovereign technological regime. Yet, here in the UK, we are increasingly seeing extensive use of lock-in deals across Defence, Health, the Treasury and so on. Can the Minister say what actions the Government will take to prevent tech dependency when they offer public contracts to foreign-based firms to ensure that the UK retains the ultimate say over its policies across all departments?

[Baroness Lloyd of Effra (Lab)]

The noble Baroness highlights the importance of having clear guidance and a clear framework for the public sector as it makes various procurements. That is why, for example, we have published the Cloud Challenge Book 2026, which helps to identify how the public sector can strengthen resilience, improve competition and reduce unnecessary dependency on individual suppliers. That is part of our approach to cloud procurement for the whole of the public sector.

Cyber Security and Resilience (Network and Information Systems) Bill

Baroness Kidron Excerpts

2nd reading
Tuesday 14th July 2026 Lords Chamber

[Baroness Kidron (CB)]

My Lords, there is a risk of agreement breaking out at this juncture. I too very much welcome the cyber security Bill and agree with others who have raised the omissions. There is nothing for the private sector and nothing on local authorities. It focuses on the size of service provider rather than risk and, in doing so, fails to learn from the battles during the Online Safety Act which established beyond doubt that the size of the company does not equate to the risk it poses in any system. There is also no mandate for executive responsibilities, as in NIS2 in Europe. All these things feel like critical omissions but, above all, there is nothing on AI, as we have just heard. That is where I will focus my remarks.

In February, Darktrace, a cyber security firm based in Cambridge, surveyed cyber security professionals; 73% of them reported that AI-powered threats are already significantly impacting their organisations. Nine out of 10 said they needed major upgrades to their defences. Only weeks ago, the US Government instructed Anthropic to withdraw two frontier models, going from zero regulation of AI to a 100% ban within 90 minutes. This was on the understanding that it posed a national security threat, with capabilities that experts anticipate will be mirrored by other frontier models, including Chinese ones, within months. It seems extraordinarily ill advised, therefore, that AI is not front and centre of the Bill. Clearly, this is a decision rather than an omission so, when she responds, can the Minister explain why, given the scale of the cyber security threat presented by AI, the Government have chosen not to identify it and tackle it explicitly in the Bill?

The absence of AI from the Bill also means the absence of the AI Security Institute. AISI is recognised globally as world leading, yet since this Government came to power its name has been changed from “Safety” to “Security” institute. We have heard repeatedly from insiders that they have been instructed not to upset the Americans. Most recently, a decision was made to fold its societal resilience team—which dealt with things including psychological harms, child safety, environmental harms, synthetic media abuse and faults with using AI for hiring, police and credit scoring—in favour of the existential threat agenda, which frontier companies prefer to discuss because industry prefers to talk about the harms of the future rather than the ones that are here right now.

I sit on the Joint Committee on the National Security Strategy and simply cannot overstate the repeated cries from security experts for society-wide resilience and a broader definition of security, including information integrity and digital sovereignty. They understand that threats to security are structural and multifaceted and need constant oversight. Can the Minister say why we are not using this Bill to strengthen and empower AISI as an independent statutory body to ensure the safety and security of the nation and to provide a constant source of wisdom and expertise over AI across all domains, with a statutory remit that allows it to investigate the full spectrum of unsafe security risks and mandatory rules for AI safety training and reporting of security incidents directly to it?

It is easy to dismiss these issues as outside the cyber security remit, but that is not the case. I was at a conference about agentic AI last week where medical researchers showed that, in 51% of cases where a person should go to hospital, AI told them not to. This has profound consequences for the health of a nation. More chilling still, the same experts pointed out that, as AI becomes integrated with health records and prescribing systems, a malign actor or hostile state could in one fell swoop manipulate the online prescriptions of an entire nation.

Similarly, in my conversations with specialist police they have said that they are extremely worried about the way digital services are fuelling an ever-growing pipeline of extremists. Recent research by the Center for Countering Digital Hate shows that eight out of 10 chatbots are willing to plan a school shooting or an attack on a synagogue. In 2025, for the first time, automated traffic overtook human traffic online, much of it concealing its identity, leaving operators unable to distinguish benign automation from hostile traffic. This enables the mass harvesting of data used to facilitate a future cyber attack at scale. As non-human traffic climbs, our exposure to cyber attacks grows with it.

At best, the Bill is unclear how these sorts of harms impact our security and adds to the mishmash of provisions and the powers taken by the Secretary of State in several previous Bills. At worst, these issues are not covered at all. The Minister in the other place said that the Bill is “technology agnostic”. Can the Minister explain what that means in practice? AI is not simply another risk to be regulated; it changes the nature, speed and scale of cyber attacks themselves.

Two weeks ago, I and several other noble Lords received a briefing from the Institute for AI Policy and Strategy and the Centre for Long-Term Resilience. They are at the forefront of tracing emerging technologies and threats and have set out a clear strategy built around four ideas: delay, defend, detect and disrupt. They have practical proposals under each heading to improve the Bill, giving us greater oversight and transparency and narrowing and neutralising the spectrum of risk. But as it stands, the Secretary of State, as she has done on so many occasions, has taken powers herself rather than offering Parliament a coherent plan of action.

In short, the greatest omission from the Bill is that it focuses primarily on what a limited set of companies and service providers should do and too little on the resilience of the wider digital system. Over the last two years, we have seen the way in which dependencies on US tech have muted our ability to protect children and creatives and made our NHS, government data and our economy vulnerable. A truly secure cyber policy is a sovereign one which gives the Government control over key chokeholds in the system and oversight over critical infrastructure while encouraging a far greater range of providers. It is one that retains valuable data in the UK, prioritises UK tech companies and deliberately works alongside other middle powers by building relationships in which we are a rule-maker rather than a rule-taker. That, to my mind, is the real opportunity presented by this Bill. It is an opportunity yet to be realised.

Artificial Intelligence: Legislation

Baroness Kidron Excerpts

Monday 21st July 2025 Lords Chamber

[Lord Vallance of Balham (Lab)]

I think the noble Viscount is very well aware that we have taken a rather different approach, in that we are proposing regulation largely through the existing regulators rather than having everything in one place. We are now looking at an AI Bill that would go across; that is what the consultation will be about.

This is one of those areas where it is crucial to work with colleagues around the world. This is not a domestic but a global issue, and one that has to be dealt with with our colleagues in the US and in the EU. We will look very carefully at some of the features of the EU Act, which, as the noble Viscount rightly said, have been carefully looked at by a number of people, who found some things that I think the EU also wishes to change as it looks at its legislation. This goes back to my earlier answer: if we rush the consultation, we will get this wrong; if we take the time and do it right, we could end up having the best regulation in this area, which will none the less need to change, as this advances very rapidly.

[Baroness Kidron (CB)]

My Lords, both the AI Opportunities Action Plan and the industrial strategy outline a commitment to sovereign AI, including the creation of a UK sovereign AI unit, but with little detail about the timeline or the terms under which it will operate. Meanwhile, the Government continue to sign contracts with global AI firms across multiple government departments without reference to the concerns expressed in both Houses about the need to protect the UK’s valuable datasets. Could the noble Lord reassure the House that the UK’s very valuable public datasets will not be shared with international tech companies before Parliament has the opportunity to understand the terms on which they are being shared? Given that the Government have pushed back the timeline of the promised AI Bill, could he also explain how and when the details of what constitutes UK sovereign AI will be established?

[Lord Vallance of Balham (Lab)]

The noble Baroness will be aware that we have allocated up to £2 billion for AI, £500 million of which is on sovereign AI. That unit is just being established now. It will look at the features, which, of course, include data, hardware and software. One thing I can tell her, which I hope she will be pleased with, is that there is a programme on the creative content exchange in the creative industries sector that is specifically designed to look at how data from the creative industries can be pulled together so that it is easy to license it, easy to understand what has happened to it, and, therefore, easier to use it appropriately in an AI setting.

Data (Use and Access) Bill [HL]

Baroness Kidron Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

[Lord Pannick (CB)]

My Lords, I add my congratulations to the noble Baroness, Lady Owen, for her skill and persistence in persuading the Government to address this noxious practice, which is causing so many women so much distress and humiliation. It is outrageous that this is still not unlawful.

I very much welcome what the Minister said, and I will press him on four matters. I hope that I understood him correctly when he said that the criminal offence will include solicitation in this country of the creation of these images abroad. I see that he is nodding—I am grateful. This is vital for this provision because, unless the criminal offence in this country covers such matters, the mischief will continue, as the Minister recognises. I can see no difficulty in terms of constitutional theory or practice or international law, because there are many offences in the criminal calendar where what is criminalised is conduct in this country, even though part of the matter that causes concern occurs abroad. I am very grateful to the Minister.

Secondly—and I hope I understood the Minister correctly—he said that the Government’s amendments will contain no intent element other than intent to create the image. That is very important. If the prosecution has to establish some other intent, that will enable defendants to come up with all sorts of spurious explanations such as, “It was not my intent” and “I didn’t realise that it would have this effect”, which would frustrate the purpose. I think that is what the Minister said, and I would welcome confirmation on that important point.

I would also welcome confirmation on another point. Another “intent”—intent to cause alarm, distress or humiliation—is in his Amendment 56A, which I of course appreciate will not be pursued in due course. Does the Minister’s statement that no other intent than intent to create the image will be required also covers the other element, which is in Amendment 56A? That also requires the prosecution to prove, as an alternative, the purpose for which these images are created. It has to be proved under Amendment 56A that the purpose is to obtain sexual gratification. The defendant will inevitably say that it is not their purpose. Could the Minister confirm that that will not be replicated in the amendment that will eventually be brought forward? I see the Minister nodding, and I am grateful to him.

Thirdly, the Minister referred to what will be in the amendment that will eventually be brought forward. If I understood him correctly, there will be a defence of reasonable excuse. The Minister confirms that that is what he said. I have great difficulty in understanding in what circumstances a defendant could have a reasonable excuse for creating or soliciting a fake image of a sexual nature without either the consent of the victim or, at the very least, a reasonable belief by the defendant that the victim had consented. Can the Minister give us an example of where the image has been created or solicited and the defendant does not believe that the woman has consented, or does not have a reasonable belief that the woman has consented, but there is nevertheless a reasonable excuse for this conduct? I cannot think of one. I am not expecting an answer from the Minister today, but if his amendment contains the reasonable excuse defence, I for one will be pressing him on it.

Fourthly and finally, I understood the Minister to give a commitment, not that the amendment will be ready in time necessarily for Third Reading, but that it will be ready and introduced during the passage of this Bill through Parliament. My understanding is that there is no question of this being kicked into the long grass. We have a commitment that the Government will propose legislation in the course of parliamentary consideration of this Bill. If I am right on that—again, I saw the Minister nodding—I very much hope that the noble Baroness, Lady Owen, will not feel it necessary to press her amendment this evening. She has made enormous progress on this, which is much welcomed around the House. It would be much better, would it not, to preserve and reserve her position for Third Reading, if she needs to bring the matter back then?

[Baroness Kidron (CB)]

My Lords, it is such a pleasure briefly to follow my noble friend Lord Pannick; not for the first time I thought that, if I ever get in trouble, I know who I will go to.

I record my admiration for the noble Baroness, Lady Owen. She has fought a just and forensic fight and she has mastered the gift of the House of Lords very rapidly. I also thank the Minister, Sarah Sackman, for the meeting on this subject and for agreeing to look again and again at the issue of intent and consent, which is something that those of us who have been in the world of sexual offences really must insist on, so I was delighted to hear from the noble Baroness and the Minister that that is somewhat resolved.

--- Later in debate ---

Moved by

[Baroness Kidron]

58: After Clause 132, insert the following new Clause—
“Sovereign data assets(1) The Secretary of State may by regulations define data sets held by public bodies and arm’s length institutions and other data sets that are held in the public interest as sovereign data assets (defined in subsection (6)).(2) In selecting data sets which may be designated as sovereign data assets, the Secretary of State must—(a) have regard to—(i) the security and privacy of United Kingdom data subjects;(ii) the ongoing value of the data assets;(iii) the rights of United Kingdom intellectual property holders;(iv) ongoing adherence to the values, laws and international obligations of the United Kingdom;(v) the requirement for public sector employees, researchers, companies and organisations headquartered in the United Kingdom to have preferential terms of access;(vi) the need for data to be stored in the United Kingdom, preferably in data centres in the United Kingdom;(vii) the need to design Application Programming Interfaces (APIs) as bridges between each sovereign data asset and the client software of the authorized licence holders;(b) consult with— (i) academics with expertise in the field;(ii) the AI Safety Institute;(iii) those with responsibility for large public data sets;(iv) data subjects;(v) the Information Commissioner.(3) The Secretary of State must establish a transparent licensing system, fully reflecting the security and privacy of data held on United Kingdom subjects, for use in providing access to sovereign data assets.(4) The Secretary of State must report annually to Parliament on the ongoing value of the sovereign data assets, in terms of—(a) their value to future users of the data;(b) the financial return expected when payment is made for the use of such data in such products and services as may be expected to be developed.(5) The National Audit Office must review the licensing system established by the Secretary of State under subsection (3) and report annually to Parliament as to its effectiveness in securing the ongoing security of the sovereign data assets.(6) In this section—“sovereign data asset” means—(a) data held by public bodies and arm’s length institutions of government;(b) data sets held by third parties that volunteer data to form, or contribute to, a public asset.(7) Regulations under this section are to be made by statutory instrument.(8) A statutory instrument containing regulations under this section may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.”Member’s explanatory statement
The UK has a number of unique publicly-held data assets, from NHS data to geospatial data and the BBC’s multimedia data. This amendment would create a special status for data held in the public interest, and a licensing scheme for providing access to them, which upholds UK laws and values, and ensure a fair return of financial benefits to the UK.

[Baroness Kidron (CB)]

My Lords, I will speak to both amendments in this group. Amendment 58, which is in my name and those of my noble friend Lord Tarassenko, and the noble Lords, Lord Stevenson and Lord Clement-Jones, seeks to ensure that the value of our publicly held large datasets is realised for the benefit of UK citizens. A full explanation of the amendment can be found at col. 162GC of Hansard. Amendment 71 is new and has a different approach to many of the same ends.

The speed at which the Government are giving access to our data is outpacing their plans to protect its financial or societal value. As we have seen over the last 24 hours, in which $1 trillion was wiped off the US AI sector and China provided a next gen proposal for AI—at least for the moment—technology moves at pace, but data is still the gold dust on which it rests.

Amendment 58 would require the Government to act as custodian of that vital asset. For example, they would need to decide the criteria for assigning publicly held data sets as a sovereign data asset, secure a valuation for that asset, and then be accountable for the decisions they took to protect that value and generate a return, both financial and societal, on behalf of the British public.

When that idea was proposed at Second Reading, the Minister said the Government’s proposal for a national data library would address those concerns. However, despite requests for further information from noble Lords in Committee, the Minister did not elaborate. That is a source of considerable frustration, given that in the same period no fewer than seven recommendations for the national data library in Matt Clifford’s AI action plan were fully accepted and widely trumpeted by the Government—including giving away BBC assets for free without asking the BBC.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

I am grateful to the noble Baroness, Lady Kidron, and the noble Lord, Lord Tarassenko, for Amendments 58 and 71, one of which we also considered in Committee. I suspect that we are about to enter an area of broad agreement here. This is a very active policy area, and noble Lords are of course asking exactly the right questions of us. They are right to emphasise the need for speed.

I agree that it is essential that we ensure that legal and policy frameworks are fit for purpose for the modern demands and uses of data. This Government have been clear that they want to maximise the societal benefits from public sector data assets. I said in the House very recently that we need to ensure good data collection, high-quality curation and security, interoperability and ways of valuing data that secure appropriate value returns to the public sector.

On Amendment 58, my officials are considering how we approach the increased demand and opportunity of data, not just public sector data but data across our economy. This is so that we can benefit from the productivity and growth gains of improvements to access to data, and harness the opportunities, which are often greater when different datasets are combined. As part of this, we sought public views on this area as part of the industrial strategy consultation last year. We are examining our current approach to data licensing, data valuation and the legal framework that governs data sharing in the public sector.

Given the complexity, we need to do this in a considered manner, but we of course need to move quickly. Crucially, we must not betray the trust of people or the trust of those responsible for managing and safeguarding these precious data assets. From my time as chair of the Natural History Museum, I am aware that museums and galleries are considering approaches to this very carefully. The noble Lord, Lord Lucas, may well be interested to see some of the work going on on biodiversity datasets there, where there are huge collections of great value that we actually did put value against.

Of course, this issue cuts across the public sector, including colleagues from the Geospatial Commission, NHS, DHSC, National Archives, Department for Education, Ordnance Survey and Met Office, for example. My officials and I are very open to discussing the policy issues with noble Lords. I recently introduced the noble Lord, Lord Tarassenko, to officials from NHSE dealing with the data side of things there and linked him with the national data library to seek his input. As was referred to, yesterday, the noble Baroness, Lady Kidron, the noble Lords, Lord Clement-Jones, Lord Tarassenko and Lord Stevenson, and the noble Viscount, Lord Camrose, all met officials, and we remain open to continuing such in-depth conversations. I hope the noble Baroness appreciates that this is an area with active policy development and a key priority for the Government.

Turning to Amendment 71, also from the noble Baroness, I agree that the national data library represents an enormous opportunity for the United Kingdom to unlock the full value of our public data. I agree that the protection and care of our national data is essential. The scope of the national data library is not yet finalised, so it is not possible to confirm whether a new statutory body or specific statutory functions are the right way to do this. Our approach to the national data library will be guided by the principles of public law and the requirements of the UK’s data protection legislation, including the data protection principles and data subject rights. This will ensure that data sharing is fair, secure and preserves privacy. It will also ensure that we have clear mechanisms for both valuation and value capture. We have already sought, and continue to seek, advice from experts on these issues, including work from the independent Prime Minister’s Council for Science and Technology. The noble Lord, Lord Freyberg, also referred to the work that I was involved with previously at the Tony Blair Institute.

The NDL is still in the early stages of development. Establishing it on a statutory footing at this point would be inappropriate, as work on its design is currently under way. We will engage and consult with a broad range of stakeholders on the national data library in due course, including Members of both Houses.

The Government recognise that our data and its underpinning infrastructure is a strategic national asset. Indeed, it is for that reason that we started by designating the data centres as critical national infrastructure. As the subjects of these amendments remain an active area of policy development, I ask the noble Baroness to withdraw her amendment.

[Baroness Kidron (CB)]

I am grateful for a breakout of agreement at this time of night; that is delightful. I agree with everything that the Minister said, but one thing we have not mentioned is the incredible cost of managing the data and the investment required. I support the Government investing to get the value out, as I believe other noble Lords do, and I would just like to put that point on record.

We had a meeting yesterday and thought it was going to be about data assets, but it turned out to be about data communities, which we had debated the week before. Officials said that it was incredibly useful, and it might have been a lot quicker if they had had it earlier. In echoing what was said in the amendment of the noble Baroness, Lady Owen, there is considerable interest and expertise, and I would love to see the Government move faster, possibly with the help of noble Lords. With that, I beg leave to withdraw the amendment.

Amendment 58 withdrawn.

--- Later in debate ---

Moved by

[Baroness Kidron]

61: After Clause 132, insert the following new Clause—
“Compliance with UK copyright law by operators of web crawlers and general-purpose AI models(1) The Secretary of State must by regulations make provision (including any such provision as might be made by Act of Parliament), requiring the operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to comply with United Kingdom copyright law, including the Copyright, Designs and Patents Act 1988, regardless of the jurisdiction in which the copyright-relevant acts relating to the pre-training, development and operation of those web crawlers and general-purpose AI models take place.(2) Provision made under subsection (1) must apply to the entire lifecycle of a general-purpose AI model, including but not limited to—(a) pre-training and training, (b) fine tuning,(c) grounding and retrieval-augmented generation, and(d) the collection of data for the said purposes.(4) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under subsection (1) within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure.”Member’s explanatory statement
This amendment is part of a group of amendments that would clarify the requirement for web-crawlers and other “data gatherers” to observe UK copyright law. This is to counter the wide spread theft of IP by AI companies who use it as raw material for their products.

--- Later in debate ---

Moved by

[Baroness Kidron]

68: After Clause 132, insert the following new Clause—
“Reliability of computer-based evidence(1) Electronic evidence produced by or derived from a computer, device or computer system (separately or together “system”) may be relied on as evidence in any proceedings —(a) where that electronic evidence is not challenged;(b) where the court is satisfied that the electronic evidence is derived from a reliable system or otherwise the court is satisfied that the evidence is reliable.(2) Rules of Court must provide that electronic evidence sought to be relied upon by a party in any proceedings may be challenged by another party as to its correctness.(3) For the purposes of subsection (1)(a), Rules of Court must provide for the circumstances in which the Court may be satisfied that the admissibility of electronic evidence cannot reasonably be challenged. (4) For the purposes of subsection (1)(b), the matters that may be taken into account by the court in determining if a system is to be considered reliable include—(a) whether the evidence is wholly obtained from a regulated system (such as a speed camera and DVLA database);(b) the errors that have been reported in the system, the actions taken to correct them, and any errors that remain uncorrected (these may include the Known Error Log and Release Notices);(c) the measures taken to ensure that the electronic evidence accurately records the facts that are being claimed (including measures to block, record and manage cyberattacks);(d) the forensic measures taken to ensure that the electronic evidence has not been affected by accidental, privileged or unauthorised access;(e) the route that the electronic evidence has taken from the originating system to the court and the measures taken to ensure its integrity;(f) external independent audit of the system.(5) If the materials under subsection (4) are not available or if the materials produced for the purposes of subsection (4) are considered by the court to be insufficient for the court to conclude that the system is reliable for the purposes of subsection (1)(b), the party seeking to rely upon the electronic evidence must otherwise satisfy the court that that evidence is reliable.(6) For the purposes of this section—“computer” means any device capable of performing mathematical or logical instructions;“device” means any apparatus or tool operating alone or connected to other apparatus or tools, that processes information or data in electronic form;“electronic evidence” means evidence derived from data contained in or produced by any device or computer the functioning of which depends on a software program or from data stored on a computer, device or computer system or communicated over a networked computer system.”

[Baroness Kidron (CB)]

My Lords, I move Amendment 68 in my name and those of the noble Lords, Lord Arbuthnot, Lord Holmes and Lord Clement-Jones. This amendment has been debated several times within this Bill and its predecessor; however, this version differs slightly in approach. The objective remains the same: to overturn the common-law assumption in both civil and criminal law that computers are infallible.

This assumption has led to untold injustice. Innocent people have lost their lives, freedom and livelihoods because the law wrongly assumed that computers are never wrong. This of course is nonsense, as explained in detail in our last debate, at column GC 153 of Hansard. In summary, computer systems are very susceptible to both human and technological error. Indeed, the presence of bugs is normal, anticipated and routine in all contexts other than the court.

As with previous iterations of this amendment, Amendment 68 overturns that common-law assumption, but the drafting now closely mirrors provisions under the Electronic Trade Documents Act 2023, which was enacted in recognition that the majority of trade documents are now electronic.

The ETDA ensures and assures the integrity of electronic trade documents. It was put in place to protect those on both sides of the trade, so I am curious, at the very least, as to why we will be able to consider the efficacy of computer evidence in relation to trade but not in our legal system. I am also concerned that the MoJ, under several Governments, has been so slow to recognise the scale of the problem of this assumption, which one of my most experienced computer science colleagues described as “wicked nonsense”.

In brief, the amendment provides that the electronic evidence produced by or derived from a computer may be relied upon as evidence where that evidence is not challenged and where the court is satisfied that the evidence can be relied upon. The rest of the amendment is carefully drafted by legal experts and computer scientists with legal expertise to support the court in coming to a meaningful assessment of whether to be satisfied, or not, that the evidence can be relied upon.

This proposal has been tried and tested within our legal system. We know that it works, and I therefore see no reason why the Government should not simply accept it. However, rather than discuss it, the Government chose to announce, last week, a consultation on computer evidence. The call for evidence is a source of significant frustration for those of us who have championed this issue, as is the fact that the promised meeting with the MoJ did not happen before that announcement, in spite of repeated requests.

In her introductory remarks to the consultation, the Minister for Justice, Sarah Sackman, says that the purpose of the consultation is to help her department

“better understand how the current presumption concerning the admissibility of computer evidence is working in practice, and whether it is fit for purpose in the modern world”.

This is a backward step. The evidence that presumption is not working and is not fit for purpose is overwhelming and decades long; what are needed now are solutions, one of which is before us tonight.

Moreover, the Government’s preference for doing everything behind doors has sunk their own consultation. Had experts been consulted, the first thing they would have pointed out is that the scope is insufficient because it does not address civil proceedings but only criminal proceedings, even though the presumption is the same for both. This means that, at best, the Government’s consultation can lead only to a partial solution.

We in this House have discussed this issue in the case of the postmasters; it is a case that is front of mind. This approach may have spared those postmasters who were subject to criminal prosecutions, but not those such as Lee Castleton who was subject to civil proceedings by the Post Office, which chased him to bankruptcy. He was also branded a thief, spat at and verbally abused in the street. He developed post-traumatic stress disorder. His wife developed epilepsy from stress, his daughter developed an eating disorder and his son remains so traumatised that he cannot be in a room where someone says the words “Post Office”. A solution that does not prevent the injustice done to Lee and his family from happening to others is not fit for purpose. If the MoJ had done us the courtesy of a meeting, this could have been avoided.

I am sure the Minister will assure us that the Government are acting, but for those whose lives have been ruined, those who have fought for too many years on this issue, the consultation creates the spectre of yet another battle and further delay when the solutions are here and at hand. I want nothing more than to be wrong on this, and for the Government to prove me wrong. But for past victims, for lawyers and experts who have given their time so generously, and for those whose lives will be ruined because the computer got it wrong, half a consultation on a matter so well-established and urgent is a pretty poor result. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, as so often, I listened with awe to the noble Baroness. Apart from saying that I agree with her wholeheartedly, which I do, there is really no need for me for me to add anything, so I will not.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

Amendment 68 from the noble Baroness, Lady Kidron, aims to prevent future miscarriages of justice, such as the appalling Horizon scandal. I thank the noble Baroness and, of course, the noble Lord, Lord Arbuthnot, for the commitment to ensuring that this important issue is debated. The Government absolutely recognise that the law in this area needs to be reviewed. Noble Lords will of course be aware that any changes to the legal position would have significant ramifications for the whole justice system and are well beyond the scope of this Bill.

I am glad to be able to update the noble Baroness on this topic since Committee. On 21 January the Ministry of Justice launched a call for evidence on this subject. That will close on 15 April, and next steps will be set out immediately afterwards. That will ensure that any changes to the law are informed by expert evidence. I take the point that there is a lot of evidence already available, but input is also needed to address the concerns of the Serious Fraud Office and the Crown Prosecution Service, and I am sure they will consider the important issues raised in this amendment.

I hope the noble Baroness appreciates the steps that the Ministry of Justice has taken on this issue. The MoJ will certainly be willing to meet any noble Lords that wish to do so. As such, I hope she feels content to withdraw the amendment.

[Baroness Kidron (CB)]

The Minister did not quite address my point that the consultation is not broad enough in scope, but I will accept the offer of a meeting. Although the noble Lord, Lord Arbuthnot, spoke very briefly, he is my partner in crime on this issue; indeed, he is a great campaigner for the postmasters and has done very much. So I say to the Minister: yes, I will have the meeting, but could it happen this time? With that, I beg leave to withdraw the amendment.

Amendment 68 withdrawn.

Data (Use and Access) Bill [HL]

Baroness Kidron Excerpts

Report stage
Tuesday 28th January 2025 Lords Chamber

Moved by

[Baroness Kidron]

44: After Clause 92, insert the following new Clause—
“Code of practice on Children's Data and Education(1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on the processing of data in connection with the provision of education.(2) Guidance under subsection (1) must include consideration of—(a) all aspects of the provision of education including learning, school management and safeguarding;(b) all types of schools and learning settings;(c) the need for transparency and evidence of efficacy on the use of AI systems in the provision of education;(d) the impact of profiling and automated decision-making on children’s access to education opportunities;(e) the principle that children have a right to know what data about them is being generated, collected, processed, stored and shared;(f) the principle that those with parental responsibility have a right to know how their children's data is being generated, collected, processed, stored and shared;(g) the safety and security of children’s data;(h) the need to ensure children's access to and use of counselling services and the exchange of information for safeguarding purposes are not restricted.(3) In preparing a code or amendments under this section, the Commissioner must have regard to—(a) the fact that children are entitled to a higher standard of protection than adults with regard to their personal data as set out in the UK GDPR, and the ICO’s Age Appropriate Design code;(b) the need to prioritise children's best interests and to uphold their rights under UN Convention on the Rights of the Child and General Comment 25;(c) the fact that children may require different protections at different ages and stages of development;(d) the need to support innovation to enhance UK children's education and learning opportunities, including facilitating testing of novel products and supporting the certification and the development of standards;(e) ensuring the benefits from product and service developed using UK children’s data accrue to the UK.(4) In preparing a code or amendments under this section, the Commissioner must consult with—(a) children,(b) educators,(c) parents,(d) persons who appear to the Commissioner to represent the interests of children,(e) the AI Safety Institute, and(f) the relevant Education department for each nation of the United Kingdom.(5) The Code applies to data processors and controllers that— (a) are providing education in school or other learning settings;(b) provide services or products in connection with the provision of education;(c) collect children's data whilst they are learning;(d) use education data, education data sets or pupil data to develop services and products;(e) build, train or operate AI systems and models that impact children’s learning experience or outcomes;(f) are public authorities that process education data, education data sets or pupil data.(6) The Commissioner must prepare a report, in consultation with the EdTech industry and other stakeholders set out in subsection (4), on the steps required to develop a certification scheme under Article 42 of the UK GDPR, to enable the industry to demonstrate the compliance of EdTech services and products with the UK GDPR, and conformity with this Code.(7) Where requested by an education service, evidence of compliance with this Code must be provided by relevant providers of commercial products and services in a manner that satisfies the education service's obligations under the Code.(8) In this section—“EdTech” means a service or product that digitise education functions including administration and management information systems, learning and assessment and safeguarding, including services or products used within school settings and at home on the recommendation, advice or instruction of a school;“education data” means personal data that forms part of an educational record.“education data sets” means anonymised or pseudonymised data sets that include Education Data or Pupil Data.“efficacy” means that the promised learning outcomes can be evidenced.“learning setting” means a place where children learn including schools, their home and extra-curricular learning services for example online and in-person tutors.“pupil data” means personal data about a child collected whilst they are learning which does not form part of an educational record.“safety and security” means that it has been adequately tested.“school” means an entity that provides education to children in the UK including early years providers, nursery schools, primary schools, secondary schools, sixth form colleges, city technology colleges, academies, free schools, faith schools, special schools, state boarding schools, and private schools.”Member's explanatory statement
This amendment proposes a statutory Code of Practice on Children and Education to ensure that children benefit from heightened protections when their data is processed for purposes relating to education. Common standards across the sector will assist schools in procurement.

[Baroness Kidron (CB)]

My Lords, Amendment 44 in my name and those of the noble Lords, Lord Russell and Lord Clement-Jones, and the noble Baroness, Lady Harding, proposes a statutory code of practice on children’s education to ensure that children benefit from heightened protections when their data is processed for the purposes of relating to education.

My understanding is that, when the Minister stands up, he will tell us that the Secretary of State is going to write to the ICO and require him to either write such a code or, if it is more practical, extend the AADC to cover educational settings. The either/or is because Government say the ICO is undertaking a consultation on edtech and DSIT is doing a consultation on AI, both of which have ramifications for children’s data at school.

Rather than make the argument for the amendment as written, I shall put on record for the department and the ICO the expectations of such a code. I hope that the Minister concurs with this list and that he will ensure that the ICO works with me and expert colleagues in the field to look at and respond to the evidence and ensure that the code addresses our concerns.

The code must apply to education provided in school settings but also outside the classroom—for example, when children use edtech products to complete homework set by school or for independent learning. The code must consider all aspects of the provision of education, including safeguarding and administration, as well as learning. The code should take as a starting point that children merit heightened protections and consider the needs of children at different ages and stages. The code should provide specific guidance on profiling, including predictions that may impact on children’s educational opportunities or outcomes. The code should require the ICO or the DfE to work with third parties to develop certification and accreditation schemes to support educators and parents in choosing products and services that are safe and private and improve learning outcomes. Lastly, in drawing up the code, the ICO must consult with children, parents, educators, devolved Governments and industry.

I also want to put on record that “school” means an entity that provides education to children in the UK. Importantly, that includes early-years providers, nursery schools, primary schools and so on, because often early years are left out of this equation.

--- Later in debate ---

[Baroness Kidron (CB)]

May I ask for a commitment from the Dispatch Box that, when the order is complete and some of those conversations are being discussed, we can have a meeting with the ICO, the DfE and noble Lords who have fought for this since 2018?

[Lord Vallance of Balham (Lab)]

I am very happy to give that commitment. That would be an important and useful meeting.

[Baroness Kidron (CB)]

I thank the Minister and the Government. As I have just said, we have been fighting for this since 2018, so that is quite something. I forgot to say in my opening remarks that edtech does not, of course, have an absolute definition. However, in my mind—it is important for me to say this to the House—it includes management, safety and tech that is used for educational purposes. All those are in schools, and we have evidence of problems with all of them. I was absolutely delighted to hear the Government’s commitments, and I look forward to working with the ICO and the department. With that, I beg leave to withdraw.

Amendment 44 withdrawn.

--- Later in debate ---

Moved by

[Baroness Kidron]

44A: Clause 94, page 119, line 1, at end insert—
“(1) In the 2018 Act, in section 139, after subsection (2) insert—“(2A) The report must include an assessment of the Commissioner’s performance of the duties assigned to it by regulations under section (Enforcement) of the Data (Use and Access) Act 2025.””

[Baroness Kidron (CB)]

In moving Amendment 44A, I shall also speak to Amendments 61 to 65 in my name and the names of the noble Lords, Lord Stevenson and Lord Clement-Jones, and my noble friend Lord Freyberg. I registered my interests in Committee, but I begin by restating that I am a copyright holder. I am married to a copyright holder, and I have deep connections with many in the creative communities who are impacted by this issue. I am also an adviser to the Institute for Ethics in AI at Oxford, and I have the pleasure and privilege of working alongside dozens of people whose businesses and academic interests relate solely to AI.

Until last night, I had a very technical argument about the amendments—about what they would do and how they would work. But I sat in the Gallery of the other place for several hours last night to listen to the debate on the creative industries, and I listened virtually to what I did not see from the Gallery, and it really made me reconsider my approach today. It was striking that, whether on the Green, DUP, Liberal Democrat or Conservative Benches, or the Government’s own Back Benches, the single biggest concern in a debate that ran for hours, with many speakers, was the question of copyright and AI. Indeed, it figured in all but two or three speeches. Moreover, as I sat in the Gallery and people started to read from the Times, the Mail, Politico and the tech blogs, an increasing flow of MPs, many on the Government’s own Benches and some actually in the Government, texted me to say that their leadership was wrong and they hoped this fight would be won for the UK’s creative industries.

It is a very great privilege to be on these Benches and never have to vote against the Whip. But I say to my friends and colleagues on all sides that, as we debate today, hundreds of organisations and many individual rights holders are watching. They are watching to see what this House will do in the face of a government proposal that will transfer their hard-earned property from them to another sector without compensation, and with it their possibility of a creative life, or a creative life for the next generation.

The Government are doing this not because the current law does not protect intellectual property rights, nor because they do not understand the devastation it will cause, but because they are hooked on the delusion that the UK’s best interests and economic future align with those of Silicon Valley. The Minister will say to the House that a consultation is ongoing and we should wait for the results. This was the same line the Minister in the other place, Chris Bryant, took last night; he said that his door and his mind were open. If that is the case, I would like to know why the honourable Dame Caroline Dinenage, the chair of the Commons Select Committee, said she felt “gaslit” by Ministers and the Secretary of State.

I would also like to know why the Minister in charge of the Bill in the other place has refused a meeting with me twice and why the creative industries say that they get blandishments from a junior Minister while the AI companies get the undivided attention of the Secretary of State. Most importantly, the assertion that the consultation is open and fair is critically undermined because it was launched with a preferred option. For the record, the Government’s preferred option is to give away the property rights of those who earned them on the promise of growth, growth, growth to the nation. Unfortunately, the Government cannot say to whom that growth will accrue or how much it will be. But the one thing they are absolutely sure of—Government, Opposition, AI companies and those whose property rights the Government are giving away—is that it will not accrue to the creative industries.

We have before us the most extraordinary sight of a Labour Government transferring wealth directly from 2.4 million individual creatives, SMEs and UK brands on the promise of vague riches in the future. Before I turn to the Opposition—which I will—I make it clear that there is a role in our economy for AI, there is a role in our economy for companies headquartered elsewhere, there is a role in our economy for new AI models and there is an opportunity of growth in the combination of AI and creative industries. But this forced marriage, on slave terms, is not it.

We have the Government, putting growth front and centre, stunting one of their most lucrative industries, and the equally extraordinary sight of the Conservative Opposition for the most part sitting on their hands, against the wishes of many in their tribe, putting party ahead of country because they prefer to have proof of the Government’s economic incompetence rather than protect the property rights of their citizens and creative industries.

Let me kill a few sacred cows. Judges, lawyers and academics all agree that the law on copyright is clear, and the ICO determination that copyright stands in spite of the advances of AI is also clear. Ministers choosing to mirror the tech lobbyist language of uncertainty rather than defending the property rights of citizens and wealth creators is bewildering. They are not quoting the law or the experts; they point at the number of court cases as proof of lack of clarity. But I am at a loss, since a person who has had their goods stolen relying on their legal rights seems to be a sign that the law is clear.

However, given the scale of the theft and the audacity of the robber barons, they should be able to turn to the Government for protection—rather than suggesting that we redefine the notion of theft. The Minister, the honourable Chris Bryant, said last night that change is needed and that we cannot do nothing, and the unified voices of the creative industries—from the biggest brands such as Sony and Disney to newspapers such as the Telegraph, the FT and the Guardian, and those who represent publishers, musicians or visual artists and the artists themselves—all agree. Nobody is saying that we should leave it as it is. They are saying, “Make the copyright regime fit for the age of AI”—which is exactly what the amendments do.

The amendments surface the names and owners of the crawlers that currently operate anonymously, record when, where and how IP is taken and, crucially, allow creators to understand what has been taken so that they can seek redress. This is not new, burdensome regulation—and it is certainly less regulation than the incredibly complex, costly and ultimately unworkable opt-outs or rights reservation mechanism of the preferred option of the consultation. All that creators are asking for is the enforcement of an existing property right. And when I say “creators”, I am not talking about 19th-century aristocrats occupying the time between lunch and dinner. In spite of the immense pleasure and extraordinary soft power that the creative industries bring, it is a hard-nosed, incredibly competitive and successful sector. It takes training, skill and talent to pursue what is often an insecure career, in which the copyright of career highs pays for the costs of a freelance life and the ongoing costs of making new work.

In the other place last night, the Minister talked about transparency without reference to the fact that the tech lobby is already on manoeuvres, saying that transparency must not be too detailed because it will impact on their IP. Creatives’ IP is being given away for literally nothing, but AI companies wish to hide behind the IP of products that are simply impossible to make without the raw material of that data. So will the Minister explain why the Government pay for software licences, why our NHS pays for drugs and why members of the Cabinet pay for branded clothes, yet the Government think that the creative industries should invent something for nothing?

The Government say that doing nothing is not an option. I agree—they could call a halt to the theft, instruct the ICO and the IPO now or even do an impact assessment of their preferred policy. This is the most extraordinary thing. They have a preferred way forward but, when I asked, they had to admit that they had not done an economic impact assessment, including of job displacement, even while acknowledging that job losses were inevitable. The Prime Minister cited an IMF report that claimed that, if fully realised, the gains from AI could be worth up to an average of £47 billion to the UK each year over a decade. He did not say that the very same report suggested that unemployment would increase by 5.5% over the same period. This is a big number—a lot of jobs and a very significant cost to the taxpayer. Nor does that £47 billion account for the transfer of funds from one sector to another. The creative industries contribute £126 billion per year to the economy. I do not understand the excitement about £47 billion when you are giving up £126 billion.

The Government have a preferred option, but they have no enforcement mechanism. They have a preferred option, but no protocols to make it work. They have a preferred option but, by their own admission, no idea how an individual artist could hope to chase down dozens, hundreds or maybe thousands of AI companies to opt out or trace their work and rights. They have a preferred option, which is to give away other people’s livings and their vast contribution to the Treasury, and with that the jobs, joy and soft power of our creative industries that the country relies on globally.

There are plenty of great ideas about how creativity could add GDP to the country, but that is not the demand that the Government have made of the sector. I will not quote most of those to whom I have spoken in the last week, because the language is unparliamentary. However, I will pass on the deep regret of Lord Lloyd- Webber that he is no longer in his place to stand by me today. I will also pass on the words of a Labour donor, who said that this was economically illiterate.

--- Later in debate ---

To further show our commitment on this issue, I will be pleased to update the House on progress and to set out next steps very soon after the consultation has closed on 25 February. Noble Lords may be aware that I called for early clarity on this matter in my 2023 review for the previous Government. I hope that we can move swiftly to reach much-needed certainty and fairness. I hope that noble Lords will allow us the chance to properly conclude our consultation process and bring forward comprehensive proposals as a result. As such, I ask the noble Baroness to withdraw her amendment.

[Baroness Kidron (CB)]

My Lords, I want to return to the moment just before the Front-Bench speeches of the Opposition and the Government, when there was absolute agreement around the House. There were fantastic speeches from all sides, which understood AI not as competition but as a fellow traveller of the creative industries. I want to make that really clear, as all colleagues did around the House. I thank all noble Lords on both Benches who are being whipped not to vote for this for saying that they will support it. As I said at the outset, there are many hundreds of people watching this, and they want to know what the House is going to do to protect their future.

I will not address my remarks to the noble Viscount, Lord Camrose; he knows what I think. For a Conservative Party not to act on the property rights of UK citizens is a crying shame. To the Government and the Minister —to whom I keep finding myself saying, “who I like very much”—I have to say that this is not good enough. The Minister used the word “premature” twice. There may be a dispute about 09 or 10, but we seem to be in agreement on the 17 over on our Benches. It is not premature to use the copyright law to protect the property rights of British citizens.

I also noticed the slight slide around the preferred option. I am sorry, but to say it is a preferred option and then suggest that it is an open consultation is simply not correct. I also want to talk about this business of the impact assessment—and I am going to revisit this. I was in a meeting with officials, and I asked for the impact assessment. They said, “Well, there was one, but I don’t think it will suffice for you, Lady Kidron”. The reason it did not suffice for the noble Baroness, Lady Kidron, is because this impact assessment of AI on companies was just eight bullet points. If just one of the bullet points concerns this point about job losses and loss of income, I do not call that an impact assessment. To have a preferred option that is so catastrophic for our country’s second most effective industry—£126 billion down the drain for this magical £4.7 billion—means that I, like other noble Lords, do not understand what we are doing here.

I can see that the Chamber is filling up. Finally, on this point about international law, we have heard it all before: we heard about data law, we heard about the OSA, we heard about competition law. I wonder whether, when they do an impact assessment, the Government might consider how many creative copyright owners might like to come to the UK to ply their trade when we have our copyright laws in full order. I remember one of the first reasons Canal+ gave for making its IPO in London was our copyright laws—and it has “Paddington”.

I thank all noble Lords for speaking. They made tremendous speeches, which were educated, thoughtful and non-hysterical. These are very modest amendments, and this House has a duty to those people outside to vote on them. I will add that, at a personal level, in the 12 years I have been in your Lordships’ House I have done so many deals with the Government of the day, whichever Government that was. I have always tried to avoid voting, and I have never called a vote that I did not know I was going to win. Because of the whipping arrangements, I believe I will lose today, but we will vote. I invite those people who want the creative industries to know that we have their back to follow me through the Lobby. I would like to test the opinion of the House.

--- Later in debate ---

Moved by

[Baroness Kidron]

51: Clause 123, page 153, line 14, leave out “may by regulations” and insert “must, as soon as reasonably practicable and no later than 12 months after the day on which this Act is passed, make and lay regulations to”
Member’s explanatory statement
This amendment removes the Secretary of State’s discretion on whether to lay regulations under Clause 123 and sets a time limit for laying them before Parliament.

[Baroness Kidron (CB)]

My Lords, these amendments have to do with research access for online safety. Having sat on the Joint Committee of the draft Online Safety Bill back in 2021, I put on record that I am delighted that the Government have taken the issue of research access to data very seriously. It was a central plank of what we suggested and it is fantastic that they have done it.

Of the amendments in my name, Amendment 51 would simply ensure that the provisions of Clause 123 are acted on by removing the Government’s discretion as to whether they introduce regulations. It also introduces a deadline of 12 months for the Government to do so. Amendment 53 seeks to ensure that the regulators will enable independent researchers to research how online risks and harms impact different groups, especially vulnerable users, including children. Given the excitements we have already had this evening, I do not propose to press any of them, but I would like to hear from the Minister that he has heard me and that the Government will seek to enshrine the principle of different ages, different stages, different people, when he responds.

I note that the noble Lord, Lord Bethell, who has the other amendments in this group, to which I added my name, is not in his place, but I understand that he has sought—and got—reassurance on his amendments. So there is just one remaining matter on which I would like further reassurance: the scope of the legal privilege exception. A letter from the Minister on 10 January explains:

“The clause restates the existing law on legally privileged information as a reassurance that regulated services will not be asked to break the existing legislation on the disclosure of this type of data”.


It seems that the Minister has veered tantalisingly close to answering my question, but not in a manner that I can quite understand. So I would really love to understand—and I would be grateful to the Minister if he would try to explain to me—how the Government will prevent tech companies using legal privilege as a shield. Specifically, would CCing a lawyer on every email exchange, or having a lawyer in every team, allow companies to prevent legitimate scrutiny of their safety record? I have sat in Silicon Valley headquarters and each team came with its own lawyer—I would really appreciate clarity on this issue. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, I can only support what the noble Baroness, Lady Kidron, had to say. This is essentially unfinished business from the Online Safety Act, which we laboured in the vineyard to deliver some time ago. These amendments aim to strengthen Clause 123 and try to make sure that this actually happens and that we do not get the outcomes of the kind that the noble Baroness has mentioned.

I, too, have read the letter from the Minister to the noble Lord, Lord Bethell. It is hedged about with a number of qualifications, so I very much hope that the Minister will cut through it and give us some very clear assurances, because I must say that I veer back and forth when I read the paragraphs. I say, “There’s a win”, and then the next paragraph kind of qualifies it, so perhaps the Minister will give us true clarity when he responds.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

I thank the noble Baroness, Lady Kidron, for the amendments on researchers’ access to data for online safety research, an incredibly important topic. It is clear from Committee that the Government’s proposals in this clause are broadly welcomed. They will ensure that researchers can access the vital data they need to undertake an analysis of online safety risks to UK users, informing future online safety interventions and keeping people safe online.

Amendment 51 would compel the Secretary of State to make regulations for a researcher access framework, and to do so within 12 months. While I am sympathetic to the spirit of the noble Baroness’s amendment, a fixed 12-month timescale and requirement to make regulations may risk compressing the time and options available to develop the most effective and appropriate solution, as my noble friend Lady Jones outlined in Committee. Getting this right is clearly important. While we are committed to introducing a framework as quickly as possible, we do not want to compromise its quality. We need adequate time to ensure that the framework is fit for purpose, appropriately safeguarded and future-proofed for a fast-evolving technological environment.

As required by the Online Safety Act, Ofcom is currently preparing a report into the ways in which researchers can access data and the barriers that they face, as well as exploring how additional access might be achieved. This report will be published in July of this year. We are also committed to conducting a thorough consultation on the issue prior to any enforceable requirements coming into force. The Government intend to consult on the framework as soon as practicable after the publication of Ofcom’s report this summer.

Sufficient time is required for a thorough consultation with the wide range of interested stakeholders in this area, including the research community, civil society and industry. I know that the noble Baroness raised a concern in Committee that the Government would rely on Ofcom’s report to set the framework for the regime, but I can assure her that a robust evidence-gathering process is already under way. The framework will be informed by collaboration with key stakeholders and formal consultation, as well as being guided by evidence from Ofcom’s report on the matter. Once all interested parties have had their say and the consultation is completed, the Government expect to make regulations to install the framework. It is right that the Government commit to a full consultation process and do not seek to prejudge the outcomes of that process by including a mandatory requirement for regulations now.

Amendment 53 would seek to expand the list of examples of the types of provision that the regulations might make. Clause 123 gives non-exhaustive examples of what may be included in future regulations; it certainly does not limit those regulations to the examples given. Given the central importance of protecting children and vulnerable users online, a key aim of any future regulations would be to support researchers to conduct research into the different ways that various groups of people experience online safety, without the need for this amendment. Indeed, a significant driving force for establishing this framework in the first place is to improve the quality of research that is possible to understand the risks to users online, particularly those faced by children. I acknowledge the point that the noble Baroness made about people of all ages. We would be keen to discuss this further with her as we consult on specific requirements as part of developing regulations.

I will touch on the point about legal privilege. We believe that routinely copying a lawyer on to all emails and documents is not likely to attract legal privilege. Legal privilege protects communication specifically between legal advisers and their clients being created for the purpose of giving or receiving legal advice, or for the sole or dominant purpose of litigation. It would not be satisfactory just to copy everyone on everything.

We are confident that we can draft regulations that will make it entirely clear that the legal right to data for research purposes cannot be avoided by tech companies seeking to rely on contractual provisions that purport to prevent the sharing of data for research purposes. Therefore, there is no need for a specific requirement in the Bill to override a terms of service.

[Baroness Kidron (CB)]

I thank the Minister for his very full answer. My legal adviser on my right—the noble and learned Lord, Lord Thomas of Cwmgiedd—let me know that I was in a good place here. I particularly welcome the Minister’s invitation to discuss Ofcom’s review and the consultation. Perhaps he would not mind if I brought some of my researcher friends with me to that meeting. With that, I beg leave to withdraw the amendment.

Amendment 51 withdrawn.

Data (Use and Access) Bill [HL]

Baroness Kidron Excerpts

Report stage
Tuesday 21st January 2025 Lords Chamber

[Lord Lucas (Con)]

My Lords, I support what the noble Baroness, Lady Freeman, said. Her maiden speech was a forewarning of how good her subsequent speeches would be and how dedicated she is to openness, which is absolutely crucial in this area. We are going to have to get used to a lot of automatic processes and come to consider that they are by and large fair. Unless we are able to challenge it, understand it and see that it has been properly looked after, we are not going to develop that degree of trust in it.

Anyone who has used current AI programs will know about the capacity of AI for hallucination. The noble Lord, Lord Clement-Jones, uses them a lot. I have been looking, with the noble Lord, Lord Saatchi, at how we could use them in this House to deal with the huge information flows we have and to help us understand the depths of some of the bigger problems and challenges we are asked to get a grip on. But AI can just invent things, leaping at an answer that is easier to find, ignoring two-thirds of the evidence and not understanding the difference between reliable and unreliable witnesses.

There is so much potential, but there is so much that needs to be done to make AI something we can comfortably rely on. The only way to get there is to be absolutely open and allow and encourage challenge. The direction pointed out by the noble Lord, Lord Clement-Jones, and, most particularly by the noble Baroness, Lady Freeman, is one that I very much think we should follow.

[Baroness Kidron (CB)]

My Lords, I will very briefly speak to Amendment 30 in my name. Curiously, it was in the name of the noble Viscount, Lord Camrose, in Committee, but somehow it has jumped.

On the whole, I have always advocated for age-appropriate solutions. The amendment refers to preventing children consenting to special category data being used in automated decision-making, simply because there are some things that children should not be able to consent to.

I am not sure that this exact amendment is the answer. I hope that the previous conversation that we had before the dinner break will produce some thought about this issue—about how automatic decision-making affects children specifically—and we can deal with it in a slightly different way.

While I am on my feet, I want to say that I was very struck by the words of my noble friend Lady Freeman, particularly about efficacy. I have seen so many things that have purported to work in clinical conditions that have failed to work in the complexity of real life, and I want to associate myself with her words and, indeed, the amendments in her name and that of the noble Lord, Lord Clement-Jones.

[Lord Vallance of Balham (Lab)]

I start with Amendment 26, tabled by the noble Viscount, Lord Camrose. As he said in Committee, a principles-based approach ensures that our rules remain fit in the face of fast-evolving technologies by avoiding being overly prescriptive. The data protection framework achieves this by requiring organisations to apply data protection principles when personal data is processed, regardless of the technology used.

I agree with the principles that are present for AI, which are useful in the context in which they were put together, but introducing separate principles for AI could cause confusion around how data protection principles are interpreted when using other technologies. I note the comment that there is a significant overlap between the principles, and the comment from the noble Viscount that there are situations in which one would catch things and another would not. I am unable to see what those particular examples are, and I hope that the noble Viscount will agree with the Government’s rationale for seeking to protect the framework’s technology-neutral set of principles, rather than having two separate sets.

Amendment 28 from the noble Lord, Lord Clement-Jones, would extend the existing safeguards for decisions based on solely automated processing to decisions based on predominantly automated processing. These safeguards protect people when there is no meaningful human involvement in the decision-making. The introduction of predominantly automated decision-making, which already includes meaningful human involvement—and I shall say a bit more about that in a minute—could create uncertainty over when the safeguards are required. This may deter controllers from using automated systems that have significant benefits for individuals and society at large. However, the Government agree with the noble Viscount on strengthening the protections for individuals, which is why we have introduced a definition for solely automated decision-making as one which lacks “meaningful human involvement”.

I thank noble Lords for Amendments 29 and 36 and the important points raised in Committee on the definition of “meaningful human involvement”. This terminology, introduced in the Bill, goes beyond the current UK GDPR wording to prevent cursory human involvement being used to rubber stamp decisions as not being solely automated. The point at which human involvement becomes meaningful is context specific, which is why we have not sought to be prescriptive in the Bill. The ICO sets out in its guidance its interpretation that meaningful human involvement must be active: someone must review the decision and have the discretion to alter it before the decision is applied. The Government’s introduction of “meaningful” into primary legislation does not change this definition, and we are supportive of the ICO’s guidance in this space.

As such, the Government agree on the importance of the ICO continuing to provide its views on the interpretation of terms used in the legislation. Our reforms do not remove the ICO’s ability to do this, or to advise Parliament or the Government if it considers that the law needs clarification. The Government also acknowledge that there may be a need to provide further legal certainty in future. That is why there are a number of regulation-making powers in Article 22D, including the power to describe meaningful human involvement or to add additional safeguards. These could be used, for example, to impose a timeline on controllers to provide human intervention upon the request of the data subject, if evidence suggested that this was not happening in a timely manner following implementation of these reforms. Any regulations must follow consultation with the ICO.

Amendment 30 from the noble Baroness, Lady Kidron, would prevent law enforcement agencies seeking the consent of a young person to the processing of their special category or sensitive personal data when using automated decision-making. I thank her for this amendment and agree about the importance of protecting the sensitive personal data of children and young adults. We believe that automated decision-making will continue to be rarely deployed in the context of law enforcement decision-making as a whole.

Likewise, consent is rarely used as a lawful basis for processing by law enforcement agencies, which are far more likely to process personal data for the performance of a task, such as questioning a suspect or gathering evidence, as part of a law enforcement process. Where consent is needed—for example, when asking a victim for fingerprints or something else—noble Lords will be aware that Clause 69 clearly defines consent under the law enforcement regime as

“freely given, specific, informed and unambiguous”

and

“as easy … to withdraw … as to give”.

So the tight restrictions on its use will be crystal clear to law enforcement agencies. In summary, I believe the taking of an automated decision based on a young person’s sensitive personal data, processed with their consent, to be an extremely rare scenario. Even when it happens, the safeguards that apply to all sensitive processing will still apply.

I thank the noble Viscount, Lord Camrose, for Amendments 31 and 32. Amendment 31 would require the Secretary of State to publish guidance specifying how law enforcement agencies should go about obtaining the consent of the data subject to process their data. To reiterate a point made by my noble friend Lady Jones in Committee, Clause 69 already provides a definition of “consent” and sets out the conditions for its use; they apply to all processing under the law enforcement regime, not just automated decision-making, so the Government believe this amendment is unnecessary.

Amendment 32 would require the person reviewing an automated decision to have sufficient competence and authority to amend the decision if required. In Committee, the noble Viscount also expressed the view that a person should be “suitably qualified”. Of course, I agree with him on that. However, as my noble friend Lady Jones said in Committee, the Information Commissioner’s Office has already issued guidance which makes it clear that the individual who reconsiders an automated decision must have the “authority and competence” to change it. Consequently, the Government do not feel that it is necessary to add further restrictions in the Bill as to the type of person who can carry out such a review.

The noble Baroness, Lady Freeman, raised extremely important points about the performance of automated decision-making. The Government already provide a range of products, but A Blueprint for Modern Digital Government, laid this morning, makes it clear that part of the new digital centre’s role will be to offer specialist insurance support, including, importantly in relation to this debate,

“a service to rigorously test models and products before release”.

That function will be in place and available to departments.

On Amendments 34 and 35, my noble friend Lady Jones previously advised the noble Lord, Lord Clement-Jones, that the Government would publish new algorithmic transparency recording standard records imminently. I am pleased to say that 14 new records were published on 17 December, with more to follow. I accept that these are not yet in the state in which we would wish them to be. Where these amendments seek to ensure that the efficacy of such systems is evaluated, A Blueprint for Modern Digital Government, as I have said, makes it clear that part of the digital centre’s role will be to offer such support, including this service. I hope that this provides reassurance.

--- Later in debate ---

[Lord Clement-Jones (LD)]

My Lords, we have waited with bated breath for the Minister to share his hand, and I very much hope that he will reveal the nature of his bountiful offer of a code of practice on the use of automated decision-making.

I will wear it as a badge of pride to be accused of introducing an analogue concept by the noble Viscount, Lord Camrose. I am still keen to see the word “predominantly” inserted into the Bill in reference to automated decision-making.

As the Minister can see, there is considerable unhappiness with the nature of Clause 80. There is a view that it does not sufficiently protect the citizen in the face of automated decision-making, so I hope that he will be able to elaborate further on the nature of those protections.

I will not steal any of the thunder of the noble Baroness, Lady Kidron. For some unaccountable reason, Amendment 33 is grouped with Amendment 41. The groupings on this Bill have been rather peculiar and at this time of night I do not think any long speeches are in order, but it is important that we at least have some debate about the importance of a code of conduct for the use of AI in education, because it is something that a great many people in the education sector believe is necessary. I beg to move.

[Baroness Kidron (CB)]

My Lords, I shall speak to Amendment 41 in my name and in the names of my noble friend Lord Russell, the noble Baroness, Lady Harding, and the noble Lord, Lord Clement-Jones. The House can be forgiven if it is sensing a bit of déjà-vu, since I have proposed this clause once or twice before. However, since Committee, a couple of things have happened that make the argument for the code more urgent. We have now heard that the Prime Minister thinks that regulating AI is “leaning out” when we should be, as the tech industry likes to say, leaning in. We have had Matt Clifford’s review, which does not mention children even once. In the meantime, we have seen rollout of AI in almost all products and services that children use. In one of the companies—a household name that I will not mention—an employee was so concerned that they rang me to say that nothing had been checked except whether the platform would fall over.

Amendment 41 does not seek to solve what is a global issue of an industry arrogantly flying a little too close to the sun and it does not grasp how we could use this extraordinary technology and put it to use for humankind on a more equitable basis than the current extractive and winner-takes-all model; it is far more modest than that. It simply says that products and services that engage with kids should undertake a mandatory process that considers their specific vulnerabilities related to age. I want to stress this point. When we talk about AI, increasingly we imagine the spectre of diagnostic benefits or the multiple uses of generative models, but of course AI is not new nor confined to these uses. It is all around us and, in particular, it is all around children.

In 2021, Amazon’s AI voice assistant, Alexa, instructed a 10 year-old to touch a live electrical plug with a coin. Last year, Snapchat’s My AI gave adult researchers posing as a 13 year-old girl tips on how to lose her virginity with a 31 year-old. Researchers were also able to obtain tips on how to hide the smell of alcohol and weed and how to conceal Snapchat conversations from their parents. Meanwhile, character.ai is being sued by the mother of a 14 year-old boy in Florida who died by suicide after becoming emotionally attached to a companion bot that encouraged him to commit suicide.

In these cases, the companies in question responded by implementing safety measures after the fact, but how many children have to put their fingers in electrical sockets, injure themselves, take their own lives and so on before we say that those measures should be mandatory? That is all that the proposed code does. It asks that companies consider the ways in which their products may impact on children and, having considered them, take steps to mitigate known risk and put procedures in place to deal with emerging risks.

One of the frustrating things about being an advocate for children in the digital world is how much time I spend articulating avoidable harms. The sorts of solutions that come after the event, or suggestions that we ban children from products and services, take away from the fact that the vast majority of products and services could, with a little forethought, be places of education, entertainment and personal growth for children. However, children are by definition not fully mature, which puts them at risk. They chat with smart speakers, disclosing details that grown-ups might consider private. One study found that three to six year-olds believed that smart speakers have thoughts, feelings and social abilities and are more reliable than human beings when it came to answering fact-based questions.

I ask the Minister: should we ban children from the kitchen or living room in which the smart speaker lives, or demand, as we do of every other product and service, minimum standards of product safety based on the broad principle that we have a collective obligation to the safety and well-being of children? An AI code is not a stretch for the Bill. It is a bare minimum.

[Baroness Harding of Winscombe (Con)]

My Lords, I will speak very briefly, given the hour, just to reinforce three things that I have said as the wingman to the noble Baroness, Lady Kidron, many times, sadly, in this Chamber in child safety debates. The age-appropriate design code that we worked on together and which she championed a decade ago has driven real change. So we have evidence that setting in place codes of conduct that require technology companies to think in advance about the potential harms of their technologies genuinely drives change. That is point one.

Point two is that we all know that AI is a foundational technology which is already transforming the services that our children use. So we should be applying that same principle that was so hard fought 10 years ago for non-AI digital to this foundational technology. We know that, however well meaning, technology companies’ development stacks are always contended. They always have more good things that they think they can do to improve their products for their consumers, that will make them money, than they have the resources to do. However much money they have, they just are contended. That is the nature of technology businesses. This means that they never get to the safety-by-design issues unless they are required to. It was no different 150 or 200 years ago as electricity was rolling through the factories of the mill towns in the north of England. It required health and safety legislation. AI requires health and safety legislation. You start with codes of conduct and then you move forward, and I really do not think that we can wait.

[Lord Vallance of Balham (Lab)]

I thank the noble Lord, Lord Clement-Jones, for Amendment 33, and the noble Baroness, Lady Kidron, for Amendment 41, and for their thoughtful comments on AI and automated decision-making throughout this Bill’s passage.

The Government have carefully considered these issues and agree that there is a need for greater guidance. I am pleased to say that we are committing to use our powers under the Data Protection Act to require the ICO to produce a code of practice on AI and solely automated decision-making through secondary legislation. This code will support controllers in complying with their data protection obligations through practical guidance. I reiterate that the Government are committed to this work as an early priority, following the Bill receiving Royal Assent. The secondary legislation will have to be approved by both Houses of Parliament, which means it will be scrutinised by Peers and parliamentarians.

I can also reassure the noble Baroness that the code of practice will include guidance about protecting data subjects, including children. The new ICO duties set out in the Bill will ensure that where children’s interests are relevant to any activity the ICO is carrying out, it should consider the specific protection of children. This includes when preparing codes of practice, such as the one the Government are committing to in this area.

I understand that noble Lords will be keen to discuss the specific contents of the code. The ICO, as the independent data protection regulator, will have views as to the scope of the code and the topics it should cover. We should allow it time to develop those thoughts. The Government are also committed to engaging with noble Lords and other stakeholders after Royal Assent to make sure that we get this right. I hope noble Lords will agree that working closely together to prepare the secondary legislation to request this code is the right approach instead of pre-empting the exact scope.

The noble Lord, Lord Clement-Jones, mentioned edtech. I should add—I am getting into a habit now—that it is discussed in a future group.

[Baroness Kidron (CB)]

Before the Minister sits down, I welcome his words, which are absolutely what we want to hear. I understand that the ICO is an independent regulator, but it is often the case that the scope and some of Parliament’s concerns are delivered to it from this House—or, indeed, from the other place. I wonder whether we could find an opportunity to make sure that the ICO hears Parliament’s wish on the scope of the children’s code, at least. I am sure the noble Lord, Lord Clement-Jones, will say similar on his own behalf.

[Lord Vallance of Balham (Lab)]

It will be clear to the ICO from the amendments that have been tabled and my comments that there is an expectation that it should take into account the discussion we have had on this Bill.

Data (Use and Access) Bill [HL]

Baroness Kidron Excerpts

Report stage
Tuesday 21st January 2025 Lords Chamber

Moved by

[Baroness Kidron]

1: Clause 1, page 3, line 11, at end insert—
“(5A) In subsection (2), references to information includes inferred data.”Member's explanatory statement
This amendment ensures that when traders are required to provide information relating to goods, services and digital content supplied or provided to the customer that includes information that has been created using AI to build a profile about them.

[Baroness Kidron (CB)]

My Lords, last week the Government published the AI Opportunities Action Plan and confirmed that they have accepted or partially accepted all 50 of the recommendations from the report’s author, Matt Clifford. Reading the report, there can be no doubting Government’s commitment to making the UK a welcoming environment for AI companies. What is less clear is how creating the infrastructure and skills pool needed for AI companies to thrive will lead to economic and social benefits for UK citizens.

I am aware that the Government have already said that they will provide further details to flesh out the top-level commitments, including policy and legislative changes over the coming months. I reiterate the point made by many noble Lords in Committee that, if data is the ultimate fuel and infrastructure on which AI is built, why, given that we have a new Government, is the data Bill going through the House without all the strategic pieces in place? This is a Bill flying blind.

Amendment 1 is very modest and would ensure that information that traders were required to provide to customers on goods, services and digital content included information that had been created using AI to build a profile about them. This is necessary because the data that companies hold about us is already a combination of information proffered by us and information inferred, increasingly, by AI. This amendment would simply ensure that all customer data—our likes and dislikes, buying habits, product uses and so on—was disclosable, whether provided by us or a guesstimate by AI.

The Government’s recent statements have promised to “mainline AI into the veins” of the nation. If AI were a drug, its design and deployment would be subject to governance and oversight to ensure its safety and efficacy. Equally, they have said that they will “unleash” AI into our public services, communities and business. If the rhetoric also included commitments to understand and manage the well-established risks of AI, the public might feel more inclined to trust both AI and the Government.

The issue of how the data Bill fails to address AI— and how the AI Opportunities Action Plan, and the government response to it, fail to protect UK citizens, children, the creative industries and so on—will be a theme throughout Report. For now, I hope that the Government can find their way to agreeing that AI-generated content that forms part of a customer’s profile should be considered personal data for the purposes of defining business and customer data. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, this is clearly box-office material, as ever.

I support Amendment 1 tabled by the noble Baroness, Lady Kidron, on inferred data. Like her, I regret that we do not have this Bill flying in tandem with an AI Bill. As she said, data and AI go together, and we need to see the two together in context. However, inferred data has its own dangers: inaccuracy and what are called junk inferences; discrimination and unfair treatment; invasions of privacy; a lack of transparency; security risks; predatory targeting; and a loss of anonymity. These dangers highlight the need for strong data privacy protection for consumers in smart data schemes and more transparent data collection practices.

Noble Lords will remember that Cambridge Analytica dealt extensively with inferred data. That company used various data sources to create detailed psychological profiles of individuals going far beyond the information that users explicitly provided. I will not go into the complete history, but, frankly, we do not want to repeat that. Without safeguards, the development of AI technologies could lead to a lack of public trust, as the noble Baroness said, and indeed to a backlash against the use of AI, which could hinder the Government’s ambitions to make the UK an AI superpower. I do not like that kind of boosterish language—some of the Government’s statements perhaps could have been written by Boris Johnson—nevertheless the ambition to put the UK on the AI map, and to keep it there, is a worthy one. This kind of safeguard is therefore extremely important in that context.

[The Minister of State, Department for Science, Innovation and Technology (Lord Vallance of Balham) (Lab)]

I thank the noble Baroness, Lady Kidron, and the noble Viscount, Lord Camrose, for their proposed amendments and continued interest in Part 1 of this Bill. I hope I can reassure the noble Baroness that the definition of customer data is purposefully broad. It encompasses information relating to a customer or a trader and the Government consider that this would indeed include inferred data. The specific data to be disclosed under a smart data scheme will be determined in the context of that scheme and I reassure the noble Baroness that there will be appropriate consultation before a smart data scheme is introduced.

I turn to Amendment 5. Clause 13 provides statutory authority for the Secretary of State or the Treasury to give financial assistance to decision-makers, enforcers and others for the purpose of meeting any expense in the exercise of their functions in the smart data schemes. Existing and trusted bodies such as sector regulators will likely be in the lead of the delivery of new schemes. These bodies will act as decision-makers and enforcers. It is intended that smart data schemes will be self-financing through the fees and levies produced by Clauses 11 and 12. However, because of the nature of the bodies that are involved, it is deemed appropriate for there to be a statutory spending authority as a backstop provision if that is necessary. Any spending commitment of resources will, of course, be subject to the usual estimates process and to existing public sector spending controls and transparency requirements.

I hope that with this brief explanation of the types of bodies involved, and the other explanations, the noble Baroness will be content to withdraw Amendment 1 and that noble Lords will not press Amendment 5.

[Baroness Kidron (CB)]

I thank the Minister for his reassurance, particularly that we will have an opportunity for a consultation on exactly how the smart data scheme works. I look forward to such agreement throughout the afternoon. With that, I beg leave to withdraw my amendment.

Amendment 1 withdrawn.

--- Later in debate ---

Moved by

[Baroness Kidron]

2: Clause 2, page 4, line 1, after “to” insert “the customer's data rights or”
Member's explanatory statement
This amendment adds enacting data rights to the list of actions that the Secretary of State or the Treasury can enable an “authorised person” to take on behalf of customers. This would make it possible for customers to assign their data rights to a third party to activate on their behalf.

[Baroness Kidron (CB)]

My Lords, in moving Amendment 2 I will speak to Amendments 3, 4, 25, 42 and 43, all of which are in my name and that of the noble Lord, Lord Clement-Jones. The very detailed arguments for Amendments 25, 42 and 43 were made during the DPDI Bill and can be found at col. GC 89 of vol. 837 of Hansard, and the subsequent arguments for their inclusion in this Bill were made in Committee at col. GC 454. For that reason, I do not propose to make them in full again. I simply say that these amendments for data communities represent a more ambitious and optimistic view of the Bill that would empower citizens to use data law to benefit those with common interests. The example I gave last time was of gig workers assigning their data rights to an expert third party to see whether they were being fairly compensated. That is not something that any individual data subject can easily do alone.

The new Amendments 2, 3 and 4 demonstrate how the concept of data communities might work in relation to the Government’s smart data scheme. Amendment 2 would add enacting data rights to the list of actions that the Secretary of State or the Treasury can enable an authorised person to take on behalf of customers. Amendment 3 requires the Secretary of State or the Treasury to include data communities in the list of those who would be able to activate rights, including data rights on a customer’s behalf. Amendment 4 provides a definition of “data communities”.

Data communities are a process by which one data holder can assign their rights for a given purpose to a community of people who agree with that purpose. I share the Government’s desire to empower consumers and to promote innovation, and these amendments would do just that. Allowing the sharing of data rights of individuals, as opposed to specific categories of data, would strengthen the existing proposal and provide economic and social benefit to the UK and its citizens, rather than imagining that the third party is always a commercial entity.

In response to these amendments in Committee, the then Minister said two things. The first was that the UK GDPR does not prevent data subjects authorising third parties to exercise certain rights on their behalf. She also warmly said that something of this kind was being planned by government and invited me and other noble Lords to discuss this area further. I made it clear that I would like such a meeting, but it has only just been scheduled and is planned for next week, which clearly does not meet the needs of the House, since we are discussing this today. I would be grateful if the current Minister could undertake to bring something on this subject back at Third Reading if we are not reassured by what we hear at the meeting.

While the UK GDPR does not prevent data subjects authorising third parties to exercise certain rights on their behalf, in the example I gave the Minister in Committee it took many years and a bespoke agreement between the ICO and Uber for the 300-plus drivers to combine their data. Under equivalent GDPR provisions in European law, it required a Court of Appeal judgment in Norway before Uber conceded that it was entitled to the data on the drivers’ behalf. A right that cannot be activated without legal action and years of effort is not a right fully given; the UK GDPR is not sufficient in these circumstances.

I want to stress that these amendments are not simply about contesting wrongs. Introducing the concept of data communities would facilitate innovation and promote fairness, which is surely an aim of the legislation.

--- Later in debate ---

[Lord in Waiting/Government Whip (Lord Leong) (Lab)]

My Lords, I rise to speak to Amendments 2, 3, 4, 25, 42 and 43. I thank the noble Baroness, Lady Kidron, and the noble Lord, Lord Clement-Jones, for these amendments on data communities, which were previously tabled in Committee, and for the new clauses linking these with the Bill’s clauses on smart data.

As my noble friend Lady Jones noted in Committee, the Government support giving individuals greater agency over their data. The Government are strongly supportive of a robust regime of data subject rights and believe strongly in the opportunity presented by data for innovation and economic growth. UK GDPR does not prevent data subjects authorising third parties to exercise certain rights on their behalf. Stakeholders have, however, said that there may be barriers to this in practice.

I reassure noble Lords that the Government are actively exploring how we can support data intermediaries while maintaining the highest data protection standards. It is our intention to publish a call for evidence in the coming weeks on the activities of data intermediaries and the exercise of data subject rights by third parties. This will enable us to ensure that the policy settings on this topic are right.

In the context of smart data specifically, Part 1 of the Bill does not limit who the regulations may allow customers to authorise. Bearing in mind the IT and security-related requirements inherent in smart data schemes, provisions on who a customer may authorise are best determined in the context of a specific scheme, when the regulations are made following appropriate consultation. I hope to provide some additional reassurance that exercise of the smart data powers is subject to data protection legislation and does not displace data rights under that legislation.

There will be appropriate consultation, including with the Information Commissioner’s Office, before smart data schemes are introduced. This year, the Department for Business and Trade will be publishing a strategy on future uses of these powers.

While the smart data schemes and digital verification services are initial examples of government action to facilitate data portability and innovative uses of data, my noble friend Lady Jones previously offered a meeting with officials and the noble Baroness, Lady Kidron, to discuss these proposals, which I know my officials have arranged for next week—as the noble Baroness indicated earlier. I hope she is therefore content to withdraw her amendment.

[Baroness Kidron (CB)]

Before the Minister sits down, may I ask whether there is a definition of “customer” and whether that includes a user in the broader sense, or means worker or any citizen? Is it a customer relationship?

[Lord Leong (Lab)]

My understanding is that “customer” reflects an individual, but I am sure that the Minister will give a better explanation at the meeting with officials next week.

[Lord Leong (Lab)]

I thank the noble Lord for that request, and I am sure my officials would be willing to do that.

[Baroness Kidron (CB)]

My Lords, I do not intend to detain the House on this for very long, but I want to say that holding meetings after the discussion on Report is not adequate. “Certain rights” and “customer” are exactly the sort of terms that I am trying to address here. To the noble Viscount—and my noble friend—Lord Camrose, I say that it is not adequate, and we have an academic history going back a long way. I hope that the meeting next week is fruitful and that the Government’s enthusiasm for this benefits workers, citizens and customers. I beg leave to withdraw the amendment.

Amendment 2 withdrawn.

--- Later in debate ---

[Viscount Colville of Culross (CB)]

My Lords, I thank my noble friend Lady Kidron and the noble Viscount, Lord Camrose, for adding their signatures to my Amendment 14. I withdrew this amendment in Committee, but I am now asking the Minister to consider once again the definition of “scientific research” in the Bill. If he cannot satisfy me in his speech this evening, I will seek the opinion of the House.

I have been worried about the safeguards for defining scientific research since the Bill was published. This amendment will require that the research should be in “the public interest”, which I am sure most noble Lords will agree is a laudable aim and an important safeguard. This amendment has been looked at in the context of the Government’s recent announcements on turning this country into an AI superpower. I am very much a supporter of this endeavour, but across the country there are many people who are worried about the need to set up safeguards for their data. They fear data safety is threatened by this explosion of AI and its inexorable development by the big tech companies. This amendment will go some way to building public trust in the AI revolution.

The vision of Donald Trump surrounded at his inauguration yesterday by tech billionaires, most of whom have until recently been Democrats, puts the fear of God into me. I fear their companies are coming for our data. We have some of the best data in the world, and it needs to be safeguarded. The AI companies are spending billions of dollars developing their foundation models, and they are beholden to their shareholders to minimise the cost of developing these models.

Clause 67 gives a huge fillip to the scientific research community. It exempts research which falls within the definition of scientific research as laid out in the Bill from having to gain new consent from data subjects to reuse millions of points of data.

It costs time and money for the tech companies to get renewed consent from data holders before reusing their data. This is an issue we will discuss further when we debate amendments on scraping data from creatives without copyright licensing. It is clear from our debates in Committee that many noble Lords fear that AI companies will do what they can to avoid either getting consent or licensing data for use in scraping data. Defining their research as scientific will allow them to escape these constraints. I could not be a greater supporter of the wonderful scientific research that is carried out in this country, but I want the Bill to ensure that it really is scientific research and not AI development camouflaged as scientific research.

The line between product development and scientific research is often blurred. Many developers posit efforts to increase model capabilities, efficiency, or indeed the study of their risks, as scientific research. The balance has to be struck between allowing this country to become an AI superpower and exploiting its data subjects. I contend that this amendment will go far to allay public fears of the abuse and use of their data to further the profits and goals of huge AI companies, most of which are based in the United States.

Noble Lords have only to look at the outrage last year at Meta’s use of Instagram users’ data without their consent to train the datasets for its new Llama AI model to understand the levels of concern. There were complaints to regulators, and the ICO posted that Meta

“responded to our request to pause and review plans to use Facebook and Instagram user data to train generative AI”.

However, so far, there has been no official change to Meta’s privacy policy that would legally bind it to stop processing data without consent for the development of its AI technologies, and the ICO has not issued a binding order to stop Meta’s plans to scrape users’ data to train its AI systems. Meanwhile, Meta has resumed reusing subjects’ data without their consent.

I thank the Minister for meeting me and talking through Amendment 14. I understand his concerns that, at a public interest threshold, the definition of scientific research will create a heavy burden on researchers, but I think it is worth the risk in the name of safety. Some noble Lords are concerned about the difficulty of defining “public interest”. However, the ICO has very clear guidelines about what public interest consists of. It states that

“you should broadly interpret public interest in the research context to include any clear and positive public benefit likely to arise from that research”.

It continues:

“The public interest covers a wide range of values and principles about the public good, or what is in society’s best interests. In making the case that your research is in the public interest, it is not enough to point to your own private interests”.


The guidance even includes further examples of research in the public interest, such as

“the advancement of academic knowledge in a given field … the preservation of art, culture and knowledge for the enrichment of society … or … the provision of more efficient or more effective products and services for the public”.

This guidance is already being applied in the Bill to sensitive data and public health data. I contend that if these carefully thought-through guidelines are good enough for health data, they should be good enough for all scientific data.

This view is supported in the EU, where

“the special data protection regime for scientific research is understood to apply where … the research is carried out with the aim of growing society’s collective knowledge and wellbeing, as opposed to serving primarily one or several private interests.”

The Minister will tell the House that the data exempted to be used for scientific research is well protected—that it has both the lawfulness test, as set out in the UK GDPR, and a reasonableness test. I am concerned that the reasonableness test in this Bill references

“processing for the purposes of any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity”.

Normally, a reasonableness test requires an expert in the context of that research to decide whether it is reasonable to consider it scientific. However, in this Bill, “reasonable” just means that an ordinary person in the street can decide whether the research is reasonable to be considered scientific. This must be a broadening of the threshold of the definition.

It seems “reasonable” in the current climate to ask the Government to include a public interest test before giving the AI companies extensive scope to reuse our data, without getting renewed consent, on the pretext that the work is for scientific research. In the light of possible deregulation of the sector by the new regime in America, it is beholden on this country to ensure that our scientific research is dynamic, but safe. If the Government can bring this reassurance then for millions of people in this country they will increase trust in Britain’s AI revolution. I beg to move.

[Baroness Kidron (CB)]

My Lords, I support my noble friend Lord Colville. He has made an excellent argument, and I ask noble Lords on the Government Benches to think about it very carefully. If it is good enough for health data, it is good enough for the rest of science. In the interest of time, I will give an example of one of the issues, rather than repeat the excellent argument made by my noble friend.

In Committee, I asked the Government three times whether the cover of scientific research could be used, for example, to market-test ways to hack human responses to dopamine in order to keep children online. In the Minister’s letter, written during Committee, she could not say that the A/B testing of millions of children to make services more sticky—that is, more addictive—would not be considered scientific, but rather that the regulator, the ICO, could decide on a case-by-case basis. That is not good enough.

There is no greater argument for my noble friend Lord Colville’s amendment than the fact that the Government are unable to say if hacking children’s attention for commercial gain is scientific or not. We will come to children and child protection in the Bill in the next group, but it is alarming that the Government feel able to put in writing that this is an open question. That is not what Labour believed in opposition, and it is beyond disappointing that, now in government, Labour has forgotten what it then believed. I will be following my noble friend through the Lobby.

[Lord Clement-Jones (LD)]

My Lords, it is almost impossible to better the arguments put forward by the noble Viscount, Lord Colville, and the noble Baroness, Lady Kidron, so I am not even going to try.

The inclusion of a public interest requirement would ensure that the use of data for scientific research would serve a genuine societal benefit, rather than primarily benefiting private interests. This would help safeguard against the misuse of data for purely commercial purposes under the guise of research. The debate in Committee highlighted the need for further clarity and stronger safeguards in the Bill, to ensure that data for scientific research genuinely serves the public interest, particularly concerning the sensitive data of children. The call for a public interest requirement reflects the desire to ensure a balance between promoting research and innovation and upholding the rights and interests of data subjects. I very much hope that the House will support this amendment.

--- Later in debate ---

Moved by

[Baroness Kidron]

15: Clause 68, page 76, line 16, at end insert—
“(e) the data subject is not a child.”Member's explanatory statement
This amendment ensures the bill maintains the high level of legal protection for children’s data even when the protections offered to adults are lowered.

[Baroness Kidron (CB)]

My Lords, I rise to move Amendment 15 and to speak to Amendments 16, 20, 22, 27, 39, 45 and, briefly, government Amendment 40. Together, these amendments offer protections that children were afforded in the Data Protection Act 2018, which passed through this House, and they seek to fix some of the underperformance of the ICO in relation to children’s data.

Before we debate these amendments, it is perhaps worth the Government reflecting on the fact that survey after survey shows that the vast majority—indeed, almost all—of the UK population support stronger digital regulation in respect of children. In refusing to accept these amendments, or, indeed, in replacing them with their own amendments to the same effect, the Government are throwing away one of the successes of the UK Parliament with their newfound enthusiasm for tech with fewer safeguards.

I repeat my belief that lowering data protections for adults is a regressive step for all of us, but for children it is a tragedy that puts them at greater risk of harm—a harm that we in this House have a proud record of seeking to mitigate. The amendments in my name and variously in the names of the noble Lords, Lord Stevenson and Lord Clement-Jones, my noble friend Lord Russell and the noble Baroness, Lady Harding, are essential to preserving the UK’s commitment to child protection and privacy. As the House is well aware, there is cross-party support for child protection. While I will listen very carefully to the Minister, I too am prepared to test the opinion of the House if he has nothing to offer, and I will ask Labour colleagues to consider their responsibility to the nation’s children before they walk through the Lobby.

I will take the amendments out of numerical order, for the benefit of those who have not been following our proceedings. Amendment 22 creates a direct, unambiguous obligation on data processors and controllers to consider the central principles of the age-appropriate design code when processing children’s data. It acknowledges that children of different ages have different capacities and therefore may require different responses. Subsection (2) of the new clause it would insert addresses the concern expressed during the passage of the Bill and its predecessor that children should be shielded from the reduction in privacy protections that adults would experience under the Act when passed.

In the last few weeks, Meta has removed its moderators, and the once-lauded Twitter has become flooded with disinformation and abuse as a result of Elon Musk’s determined deregulation and support of untruth. We have seen the dial move on elections in Romania’s presidential election via TikTok, a rise in scams and the horror of sexually explicit deepfakes, which we will discuss in a later group.

Public trust in both tech and politics is catastrophically low. While we may disagree on the extent to which adults deserve privacy and protection, there are few in this House or the other place who do not believe it is a duty of government to protect children. Amendment 22 simply makes it a requirement that those who control and process children’s data are directly accountable for considering and prioritising their needs. Amendment 39 does the same job in relation to the ICO, highlighting the need to consider that high bar of privacy to which children are entitled, which should be a focus of the commissioner when exercising its regulatory functions, with a particular emphasis on their age and development stage.

Despite Dame Elizabeth Denham’s early success in drafting the age-appropriate design code, the ICO’s track record on enforcement is poor and the leadership has not championed children by robustly enforcing the ADC, or when faced with proposals that watered down child protections in this Bill and its predecessor. We will get to the question of the ICO next week, but I have been surprised by the amount of incoming mail dissatisfied with the regulator and calling on Parliament to demand more robust action. This amendment does exactly that in relation to children.

Government Amendment 40 would require the ICO, when exercising its functions, to consider the fact that children merit specific protections. I am grateful for and welcome this addition as far as it goes; but in light of the ICO’s disappointing track record, clearer and more robust guidance on its obligations is needed.

Moreover, the Government’s proposal is also insufficient because it creates a duty on the ICO only. It does nothing for the controllers and processors, as I have already set out in Amendment 22. It is essential that those who control and process children’s data are directly accountable for prioritising their needs. The consequences when they do not are visible in the anxiety, body dysmorphia and other developmental issues that children experience as a result of their time online.

The Government have usefully introduced an annual report of ICO activities and action. Amendment 45 simply requires them to report the action it has taken specifically in relation to children, as a separate item. Creating better reporting is one of the advances the Government have made; making it possible to see what the ICO has done in regard to children is little more than housekeeping.

This group also includes clause-specific amendments, which are more targeted than Amendment 22. Amendment 15 excludes children from the impact of the proposal to widen the definition of scientific research in Clause 68. Given that we have just discussed this, I may reconsider that amendment. However, Amendment 16 excludes children from the “recognised legitimate interest” provisions in Clause 70. This means that data controllers would still be required to consider and protect children, as currently required under the legitimate interest basis for processing their data.

Amendment 20 excludes children from the new provisions in Clause 71 on purpose limitation. Purpose limitation is at the heart of GDPR. If you ask for a particular purpose and consent to it, extending that purpose is problematic. Amendment 21 ensures that, for children at least, the status quo of data protection law stays the same: that is to say, their personal data can be used only for the purpose for which it was originally collected. If the controller wants to use it in a different way, it must go back to the child—or, if they are under 13, their parent—to ask for further permission.

Finally, Amendment 27 ensures that significant decisions that impact children cannot be made during automated processes unless they are in a child’s best interest. This is a reasonable check and balance on the proposals in Clause 80.

In full, these amendments uphold our collective responsibility to support, protect and make allowances for children as they journey from infancy to adulthood. I met with the Minister and the Bill team, and I thank them for their time. They rightly made the point that children should be participants in the digital world, and I should not seek to exempt them. I suggest to the House that it is the other way round: I will not seek to exempt children if the Government do not seek to put them at risk.

Our responsibility to children is woven into the fabric of our laws, our culture and our behaviour. It has taken two decades to begin to weave childhood into the digital environment, and I am asking the House to make sure we do not take a single retrograde step. The Government have a decision to make. They can choose to please the CEOs of Silicon Valley in the hope that capitulation on regulatory standards will get us a data centre or two; or they can prioritise the best interests of UK children and agree to these amendments, which put children’s needs first. I beg to move.

[Baroness Harding of Winscombe (Con)]

My Lords, I rise to support all the amendments in this group. I have added my name to Amendments 15, 22, 27 and 45. The only reason my name is not on the other amendments is that others got there before me. As is always the case in our debates on this topic, I do not need to repeat the arguments of the noble Baroness, Lady Kidron. I would just like to make a very high-level point.

--- Later in debate ---

[Lord Vallance of Balham (Lab)]

I will speak first to government Amendment 40, tabled in my name, concerning the ICO’s duty relating to children’s personal data. Before that, though, I thank the noble Lords, Lord Stevenson and Lord Russell, the noble Baroness, Lady Harding, and in particular the noble Baroness, Lady Kidron, for such considered debates on this incredibly important issue, both in today’s discussion in the House and in the meetings we have had together. Everyone here wants this to be effective and recognises that we must protect children.

The Government are firmly committed to maintaining high standards of protection for children, which is why they decided not to proceed with measures in the previous Data Protection and Digital Information Bill that would have reduced requirements for data protection impact assessments, prior consultation with the ICO and the designation of data protection officers. The ICO guidance is clear that organisations must complete an impact assessment in relation to any processing activity that uses children’s or other vulnerable people’s data for marketing purposes, profiling or other automated decision-making, or for offering online services directly to children.

The Government also expect organisations which provide online services likely to be accessed by children to continue to follow the standards on age-appropriate design set out in the children’s code. The noble Baroness, Lady Kidron, worked tirelessly to include those provisions in the Data Protection Act 2018 and the code continues to provide essential guidance for relevant online services on how to comply with the data protection principles in respect of children’s data. In addition to these existing provisions, Clause 90 already includes a requirement for the ICO to consider the rights and interests of children when carrying out its functions.

I appreciate the point that the noble Baroness made in Committee about the omission of the first 10 words of recital 38 from these provisions. As such, I am very happy to rectify this through government Amendment 40. The changes we are making to Clause 90 will require the Information Commissioner to consider, where relevant, when carrying out its regulatory functions the fact that children merit special protection with regard to their personal data. I hope noble Lords will support this government amendment.

Turning to Amendment 15 from the noble Baroness, Lady Kidron, which excludes children’s data from Clause 68, I reassure her that neither the protections for adults nor for children are being lowered. Clause 68 faithfully transposes the existing concept of giving consent to processing for an area of scientific research from the current recital. This must be freely given and be fully revokable at any point. While the research purpose initially identified may become more specific as the research progresses, this clause does not permit researchers to use the data for research that lies outside the original consent. As has been highlighted by the noble Viscount, Lord Camrose, excluding children from Clause 68 could have a detrimental effect on health research in children and could unfairly disadvantage them. This is already an area of research that is difficult and underrepresented.

I know that the noble Baroness, Lady Kidron, cares deeply about this but the fact is that if we start to make research in children more difficult—for example, if research on children with a particular type of cancer found something in those children that was relevant to another cancer, this would preclude the use of that data—that cannot be right for children. It is a risk to move and exempt children from this part of the Bill.

Amendment 16 would prevent data controllers from processing children’s data under the new recognised legitimate interests lawful ground. However, one of the main reasons this ground was introduced was to encourage organisations to process personal data speedily when there is a pressing need to do so for important purposes. This could be where there is a need to report a safeguarding concern or to prevent a crime being committed against a child. Excluding children’s data from the scope of the provision could therefore delay action being taken to protect some children—a point also made in the debate.

Amendment 20 aims to prohibit further processing of children’s personal data when it was collected under the consent lawful basis. The Government believe an individual’s consent should not be undermined, whether they are an adult or a child. This is why the Bill sets out that personal data should be used only for the purpose a person has consented to, apart from situations that are in the public interest and authorised by law or to comply with the UK GDPR principles. Safeguarding children or vulnerable individuals is one of these situations. There may be cases where a child’s data is processed under consent by a social media company and information provided by the child raises serious safeguarding concerns. The social media company must be able to further process the child’s data to make safeguarding referrals when necessary. It is also important to note that these public interest exceptions apply only when the controller cannot reasonably be expected to obtain consent.

I know the noble Baroness, Lady Kidron, hoped that the Government might also introduce amendments to require data controllers to apply a higher standard of protection to children’s data than to adults’. The Government have considered Amendment 22 carefully, but requiring all data controllers to identify whether any of the personal data they hold relates to children, and to apply a higher standard to it, would place disproportionate burdens on small businesses and other organisations that currently have no way of differentiating age groups.

Although we cannot pursue this amendment as drafted, my understanding of the very helpful conversations that I have had with the noble Baroness, Lady Kidron, is that she intended for this amendment to be aimed at online services directed at or likely to be accessed by children, not to every public body, business or third sector organisation that might process children’s data from time to time.

I reassure noble Lords that the Government are open to exploring a more targeted approach that focuses on those services that the noble Baroness is most concerned about. The age-appropriate design code already applies to such services and we are very open to exploring what further measures could be beneficial to strengthen protection for children’s data. This point was eloquently raised by the noble Baronesses, Lady Harding and Lady Kidron, and the noble Lord, Lord Stevenson, and is one that we would like to continue. Combined with the steps we are taking in relation to the new ICO duty, which will influence the support and guidance it provides for organisations, we believe this could drive better rates of compliance. I would be very pleased to work with all noble Lords who have spoken on this to try to get this into the right place.

I turn to Amendment 27, tabled by the noble Baroness, Lady Kidron. I agree with her on the importance of protecting children’s rights and interests when undertaking solely automated decision-making. However, we think this amendment, as currently drafted, would cause operational confusion as to when solely automated decision-making can be carried out. Compliance with the reformed Article 22 and the wider data protection legislation will ensure high standards of protection for adults and children alike, and that is what we should pursue.

I now turn to Amendment 39, which would replace the ICO’s children’s duty, and for which I again thank the noble Baroness, Lady Kidron, and the noble Lord, Lord Russell. As a public body, the ICO must adhere to the UK’s commitment to the UN Convention on the Rights of the Child, and we respectfully submit that it is unnecessary to add further wording of this nature to the ICO’s duty. We believe that government Amendment 40, coupled with the ICO’s principal objective to secure an appropriate level of protection, takes account of the fact that the needs of children might not always look the same.

Finally, to address Amendment 45, the Government believe that the Bill already delivers on this aim. While the new annual regulatory action report in Clause 101 will not break down the activity that relates to children, it does cover all the ICO’s regulatory activity, including that taken to uphold the rights of children. This will deliver greater transparency and accountability on the ICO’s actions. Furthermore, Clause 90 requires the ICO to set out in its annual report how it has complied with its statutory duties. This includes the new duty relating to children.

To conclude, I hope that the amendment we tabled today and the responses I have set out reassure noble Lords of our commitment to protect children’s data. I ask noble Lords to support the amendment tabled in my name, and hope that the noble Baroness, Lady Kidron, feels content to withdraw her own.

[Baroness Kidron (CB)]

Before the Minister sits down, I have some things to say about his words. I did not hear: “agree to bring forward a government amendment at Third Reading”. Those are the magic words that would help us get out of this situation. I have tried to suggest several times that the Government bring forward their own amendment at Third Reading, drafted in a manner that would satisfy the whole House, with the words of the noble Viscount, Lord Camrose, incorporated and the things that are fundamental.

I very much admire the Minister and enjoy seeing him in his place but I say to him that we have been round this a few times now and a lot of those amendments, while rather nerdy in their obsession, are based on lived experience of trying to hold the regulator and the companies to account for the law that we have already passed. I am seeking those magic words before the Minister sits down.

[Lord Vallance of Balham (Lab)]

I have likewise enjoyed working with the noble Baroness. As has been said several times, we are all working towards the same thing, which is to protect children. The age-appropriate design code has been a success in that regard. That is why we are open to exploring what further measures can be put in place in relation to the ICO duty, which can help influence and support the guidance to get that into the right place. That is what I would be more than happy to work on with the noble Baroness and others to make sure that we get it right.

--- Later in debate ---

[Lord Stevenson of Balmacara (Lab)]

This is a self-governing House.

[Baroness Kidron (CB)]

I thank the Minister for that very generous offer. I also thank the noble Lord, Lord Stevenson, for his incredible support. I note that, coming from the Government Benches, that is a very difficult thing to do, and I really appreciate it. On the basis that we are to have an amendment at Third Reading, whether written by me with government and opposition help or by the Government, that will address these fundamental concerns set out by noble Lords, I will not press this amendment today.

These are not small matters. The implementation of the age-appropriate design code depends on some of the things being resolved in the Bill. There is no equality of arms here. A child, whether five or 15, is no match for the billions of dollars spent hijacking their attention, their self-esteem and their body. We have to, in these moments as a House, choose David over Goliath. I thank the Minister and all the supporters in this House —the “Lords tech team”, as we have been called in the press. With that, I beg leave to withdraw the amendment.

Amendment 15 withdrawn.

King’s Speech (4th Day)

Baroness Kidron Excerpts

Monday 22nd July 2024 Lords Chamber

[Baroness Kidron (CB)]

I welcome the new Ministers and commend the noble Lord, Lord Vallance, on his maiden speech. Indeed, I wish the new Government well in their ambition for growth and their commitment to creativity in education, without which we squander both joy and one of our most valuable industries. I am encouraged by early statements about skills and innovation.

I will use my time to raise vital unfinished business that was abandoned as the snap election was called. In doing so, I declare my interests in the register, particularly as chair of 5Rights Foundation and adviser to the Oxford Institute for Ethics in AI. Top of the list was the measure to give coroners access to company data in cases where a child has died. We have campaigned long and hard for this and I am grateful to the Secretary of State, Peter Kyle, for committing to carry it forward in the data Bill. Can the Minister say when the Bill is anticipated and confirm that it will not undermine any existing protections for children’s data privacy?

Similarly promised and equally urgent is the new criminal offence of training, distributing or sharing digital files that create AI-generated child sexual abuse. The offence was agreed in principle with the Home Office and the irrefutable reasons for it are recorded in Hansard on 24 April at col. 588GC. Can the Minister please also commit to this measure?

Other agreed measures, all supported by the Labour Front Bench when in opposition, include data access for independent academic researchers. Access to data is an essential part of the innovation supply chain, and therefore the growth agenda.

There is a scandal brewing as the edtech sector oversells and underdelivers in our schools. The DfE had agreed to a review to establish criteria for efficacy, safety, security and privacy, so that children are as well protected inside the classroom as on the bus to school. A trusted edtech sector is yet to be developed anywhere in the world. It is a necessity and an opportunity.

The new Secretary of State has committed to strengthening the Online Safety Act. The children’s coalition has set out its concerns with Ofcom’s draft codes, which I will forward to Ministers. The gaps that it has identified are as mission-critical to the published codes as they will be to tackle violence against women and girls. It would mean a lot if the Secretary of State’s commitment made in the media to look again was repeated at the Dispatch Box today.

Finally on unfinished business, current UK law determines that computer information is always reliable, which is nonsense and has contributed to multiple injustices, most notably Horizon. The previous Lord Chancellor looked at how to rectify this. I was delighted to see the new Attorney-General introduced today. This must be a priority for him.

This is not an arbitrary list but part of a broader view that we need to live with and alongside technology to build a future that many cannot yet imagine and access, as the noble Lord, Lord Vallance, said. Technology will play an enormous part in our economy, but it is also fundamental to our security, self-worth, well-being, happiness, confidence in the future, and Britain’s place in the world, all of which are essential for growth.

Like the noble Lord, Lord Clement-Jones, I am concerned by the absence of a more comprehensive AI Bill, and I pray that the incoming Government have not already blinked in the face of tech lobbying. An AI Bill to establish minimum standards for the design and deployment of AI systems, manage risk, build necessary digital infrastructure and distribute the benefits more equitably is essential. As the noble Lord, Lord Clement-Jones, said, innovation should not be unconditional and regulation need not be the enemy of innovation.

Our response to digital transformation has been poor, largely due to a gap between the expertise of policymakers and those we seek to regulate. A permanent Joint Committee of both Houses on digital regulation is often asked for and could address this. In the meantime, I invite the Minister to meet the cross-party Peers informally referred to as the Lords tech team—of which the noble Baroness, Lady Jones of Whitchurch, was once part—to take forward the issues I have raised and work towards a model of innovation that serves the public as well as the Government’s growth agenda.

Data Protection and Digital Information Bill

Baroness Kidron Excerpts

Committee stage
Wednesday 24th April 2024 Grand Committee

[Viscount Younger of Leckie (Con)]

That is one of the questions that I can now answer. The power will allow this, in so far as it pertains to helping the Secretary of State establish whether the benefits are being paid properly, as with paragraph 1(2) of new Schedule 3B. Rules around living together are relevant only to some benefits. That is a very short answer, but I could expand on it.

[Baroness Kidron (CB)]

May I add to the very long letter? I have been sitting here worrying about this idea that one of the “signals” will be excess capital and then there are matching accounts. If the matching account has more capital—for example, the person who has a connected account is breaking the £16,000 or £6,000—does that signal trigger some sort of investigation?

[Viscount Younger of Leckie (Con)]

That is a very fair question, and I hope that I understand it correctly. I can say that the limit for the DWP is that it can gain only from what the third party produces. Whatever goes on behind the doors of the third party is for them and not us. Whether there is a related account and how best to operate is a matter for the bank to decide. We may therefore end up getting very limited information, in terms of the limits of our powers. I hope that helps, but I will add some more detail in the letter.

--- Later in debate ---

[The Parliamentary Under-Secretary of State, Department for Science, Innovation and Technology (Viscount Camrose) (Con)]

My Lords, having listened carefully to representations from across the House at Second Reading, I am introducing this amendment to address concerns about the data preservation powers established in the Bill. The amendment provides for coroners, and procurators fiscal in Scotland, to initiate the data preservation process when they decide it is necessary and appropriate to support their investigations into a child’s death, irrespective of the suspected cause of death.

This amendment demonstrates our commitment to ensuring that coroners and procurators fiscal can access the online data they may need to support their investigation into a child’s death. It is important to emphasise that coroners and procurators fiscal, as independent judges, have discretion about whether to trigger the data preservation process. We are grateful to the families, Peers and coroners whom we spoke to in developing these measures. In particular, I thank the noble Baroness, Lady Kidron, who is in her place. I beg to move.

[Baroness Kidron (CB)]

My Lords, it is an unusual pleasure to support the Minister and to say that this is a very welcome amendment to address a terrible error of judgment made when the Government first added the measure to the Bill in the other place and excluded data access for coroners in respect of children who died by means other than suicide. I shall not replay here the reasons why it was wrong, but I am extremely glad that the Government have put it right. I wish to take this opportunity to pay tribute to those past and present at 5Rights and the NSPCC for their support and to those journalists who understood why data access for coroners is a central plank of online safety.

I too recognise the role of the Bereaved Families for Online Safety. They bear the pain of losing a child and, as their testimony has repeatedly attested, not knowing the circumstances surrounding that death is a particularly cruel revictimisation for families, who never lose their grief but simply learn to live with it. We owe them a debt of gratitude for putting their grief to work for the benefit of other families and other children.

--- Later in debate ---

Moved by

[Baroness Kidron]

251: After Clause 142, insert the following new Clause—
“Evidence from computer records(1) In any proceedings, a statement containing information in a document produced by a computer is not to be admissible as evidence of any fact stated therein unless it is shown—(a) that there are no reasonable grounds for believing that the information contained in the statement is inaccurate because of improper use of the computer,(b) that at all material times the computer was operating properly, or if not, that any respect in which it was not operating properly or was out of operation was not such as to materially affect the production of the document or the accuracy of the information it contains, and(c) that any relevant conditions specified in rules of court under subsection (2) below are satisfied.(2) Provision may be made by rules of court requiring that in any proceedings where it is desired to give a statement in evidence by virtue of this section such information concerning the statement as may be required by the rules must be provided in such form and at such time as may be so required.”Member’s explanatory statement
This probing amendment reinstates the substantive provisions of section 69 of the Police and Criminal Evidence Act 1984. In light of the Post Office Horizon scandal, this would revoke the current assumption that the information provided by computers is always accurate.

[Baroness Kidron (CB)]

My Lords, Amendment 251 is also in the names of the noble Lords, Lord Arbuthnot and Lord Clement-Jones, and the noble Baroness, Lady Jones. I commend the noble Lord, Lord Arbuthnot, for his staunch support of the sub-postmasters over many years. I am grateful to him for adding his name to this amendment.

This amendment overturns a previous intervention in the law that has had and will continue to have far-reaching consequences if left in place: the notion that computer evidence should in law be presumed to be reliable. This error, made by the Government and the Law Commission at the turn of the century and reinforced by the courts over decades, has, as we now know, cost innocent people their reputations, their livelihoods and, in some cases, their lives.

Previously, Section 69 of the Police and Criminal Evidence Act 1984 required prosecutors in criminal cases relying on information from computers to confirm that the computer was operating correctly and could not have been tampered with before it submitted evidence. As the volume of evidence from computers increased, this requirement came to be viewed as burdensome.

In 1997, the Law Commission published a paper, Evidence in Criminal Proceedings: Hearsay and Related Topics, in which it concluded that Section 69

“fails to serve any useful purpose”.

As a result, it was repealed. The effect of this repeal was to create a common law presumption, in both criminal and civil proceedings, of the proper functioning of machines—that is to say, the computer is always right. In principle, there is a low threshold for rebutting this presumption but, in practice, as the Post Office prosecutions all too tragically show, a person challenging evidence derived from a computer will typically have no visibility of the system in question or the ways in which it could or did fail. As a result, they will not know what records of failures should be disclosed to them and might be asked for.

This situation was illustrated in the Post Office prosecution of sub-postmaster Mrs Seema Misra. Paul Marshall, Mrs Misra’s defence lawyer, describes how she was

“taunted by the prosecution for being unable to point to any … identifiable … problem”,

while they hid behind the presumption that the Horizon system was “reliable” under the law. On four occasions during her prosecution, Mrs Misra requested court order disclosure by the Post Office of Horizon error records. Three different judges dismissed her applications. Mrs Misra went to prison. She was eight weeks pregnant, and it was her son’s 10th birthday. On being sentenced, she collapsed.

The repeal of Section 69 of PACE 1984 reflects the Law Commission’s flawed belief that most computer errors were “down to the operator” or “apparent to the operator”, and that you could

“take as read that computer evidence is reliable unless a person can say otherwise”.

In the words of a colleague of mine from the University of Oxford, a professor of computing with a side consultancy specialising in finding bugs for global tech firms ahead of rollout, this assumption is “eye-wateringly mistaken”. He recently wrote to me and said:

“I have been asking fellow computer scientists for evidence that computers make mistakes, and have found that they are bewildered at the question since it is self-evident”.


There is an injustice in being told that a machine will always work as expected, and a further injustice in being told that the only way you can prove that it does not work is to ask by name for something that you do not know exists. That is to say, Mrs Misra did not have the magic word.

In discussions, the Government assert that the harm caused by Horizon was due to the egregious failures of corporate governance at the Post Office. That there has been a historic miscarriage of justice is beyond question, and the outcome is urgently awaited. But the actions of the Post Office were made possible in part because of a flaw in our legal and judicial processes. What happened at the Post Office is not an isolated incident but potentially the tip of an iceberg, where the safety of an unknown number of criminal convictions and civil judgments is called into question.

For example, the Educational Testing Service, an online test commissioned by the Home Office, wrongly determined that 97% of English language students were cheating, a determination that cost the students their right to stay in the UK and/or their ability to graduate, forfeiting thousands of pounds in student fees. The Guardian conducted interviews with dozens of the students, who described the painful consequences. One man was held in UK immigration detention centres for 11 months. Others described being forced into destitution, becoming homeless and reliant on food banks as they attempted to challenge the accusation. Others became depressed and suicidal when confronted with the wasted tuition fees and the difficulty of shaking off an allegation of dishonesty.

The widespread coverage of the Horizon scandal has made many victims of the Home Office scandal renew their efforts to clear their names and seek redress. In another case, at the Princess of Wales Hospital in 2012, nurses were wrongly accused of falsifying patient records because of discrepancies found with computer records. Some of the nurses were subjected to criminal prosecution, suffering years of legal action before the trial collapsed, when it emerged that a visit by an engineer to fix a bug had eradicated all the data that the nurses were accused of failing to gather. That vital piece of information could easily have been discovered and disclosed, if computer evidence was not automatically deemed to be reliable.

--- Later in debate ---

[Viscount Camrose (Con)]

It may have already done so, but I will certainly pass that on.

[Baroness Kidron (CB)]

I thank everyone who spoke and the Minister for the offer of a meeting alongside his colleagues from the MoJ. I believe he will have a very busy diary between Committee and Report, based on the number of meetings we have agreed to.

However, I want to be very clear here. We have all recognised that the story of the Post Office sub-postmasters makes this issue clear, but it is not about the sub-postmasters. I commend the Government for what they are doing. We await the inquiry with urgent interest, and I am sure I speak for everyone in wishing the sub-postmasters a fair settlement—that is not in question. What is in question is the fact that we do not have unlimited Lord Arbuthnots to be heroic about all the other things that are about to happen. I took it seriously when he said not one moment longer: it could be tomorrow.

--- Later in debate ---

Moved by

[Baroness Kidron]

291: After Clause 149, insert the following new Clause—
“Offence to use personal data or digital information to create digital models or files that facilitate the creation of AI or computer generated child sexual abuse material(1) A person commits an offence if they—(a) collect, scrape, possess, distribute or otherwise process personal data or digital information with the intention of using it, or attempting to use it, to create or train a digital model which enables the creation of AI or computer generated child sexual abuse material or priority illegal content; (b) use personal data or digital information to create, train or distribute or attempt to create, train or distribute a digital file or model that has been trained on child sexual abuse material or priority illegal content, or which enables the creation of artificial intelligence or computer generated child sexual abuse material or priority illegal content;(c) collate, or attempt to collate, digital files or models based on personal data or digital information that, when combined, enable the creation of AI or computer generated child sexual abuse material or priority illegal content;(d) possess, or attempt to possess, a digital file or model based on personal data or digital information with the intention of using it to produce or gain access to AI or computer generated child sexual abuse material or priority illegal content.(2) For the purposes of this section, “artificial intelligence or computer generated child sexual abuse material or primary priority illegal content” includes images, videos, audio including voice, chatbots, material generated by large language models, written text, computer file and avatars.(3) A person who commits an offence under subsection (1) is liable to the sentences set out in section 160 of the Criminal Justice Act 1988 and section 6 of the Protection of Children Act 1978 for the equivalent offences.(4) For the purposes of this section, “priority illegal content” is content that meets the definition of “priority illegal content” set out in section 59 of the Online Safety Act 2023.”Member’s explanatory statement
This amendment seeks to make the files trained on or trained to create “Child Sex Abuse Material” illegal.

[Baroness Kidron (CB)]

My Lords, I rise somewhat reluctantly to speak to Amendment 291 in my name. It could hardly be more important or necessary, but I am reluctant because I really think that the Minister, alongside his colleagues in DSIT and the Home Office, should have taken this issue up. I am quite taken aback that, despite my repeated efforts with both of those departments, they have not done so.

The purpose of the amendment is simple. It is already illegal in the UK to possess or distribute child sexual abuse material, including AI-generated or computer-generated child sexual abuse material. However, while the content is clearly covered by existing law, the mechanism that enables its creation—the files trained on or trained to create child sexual abuse material—is not. This amendment closes that gap.

Some time ago, I hosted an event at which members of OCCIT—the online child sexual exploitation and abuse covert intelligence team—gave a presentation to parliamentarians. For context, OCCIT is a law enforcement unit of the National Police Chiefs’ Council that uses covert police tactics to track down offender behaviour, with a view to identifying emerging risks in the form of new technologies, behaviours and environments. The presentation its officers gave concerned AI-generated abuse scenarios in virtual reality, and it was absolutely shattering for almost everyone who was present.

A few weeks later, the team contacted me and said that what it had showed then was already out of date. What it was now seeing was being supercharged by the ease with which criminals can train models that, when combined with general-purpose image-creation software, enable those with a sexual interest in children to generate CSAM images and videos at volume and—importantly—to order. Those building and distributing this software were operating with impunity, because current laws are insufficient to enable the police to take action against them.

In the scenarios that they are now facing, a picture of any child can be blended with existing child sexual abuse imagery, pornography or violent sexual scenarios. Images of several children can be honed into a fictitious child and used similarly or, as I will return to in a moment, a picture of an adult can be made to look younger and then used to create child sexual abuse. Among this catalogue of horrors are the made-to-order models trained using images of a child known to the perpetrator—a neighbour’s child or a family member—to create bespoke CSAM content. In short, the police were finding that the scale, sophistication and horror of violent child sexual abuse had hit a new level.

The laws that the police use to enforce against CSAM are Section 1 of the Protection of Children Act 1978 and Section 160 of the Criminal Justice Act 1988, both of which create offences in respect of indecent photographs or pseudophotographs of a child. AI content depicting child sexual abuse in the scenarios that I have just described is also illegal under the law, but creating and distributing the software models needed to generate them is not.

There are many services that allow anyone to take any public image and put it in a false situation. Although I have argued elsewhere that AI images should carry a mark of provenance, these services are not the subject of this amendment. This amendment is laser focused on criminalising AI models that are trained on or trained to create child sexual abuse material. They are specific, specialist and being traded with impunity. These models blend images of children—known children, stock photos, images scraped from social media or synthetic, fabricated AI depictions of children—with existing CSAM or pornography, and they allow paedophiles to generate bespoke CSAM scenarios.

--- Later in debate ---

[Viscount Camrose (Con)]

I thank the noble Baroness, Lady Kidron, for tabling Amendment 291, which would create several new criminal offences relating to the use of AI to collect, collate and distribute child abuse images or to possess such images after they have been created. Nobody can dispute the intention behind this amendment.

We recognise the importance of this area. We will continue to assess whether and what new offences are needed to further bolster the legislation relating to child sexual abuse and AI, as part of our wider ongoing review of how our laws need to adapt to AI risks and opportunities. We need to get the answers to these complex questions right, and we need to ensure that we are equipping law enforcement with the capabilities and the powers needed to combat child sexual abuse. Perhaps, when I meet the noble Baroness, Lady Kidron, on the previous group, we can also discuss this important matter.

However, for now, I reassure noble Lords that any child sex abuse material, whether AI generated or not, is already illegal in the UK, as has been said. The criminal law is comprehensive with regard to the production and distribution of this material. For example, it is already an offence to produce, store or share any material that contains or depicts child sexual abuse, regardless of whether the material depicts a real child or not. This prohibition includes AI-generated child sexual abuse material and other pseudo imagery that may have been AI or computer generated.

We are committed to bringing to justice offenders who deliberately misuse AI to generate child sexual abuse material. We demonstrated this as part of the road to the AI Safety Summit, where we secured agreement from NGO, industry and international partners to take action to tackle AI-enabled child sexual abuse. The strongest protections in the Online Safety Act are for children, and all companies in scope of the legislation will need to tackle child sexual abuse material as a priority. Applications that use artificial intelligence will not be exempt and must incorporate robust guard-rails and safety measures to ensure that AI models and technology cannot be manipulated for child sexual abuse purposes.

Furthermore, I reassure noble Lords that the offence of taking, making, distributing and possessing with a view to distribution any indecent photograph or pseudophotograph of a child under the age of 18 carries a maximum sentence of 10 years’ imprisonment. Possession alone of indecent photographs or pseudophotographs of children can carry a maximum sentence of up to five years’ imprisonment.

However, I am not able to accept the amendment, as the current drafting would capture legitimate AI models that have been deliberately misused by offenders without the knowledge or intent of their creators to produce child sexual abuse material. It would also inadvertently criminalise individual users who possess perfectly legal digital files with no criminal intent, due to the fact that they could, when combined, enable the creation of child sexual abuse material.

I therefore ask the noble Baroness to withdraw the amendment, while recognising the strength of feeling and the strong arguments made on this issue and reiterating my offer to meet with her to discuss this ahead of Report.

[Baroness Kidron (CB)]

I do not know how to express in parliamentary terms the depth of my disappointment, so I will leave that. Whoever helped the noble Viscount draft his response should be ashamed. We do not have a comprehensive system and the police do not have the capability; they came to me after months of trying to get the Home Office to act, so that is an untruth: the police do not have the capability.

I remind the noble Viscount that in previous debates his response on the bigger picture of AI has been to wait and see, but this is a here and now problem. As the noble Baroness, Lady Jones, set out, this would give purpose and reason—and here it is in front of us; we can act.