Data Protection Bill [HL]

Baroness Kidron Excerpts

2nd reading (Hansard - continued): House of Lords
Tuesday 10th October 2017 Lords Chamber

[Baroness Kidron (CB)]

My Lords, many noble Lords will know that my particular interests, clearly stated on the register, are concerned with making the digital world fit for children and young people, and so the greater part of my comments concern that. However, I wanted to say at the outset that dealing with this Bill without having had the opportunity to scrutinise the GDPR or understand the ambition and scope of the Government’s digital charter, their internet safety strategy or even some of the details that we still await on the Digital Economy Act made my head hurt also.

I start with the age of consent. Like others, I am concerned that the age of 13 was a decision reached not on the advice of child development experts, child campaigners or parents. Perhaps most importantly of all, the decision lacks the voice of young people. They are key players in this: the early adopters of emerging technologies, the first to spot its problems and, so very often, the last to be consulted or, indeed, not consulted at all. Also, like others, I was bewildered when I saw Clause 187. Are Scottish children especially mature or are their southern counterparts universally less so? More importantly, it seems that we have to comply with the GDPR, except when we do not.

As the right reverend Prelate has outlined, the age of 13 is really an age of convenience. We have simply chosen to align UK standards with COPPA, a piece of US legislation that its own authors once described to me as a “terrible compromise”, and which dates from 2000, when the notion of every child carrying a smartphone with the processing power of “Apollo 11” and consulting it every few minutes, hundreds of times day and night, was not even in our imagination, let alone our reality.

Before considering whether 13 is the right age, we should understand what plans the Government have to require tech companies to make any provisions for those aged 13 to 17, or whether it is the considered opinion of the UK Government that in the digital environment a 13 year-old is a de facto adult. Will the Government require tech companies to publish data risk assessments setting out how children are likely to engage with their service at different ages and the steps they have taken to support them, including transparent reporting data? Are we to have minimum design standards in parts of the digital environment that children frequent, and that includes those places that they are not supposed to be? Will the ICO have powers to enforce against ISS providers which do not take steps to prevent very young children accessing services designed for people twice their age? My understanding is that age compliance will continue to be monitored and enforced by the ISS companies themselves.

As Ofcom pointed out, in 2016 in the UK, 21% of 10 year-olds, 43% of 11 year-olds and half of all 12 year-olds had a social media profile, in spite of COPPA. Are the Government planning to adequately resource and train all front-line workers with children, teachers, parents and children in a programme of digital literacy as the House of Lords Communications Committee called for, and in doing so inform all concerned—those 13 and under and those between the ages of 13 and 18—on the impact for young people of inhabiting what is increasingly a commercial environment? Until these questions are answered positively, the argument for a hard age of consent seems weak.

In contrast, in its current code of practice on processing personal data online, the ICO recommends a nuanced approach, advising would-be data collectors that:

“Assessing understanding, rather than merely determining age, is the key to ensuring that personal data about children is collected and used fairly”.


The current system places the obligation on the data controller to consider the context of the child user, and requires them to frame and direct the request appropriately. It underpins what we know about childhood: that it is a journey from dependence to autonomy, from infancy to maturity. Different ages require different privileges and levels of support.

If being GDPR compliant requires a hard age limit, how do we intend to verify the age of the child in any meaningful way without, perversely, collecting more data from children than we do from adults? Given that the age of consent is to vary from country to country—16 in the Netherlands, Germany and Hungary; 14 in Austria—data controllers will also need to know the location of a child so that the right rules can be applied. Arguably, that creates more risk for children, but definitely it will create more data.

In all of this we must acknowledge a child’s right to access the digital world knowledgeably, creatively and fearlessly. Excluding children is not the answer, but providing a digital environment fit for them to flourish in must be. There is not enough in this Bill to fundamentally realign young people’s relationship with tech companies when it comes to their data.

Much like the noble Lord, Lord Knight, my view is that we have got this all wrong. In the future, the user will be the owner of their own data, with our preferences attached to our individual online identity. Companies and services will sign up to our bespoke terms and conditions, which will encompass our interests and tolerances, rather than the other way round. If that sounds a little far-fetched, I refer noble Lords to the IEEE, where this proposal is laid out in considerable detail. For those who do not know the IEEE, it is the pre-eminent global organisation of the electrical engineering professions.

While this rather better option is not before us today, it must inform our understanding that the Bill is effectively supporting an uncomfortable status quo. Challenging the status quo means putting children first, for example by putting the code of practice promised in the Digital Economy Act on a statutory footing so that it is enforceable; by imposing minimum design standards where the end-user is likely or may be a child; by publishing guidance to the tech companies on privacy settings, tracking, GPS and so forth; by demanding that they meet the rights of young people in the digital environment; and by a much tougher, altogether more appropriate, regime for children’s data.

All that could and should be achieved by May, because it comes down to the small print and the culture of a few very powerful businesses for which our children are no match. The GDPR offers warm words on consumer rights, automated profiling and data minimisation, but with terms and conditions as long as “Hamlet”, it is disingenuous to believe that plain English or any number of tick boxes for informed or specific consent will materially protect young people from the real-life consequences of data harvesting, which are intrusive, especially when we have left the data poachers in charge of the rules of engagement.

We could do better—a lot better. I agree wholeheartedly with other noble Lords who are looking for structures and principles that will serve us into the future. Those principles should not only serve us in terms of other EU member states but be bold enough to give us a voice in Silicon Valley. In the meantime, the Government can and should enact the derogation under article 80(2) and in the case of complainants under the age of 18, it should not only be a right but a requirement. We cannot endorse a system where we create poster children on front-line battles with tech companies. We are told that this Bill is about data protection for individuals—a Bill that favours users over business and children over the bottom line. But the absence of Article 8 of the European Charter of Fundamental Rights is an inexcusable omission. The Bill in front of us is simply not robust enough to replace Article 8. I call on the Government to insert that crucial principle into UK legislation. It must be wrong for our post-Brexit legislation to be deliberately absent of underlying principles. It is simply not adequate.

I had a laundry list of issues to bring to Committee, but I think I will overlook them. During the debate, a couple of noble Lords asked whether it was possible to regulate the internet. We should acknowledge that the GDPR shows that it can be done, kicking and screaming. It is in itself a victory for a legislative body—the EU. My understanding is that it will set a new benchmark for data-processing standards and will be adopted worldwide to achieve a harmonised global framework. As imperfect as it is, it proves that regulating the digital environment, which is entirely man and woman-made and entirely privately owned, is not an impossibility but a battle of societal need versus corporate will.

As I said at the beginning, my central concern is children. A child is a child until they reach maturity, not until they reach for their smart phone. Until Mark Zuckerberg, Sergey Brin and Larry Page, Tim Cook, Jack Dorsey and the rest, with all their resources and creativity, proactively design a digital environment that encompasses the needs of children and refers to the concept of childhood, I am afraid that it falls to us to insist. The Bill as it stands, even in conjunction with the GDPR, is not insistent enough, which I hope as we follow its passage is something that we can address together.

EU Action Plan Against Migrant Smuggling (EUC Report)

Baroness Kidron Excerpts

Wednesday 15th June 2016 Lords Chamber

[Baroness Kidron (CB)]

Many noble Lords will recall the last weekend in May, when more than 700 refugees drowned in quick succession. It is in their memory that I wish to call on this Government to open up further safe and legal routes of migration as requested in this excellent report.

Desperate people do not make rational decisions. They take to unstable dinghies, put their families at risk and entrust their future to the hands of the unqualified, who may well have pure motives, or the unscrupulous, who do not. In either case, neither offers very good odds. The report we are debating expresses regret at the refusal of the UK Government to participate in EU relocation strategies, and it urges, both at UK and EU level, that more emphasis be put on establishing safe and legal routes of migration. Many noble Lords have called for community-based private sponsorship, medical evacuation, humanitarian visas, family reunion, academic scholarships and labour mobility schemes. Any one of these offers an orderly and controlled form of migration. Collectively they describe a minimum human response to desperate neighbours.

The arguments against such mechanisms were also captured in the report. It is suggested that the number of beneficiaries would be so few in relation to potential refugees that it is not worth it. There is a fear that these routes would expose us to terrorist threat, and that establishing such routes would act as a pull factor.

These are poor arguments. The fact that we can do little is a wholly inadequate reason for refusing to do what we can. In spite of intelligence from Europol, it is simply the case that people are coming in in this way, those intent on doing harm will do so by any means, and they do not need the sanction of formal status to do so. The bloodshed in Syria and the conflict in failed states within the Middle East and north Africa are driving millions to flee. They are not being pulled. They are being pushed. Even those in the relative security of refugee camps face decades in limbo, in circumstances that do not offer a life with prospects or dignity.

All this is not just about what is right for those fleeing. This is about what is right for us. This is the country that gave refuge to my parents, Michael and Nina, the children of Samuel, Ruchel, Soloman and Maternal, who themselves had been given serial refuge both as children and as adults—five countries in just three generations, three generations that survived and prospered, unlike so many of their friends and family because they were given repeatedly safe and legal routes of migration until my siblings and I were born in the safety and security of the United Kingdom.

The philosopher Peter Singer famously asks: “If you had just bought a beautiful pair of shoes and saw a child drowning in a shallow pond, would you save your shoes or save the child?”. Unanimously, people answer, “Save the child”. He goes on: “If there are others present, would you still save the child?”. Invariably, the answer is yes. People recognise that their obligations belong to them, irrespective of the obligations of others. Finally, he asks: “What if the child were far away, perhaps in another country, but it remains equally within your means to save them at no great danger to yourself?”. Virtually all agree that distance and nationality make no difference to one’s obligations.

Her Majesty’s Government talk of solving the problem “upstream”, yet upstream we have problems of great magnitude, poetically described by the right reverend Prelate—proxy wars, climate change, unequal distribution of global wealth, food scarcity, conflicts, failed states and terror. And we have no expectation that those problems will be resolved very soon. That leaves us, I am afraid, with Peter Singer’s challenge: do we let people drown because they are out of our sight?

The safe and legal routes proposed describe an achievable lifeline for a human being in desperate need. They undermine smugglers, give hope and choice in the intractable lives of those forcibly on the move, and allow us the privilege of not standing by, dehumanised by our inaction.

I had hoped to say the names of the dead, just as we do for those who perished in 9/11, 7/7 and Hillsborough, and just as we do for fallen soldiers or indeed Members of your Lordships’ House when they pass away—we name our dead to honour their memory—but in spite of considerable effort, no one could provide me with names. The final indignity of the desperate is that they are a number, not a name. But I can remind the House of three year-old Alan Kurdi, who washed up on a beach last year, and the outpouring of compassion that accompanied that young child’s death. It is in his name that I ask Her Majesty’s Government to reflect the long-standing values, compassion and leadership that my family benefited from and open up new, safe and legal routes to the UK and, in doing so, offer safety to the few—too few perhaps—but dignity to us all.

Data Retention and Investigatory Powers Bill

Baroness Kidron Excerpts

Thursday 17th July 2014 Lords Chamber

[Baroness Kidron (CB)]

My Lords, my name is also on this amendment. The question of public trust has been raised, and this amendment is an attempt to restore public trust. The Minister referred yesterday to the overwhelming support in the other place for this emergency legislation. Of course if one looks at the vote in terms of numbers alone he is completely correct. However, the most cursory glance through the past two days of Hansard reveals that even those who support this Bill have grave reservations about a system of warrants that very experienced legal colleagues are suggesting may prove unenforceable, and about whether this Bill has answered all the findings of the ECJ reservations over whether Clause 4 represents an extension of powers. Very importantly, there are also reservations about the level of understanding of the technology itself, and exactly what gathering “who, what, when and where” can mean for the individual. These reservations have been expressed in other places, such as the Constitution Committee and the Law Society, and among senior legal experts as well.

Like others, I absolutely accept that the noble Lord has done his utmost to reassure the House on all points. Even if he is completely correct that this indeed represents business as usual, there remains the outstanding case that this Bill is a response to the ECJ ruling hurried through in fear of an impending judgment in the domestic courts, and that it is sitting on top of RIPA legislation that is generally accepted as inadequate. This Bill has gone through the House so rapidly that it is impossible for it to incorporate effectively all the expertise and views that have been given.

It is not overwhelming support for the legislation that has resulted in there being only four amendments this morning. It was the lack of time to articulate and design useful and necessary clarifications without undermining the needs of the security and intelligence services, which, I say again, nobody present would wish to do. A sunset clause two and half years hence gives no comfort to those who suspect that this Bill came to the House deliberately without time to challenge it. December 2015 is a reasonable time for review, parliamentary scrutiny, public debate and collective agreement. Three days certainly were not. I commend the amendment to the House.

[Lord West of Spithead]

My Lords, the noble Lord, Lord Phillips, spoke to me before the debate to ask if I would be supporting this amendment, so I have thought about it in some depth, and the answer is that I cannot. I am very supportive of my noble friend Lord Rooker’s comments. What he said about that toxic word “snooper” is exactly what I said in my speech yesterday at Second Reading. It is a very bad and emotive term, for the reasons that I gave then. I support a number of the other things that my noble friend said as well.

Both Houses are clearly in accord that the maintenance of these powers is critical for the safety and security of our people. Removing this provision before something has replaced it is an absolute nonsense. Having been involved over a number of years in this sort of legislation and this sort of work, it is clear to me that, in reviewing something like RIPA, if we are to do it properly, there is no way that we can achieve something in place of this provision in such a short time, because it will be removed. As the noble Lord, Lord Carlile, mentioned, it will have gone before we could do it. Actually, it will be tight to achieve it even by December 2016. We need to do a proper review. We will need something like a new communications data Bill. We so nearly got one before political shenanigans stopped it happening, but we need to look at this and go into great detail in reviewing RIPA. All this has to be done. It is extremely dangerous to try to shorten these timescales. It would be a dreadful mistake to make it any earlier than December 2016.

Data Retention and Investigatory Powers Bill

Baroness Kidron Excerpts

Wednesday 16th July 2014 Lords Chamber

[Baroness Kidron (CB)]

My Lords, it is an honour to follow such a speech from the noble Lord, Lord Judd. I feel that I had better declare my involvement in iRights, a civil society initiative that seeks to establish five principles that would frame all interactions with children and young people under 18 when they use the internet and digital technologies.

There seem to be four aspects of the Bill that cause concern: the process by which it came to your Lordships’ House; whether it does or does not represent the status quo; whether the status quo is what we want to reproduce; and, given the uncertainty of the first three, whether the sunset clause is too far away.

Given how much has been said on the first point, I just want to share the dismay of others at the lack of both foresight and oversight. I understand that heading off opposition and consulting stakeholders are legitimate parts of the legislative process but, somewhat unusually, in considering this Bill it is worth us noting that nearly all the UK population uses the technologies that the Bill addresses. They, too, are stakeholders, and to deny them a proper understanding through the reporting of public debate that the parliamentary process provides is at the very best disrespectful and most probably a further blow to public confidence in the political establishment.

The question of security versus freedom and privacy will be central in a world in which web and digital technologies become the organisational technologies of our society. Rushing through emergency legislation that has been privately consulted upon by an elite group of parliamentarians and international companies does not send a reassuring message of transparency and accountability that such an important issue deserves.

We are repeatedly told that this Bill is not intended as an extension of powers but that it simply upholds the status quo, that Clause 1 restores the previous position on communications data retention, and that what had previously been assumed about the extraterritorial application of communications data acquisition and interception powers was now being properly put on the face of the Bill in Clause 4. This reassurance has been repeated in briefings, in the Explanatory Notes attached to the draft Bill, in the impact assessment, in the other place and today in this debate, but it is in this Chamber on multiple occasions, listening to the likes of my noble friend Lord Pannick, the noble Lord, Lord Lester, my noble and learned friend Lord Woolf and many others that I have experienced the powerful art of clarification.

The companies at which the extraterritorial reach of RIPA is established and aimed want clarification, by Ministers’ own admission. If they need clarification, it must mean that there is some doubt. If there is no longer doubt then there has, de facto, been an extension, the purposes and meaning of which have not adequately been tested by the British public nor by their Parliament.

My noble friend Lady Lane-Fox, in her debate that celebrated the 25th anniversary of the world wide web and again today, suggested that we as a nation and we as a Parliament had not properly responded to the revelations contained in the leaks orchestrated by Edward Snowden. In spite of what we now know and the Pulitzer prize-winning efforts of the Guardian and the Washington Post to make us care, we are rushing through a Bill without the opportunity to determine whether the status quo should be underlined and underscored or whether, in a world where communications are central to every aspect of our lives, we now need to think again.

I should like to make it clear that I have little appetite for a lawless and untended communications highway with no responsibilities to real-world outcomes. Like most others who reject this emergency legislation, I would actively support a more carefully considered Bill that sought to address some of the broader issues that have been raised today and some of the newer technologies on the horizon. However, imposing suspicionless blanket communications data retention on the entire population challenges the basic premise of a free society. For that reason, this policy has been struck down in constitutional courts across Europe and, for that reason too, we must have a regime that takes account of all possible consequences of data retention, as well as the absolutely legitimate needs of the police and security forces.

The European Court of Justice found that on 10 counts the 2009 regulations failed to deliver proportionate retention of data. It laid out specific criteria that needed to be met. We have been told by Ministers in briefings that the Bill in front of us answers some of those findings and that others are answered by existing UK legislation. In spite of reading many late briefings, I cannot fully comprehend in sufficient detail whether all 10 counts have been fully answered. I ask the Minister whether there is any danger that the Bill simply re-enacts the disproportionate retention that has already been found unlawful by the European Court of Justice—a point put much more eloquently and precisely by my noble and learned friend Lord Hope of Craighead.

It is disappointing that the Bill has come to your Lordships’ House in such unhappy haste and that its progress to becoming law does not serve to educate Members of both Houses about the issues at stake. Nor does it ignite a desperately needed public debate about who is gathering the data, what those data are, and when and how they are being gathered. It is desperately worrying that its development has taken place entirely in private. I find myself wondering whether the explanations given by Ministers for conceiving this Bill in private suggest that Her Majesty’s Government’s need for privacy is a little more equal than the need for privacy of the population as a whole.

Given the inevitable passing of the Bill without it being subject to the parliamentary journey that it deserves, your Lordships may wish to send a message to the citizens of the UK by inserting an earlier date for the sunset clause. It would be a date not designed to serve the needs of the election cycle but one that reflects the urgent need of the British people—indeed, it is an emergency—for their Parliament to understand, investigate and decide how we are going to balance their need for security against their need for privacy and liberty.