Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Lord Arbuthnot of Edrom and Lord Holmes of Richmond

Committee stage
Thursday 3rd September 2026 Grand Committee

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to support these amendments. I have signed all of them, although in doing so I almost got a serious case of electronic RSI. They have the great good fortune of being clear, precise and aligned with existing regulations in other jurisdictions. As my noble friend Lady Harding has already pointed out, many businesses will have operations in multiple jurisdictions. For something as significant as reporting, why would we not follow NIS2 in this respect?

The clarity of the amendments is their strength, even more so when compared with what is currently in the Bill in this respect. What we are trying to achieve from these changes is clear. The 24-hour initial reporting period makes sense: of course it does. As my noble friend Lady Harding pointed out, what one knows at that point is that something is happening and a report is made. In many ways, that is all that needs to be known and all that needs to be reported.

To have a situation as currently set out in the Bill, 24 then 72, means that in that period so much would need to be known to comply with the provisions set out in the Bill that it is just not realistic. This staged approach is both clear and precise. It enables what the purpose of the Bill is all about, which is to support the individual business or entity that is under attack. Crucially, as other noble Lords have said, it puts the power in the collective. As a consequence of one attack, the collective can benefit if there is a sense of commitment to this reporting schedule. That will come only if it is in this stage 4, as clearly set out by my noble friend Lady Harding.

If we want to enable businesses and other entities to really commit to this process—not just be dragged there by force of statute but have it as a means of business as usual, a real cultural change and a commitment to the positivity of this—it has to work for them. This staged process not only does that but, by aligning with NIS, stops this being yet another burden added to business: added unnecessarily and less effectively than what these amendments propose. I very much look forward to the Minister’s response.

[Lord Arbuthnot of Edrom (Con)]

My Lords, good can come out of bad events. The experience, as well as the speech, of my noble friend Lady Harding is one such good aspect. If it combines with bringing us into line with European practice, which so many businesses already have to follow, so much the better. I hope the Minister will be as sympathetic as she possibly can to my noble friend’s amendments.

Data (Use and Access) Bill [HL]

Debate between Lord Arbuthnot of Edrom and Lord Holmes of Richmond

Report stage
Tuesday 28th January 2025 Lords Chamber

[Lord Holmes of Richmond (Con)]

My Lords, in moving Amendment 47, I shall speak also to Amendment 48.

Here we are again: the Computer Misuse Act 1990 is another year older. It was put into statute at a time when technology looked nothing like it did 10 or 20 years ago, never mind today. I will give some brief facts. We have a fantastic cyber sector in our country, which adds so much to our economy and safety. The Computer Misuse Act constrains the sector from keeping us as safe as it might and constrains businesses in terms of their growth and what they could be adding today to our economy in terms of—yes—growth.

There is no reason for us to continue with the Computer Misuse Act when we have the solution in our hands, set out, I suggest, in Amendments 47 and 48. Our cyber- security professionals, often working way out of sight, for obvious reasons, do such important work and professionally, diligently, keep us safe and keep our country, assets and economy secure.

When the Minister responds, will he say, even sotto voce, that a Division on these amendments might help him in his discussions within the department to get some movement on this issue? We heard in previous debates how doing this would be premature and how the time was not now. Well, for a statute that came into being at the beginning of the 1990s, I suggest that it is high time that we made these amendments for individuals, for businesses, for our economy and for our society, in an extraordinarily uncertain world and at a time when I imagine that every Minister should be looking to every potential source of economic growth. I look forward to the debate and to the Minister’s response. I beg to move.

[Lord Arbuthnot of Edrom (Con)]

My Lords, in Committee, the noble Baroness the Minister said there was no consensus on the best way forward to amend the law to provide protection for ethical hackers trying to work against cybercrime. All I ask is that noble Lords should read the amendment, which says:

“It is a defence to a charge … to prove that … the person’s actions were necessary for the detection or prevention of crime or … the person’s actions were justified as being in the public interest”.


What on earth could be wrong with that? I support my noble friend Lord Holmes of Richmond.