Media Bill (Sixth sitting)

Debate between Damian Collins and Stephanie Peacock

Committee stage
Tuesday 12th December 2023 Public Bill Committees

[Damian Collins]

That is why it was important that there is an exemption for media organisations from the regulatory powers that Ofcom will have through the Online Safety Act. The reason those exemptions were there was that newspapers already have liability for not only the copy printed, but the adverts they accept and run. The newspaper or magazine editor is legally liable for advertising as much as they are for the articles they commission. Those liabilities and that transparency just did not exist for a lot of online publications, and it could be difficult to see who was behind it.

The challenge with the Online Safety Act was to recognise that the platforms were acting as distributors and promoters of the content—even for a lot of the content that is spam-related or comes from misinformation networks and hostile foreign states. If companies like Facebook are actively promoting that content and highlighting its existence to its users, they should have a liability for it. Newspapers and magazines already had those liabilities because it was clear who was publishing them. In the Online Safety Act, to qualify for the media exemption, it has to be clear who they are, where they are based and who the editor is, and therefore the transparency, liability and risks exist already. They did not in the online world, where many of the publishers were hidden and used that anonymity to spread lies and disinformation.

With that, the onerous costs that lawfare brings to newspapers, and the hollowing out of their business model by the ad platforms that distribute their content for nothing, there is an urgent need to have some sort of compensation mechanism for news organisations, so that local newspapers, national newspapers and magazines get fair compensation for the free distribution of their content across the web. Those are the challenges we face now, and those were things that were never envisaged at the time of Leveson.

As the hon. Member for Aberdeen North has said many times in the debate, things move pretty fast between media Bills. This is another example of how things have moved fast again. This amendment to the law and removing section 40 from the statute books reflects the need for us to change the law to reflect the media world that exists today.

[Stephanie Peacock]

When Leveson produced his report over 10 years ago, he attempted to strike a careful balance between two important competing objectives: enforcing press standards and protecting the free press. As such, although the inquiry paved the way for the existence of an approved press regulator, it was decided that membership in such a regulator would be voluntary rather than mandatory for news publishers, with incentives put in place to encourage active take-up of membership. One of the major incentives to encourage membership was introduced in the form of section 40. Where papers had not signed up to an approved regulator, they would be vulnerable to paying their legal opponents’ costs where the judge considered it reasonable to do so, even if they were to win the wider case. If they were signed up to a recognised regulator, however, they would be protected from that.

Despite being introduced in the Crime and Courts Act 2013, section 40 has never been commenced and would be repealed by clause 50. We appreciate that section 40 is not a particularly well-drafted piece of legislation. Representatives from and of the press, including the NMA, have long argued that it is morally wrong to attempt to persuade them to sign up to external regulation on the basis that they would have to pay the legal fees of both sides, even when they had won the case. They say if the section was commenced, it would prove financially ruinous to them as on principle they would never sign up to such a regulator.

With over a decade passed, the media landscape has changed significantly since the Leveson report was published, as we have discussed. Almost every major press news outlet has introduced some form of regulation, whether individually or through the Independent Press Standards Organisation, which was not anticipated when the law was drafted. Publishers face significant new challenges that threaten the ability of the industry to carry out its vital work, from inflation and falls in advertising revenue to the rise of social media and the ability to share disinformation more easily online.

Amendment 41, tabled by the hon. Member for Aberdeen North, acknowledges what we will do when section 40 is repealed. It remains important that we have a press that is accountable for its reporting and meets the highest ethical and journalistic standards, but given the poor drafting of section 40 and the fundamental imbalance of costs, I believe that those questions are best answered outside the matter of repeal itself. On that basis, I will not stand in the way of this Bill as a result of the Government’s decision to repeal section 40.

Data Protection and Digital Information (No. 2) Bill (Sixth sitting)

Debate between Damian Collins and Stephanie Peacock

Committee stage
Thursday 18th May 2023 Public Bill Committees

[Stephanie Peacock]

The clause defines key terms in this part of the Bill, such as business data, customer data and data holder, as well as data regulations, customer and trader. These are key to the regulation-making powers on smart data in part 3, and I have no specific concerns to raise about them at this point.

I note the clarification made by the Minister in his amendment to the example given. As he outlined, that will ensure there is consistency in the definition and understanding of business data. It is good to see areas such as that being cleaned up so that the Bill can be interpreted as easily as possible, given its complexity to many. I am therefore happy to proceed with the Bill.

[Damian Collins (Folkestone and Hythe) (Con)]

I rise to ask the Minister a specific question about the use of smart data in this way. A lot of users will be giving away data a device level, rather than just accessing individual accounts. People are just going to a particular account they are signed into and making transactions, or doing whatever they are doing in that application, on a particular device, but there will be much more gathering of data at the device level. We know that many companies—certainly some of the bigger tech companies—use their apps to gather data not just about what their users do on their particular app, but across their whole device. One of the complaints of Facebook customers is that if they seek to remove their data from Facebook and get it back, the company’s policy is to give them back data only for things they have done while using its applications—Instagram, Facebook or whatever. It retains any device-level data that it has gathered, which could be quite significant, on the basis of privacy—it says that it does not know whether someone else was using the device, so it is not right to hand that data back. Companies are exploiting this anomaly to retain as much data as possible about things that people are doing across a whole range of apps, even when the customer has made a clear request for deletion.

I will be grateful if the Minister can say something about that. If he cannot do so now, will he write to me or say something in the future? When considering the way that these regulations work, particularly in the era of smart data when it will be far more likely that data is gathered across multiple applications, it should be clear what rights customers have to have all that data deleted if they request it.

Data Protection and Digital Information (No. 2) Bill (First sitting)

Debate between Damian Collins and Stephanie Peacock

Committee stage
Wednesday 10th May 2023 Public Bill Committees

[Stephanie Peacock]

That is useful. Thank you.

[Damian Collins]

Q Continuing with that theme, the Bill uses a broader definition of “recognised legitimate interests” for data controllers. How do you think the Bill will change the regime for businesses? What sort of things might they argue they should be able to do under the Bill that they cannot do now?

John Edwards: There is an argument that there is nothing under the Bill that they cannot do now, but it does respond to a perception that there is a lack of clarity and certainty about the scope of legitimate interests, and it is a legitimate activity of lawmakers to respond to such perceptions. The provision will allow doubt to be taken out of the economy in respect of aspects such as, “Is maintaining the security of my system a legitimate interest in using this data?” Uncertainty in law is very inefficient—it causes people to seek legal opinions and expend resources away from their primary activity—so the more uncertainty we can take out of the legislation, the greater the efficiency of the regulation. We have a role in that at the Information Commissioner’s Office and you as lawmakers have just as important a role.

Data Protection and Digital Information (No. 2) Bill (Second sitting)

Debate between Damian Collins and Stephanie Peacock

Committee stage
Wednesday 10th May 2023 Public Bill Committees

[Stephanie Peacock]

Q A final question: do you think that the definitions of “vexatious” and “excessive” are clear enough not to be abused by controllers who simply do not want to carry out subject access requests?

Alex Lawrence-Archer: The new definitions, particularly the list of factors to be taken into consideration in determining whether the test is met, provide a lot of breathing room for controllers, whether or not they have good intentions, to make arguments that they do not need to comply with the right of access. If you are looking not to comply or if you have an incentive not to, as many controllers do, that does not necessarily mean that you are acting in bad faith; you might just not want to hand over the data and think that you are entitled not to do so. If you are looking not to comply, you will look at the Act and see lots of hooks that you can hang arguments on. Ultimately, that will come back to individuals who are just trying to exercise their rights and who will be engaged in big arguments with big companies and their lawyers.

[Damian Collins]

Q The age-appropriate design code for children was mentioned in our session this morning. Do you have any thoughts on what the Bill could mean for the application of that design code, which was obviously prepared for an environment in which GDPR was enshrined in UK data law?

Alex Lawrence-Archer: The age-appropriate design code was a real success for the UK in terms of its regulation and its reputation internationally. It clarified the rights that children have in relation to the processing of their personal data. However, those rights are only helpful if you know what is happening to your personal data, and if and when you find out that you can exercise your rights in relation to that processing.

As I have said, what the Bill does—again, perhaps inadvertently—is undermine in a whole host of ways your ability to know what is happening with your personal data and to do something about it when you find out that things have gone wrong. It seems to me that on the back of a notable success in relation to the AADC, we are now, with this Bill, moving in rather a different direction in terms of that argument for protection of personal data.

Looking at the even longer term, there will be some slightly more nuanced changes if and when the AADC comes to be amended or redrafted, because of the role of the ICO and the factors that it has to take into account in its independence, which again you have already heard about. So you could, in the long term, see a new version of the AADC that is more business-friendly, potentially, because of this Bill.