Data (Use and Access) Bill [Lords]

Iain Duncan Smith Excerpts

Wednesday 7th May 2025 Commons Chamber

[Chris Bryant]

I model myself in all things on the right hon. Gentleman, apart from the fact that I left the Tory party many years ago, and it is about time that he came over to the Labour Benches.

[Sir Iain Duncan Smith (Chingford and Woodford Green) (Con)]

It is not too late.

[Chris Bryant]

No, the right hon. Member for Maldon (Sir John Whittingdale) could come over here; I am not going back over there.

The point I was going to make is that I am fully cognisant of my duties. I think the right hon. Gentleman was referring to the artificial intelligence copyright issues that we will be addressing fairly shortly. I like the fact that I am in both Departments, because it means I can bring the knowledge of both sectors to bear on each other. If we are lucky, and if we work hard at it, I hope that I will be able to persuade him that we can come to a win-win solution. As he knows, this is not easy. When I had my first meeting with him after I was appointed in the post, he said, “This is not an easy area to resolve.” I hope I am not breaking a confidence—but he is smiling.

I have a large number of topics to cover, and I am conscious that many Members will think this is the data Bill, when we will actually be dealing with an awful lot of subjects this afternoon that do not feel as if they have anything to do with the measures in the original version brought forward by the right hon. Gentleman and previously. I hope that Members will bear with me. I intend to address the Government’s amendments as follows: first, AI and copyright; secondly, deepfakes; thirdly, the national underground assets register; and then smart data and other minor and technical amendments.

I will start with AI and intellectual property. As Members know, it was never the Government’s intention to legislate on that issue at all in this Bill. It is a complex and important issue, which is why we have consulted on a package of measures. That consultation had more than 11,500 responses, which we are still considering. Several hon. Members have said to me, “Will you remove the opt-out clause in the Bill?” I need to make it absolutely clear that no such opt-out clause is in the Bill. We never laid one in the Bill, so there is not an opt-out clause to remove.

As Members will also know, the Lords inserted a set of amendments on AI and copyright, which we removed in Committee. They reappear on the amendment paper today as new clauses 2 to 6, tabled by the hon. Member for Harpenden and Berkhamsted (Victoria Collins). A similar measure has been tabled as new clause 14 by my hon. Friend the Member for Leeds Central and Headingley (Alex Sobel).

We oppose all these new clauses for several reasons. First, they pre-empt the results of the consultation. It must surely be better to legislate on this complex subject in the round rather than piecemeal. The amendments are also unworkable. New clause 5, for instance, would make the Information Commissioner the regulator of transparency requirements, but the Information Commissioner’s Office has neither the skills nor the resources to perform that function. Obviously, transparency requirements without an effective enforcement mechanism are worse than useless, which means the other clauses on transparency are also unworkable in this context. The new clauses also fail to address some of the most important questions in this area. They effectively legislate piecemeal rather than in the round. Whenever Parliament has done that in the past, it has rued the day, and I think the same is true today.

--- Later in debate ---

I do not intend to press my new clauses to a vote, but I hope the Government will bring forward changes that mandate the inclusion of Jewish and Sikh ethnicity categories for the purposes of public service delivery. I fully support the Bill’s mission to unlock the power of data to transform lives. That data must be fair. Sikhs and Jews must no longer be invisible to policymakers.

[Sir Iain Duncan Smith]

I rise to speak in support of amendment 10 tabled by the hon. Member for Leeds Central and Headingley (Alex Sobel), in my name and that of others. I congratulate him on the amendment, as it is worth talking about.

The amendment is quite simple, in a way, as its key point is that it prevents the transfer of UK user data to jurisdictions where data rights cannot be enforced and there is no credible right of redress. The core principle of data protection law is accountability, yet current UK law allows UK companies to transfer user data to their international partners in jurisdictions where there is no credible appeals process and no predictable rule of law. That basically puts power in the hands of those who have signed contracts containing standard data protection clauses. Those contracts create the illusion of protection, but in reality the data transfer is unsafe, either because the prospect of state interference is real or because the conditions for protection of data transfer simply are not present. We rely too much on the idea that, somehow, contract law in the UK will protect the data being transferred across to other countries, but this is about countries where such rules do not apply.

Transferring data to regimes such as China, for example, is not just a threat to UK citizens’ privacy but a national security risk. British citizens’ personal information, health records, financial details, biometrics, genomics or location data could be accessed under China’s national intelligence law, which compels organisations to co-operate with state intelligence work in secret. That is not speculation; it is the well-known and established law in China.

This is not only about China, but I use that country as a good example because it is a regular abuser of data. We have been unbelievably stupid across the board, in companies and so on, in assuming straightaway that the rules would apply to Chinese companies and they would enforce them. They cannot, because under the national intelligence law, they are told, “You will provide data as and when we require it from whatever source you have access to.”

The situation right now in Ireland is interesting. The Irish Data Protection Commission recently fined TikTok the not inconsiderable sum of €530 million and found that the company had illegally transferred data from users in the European economic area to China. The commission determined that Chinese law offers no essential equivalent to protection on GDPR due to state surveillance laws and the lack of judicial oversight.

That is not a lone example. I have written on a number of occasions about the stupidity of the contract law covering things such as pregnancy tests and covid tests, which were dominated by a Chinese company called BGI. It is the biggest genomics company in the world and it was allowed to hold about 15% of the data gathered for tests for use back in China. We now know that China is using that data, working with AI companies, to develop tests and to reference weaknesses in certain ethnic groups. We see what is already going on in Xinjiang, where a troublesome ethnic group is being deliberately targeted through genocide to get rid of it, but it is also looking at areas and weaknesses in Europe that may well in turn be usable. We have allowed it under this contract to have that data presuming that it would be protected. It is not protected at all; it has simply been transferred and is now being used for military purposes.

Those are just two examples, but it is interesting that Ireland has already taken action. Let us not forgot the Shanghai police database leak in 2022 in which the personal data of over 1 billion Chinese citizens, including criminal records and biometric details, was left openly accessible online for over a year without any enforcement action or Government accountability.

I congratulate the hon. Gentleman on tabling the amendment, because it goes to the heart of what it means to be a democracy that values the rule of law, privacy and the dignity of the individual. It rightly states that no third country can be considered adequate if it lacks credible means for judicial protection, administrative redress or statutory legal remedy. It aligns closely with the high threshold set by the Schrems II judgment, and it ensures that the standards do not fall below those we uphold, and are upheld among our friends in the European Union.

[David Davis]

My right hon. Friend makes a formidably important point. The amendment highlights one of the extraordinary weaknesses of the Bill, which is that it in effect reverses GDPR on a large number of citizen protections. To reiterate the point he gently made, that enormous fine will not stop TikTok, because it operates under legal compulsion. Even though it paid £450 million, it will continue to commit the criminal offence for which it has just been convicted.

[Sir Iain Duncan Smith]

I agree with my right hon. Friend: that is the peculiarity. The Minister knows only too well about the nature of what goes on in countries such as China. Chinese companies are frankly scared stiff of cutting across what their Government tell them they have to do, because what happens is quite brutal.

We have to figure out how we protect data from ill use by bad regimes. I use China as an example because it is simply the most powerful of those bad regimes, but many others do not observe data protection in the way that we would assume under contract law. For example, BGI’s harnessing of the data it has gleaned from covid tests, and its dominance in the pregnancy test market, is staggering. It has been officially allowed to take 15% of the data, but it has taken considerably more, and that is just one area.

Genomics is a huge and vital area right now, because it will dominate everything in our lives, and it populates AI with an ability to describe and recreate the whole essence of individuals, so this is not a casual or small matter. We talk about AI being used in the creative industries—I have a vested interest, because my son is in the creative industries and would support what has been said by many others about protecting them—but this area goes a whole quantum leap in advance of that. We may not even know in the future, from the nature of who they are, who we are talking to and what their vital statistics are.

This amendment is not about one country; it is about providing a yardstick against which all third countries should be measured. If we are to maintain the UK’s standing as a nation that upholds privacy, the rule of law, democracy and accountability, we must not allow data to be transferred to regimes that fundamentally do not share those values. It is high time that we did this, and I am glad to see the Minister nodding. I hope therefore that he might look again at the amendment. Out of old involvement in an organisation that he knows I am still part of, he might think to himself that maybe this is worth doing or finding some way through.

[Chris Bryant]

I do not resile from my views just because I have become a Minister, just as the right hon. Member did not when he became a Minister. He makes an important set of points. I do think, however, that they are already met by the changes in the schedule to article 45B, which is not an exhaustive list of things that the Secretary of State may consider. The points he refers to are certainly things that the Secretary of State could—and should, I would argue—consider.

[Sir Iain Duncan Smith]

I am grateful to the Minister, and I hope that that might find its way on to the face of the Bill with a little more description, but I understand that and I acknowledge that he does as well.