Data (Use and Access) Bill [Lords]

Joe Robertson Excerpts

2nd reading
Wednesday 12th February 2025 Commons Chamber

[Sir John Whittingdale]

Although the hon. Gentleman and I had a robust but nevertheless amicable exchange on Report, it was in fact his colleague, the hon. Member for Barnsley South (Stephanie Peacock), who took that Bill through Committee. It was not until Report that the Conservative Government decided to add measures to the Bill—measures that I fully supported, of course, but which nevertheless made the task a little more difficult, as they resulted in a lack of agreement across the Chamber, which had previously pertained throughout the passage of the Bill. It is a pleasure to debate these matters again, and, indeed, to see not just the hon. Gentleman but some of the officials who laboured to take that Bill through Committee with me, and are now tasked with doing it all over again.

One point about the Bill that the Secretary of State did not refer to is that a lot of it seeks to improve the working of data protection law in this country and make data more accessible while safeguarding important privacy rights. However, the fact that we are able to make changes to improve our data protection laws is a consequence of Britain no longer being a member of the European Union—otherwise, we were trapped by the GDPR requirements. This is an example of where we can draft legislation to benefit people in this country and not have to accept top-down imposed legislation from Brussels—another reason why I was an enthusiastic supporter of the previous Bill.

One issue that featured a lot during the previous debate, and which I am slightly surprised has not been mentioned so far, is whether the changes made in the Bill would in any way jeopardise data adequacy recognition by the EU. [Interruption.] I am sorry; the hon. Member for Harpenden and Berkhamsted (Victoria Collins) did mention it, but the Secretary of State did not. Data adequacy is an important issue, and concern has been expressed outside the House that the Bill might put it at risk. We were very keen to ensure that that was not the case, and we worked closely—as I am sure the Minister continues to do—with the Information Commissioner, John Edwards, who has a lot of experience in this field, having previously overseen the data protection regime in New Zealand, which enjoys data adequacy but is not identical to GDPR. I am sure, given that this Bill is so similar, that there is no risk to data adequacy, which is of importance to many large firms.

The Bill covers a lot of other areas that we regarded as important and which have remained largely unchanged, such as the operation of the Information Commissioner’s Office, digital identification, the national underground asset register, the electronic use of the register of births and marriages, the extension of smart data use, automated decision making, and the retention of information where required by coroners after child deaths. All those areas were included in the previous Bill, and I am delighted that they are still there in this one.

[Joe Robertson (Isle of Wight East) (Con)]

If I may, I will take this opportunity to explore some of my right hon. Friend’s knowledge and expertise in this area. Will he comment on the balance in this Bill between safeguards on the one hand and freedom on the other? I would be interested in his thoughts.

[Sir John Whittingdale]

If my hon. Friend is referring to data protection, it is a careful balance. People are rightly concerned that their data is protected and that they should have privacy rights, and there are campaigning organisations out there that have examined the Bill and expressed concern. We were careful to ensure that the standards of data protection required were maintained, and I am sure this Government take the same view.

At the same time—this is where there are small differences between the previous Bill and this Government’s Bill—we were keen to ensure that data protection did not impose unnecessary burdens, particularly on small businesses. There were one or two areas where we were able to slightly relax the definitions and to reduce the burden on business, but this Government have taken a different view. They are relatively minor and relatively technical areas, but there are things such as the definition of “vexatious and excessive”, which was an issue that occupied a lot of discussion. The Government have now removed that and reverted to the previous definition, which we felt was unnecessarily burdensome. There is also the whole area of subject access requests that would occupy a huge amount of firms’ time in trying to respond to them. We felt there needed to be at least some safeguard to prevent those becoming, as we defined it, vexatious, so I regret the fact that the Government have not proceeded with that element.

However, those are relatively minor areas, and in large part the Bill is one that previously enjoyed cross-party consensus when it went through this Chamber in the last Parliament and that I suspect will continue to enjoy cross-party consensus as it moves into Committee in this Parliament. The Secretary of State is no longer with us, but I hasten to add that I am not volunteering to serve on the Public Bill Committee. Having previously endured many hours doing so, I do not particularly want to repeat that experience.

Perhaps in part because the Bill enjoys a lot of support across the House, there is inevitably a particular element about which there is real concern, and that is the area of copyright protection and artificial intelligence. It is worth saying that that was not originally in the Bill at all, and I congratulate Baroness Kidron, who managed to persuade the Clerks in the other place to allow her to move the amendments to insert it into the Bill, and it is now part of the Bill. I think those amendments are very important, and I very much welcome them.

The hon. Member for Bury North (Mr Frith) referred to the fact that the previous Government had not acted in this area, and he is right. The Conservatives did not act because we felt, and continue to feel, that the law on copyright is clear and does not need changing. This Government have proposed to change the law to bring in the text and data mining exception. That will create the opportunity for AI to take, scrape and ingest creative content, of the kind the hon. Member for Scarborough and Whitby mentioned, using an exception that the Government are bringing in. It was proposed under the last Government, but I can tell the House that the last Government rejected it precisely because we felt it would drive a coach and horses through copyright law and do real damage to the creative industries.

Data (Use and Access) Bill [ Lords ] (First sitting)

Joe Robertson Excerpts

Committee stage
Tuesday 4th March 2025 Public Bill Committees

[Dr Spencer]

What is the point of politics if we do not have a debate? We strongly disagree with the interpretation that the provisions are somehow incompatible with ECHR rights. They totally support people’s privacy rights under article 8 regarding proportionate disclosures. If somebody needs to have someone’s sex data, they need sex data. They do not need gender data. The provisions allow for it, and if somebody does not need sex data, they should not be collecting it in the first place.

[Joe Robertson (Isle of Wight East) (Con)]

It is an honour to serve under your chairmanship, Mr Turner.

Further to the comments made by my hon. Friend the Member for Runnymede and Weybridge, does the Minister at least accept that the Bill poses a risk of entrenching inaccurate data relating to sex through public bodies using DVS systems? Notwithstanding his views on the Lords amendments, could he address that point? What steps will the Government take to ensure the reliability of sex data to ensure protection, such as of women using female-only spaces? What will the Minister do to ensure that inaccurate data entrenched by the Bill will not pose a risk to people in those situations and others? I am thinking, of course, of services available in healthcare, but that is by no means the only example.

[Chris Bryant]

I need to make it absolutely clear, for a start, that the element of clause 45 that we are removing—subsection (6)—makes no reference to sex or gender at all. The words do not appear on the face of the Bill at all. Subsection (6) refers to accuracy and inaccuracy, but it says

“the public authority is able to attest that it…has been corrected through a lawfully made correction,”

and that is obviously aiming at a particular form of lawfully made correction.

Public authorities are already bound in law by data protection legislation—this goes to the point that the hon. Member for Isle of Wight East just made—to ensure that the personal data they process is accurate and, importantly, that it is accurate for the purpose for which it is being processed, and that it is kept up to date where necessary. In essence, what the noble Lords’ amendments to the Bill did was say that we should also be keeping, in every instance, a history of what the data had been. That, I think, is problematic.

The hon. Member is absolutely right about wanting to preserve women-only spaces, which is why public authorities are required to process information that is accurate for the purpose for which it is being processed. In the delivery of healthcare, for instance, when it comes to health screening for transgender and non-binary individuals, the Department of Health and Social Care has comprehensive guidance that sets out the NHS default adult screening programmes that are available in England and lays out who is invited. In England, it is up to GPs to ensure that, as part of processing gender change, the individual is correctly registered for relevant screenings in relation to their sex.

I simply do not buy this argument that we need to make this provision in relation to all digital verification services. Although it is of course right that, in the delivery of prison services or in the health service, or in so many other areas, simple common sense should apply in relation to female-only spaces and wanting to make sure that women are safe, I do not think that this Bill on digital verification services benefits from the introduction of a measure that would effectively mean that in the provision of every digital verification service—whether in regard to the provision of some sensitive service or not—you should make this provision. That is why we tabled amendments 10 and 11, and I urge all hon. Members to support them.

Data (Use and Access) Bill [ Lords ] (Third sitting)

Joe Robertson Excerpts

Committee stage
Tuesday 11th March 2025 Public Bill Committees

[Victoria Collins]

I start with the young people at the heart of this. We have indeed debated this time and again, and it is important that we keep that going. I have been on a Safe Screens tour, speaking to young people across Harpenden and Berkhamsted—from Ashlyns school in Berkhamsted to St George’s school in Harpenden, and beyond. Girl guides have spoken to me of their concerns about online bullying and harmful content. When I visited local schools on my Safe Screens tour, young men told me that social media has shown them extreme content that they do not want to see, and despite their efforts to block or ban it, the algorithm brings it back. Young women have told me of their worries about the growing misogyny in online content. Together, young women and men alike have talked about the impact on their body image, bullying and the amount of time sucked up by social media—time they want to spend doing other things.

There is mounting evidence of the negative effects of our children’s exposure to an unsafe online environment. Every day, we hear the concerns of parents, the anxieties of teachers and, crucially, the voices of young people themselves, all crying out for action to ensure their safety online and calling for stronger regulation of their online experience. I realise that the Online Safety Act is moving forward, but it will not go far enough.

This is a matter of profound importance for the wellbeing of our nation’s children and young people. The digital world is now the fabric of our lives and the lives of young people—it is where they learn, connect and seek entertainment—and yet, as the digital landscape expands, so do the risks they face. As 5Rights highlights,

“the enormous potential of technology can only be realised when it is designed with children in mind”.

Parliament now has an opportunity, perhaps even an obligation, to help shape that technology. It is disappointing that the safer phones Bill was watered down, so we have tabled new clause 21 as a crucial step to strengthen protections for young people in the digital age. It seeks to bring UK data law in line with many of our European neighbours, by raising the minimum age at which internet companies can collect, process and store a user’s data without explicit parental consent to 16.

New clause 21 is not about banning children under the age of 16 from accessing social media. It is important that the responsibility lies with the social media companies to ensure that online spaces are age-appropriate, and to manage content and features. This new clause is a targeted and proportionate measure to require online services to change fundamentally how they handle children’s data. This crucial change will necessitate restricting the pervasive and often harmful influence of algorithms to make the platforms inherently less addictive and ultimately foster a more child-friendly digital environment.

It is imperative that digital technology is designed with the best interests of our children and young people at heart, ensuring that their rights and privacy are upheld—not as an afterthought, but with safety by design and by default. Furthermore, new clause 21 underscores the fundamental principle that the responsibility for managing content and features must remain firmly with the social media companies. We call for the establishment of robust digital standards to ensure that platforms prioritise child safety and privacy as their default setting, rather than as an optional extra.

Our duty to protect children online, however, cannot end with new clause 21. We call on the Government to take further action, such as explicitly recognising and treating children’s use of social media as a critical public health issue, thoroughly examining international best practice, identifying innovative solutions to the challenges we face, and developing evidence-based policies that will demonstrably improve online safety for children. I welcome the Government’s proposal last week to introduce a cross-Government safer screens taskforce to look at research into the multifaceted impact of social media on children’s wellbeing.

This is not an overnight phenomenon. Last year marked 20 years since Facebook was created and 18 years since the smartphone was launched. We now face mounting calls from young people, parents and teachers. Now is the time for greater action on the gaps left by the Online Safety Act. I urge the Government to recognise the urgent need for decisive action and to support new clause 21. This is a pivotal opportunity to strengthen protections for young people online and to cultivate a digital world where they can thrive, not merely navigate potential harms. Let us work together across party lines to ensure a safer and brighter digital future for all our children.

[Joe Robertson (Isle of Wight East) (Con)]

It is a pleasure to speak under your chairship, Mr Turner.

I have some sympathy with what the hon. Lady is trying to do with new clause 21. I invite the Minister to address, as I am sure he will, her very specific point that it is not about restricting access to social media for people aged between 13 and 16, but about further restricting how social media is targeted at those age groups. After visiting schools in my constituency, I am minded to support her argument. At Ryde academy, I heard the reaction of young people to their school restricting access to their phones, which a school can only do during the school day.

I am interested to hear the Minister’s response to the quite reasonable proposition on how to restrict social media companies from targeting children aged 13 to 16. Restricting the way they collect their data sounds like a small, but meaningful, step that the Government could take.

[Chris Bryant]

I thought the debate might stray a little from the precise point my hon. Friend just made to into broader issues about young people’s use of smartphones and social media in general, and inevitably it has. This is a very live issue, of which the Government are painfully aware, as I tried to say in the debate last Friday. We are trying to work out the best way forward to a place where the rules that were implemented in the Online Safety Act, some of which only come into force in the spring—some have yet to get parliamentary approval; that will probably come in April—bed in properly and are adhered to before we take further action. That is simply because it is difficult to know otherwise whether the Online Safety Act has gone far enough. I wish that the Online Safety Act had been not the Online Safety Act 2023, but the Online Safety Act 2021 or 2019. Had it been, we might now be in a position to assess its effects.

In the debate on Friday I referred to the feasibility study commissioned by the Department for Science, Innovation and Technology from the University of Cambridge, which is working with other researchers. Work on that will finish in May, so I hope to have further information then. There is already a lot of guidance out there for parents, teachers and schools, but if we need to provide more informed guidance in the future, we will certainly look into that.

The precise targeting of young people by algorithms and so on is, at least theoretically, already dealt with by the Online Safety Act. That is why I do not think that new clause 21 is an appropriate measure to take forward at this time. Whether the age limit should be 13 or 16 was decided by the previous Government and agreed by Parliament after quite extensive consultation during the passage of the Data Protection Act 2018. All these matters have to be kept under review, and we are doing so in an urgent way, not least because a lot of Members are bringing up concerns raised by their constituents, families and so on.

I sometimes worry that the concentration solely on schools is to the detriment of the wider issues we are facing, not least because, as teachers readily admit, they only ever see children for about 20% of their time, and we need to set this in a wider context. I understand the motivation behind the new clause, but I will still resist it.

Question put and agreed to.

Clause 81 accordingly ordered to stand part of the Bill.

Clauses 82 to 85 ordered to stand part of the Bill.

Schedules 7 to 9 agreed to.

Clauses 86 to 88 ordered to stand part of the Bill.

Clause 89

Joint processing by intelligence services and competent authorities

Question proposed, That the clause stand part of the Bill.