On a point of order, Mr Turner. I want to make a point about new clause 30, which I know was not selected for debate. Many will be familiar with the story of the constituent of my hon. Friend the Member for Cheltenham (Max Wilkinson), Ellen Roome, who lost her 14-year-old son Jools in 2022. Jools was a happy boy. He died in tragic circumstances. In her search for answers about the circumstances leading up to Jools’s death, Ellen has come up against outdated laws and social media giants taking an intransigent approach to sharing data that should naturally be hers as a bereaved parent. We are talking about things that, in the past, she would have been able to find out by looking through her child’s bedroom—things that might have been in wardrobes, stored under the bed or in scrawled notes. These days, those bits of data could be on multiple social media accounts, but parental access is denied.

That is the subject of new clause 30, tabled by my hon. Friend the Member for Cheltenham (Max Wilkinson), Ellen’s Member of Parliament. The change to the law would be known as Jools’ law, in his memory. It would give parents access rights to their deceased child’s data automatically, with certain safeguards to respect third parties, so that other grieving parents will never face the challenges and the huge legal costs that Ellen has had to endure. I know that this new clause has not been chosen for discussion, but I would welcome a meeting with the Minister and my hon. Friend the Member for Cheltenham to discuss the issue further.

Further to that point of order, Mr Turner. The reason new clause 30 has not been selected is not that anybody has wanted to rule it inadmissible; it is simply because we are cracking through the Bill at such a speed that, although it was anticipated we would still be sitting on Thursday, it seems likely we will finish today, and new clause 30 therefore cannot be reached today because of its late tabling.

I know that Ellen is in the room, and I am very happy to facilitate a meeting with her, which I think is still outstanding with the Department. We will make sure that happens before the Bill gets to Report stage. If the hon. Member for Cheltenham or other Members want to be present at that meeting, I will make sure that happens. This is not a slight of any kind; it is just an accident of fortune in terms of the tabling of amendments.

I am grateful to the hon. Lady and the Minister for their points of order.

Clause 117

The Information Commission

I beg to move amendment 21, in clause 117, page 149, line 11, at end insert—

“(5A) In Schedule 13, paragraph 1(1), at end insert—

‘(j) advise the Government on measures relating to data ownership, and individuals’ rights and freedoms, in the delivery of its Data Vision and Strategy.’”

This amendment amends the functions of the Information Commission to allow it to advise the Government in the delivery of a Data Vision and Strategy.

With this it will be convenient to discuss the following:

New clause 10—Data Vision and Strategy—

“Within six months of Royal Assent of this Act, the Secretary of State must publish a ‘Data Vision and Strategy’ which outlines—

(a) the Government’s data transformation priorities for the next five years; and

(b) steps the Government will take to ensure the digitisation of Government services.”

New clause 11—Departmental Board Appointments—

“(1) Within six months of the day on which this Act is passed—

(a) Government departments;

(b) NHS England; and

(c) NHS trusts

shall appoint to their departmental board or equivalent body at least one of the following—

(i) Chief Information Officer;

(ii) Chief Technology Officer;

(iii) Chief Digital Information Officer;

(iv) Service Transformation Leader; or

(v) equivalent postholder.

(2) The person or persons appointed as under subsection (1) shall provide an annual report on the progress of the department or body towards the Government’s Data Vision and Strategy.”

This new clause would require digital leaders to be represented at executive level within Government departments and other bodies.

New clause 16—Data use in Public Service Delivery Review—

“(1) The Secretary of State must, every 12 months, lay before Parliament a ‘Data use in Public Service Delivery Review’.

(2) The Data use in Public Service Delivery Review shall include, but is not limited to assessment of the steps being taken to—

(a) improve the Government’s use of data in public service delivery over the previous 12 months;

(b) expand the use of data to support increased and improved digital services in public service delivery;

(c) improve expertise and digital talent within Government departments to help expand the use of data for public service delivery; and

(d) facilitate and regulate for better use of data in the delivery of public services.”

This new clause would require an annual assessment by the Secretary of State to examine the steps being taken to facilitate and regulate the use of data in the delivery of public services using digital and online technologies.

New clause 10 requires the Government to bring forward a data vision and strategy within six months of the passing of the Bill, and amendment 21 would add a new function to the Information Commission to allow it to support the Government in the drafting and delivery of that data vision and strategy. New clause 11 seeks to ensure that all departmental boards and NHS bodies have senior staff with data and technology expertise at the highest level. Finally, new clause 16 would require the Government to publish annual reviews of the use of data in the delivery of public services, including updates on the progression of a number of key goals.

I turn first to new clause 10. In previous speeches in the House, I have tried my best to emphasise the transformative power of data in our era. It can be seen as similar to the discovery of fire, gold or oil, such is its value and ability to totally reshape how we approach the world. I think the most accurate comparison is with Edison’s harnessing of the power of electricity. I invite you, Mr Turner, and the Committee to imagine that Government is like a 19th-century factory. Prior to electricity generation, a factory had to be organised around a single power source—usually a steam engine—with every machine that needed power connecting directly to the central driveshaft above. Components could be made but then had to be transported elsewhere to be assembled, usually by hand. By harnessing electricity, it was possible to pipe power anywhere on the factory floor. That meant the machines could be placed wherever they were needed, becoming more precise, more efficient and more specialised, and it led to mass manufacturing of the product as the central organising principle of industry.

What does this have to do with modern government? The data revolution that has been under way since the 1990s means that the structures and organisation of government can themselves be transformed in the same way that industry was in the 1890s. We can use data to shift from archaic practices and government functions, some of which occasionally feel like they might still run on steam power, and shift towards public services that make the citizen experience their central organising principle. With the true free flow of data through government, we can bring services to people, make them easier and more efficient to use and radically improve how people interact with government. However, to do any of that, the Government need to develop key principles to enable them to seize that opportunity. Creating a data vision will show what the future could be for data use across government, setting out where we want to get to, how we want services to run and what the ideal citizen experience will be. From that vision, which I hope would be ambitious and wide-ranging, the Government could design a strategy to deliver on it, outlining how they are going to seize data’s transformative power to improve the state’s workings and ultimately deliver a better experience for all our constituents when they come into contact with government or the state.

A national data strategy was, in fact, published under the last Government. It was consulted on during 2019 and published in 2020. It is clear that the world is very different from the world in 2019. The pandemic made Government rapidly re-evaluate and improve their relationship with available data to handle a national emergency and there are lessons to be learned from that. It also forced a change in many people’s habits and expectations. We are prepared to act far more digitally now, but also expect that businesses and corporations and Government will be more adept in the experiences they provide for us. Although much of what was in the last data strategy was on the right track, I am sure that, with a new world, this new Government would want to make their own mark and fully harness the data revolution.

A comprehensive data vision and strategy also empowers the Government when they need to move quickly, to adapt and react to the ever-changing technological landscape. When we need swiftly to harness new technologies or developments, we risk missing out and needlessly delaying, if we drive ourselves back to the legislation table each time. Although I am greatly enjoying the Bill Committee, if we go through a full set of legislative processes every time we want to use the latest innovation, we will move far too slowly. An overarching vision gives confidence to the Government in how to react to new developments by assessing how they can match up with the long-term strategic goals that they want to achieve.

Our slow adoption of the power of data has allowed many other countries to be leaps and bounds ahead of us, despite not having the resources, the expertise or the talent that our country has heaps of. Let us make sure that, for the next step of digital transformation, people look to us as leaders and trailblazers.

I hope that the Government will take inspiration for the data vision and strategy from the last 25 years in Estonia. As I told the House on Second Reading. Estonia has made the astonishing transformation from a poor post-Soviet state to a leader in digital government and data leadership. Its national drive to improve digital literacy and access, along with pulling their public services into the digital age, is an example that many other nations, including ours, should seek to follow. It has made 100% of public services available digitally, developed the fantastic X-Road data-sharing platform and delivered millions of euros in efficiency savings. It is a completely realistic goal to make the UK a digital leader in digital government and data efficiency, just like Estonia. That is the goal that I would write in the Government’s data vision. I hope that the Minister, if he were authoring it, would be just as ambitious.

I also think the Government could take lessons from Denmark, which has come top of the UN’s e-government rankings. It has embedded core principles of digital inclusion into its data and digital transformation journey. Those principles include being aware of the consequences of digitisation, providing usable alternatives and designing solutions for all citizens. This quote from its “Principles for Digital Inclusion” publication is particularly pertinent:

“It is a democratic problem if the digital transformation becomes a barrier to participating in the welfare society.”

The Minister and I have spoken about and shared concerns about digital exclusion. It is something that our constituencies and constituents both have in common. I hope he would be as keen as me to see that inclusion principle made a key tenet of the future of digital governance and data use.

Amendment 21 also ensures that, in drafting and delivering the strategy, the Government can rely upon the expertise of the Information Commissioner. The rights and freedoms of citizens and their data ownership must be core to a future data vision and strategy. The amendment enshrines the ability of the Information Commissioner to act as a source of advice and guidance in bringing that forward. The Government and Departments will need to be ready to implement the data vision and strategy, and the radical transformation that it will require.

I have therefore tabled new clauses 11 and 16. New clause 11 would require the NHS and Government to ensure the appointment of someone with a senior data, information or technology role to their boards. A helpful inspiration in the drafting of the new clause was the Government’s own “State of digital government review”, published only a couple of months ago. It is nothing short of excoriating in its assessment of the state of digital government, as well as the Government’s digital talent and culture. The review states that

“non-digital public sector leaders with sizable delivery responsibilities have insufficient technical expertise or training”,

and that

“Digital leadership is not a consistent priority.”

My new clause 11 would ensure that a chief digital and information officer, a chief information officer, a chief technology officer or a service transformation lead is present on the boards of all Departments. As it stands, none of those roles is present on the executive committee at any of the following Departments: Business and Trade; Housing, Communities and Local Government; Health and Social Care; Education; the Home Office; the Cabinet Office; NHS England; and the Treasury. I could keep going, but I think everyone gets the point.

That is in the Government’s own review, published by the Minister’s Department, and I am using it to draw attention to the problem. It criticises the problem that new clause 11 seeks to remedy. I invite the Minister to accept the new clause to fix something that his own Department has highlighted and that I would not have known about without its helpful review. I do not blame him one bit, of course, because his party inherited this situation from the Conservatives, who were guilty of failing for almost a decade to address the problem, but I hope that he can put it right by accepting new clause 11.

Turning back to the review by the Minister’s Department, it also states that 47% of central Government services and 45% of NHS services still lack a digital pathway. The report says:

“The UK is under digitised”,

and I wholly agree. I hope that new clause 16 could take steps to fix that. I would look forward to the Secretary of State coming to Parliament with his review each year to tell us about the great leaps that the Government are making towards improved data use in public service delivery and improving their digital talent and culture.

If the Government are serious about pushing forward digital transformation with the power of data, new clause 16 provides them with an annual victory lap. If things are falling behind, if the problems that the “State of digital government review” identified are not being rectified, this measure would ensure that they can be scrutinised and held to account. We cannot let the Government fall again into the state that their review found them to be in. I hope that my new clauses could fire the starting gun for a Government that is ambitious and innovative about their data use and digitisation in future.

The Minister heard me make many of the same arguments on Second Reading. I was pleased with the warmth of his reception then, as well as the broad understanding of his Department that we need to do more and do it better. I hope that he can provide me with some commitments today on the issues that I have raised, for the benefit of the citizen’s experience and of everyone we represent. I will end by quoting from the conclusion of his Department’s review—I am grateful to the Government for publishing those findings—which sums up the points I have made excellently:

“Digital is one of the most powerful forces for public service reform, and when it is successful, it changes lives and the public experience of government…However, our approaches to leadership, structure, measurement, talent and funding do not yet do justice to this potential: it is time to transform and reform the way we do digital.”

I note that before the break we had the Sugababes, and that now we have “The Tempest”—I think the hon. Gentleman managed to get in a very brief quote, or I guess his version of it: O brave new world that has such data in it.

The hon. Gentleman excoriates the Government for moving too slowly and for not taking enough powers to be able to move faster, and yet several of the amendments that the Liberal Democrats have tabled have been ones that insist that we should have more accountability to Parliament and a slower process, and should not have such regulation-making powers. It is often difficult to decide between those two because we want enough parliamentary scrutiny, but in an area of rapid technological change it is important that legislation is able to move fast enough to adapt. The hon. Gentleman rightly refers to digital inclusion as a key aspect of the Bill. If we are going to take forward a digital nation and a digital Government plan, we have to factor in the fact that some people will simply not be able to take part unless we take radical action to include them digitally.

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Question proposed, That the clause stand part of the Bill.

With this it will be convenient to discuss the following:

Amendment 52, in schedule 14, page 242, line 33, at end insert—

“(1A) The appointment of the Chair of the Information Commission must be subject to approval by a resolution of each House of Parliament.”

This amendment seeks to strengthen the regulator’s independence by subjecting key appointments to Parliamentary approval.

Schedule 14.

Clauses 118 to 120 stand part.

I rise to speak to clause 117, the first clause in part 6, on reforming the information commission. Part 6 sets out provisions to abolish the Information Commissioner’s Office and transfer its functions to a new body, the information commission, with a chief executive and board of directors. His Majesty’s Opposition welcome the fact that the Government are substantially taking forward some measures on reform of the ICO envisaged in previous iterations of this Bill, including the previous Government’s Data Protection and Digital Information Bill. Indeed, the ICO has said that the changes under the Bill will bring its governance structure into line with that of comparable regulators. Given some of the challenges and opportunities that our data-driven economy will present, the new information commission must be set up in the right way to perform its regulatory functions as effectively as possible.

There is no doubt that the scope of the information commission’s role will grow, commensurate with the changes brought in by the Bill—for example, the obligation to have regard, in the performance of its role, to factors such as promoting innovation and competition. We are supportive of those aims, but it would be helpful if the Minister could briefly address some of the concerns raised by my noble Friend Lord Holmes of Richmond in the other place, particularly the Minister’s strategy for ensuring that the information commission is provided with clarity as to its responsibilities and obligations when it comes to economic growth, and how he will ensure that that remains consistent with the information commission’s primary functions relating to data protection.

I will speak only briefly about amendment 52, but I would like to think that after all the Liberal Democrat interventions today, no one will have any doubt that we take data very seriously. I realise that we have outlined a lot of proposals, but they are all in the spirit of helping to shape the data vision and of saying how important we feel it is. Amendment 52 is about the questioning of scrutiny. I am happy not to press the amendment, but again it is important to make sure we have trust in line with innovation.

The Government are, of course, committed to the independence of the ICO. As the hon. Member for Runnymede and Weybridge said, the recommendations about changing the structure were entirely ones that were advanced in the previous version of the Bill and supported by the previous Government. We think that it will just make it more efficient, more effective and more transparent.

As I have said, we are committed to the ICO’s independence; it is a vital part of its role. That is why the new role of the chair of the information commission will be appointed by His Majesty, by letters patent— the same approach taken for the current Information Commissioner role. Furthermore, the Secretary of State has agreed with the Chancellor of the Duchy of Lancaster that the role of chair will be listed as a significant appointment with the Commissioner for Public Appointments and be subject to pre-appointment scrutiny by the Science, Innovation and Technology Committee.

The shadow Minister’s questions about how the Information Commissioner can balance those two requirements are perfectly legitimate. I think that they are questions for the Information Commissioner, and they are the kind of questions that could legitimately be asked in a pre-appointment session with the Select Committee. I do not, therefore, believe that the amendment from the hon. Member for Harpenden and Berkhamsted is necessary.

However, I would like to put on record that the Government intend to maintain the title of the Information Commissioner in respect of the chair of the information commission, acknowledging the fact that the identity and brand of the Information Commissioner is valued and recognised domestically and internationally. We do not want to lose that, so we intend to preserve it.

Question put and agreed to.

Clause 117 accordingly ordered to stand part of the Bill.

Schedule 14 agreed to.

Clauses 118 to 120 ordered to stand part of the Bill.

Clause 121

Information standards for health and adult social care in England

Question proposed, That the clause stand part of the Bill.

With this it will be convenient to discuss the following:

New clause 3—Health and social care data records—

“(1) A person processing health and/or social care data for research purposes must maintain a record of the basis on which that data was shared or accessed.

(2) Such a person must make available a description of—

(a) the categories of data used,

(b) the intended research purpose,

(c) where possible, the scope of organisations or persons who will have access to the data,

(d) how individuals can exercise their data subject rights under Article 13 to Article 22 of the UK GDPR.

(3) The Secretary of State must by regulations set out requirements for how the record set out by subsection (2) must be published.”

This new clause would require researchers using health/social care data to keep and publish records explaining what data is used and for what reason.

Government amendment 14.

Schedule 15.

Clause 121 and schedule 15 make clear that information standards published under section 250 of the Health and Social Care Act 2012, as amended by the Health and Care Act 2022, will include standards relating to information technology or IT services used, or intended to be used, in connection with the processing of information related to the provision of health and adult social care in England.

For the health and adult social care system to work effectively, data needs to be processed in a standardised way using common specifications, which goes to some of the points made by the hon. Member for North Norfolk in quoting Government publications. These provisions are an important step towards creating a modern health and adult social care service, where systems are integrated and staff have quicker access to patient data, freeing up time that can be spent with patients.

In previous debates, several Members have referred to physical records, and I have referred to one hospital in Doncaster that employs 42 members of staff solely to carry around physical records. There are still departments in many parts of the NHS in England that are producing more physical, handwritten notes every day of the week. That must be nonsense; it must make it more difficult for us to deliver connected services in future and it cannot be in the interests of the patient, because we would want the patient to be able to hold in their hand an app with everything that relates to their own medical health, almost like a medical passport of their own. That simply is not possible if all the different bits of the NHS in England cannot work together. Government amendment 14 is a technical change to ensure that any personal data processed in the exercise of the public censure power, set out in schedule 15, is subject to the relevant existing data protection legislation.

New clause 3 would require researchers to keep and publish records about the health and social care data that they have processed for research. There are already extensive transparency requirements for health data, and the Information Commissioner’s Office provides detailed advice to the public on their data rights. The law only allows confidential patient information to be used for research without consent when it has been approved by the Health Research Authority. There are detailed arrangements for this approval, based in law, and the transparency arrangements include published registers of approved applications showing what data is used for what purpose and by whom. I hope therefore that the hon. Member for Harpenden and Berkhamsted will accept that this means her new clause is not necessary.

This part of the Bill is a concatenation of different provisions relating to data, which is one of the reasons why I think the Bill is so glorious; it covers such a wide scope of things to sort out. I will speak to some of the deeper debates that we will have later, but I am quite glad to start off by speaking to clause 121. As a former doctor—my wife is a doctor too—I particularly welcome these provisions and the opportunity they provide to ensure that health data can be shared properly.

I would say to the Minister that the issue is not merely carrying around patient notes; certainly, in my experience the issue is whether patient notes turn up in the first place at all. As somebody who does not work in the health service any more, I see the other side, where the burden is quite often on the patient to provide their notes or to give information repeatedly that different parts of the system already have. That is a wholly inefficient way of doing things. One of the benefits of having the NHS set up as it is must surely be the ability to have coherent approaches to the sharing of data, so that we do not have this situation with notes.

It is not merely an inconvenience. Patients can be exposed to repeated tests and repeated imaging, all of which have a degree of iatrogenic harm and risk, plus delays to progressing. My former field of work was psychiatry, and the places where I worked were very quick to adopt electronic patient records, noting not only the importance of data sharing, but the risk of retraumatising people when repeated disclosures of traumatic events are required—in part, I worry, because that data is not shared as effectively as it could be.

I raised the point on Second Reading that changes in this area will need to be supported by ensuring that hospitals and healthcare settings have access to IT of sufficient quality to support the new systems. Can the Minister provide an update on his strategy—although I recognise it is not precisely his strategy; it is shared with the Department of Health and Social Care—on renewing NHS IT infrastructure and ensuring that the necessary kit is put in place so that the provisions can be rolled out to maximum advantage? This is about not merely the sharing of data, but the fact that faxing information is no longer required, and we must have the computer infrastructure necessary for data sharing.

I will speak specifically on new clause 3. On the question of trust, I know that even the British Medical Association has highlighted concerns over transparency and ensuring that we unlock that innovation and bring that data—in other words, that people are willing, ready and happy to be part of this. New clause 3 therefore highlights that health and social data, when used for research, should have clear data categories that are properly recorded, and that individuals have a right to understand how their data is used. However, I appreciate the comments from the Minister, and I am happy not to press the new clause.

The hon. Member for Runnymede and Weybridge nearly caught me out because I had to look up “iatrogenic”. Basically, I think it means that when someone is being treated for something, it can lead to harmful effects. I am worried about that, because I have a PET CT scan tomorrow afternoon and an MRI scan on Saturday, so I am worried that I am being subjected to more risk because of all this imaging.

The truth of the matter is that a patient wants to be able to access as many of their records as possible—whether it is their blood tests or whatever else. That is a significant change that has happened in the last few years. It is about putting the patient back in a key role in the NHS, and them being able to manage their own data, but that simply cannot happen unless we pass this legislation and roll out changes across the whole of the NHS.

The hon. Gentleman asked me a specific question, although he admitted that it is not really my plan to develop these things; I might have to get the Department of Health and Social Care to write to him to lay some of that out. That is part of the work that we need to do at the moment. This is not in the Bill, but as a Welsh MP, I would like us to have shared standards across the whole of the United Kingdom, because there are people using different parts of the NHS across the different nations. That would make simple, common sense.

I also worry sometimes about cyber-security, with every different part of the NHS buying its own systems, and whether those systems all have the necessary cyber-security to make sure that data is preserved safely. I believe that the Bill will enable us to get a much more secure set of data provisions on the way health information can be shared between different parts of the NHS in England.

Question put and agreed to.

Clause 121 accordingly ordered to stand part of the Bill.

Schedule 15

Information standards for health and adult social care in England

Amendment made: 14, in schedule 15, page 255, line 35, at end insert—

“(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).

(6) In this section, ‘the data protection legislation’ has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”—(Chris Bryant.)

This amendment provides that information may not be processed for the purposes of new section 251ZC of the Health and Social Care Act 2012 (public censure of relevant IT providers) if that would contravene the data protection legislation.

Schedule 15, as amended, agreed to.

Clause 122 ordered to stand part of the Bill.

Schedule 16 agreed to.

Clause 123 ordered to stand part of the Bill.

Clause 124

Retention of information by providers of internet services in connection with death of child

Question proposed, That the clause stand part of the Bill.

With this it will be convenient to discuss new clause 29—Compliance with Section 124 of this Act and Part 3, Chapter 2 of the Online Safety Act 2023—

“(1) The Secretary of State must, within 12 months of the passing of this Act, publish a report on provisions of Section 124 of this Act.

(2) A report published under subsection (1) must include an analysis of the level compliance to notices requiring social media companies, including Category 1 services under the Online Safety Act 2023, to preserve data relating to the use of specified regulated services by children where that information may be needed to respond to an information notice issued under s.101 or to produce a report under s.163 of the Online Safety Act.”

This new clause would require the Secretary of State to publish a report assessing compliance with Section 124 of this Act and Part 3, Chapter 2 of the Online Safety Act 2023.

Clause 124 delivers on the Labour manifesto commitments to further support coroners, and procurators fiscal in Scotland, to access information held by online services after a child’s death. This is a very sensitive issue, and we have tried to address it as such. The provision will require Ofcom, when informed by a coroner, to issue a data preservation notice to specified online service companies. That will help to ensure that those online service companies retain all the relevant data they have on a child so that it will be available on request should a coroner later require it as part of an inquest into a child’s death. The clause demonstrates the Government’s commitments to keeping children safe online and supporting families that have endured unimaginable losses. I am conscious that some might want us to go further; further to the conversation we had earlier, we might be able to have a fruitful discussion on that before we reach Report.

On new clause 29, I reassure the hon. Member for Harpenden and Berkhamsted that there are already strong powers to ensure that companies comply with data preservation notices. Those include the power to issue fines for non-compliance of up to £18 million, or 10% of qualifying worldwide revenue, and the ability to hold senior managers criminally liable for non-compliance. Those sanctions will help to ensure that online services comply with any notice issued under section 101 of the Online Safety Act 2023. Under a provision in that Act, the Secretary of State must already review the effectiveness of the Act’s regime, including the data preservation measures, between two and five years after it comes into force and must produce a report detailing his findings, which will then be laid in Parliament. I therefore hope that the hon. Member will not feel the need to press her new clause to a vote.

This is not the appropriate place to discuss new clause 30, but I hope that there will be ample opportunity on Report for further discussion of the broader issue, which is of great importance.

Clause 124 concerns the retention of information by internet service providers in the deeply tragic event of a child’s death. It rightly acknowledges the potential need to access such data for crucial investigations and to understand the circumstances surrounding such a loss. However, mere provision for data retention is insufficient without a mechanism to ensure its effective implementation in line with broader online safety efforts. That is why we have proposed new clause 29, which ensures Government oversight by requiring the Secretary of State to publish a compliance report within 12 months. The report will assess whether social media platforms, including category 1 services under the Online Safety Act 2023, are preserving data when needed for investigations, regulatory actions and legal proceedings. I appreciate the comments from the Minister.

Although it is not in this Bill, this is an opportunity to highlight the Liberal Democrat’s belief that category 1 services should not be linked to the size of online platforms alone and that platform functionality and other characteristics should determine whether a regulated provider is classed as category 1 or 2. We know that harmful content, abuse and illegal activity leave a digital footprint but, without enforcement, key evidence may be erased before authorities can act. The new clause ensures that platforms are held accountable, preventing data from being lost if needed. It is about not just policy, but ensuring that social media companies meet their legal obligations and that enforcement is transparent and effective. Once again, I appreciate the open discussion of these issues that the Minister has put forward.

Question put and agreed to.

Clause 124 accordingly ordered to stand part of the Bill.

Clause 125 ordered to stand part of the Bill.

Clause 126

Retention of biometric data and recordable offences

Question proposed, That the clause stand part of the Bill.

With this it will be convenient to discuss the following:

Amendment 54, in clause 127, page 161, line 36, at end insert—

“(6A) An authority which retains biometric data under this Part must—

(a) review the necessity and proportionality of retention every 12 months, and

(b) erase the biometric data unless continued retention is strictly necessary for a lawful purposes, the reasons for which must be recorded and reviewable by the Information Commission.

(6B) The Secretary of State must publish an annual report on the retention and use of biometric data under this Part, including statistical data on the number of records retained, the time period of retainment, and the purposes of retainment.”.

This amendment would introduce mandatory periodic reviews of retained biometric data, requiring erasure unless the authority can demonstrate ongoing necessity. It also would mandate annual transparency reporting to Parliament on biometric use and retention.

Clauses 127 and 128 stand part.

I did not realise that we would be debating all these amendments today. I appreciate that my voice is probably being heard loud and clear, which was not the original intention, but these are important issues. Clause 126 addresses the sensitive issue of biometric data retention, particularly for law enforcement purposes. Amendment 54 strengthens safeguards by requiring judicial review methods before data can be retained beyond a defined period. That is where we are raising the alarm to ensure that there is a defined period, and that there is cause to ensure that data is not kept beyond that. It is a crucial protection to prevent undue encroachment on civil liberties.

The use of biometric data must be carefully regulated to prevent misuse and overreach: while we acknowledge the role of such data in tackling crime, we must ensure that retention policies are both proportionate and necessary. Amendment 54 aligns the UK’s approach with best practices, ensuring that security does not come at the cost of fundamental rights.

The hon. Lady has tabled another amendment that calls for the Secretary of State to report to Parliament. I hope that I am proving that the requirement to put those reports in the Bill is unnecessary.

The amendment would introduce a new duty on the police to review the retention of biometric data under clause 127, and a duty for the Secretary of State to report to Parliament on the use of that data. Clause 127 does not alter the existing duty in the Data Protection Act 2018, which ensures that the police retain only personal data, including sensitive personal data such as biometrics, as long as it is considered “necessary and proportionate”—precisely the terms that she advocated.

The biometrics commissioner already has independent oversight of biometric data retained under the Counter-Terrorism Act 2008, and has a statutory duty to report to Parliament annually. The independent reviewer of terrorism legislation also has statutory oversight of all the powers in the 2008 Act, and reports annually to Parliament. For those reasons—without doubting the hon. Lady’s intent—I hope that she will not press the amendment to a vote.

Question put and agreed to.

Clause 126 accordingly ordered to stand part of the Bill.

Clauses 127 to 134 ordered to stand part of the Bill.

Clause 135

Compliance with UK copyright law by operators of web crawlers and general-purpose AI models

Question put, That the clause stand part of the Bill.

I propose that the clause does not stand part of the Bill. Clause 140, which was tabled in the House of Lords, is a regulation-making power that would enable terms relating to core personal data attributes to be defined consistently across data held by public authorities. The intention behind this measure is that the power could be used to define the term “sex”. We seek to overturn this clause for the following reasons.

The Government believe that public sector data, including data about sex and gender, should continue to be collected based on the specific data requirements of those collecting the data, and their users, which differs across contexts. That is in line with the data minimisation principle set out in the data protection legislation. We do not think it is appropriate to have core personal data attributes defined in regulations in the way that is proposed.

Furthermore, setting out such definitions using secondary legislation could create confusion where terms are already defined in legislation, and so—depending on the approach taken—could cut across the existing definitions. For example, defining sex could cut across the existing legal framework and undermine protections in the Gender Recognition Act 2004 and the Equality Act 2010.

I am, however, keen to reassure the Committee that the Government recognise the importance of harmonising data and have already commenced important work on standards across Government—via a cross-Government working group led by the Data Standards Authority—to define the core attributes of a person. Last year, the Office for Statistics Regulation published guidance on collecting and reporting data about sex and gender identity, and in December 2024 the Government Statistical Service published a work plan for harmonised standards in this space.

The Government’s belief is that such matters are crucial and more appropriately considered holistically outside the Bill. The intention of the Bill is not to define or remark on the definitions of sex and gender, or other core personal data attributes. I therefore recommend that the clause does not stand part of the Bill.

As the Minister noted, the clause is a provision that was introduced in Committee in the other place, along with clause 28(3) and (4), and clause 45(6), which have now been removed from the Bill pursuant to our decisions in Committee.

Clause 140 aims to ensure the accuracy of data underpinning digital forms of verifying identity, and more broadly. To a degree, it is ironic that we live in a world where we have to debate data dictionaries when it comes to the definition of sex, but I think the point about data dictionaries more generally, over and above the focus on sex data in this debate, is nevertheless sound.

We are aware of the Government’s argument that the clauses inserted in the other place pertaining to data accuracy—in particular, clause 45(6)—are not compatible with certain provisions of the European convention on human rights and the Gender Recognition Act 2004. I am grateful to the Minister for writing to the Committee on that, among other matters, but I do not think that his explanation gives any rationale for the removal of clause 140.

We strongly disagree with the Government’s position for the reasons I set out last week, but I will not rehash those arguments now. Rather, I want to make a simple argument in favour of retaining the clause on data dictionaries that the Government intend to remove. Clause 140 grants the Secretary of State the power to make regulations establishing the definitions and associated metadata for core personal data attributes. The Secretary of State may require that those definitions are used for, among other things, personal data recorded by public authorities, under subsection (1)(d), and the digital verification service, under subsection (1)(a).

My noble friend Lord Lucas compellingly stated the case in support of his data dictionary amendment in the other place, saying that

“if we are to live in a data-rich world, we really need a set of well-understood, good definitions for the basic information we are collecting.”—[Official Report, House of Lords, 28 January 2025; Vol. 843, c. 237-238.]

It really is that simple: giving the Secretary of State the power to define those core personal data attributes so that a consistent approach can be taken across the board by public authorities and entities engaged in digital verification services.

My question for the Minister is, therefore: what is the objection to the Secretary of State having that power to clarify the meanings of those essential terms, which we need to define data attributes? A clear definition of data attributes, and in particular the meaning of sex, is a foundational building block that will help to ensure that the data we collect can be harnessed for good-quality research on which sound public policy decisions can be based.

In the other place, the DSIT Minister, the noble Lord Vallance of Balham, acknowledged the need for data to be “based in truth” and “consistent and clear”. However, he opposed this clause on the basis that the Government would prefer to consider the matter of data accuracy and consistency holistically, outside the scope of the Bill. In that regard, he pointed to ongoing research in the field, including the Sullivan review of data, stats and research on sex and gender, which was commissioned by the previous Conservative Government, and the findings of which this Government would like to take into account in developing their policies in the area.

I welcome the fact that the Government intend to take a closer look at the importance of data accuracy, especially in relation to the collection of sex data, but there is no need to kick the can down the road. The clause compels the Secretary of State to do nothing—well, not in an active sense—[Interruption.] If only. It does not compel the Secretary of State in an active sense, but it does give him the important power to put definitions of core personal data attributes in place once the important Sullivan review and other studies have been published and considered. As we have mentioned a few times, the Bill has gone through many iterations and a long legislative period. We believe that this clause will be useful, if not essential, for resolving some of these issues.

Getting those basic definitions right is essential. If we do not, there could be mistakes that could become entrenched in the records of public authorities. That could lead to skewed research findings on important societal matters, such as health disparities and outcomes across the sectors, as well as employment opportunities and equal pay. For those and many other good reasons, let us take this opportunity to get the basics right.

In that regard, I encourage the Minister to heed the timeless words of Julie Andrews with which he opened Committee stage. As far as definitions for core data attributes are concerned,

“Let’s start at the very beginning,

A very good place to start.”

Mr Turner, I have confidence in confidence alone; I have confidence in you—if we are going to do Julie Andrews.

This is obviously a serious matter. The clause pretends to be just a regulation-making power that would allow the Government to publish a data dictionary by regulations. It is framed as a means to promote data consistency, but its actual intent is to push the Government to set a single definition of the term “sex” through a public authority data dictionary that public authorities would need to have regard to when processing data. As I have said several times in debates already, that is inappropriate. The whole purpose of data is that it is set within a context and that that context changes. For instance, the data that is required for the running of a hospital or prison is different from that required for the hiring of a car or the purchase of a property. That is why we think it is important that we do not go down this route.

The Opposition are again trying to give the Secretary of State more powers to do things by regulation, but it would be completely inappropriate to develop this data dictionary by secondary legislation, which would be unamendable and therefore subject to only minimal debate. I completely agree with the noble Lord Vallance that data has to be consistent and accurate, but it also has to be in the context for which it is being used. That is the key determinant that some Members have not understood in the Government’s argument. I still suggest that clause 140 does not stand part of the Bill.

Question put, That the clause stand part of the Bill.

I beg to move amendment 28, in clause 141, page 173, line 27, leave out

“or soliciting the creation of”.

This amendment is consequential on Amendment 29.

With this it will be convenient to discuss the following:

Government amendments 29 to 48.

Clause stand part.

The amendments are the result of considerable discussion between officials, who have suddenly joined me as my inspiration, and the noble Baroness Owen. As promised in the other place, we have tabled further amendments relating to the offence that was included in the House of Lords. Recognising how crucial time limits are in this sensitive area, we made a commitment that is fulfilled by amendment 38, which would extend the statutory time limits to enable prosecutions to be brought at any date that is both within six months from when sufficient evidence comes to the prosecutor’s knowledge to justify prosecution, and within three years from when the offence was committed. By doing that, perpetrators will not be able to get away with creating a deepfake just because no one knew about it in time for the prosecution to commence within six months.

Amendment 31 will ensure that the law comprehensively criminalises asking someone to create a deepfake, regardless of where they are based or whether the image was made. We absolutely agree with the policy rationale put forward by Baroness Owen, which is why we did not oppose the amendment on solicitation. Our amendments replace the term “solicitation” with a new requesting offence, which has been drafted to ensure that it is comprehensive and functions as it should, and that it is clear to the courts how it should be understood and applied in practice within the wider criminal law framework.

I start by congratulating my noble Friend Baroness Owen of Alderley Edge for her hard work and tenacity in raising the profile of the harms caused to victims of sexually explicit deepfakes, and ensuring that clauses criminalising that activity were inserted into the Bill in the other place. We very much welcome the Government’s engagement in this important area, and we broadly support their amendments, which substantially deliver the changes to the Sexual Offences Act 2003 that Baroness Owen sought in the other place.

In particular, we welcome Government amendment 31, which substantially reflects the offence of solicitation under clause 141, but could the Minister put a bit more flesh on the bones of the reasoning and necessity behind substituting the term “requesting” for “solicitation”? Does he regard those terms as having equivalent meaning in this context? If not, what is the material difference in the approach to terminology?

I am thankful for the Minister’s comments on the “reasonable excuse” defence, but I have some questions about what exactly a reasonable excuse looks like in this context. Does he have any examples to aid our understanding of what constitutes a reasonable excuse in these circumstances? Based on that, do the Government intend to publish guidance on the scope of this defence and its explanation?

We are pleased to see the inclusion of Government amendment 38, inserting among other things an extended limitation period of three years from the date of creation, or request for creation, of a purported intimate image for bringing criminal charges. This will increase the scope for victims to seek justice where these images come to light some time after creation.

The Liberal Democrats very much welcome clause 141 and action taken on violence against women and girls in particular, including online. However, the clause talks about creating or soliciting the creation of purported intimate images of adults, but it does not necessarily deal with the sharing of them. How do we hold to account those who are sharing intimate images that they should not be?

I should have put on the record, as the shadow Minister did, my gratitude and congratulations to Baroness Owen for her tenacity; that point was absolutely right.

Hear, hear.

Excellent: we all agree that Baroness Owen has done a great piece of work for us, and we are grateful. Incidentally, I am also grateful to Ministry of Justice officials who worked with DSIT officials on the amendments before us today, which provide a more comprehensive version of what was originally argued for.

The hon. Member for Runnymede and Weybridge asked me about the difference between solicitation and requesting. Often, it is considered that solicitation would require some form of exchange of money. Obviously, that would not necessarily be the case in this context, which is why we have “requesting”, a broader category than solicitation. A request includes doing an act that could reasonably be taken to be a request—for example, nodding or otherwise indicating agreement in response to an offer or complying with conditions of an offer. It also includes both making a request directed to a particular person or persons and making a request available to one or more people, or people generally, without directing it to a particular person or people. In other words, that is broader than what solicitation would have required. I think Baroness Owen agrees with us that this is therefore a more comprehensive offence.

The hon. Gentleman asked about the “reasonable excuse” defence. Let us say that a software developer wants to ensure that he or she—probably “he” in this case—has developed the right safeguards in his software to stop people generating intimate deepfakes without the consent of the person depicted. In some circumstances, he will have a reasonable excuse where, in the course of the testing to ensure that the software does not create such images, he creates a purported intimate image. That might be an instance of a reasonable excuse. I do not want to lay out what reasonable excuses might be, because the courts are so used to dealing with the concept of a reasonable excuse. There are many offences to which it applies, and the courts, as I have said, are used to dealing with them.

The hon. Member for Harpenden and Berkhamsted asked me about sharing—is sharing a deepfake an offence? Sharing a deepfake intimate image without consent is already an offence under section 66B of the Sexual Offences Act 2003. I hope that, without further ado, we can agree the amendments and the clause.

Amendment 28 agreed to.

Amendments made: 29, in clause 141, page 173, line 35, leave out from beginning to end of line 8 on page 174.

This amendment removes a new offence of soliciting the creation of a purported intimate image of an adult. For a replacement offence, see Amendment 31.

Amendment 30, in clause 141, page 174, line 26, at end insert—

“(7A) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.”

This amendment adds a defence of reasonable excuse to the new offence of creating a purported intimate image of an adult.

Amendment 31, in clause 141, page 174, line 29, at end insert—

“66EA Requesting the creation of purported intimate image of adult

(1) A person (A) commits an offence if—

(a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms),

(b) B does not consent to A requesting the creation of the purported intimate image, and

(c) A does not reasonably believe that B consents.

(2) A person (A) commits an offence if—

(a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else),

(b) B does not consent to A requesting the inclusion or exclusion of that thing, and

(c) A does not reasonably believe that B consents.

(3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer).

(4) References in this section to making a request (however expressed) are references to—

(a) making a request directed to a particular person or persons, or

(b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons.

(5) References in this section to consent to a person requesting something are—

(a) in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and

(b) in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate.

(6) An offence under this section is committed—

(a) regardless of whether the purported intimate image is created,

(b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and

(c) regardless of where in the world the person or persons mentioned in subsection (4)(a) and (b) is or are located.

(7) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request.

(8) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both).

(9) In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E.”

This amendment makes it an offence to request the creation of a purported intimate image of an adult without consent.

Amendment 32, in clause 141, page 174, line 30, leave out “soliciting” and insert “requesting”.

This amendment is consequential on Amendments 29 and 31.

Amendment 33, in clause 141, page 174, line 32, leave out “section 66E” and insert “sections 66E and 66EA”.

This amendment provides that the definitions in new section 66F of the Sexual Offences Act 2003 apply for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E).

Amendment 34, in clause 141, page 174, line 33, leave out “the creation of a purported intimate image” and insert “an act”.

This amendment, and Amendments 35 and 36, adjust the definition of “consent” in new section 66F of the Sexual Offences Act 2003 so that it works for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E).

Amendment 35, in clause 141, page 174, line 34, leave out “of creation”.

See the explanatory statement for Amendment 34.

Amendment 36, in clause 141, page 174, line 35, at end insert

“(and see also section 66EA(5))”.

See the explanatory statement for Amendment 34.

Amendment 37, in clause 141, page 175, line 10, at end insert—

“(8) The “maximum term for summary offences” means—

(a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months;

(b) if the offence is committed after that time, 51 weeks.”

This amendment explains what is meant by the “maximum term for summary offences” in new sections 66E and 66EA of the Sexual Offences Act 2003. (New section 66EA is inserted by Amendment 31).

Amendment 38, in clause 141, page 175, line 10, at end insert—

“66G Creating, or requesting the creation of, purported intimate image of adult: time limit for prosecution

(1) Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66EA if the information is laid or the charge is issued—

(a) before the end of the period of 3 years beginning with the day on which the offence was committed, and

(b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge.

(2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact.”

This amendment extends the period during which a person may be prosecuted for an offence under new section 66E or 66EA of the Sexual Offences Act 2003 (creating, or requesting the creation of, purported intimate image of adult).

Amendment 39, in clause 141, page 175, line 12, after “66E” insert “, 66EA”.

This amendment provides that references to an image of a person in new section 66EA of the Sexual Offences Act 2003 (see Amendment 31), like references to such an image in new section 66E of that Act, do not include an image of an imaginary person.

Amendment 40, in clause 141, page 175, line 12, at end insert—

“(3A) In the Armed Forces Act 2006, after section 177D insert—

‘177DA Purported intimate images to be treated as used for purpose of certain offences

(1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

(2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).’”

This amendment provides that deprivation orders can be made under the Armed Forces Act 2006 in connection with an offence under new section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

Amendment 41, in clause 141, page 175, line 12, at end insert—

“(3B) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—

‘Sexual Offences Act 2003

38ZA An offence under section 66EA of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).’”

This amendment provides that a person cannot be guilty, under Part 2 of the Serious Crime Act 2007, of encouraging or assisting the offence under new section 66EA of the Sexual Offences Act 2003 (requesting the creation of a purported intimate image) (see Amendment 31).

Amendment 42, in clause 141, page 175, line 17, leave out

“or soliciting the creation of”.—(Chris Bryant.)

This amendment is consequential on Amendment 29.

Clause 141, as amended, ordered to stand part of the Bill.

Clause 142

Power to make consequential amendment

Question proposed, That the clause stand part of the Bill.

With this it will be convenient to discuss the following:

Clauses 143 to 146 stand part.

Government amendment 16.

Clause 147 stand part.

I will speak only to Government amendment 16, which is highly technical—there will be a test on it afterwards. It removes the privilege amendment inserted at Lords Third Reading to clause 147, which was necessary given the Bill was introduced in the Lords.

Question put and agreed to.

Clause 142 accordingly ordered to stand part of the Bill.

Clause 143 ordered to stand part of the Bill.

Clause 144

Extent

Amendments made: 43, to clause 144, page 177, line 25, leave out “141” and insert

“141(1) to (3) and (4)”.

This amendment, and Amendment 44, are consequential on Amendments 40 and 41.

Amendment 44, in clause 144, page 177, line 26, leave out “extends” and insert “extend”.

See the explanatory statement for Amendment 43.

Amendment 45, in clause 144, page 177, line 26, at end insert—

“(d) section 141(3A) (amendment of the Armed Forces Act 2006) extends to—

(i) England and Wales, Scotland and Northern Ireland,

(ii) the Isle of Man, and

(iii) the British overseas territories, except Gibraltar;”

This amendment provides for the amendment of the Armed Forces Act 2006 made by Amendment 40 to have the same extent as that Act.

Amendment 46, in clause 144, page 177, line 26, at end insert—

“(d) section 141(3B) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.”

This amendment provides for the amendment of the Serious Crime Act 2007 made by Amendment 41 to have the same extent as that Act.

Amendment 47, in clause 144, page 177, line 26, at end insert—

“(5A) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 141(3A) of this Act).”—(Chris Bryant.)

This amendment provides that the new section inserted in the Armed Forces Act 2006 by Amendment 40 may, like the other provisions of that Act, be extended to the Channel Islands and modified as it extends to those Islands, the Isle of Man and British overseas territories other than Gibraltar.

Clause 144, as amended, ordered to stand part of the Bill.

Clause 145 and 146 ordered to stand part of the Bill.

Clause 147

Short title

Amendment made: 16, in clause 147, page 179, line 10, leave out subsection (2).—(Chris Bryant.)

This amendment removes the privilege amendment inserted by the Lords.

Clause 147, as amended, ordered to stand part of the Bill.

New Clause 2

Impact of this Act and other developments at national and international level on EU data adequacy decision

“Within three months of this Act receiving Royal Assent, the Secretary of State must carry out an assessment of the likely impact on the European Union data adequacy decisions relating to the United Kingdom of the following—

(a) this Act;

(b) other changes to the United Kingdom’s domestic frameworks which are relevant to the matters listed in Article 45(2) of the UK GDPR (transfers on the basis of an adequacy decision);

(c) relevant changes to the United Kingdom’s international commitments or other obligations arising from legally binding conventions or instruments, as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.”—(Victoria Collins.)

This new clause requires the Secretary of State to carry out an assessment of the impact of this Act and other changes to the UK’s domestic and international frameworks relating to data adequacy.

Brought up, and read the First time.

I beg to move, That the clause be read a Second Time.

It will be no surprise that the Liberal Democrats support greater collaboration with our European partners. Local people and businesses across Harpenden and Berkhamsted, as well as up and down the country, continue to highlight the importance of working with the EU and for ever closer union.

New clause 2 seeks to ensure that any changes in our data laws or international commitments do not jeopardise our data adequacy, which is due to be reassessed by the EU in June this year. The Minister may be pushing through the Bill to ensure that we get our adequacy in line with that requirement, which is crucial, because the UK’s ability to transfer data internationally underpins business, research and security partnerships.

Data adequacy is what allows personal data to flow freely between the UK and the EU without the need for costly and complex additional safeguards. A report by the New Economics Foundation put the cost of data inadequacy with the EU at between £1 billion to £1.6 billion for British businesses, highlighting the importance of aligning with our European neighbours on this. The UK is also party to various international agreements and conventions relating to data protection.

New clause 2 ensures that we assess how our international commitments may impact the EU’s view of our data protection framework. If we fail to maintain strong data protections, we risk losing our EU data adequacy status, an outcome that could cost billions in compliance burdens, disrupt cross-border operations and hinder UK businesses from accessing global markets. That would be a hammer blow to the UK businesses, particularly small and medium-sized enterprises, that rely on seamless data exchange with our European partners.

Supporting new clause 2 is about ensuring that Britain continues to lead on data governance, innovation and global collaboration. Data adequacy is not just a legal issue; it is a fundamental element of maintaining economic growth, international trust and our competitive edge. We welcome assurances—and indeed the discussions I have already had with the Minister—on data adequacy with Europe being maintained.

I just want to make two points. I was a bit confused by the timings in this new clause. I think we all agree on the importance of data adequacy, but my understanding is that, by three months post Royal Assent, we will already have to have a data adequacy agreement in place, given the time that it will take to achieve Royal Assent.

The other point I wanted to make was that I think this might be the last time that I get to speak on behalf of His Majesty’s Opposition in this Bill Committee, so I want to thank Members, officials and the Chairs for taking part in our proceedings. I look forward to further debate on Report.

First, I should have also thanked the Under-Secretary of State for Justice, my hon. Friend the Member for Pontypridd (Alex Davies-Jones), because she has been intimately involved in bringing forward the measures that we debated in the last group. My apologies for forgetting that, Mr Turner.

On new clause 2, I completely agree that EU data adequacy is vital, but I completely disagree with the new clause, because I think it is technically deficient. One reason for that is the timeline that it lays out of three months, by which time I hope we might be able to have made progress. I also think that it undermines the independence of the process that the European Commission has to go through. The European Commission has already confirmed that its review of its two adequacy decisions for the UK are currently under way—ahead of the deadline, which is good. As Lord Vallance stated in the House of Lords, DSIT and the Home Office have dedicated teams supporting the European Commission’s technical review, as required.

I acknowledge the unilateral nature of the adequacy assessment made by the European Commission. For that reason, it is important to provide the European Commission with the discretion needed to complete its process, which I am afraid new clause 2 would undermine. So, for that reason, I am resisting the blandishments of the Liberal Democrats.

I beg to ask leave to withdraw the motion.

Clause, by leave, withdrawn.

New Clause 6

Public-interest data trusts and communities

“(1) The Secretary of State must, within 12 months of this Act being passed, lay before Parliament a strategy for promoting data trusts and community data governance models for the public interest (referred to in this section as ‘data trusts’).

(2) That strategy must include—

(a) a definition of data trusts or data communities which prioritise ethical and responsible use of personal data,

(b) mechanisms for ensuring meaningful participant control and governance over shared datasets,

(c) potential incentives for organisations to participate in or develop such data trusts,

(d) safeguards to protect individuals’ rights and freedoms when data is shared,

(e) requirements for transparency in data trusts’ decision-making, including governance arrangements and any commercial partnerships,

(f) arrangements for ongoing independent oversight and review, and

(g) an assessment of how these models might advance innovation, economic growth, and data-driven research in socially beneficial areas such as health, climate resilience, and energy.

(3) The Secretary of State must consult the Information Commission, UK Research and Innovation, relevant civil society groups, and such other persons as the Secretary of State considers appropriate prior to laying the strategy under subsection (1).

(4) The Secretary of State must, at least once every three years, publish a progress report on how data trusts and data communities are being used and how they have contributed to the public interest, including any recommendations for further legislative or policy changes.”—(Victoria Collins.)

This new clause would require the Secretary of State to develop a formal strategy for data trusts and to report periodically on progress. Encourages innovative but responsible data use.

Brought up, and read the First time.

I beg to move, That the clause be read a Second time.

With this it will be convenient to discuss the following:

New clause 25—Promotion of public-interest data trusts and communities—

“(1) The Secretary of State must, within 12 months of this Act being passed, lay before Parliament a strategy for promoting data trusts and community data governance models for the public interest (referred to in this section as ‘data trusts’).

(2) That strategy must include—

(a) a definition of data trusts or data communities which prioritise ethical and responsible use of personal data;

(b) mechanisms for ensuring meaningful participant control and governance over shared datasets;

(c) potential incentives for organisations to participate in or develop such data trusts;

(d) safeguards to protect individuals’ rights and freedoms when data is shared;

(e) requirements for transparency in data trusts’ decision-making, including governance arrangements and any commercial partnerships;

(f) arrangements for ongoing independent oversight and review; and

(g) an assessment of how these models might advance innovation, economic growth, and data-driven research in socially beneficial areas such as health, climate resilience, and energy

(3) The Secretary of State must consult—

(a) the Information Commission,

(b) UK Research and Innovation,

(c) relevant civil society groups, and such other persons as the Secretary of State considers appropriate prior to laying the strategy under subsection (1).

(4) The Secretary of State must, at least once every three years, publish a progress report on how data trusts and data communities are being used and how they have contributed to the public interest, including any recommendations for further legislative or policy changes.”

This new clause would require the Secretary of State to develop a formal strategy for data trusts and to report periodically on progress. Encourages innovative but responsible data use.

New clause 28—Public-interest data altruism—

“(1) The Secretary of State must, within 12 months of this Act being passed, establish a framework to recognise and register ‘data altruism organisations’ that manage personal data voluntarily contributed for public-interest objectives.

(2) A data altruism organisation registered under this section must—

(a) demonstrate enhanced governance, transparency, and accountability measures;

(b) publish clear terms on how personal data is used or shared; and

(c) uphold safeguards protecting data subjects’ rights.

(3) The Secretary of State may by regulations—

(a) provide for eligibility criteria and the application process for data altruism organisations;

(b) specify ongoing compliance and auditing requirements;

(c) establish processes for revocation of registration where an organisation fails to meet the criteria.

(4) In developing the framework under this section, the Secretary of State must consult the Information Commission, data subjects, civil society organisations, and such other persons as the Secretary of State considers appropriate.

(5) Regulations under this section are subject to the affirmative resolution procedure.”

This new clause would require creation of a statutory framework for data altruism allowing organisations to register as data altruism organisations where they collect and process personal data for public-interest purposes under enhanced transparency, governance, and accountability standards.

This is my last intervention, which I am sure the Committee will all be very sad about, and it is on data. I know that we have talked a lot about public trust, but I also want to highlight that, as Liberal Democrats, we are also excited about unlocking the opportunities from data. These new clauses speak to that.

New clauses 6, 25 and 28 together would ensure that we harness the benefits of data while upholding fundamental rights. Too often, data is seen as something that happens to people rather than something that they have a say in. We have an opportunity here to unlock even more opportunities, not just in Government data systems but in how data is used across research, public services and wider society.

New clause 6 calls on the Government to develop a clear strategy for public-interest data trusts and community data governance. That means allowing individuals and communities to contribute their data for socially beneficial purposes while retaining meaningful control. Imagine if patients suffering from rare diseases could securely share their data for medical research, knowing that it would be used solely for public good, not commercial gain; that is a future we can build.

New clause 25 would ensure that the Government take a proactive role in shaping public-interest data governance, setting clear ethical guidelines for how data can be shared securely and fairly. This is about moving beyond reactive regulation. Instead, we should actively create frameworks that allow innovation to flourish while protecting those rights. If we want the UK to be a leader in responsible AI and data stewardship, we need clear structures that allow businesses, researchers and civil society to work together with confidence.

New clause 28 would establish a framework for data altruism, ensuring that those who wish to donate their data for public interest projects can do so safely and transparently. Consider a family in my constituency of Harpenden and Berkhamsted who want to contribute to a dementia research project. Right now, there is no clear framework guaranteeing that their data will be protected from misuse. By formalising ethical data-sharing models, we can enable research and innovation without compromising trust. These new clauses share a simple principle: data must serve people, not the other way around. We must strike the right balance, harnessing data to drive innovation while ensuring that public confidence and ethical standards remain at the core of our approach.

We have a huge economic opportunity. The UK has led the way in setting high regulatory and Government standards in sectors such as fintech, law and insurance, where trust, transparency and compliance are critical. We should build on those strengths and apply the same principles to emerging fields such as AI, healthtech and responsible data sharing. By learning from what works and setting clear guidelines now, we can unlock investment, support start-ups and ensure that the UK becomes a hub for innovative, data-driven businesses. That is why I urge colleagues to consider new clauses 6, 25 and 28, as well as the principles put forward in them, to ensure that we build a data-driven future that is transparent, accountable and a gold standard for responsible innovation and public involvement.

I listened carefully to the hon. Lady’s comments, and I want to reflect on one point. She presented, or at least seemed to present, a tension between public interests and the commercial use of data. It is really important that we recognise that a lot of health research, particularly pharmaceutical development, is for commercial purposes, with a huge amount of benefits for health as a consequence.

I do not think it is to right to try to sabotage the use of data for commercial purposes, because it has huge benefits for the care and treatment of people. We depend on pharmaceutical companies to spend the risk money, for which a state organisation would never have the appetite, to develop the new drugs of the future. It is important to be quite careful when one is thinking about commercial interests versus non-commercial interests for scientific research.

The hon. Member for Harpenden and Berkhamsted said that this is her last contribution to the debate, so in the words of the “The Little Mermaid”, I suppose we are poor, unfortunate souls. I thank her for tabling these new clauses, and she raised issues that were also discussed in the other place.

On new clause 6, as my noble Friend Baroness Jones noted in the House of Lords, the Government support giving individuals greater agency over their data and a robust regime of data subject rights. We have already announced our intention to publish a call for evidence on the potential role of data intermediaries. It is important that we establish a firm evidence base before we make any changes to people’s data rights, so I hope that that makes new clause 6 unnecessary.

On new clause 25, as I have just said, we have already published a call for evidence on the potential role of data intermediaries, which is why we need to proceed carefully before going down the route offered by the new clause. Finally, on new clause 28, the Government acknowledge that there are various models of data intermediaries, including those that manage voluntarily contributed personal data for the common good, such as data co-operatives and trusted research environments.

We have already announced our call for evidence, which will seek views on various aspects relevant to data intermediaries, including the delegation of data subject rights to third parties, barriers preventing data intermediaries from operating at full capacity and risk factors associated with significant growth in their activities. This will also include views on different models of data intermediaries, including those focused on data altruism, as the hon. Lady mentioned. Given that we have already announced our intention to act in these areas, I very much hope that the hon. Lady will be content to withdraw the motion.

I beg to ask leave to withdraw the motion.

Clause, by leave, withdrawn.

New Clause 9

Right to use non-digital verification services

“(1) This section applies when an organisation—

(a) requires an individual to use a verification service; and

(b) uses a digital verification service for that purpose.

(2) Where it is reasonably practicable for an organisation to offer a non-digital method of verification, the organisation must—

(a) make a non-digital alternative method of verification available to any individual required to use a verification service; and

(b) provide information about digital and non-digital methods of verification to those individuals before verification is required.”—(Steff Aquarone.)

This new clause would create a duty upon organisations to support digital inclusion by offering non-digital verification services where practicable.

Brought up, and read the First time.

Question put, That the clause be read a Second time.

I thank the Clerks, as well as you, Mr Turner, and other Chairs who have been on this Committee. I also thank the Government and Committee members for working together to get through the Bill very quickly.

Question put and agreed to.

Bill, as amended, accordingly to be reported.