Chris Bryant MP: speeches

Speeches

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  Clause 95(1) relates to artificial intelligence and copyright and the related reporting requirement on the Information Commissioner. I will set out our fuller reasoning on copyright shortly, but for now, I merely state that we believe that now is not the right time to place an additional reporting obligation on the Information Commissioner in the Bill. Government amendment 22 would therefore remove subsection (1), which was added to the Bill on Report in the Lords. Subsection (2) requires the Information Commissioner to publish key performance indicators. The Government take the performance and accountability of UK regulators seriously. Regulators undertake important functions across our economy and society, and the Information Commissioner’s Office is no exception, so it is important that Parliament and other stakeholders have the right means to hold them to account. Publishing such metrics is best practice and a transparent way of providing measurable analysis of the ICO’s performance year on year. This forms part of a package of additional reporting requirements, alongside those in clause 91 and the report on regulatory action in clause 102, which we will discuss later. Together, they will increase understanding and transparency about priorities, performance and enforcement activities. Clauses 135 to 139 are in this group, although we will vote on them later. They set out further requirements regarding copyright and AI, and I urge that they do not stand part of the Bill. These clauses require regulations to be made to ensure compliance with copyright law by web crawlers and general AI models, and transparency about the use of web crawlers and the works they scrape. There is also an enforcement requirement for the Information Commissioner, and provision on a review of technical solutions. The Committee well knows, because I have mentioned it several times, that I agree with many of the points raised in debate on the clauses and the importance of transparency for rights holders in the creative industries. It was one of the key principles in the consultation we published on copyright and AI that closed on 25 February. We want genuine transparency about what is used in training AI, alongside rights holders’ control of their work and appropriate access to training material for AI. However, although I accept the intention behind the amendments—that is, clauses 135 to 139, which were added in the Lords—we do not believe that the Bill, which is a data measure, is the right vehicle for action. We received more than 11,000 detailed and heartfelt responses to our public consultation on AI and copyright. Many set out specific views on transparency, technical standards and a range of the questions that we asked in the consultation. We are taking care to read each response. Although we believe that action needs to be taken on transparency and web crawlers, as well as other issues relating to AI and copyright, it is only right that we carefully consider all the viewpoints and evidence before acting. We have heard loud and clear the message that stakeholders do not want us to rush to legislate on this topic, and we intend to heed this message. Yesterday the Secretary of State met representatives of the creative industries and repeated that point. The engagement will not end with this consultation. I have already stated our intention to create working groups to move the conversation forward, including on technical solutions. Industry often comes up with the best ideas, so I want to harness that, whether it is greater transparency about AI training or standards on web crawlers, metadata and watermarking. Whatever the solution, we want to be confident in its efficacy and, critically, in its simplicity and accessibility. We have said repeatedly that we will not move forward in this sphere unless we are confident we can give rights holders greater control over the use of their works. Once we have analysed the responses to the consultation, we will publish proposals. Clauses 135 to 139, which were added to the Bill on Report in the House of Lords, should not stand part of the Bill. Opposition new clauses 17 to 20 also relate to AI and copyright. I am grateful for the way in which the shadow Minister, the hon. Member for Runnymede and Weybridge, has advanced these suggestions. These new clauses would require the Secretary of State to issue a statement on the application of UK copyright law to the activities of web crawlers and artificial intelligence models. One of the new clauses sets out the possibility of this being a copyright notice, issued by the Intellectual Property Office. They also require the Secretary of State to produce two reports, one of which should include a plan for transparency regarding the use of copyright materials with AI; the other should be on access to data and how to reduce market entry barriers for start-ups and smaller AI enterprises. Finally, they would require the Secretary of State to publish a technical standard for a machine-readable digital watermark, which would allow rights holders to label their content for the purposes of licensing. As the House is aware, these amendments relate to matters that are at the heart of the government’s approach to AI and copyright. Indeed, the recently closed consultation sought views precisely on these issues. I commend my Conservative colleagues on the spirit of these amendments, but ask that they not be pressed at this time. I hope we can have further discussions on how we move forward on Report. While the amendments may indeed offer useful steps for the Government to take in solving issues of AI and copyright, proper analysis and policy development is likely to take longer than the proposed timeframes included in the clauses, given the 11,000 responses we received to the consultation. In addition, we would not wish to pre-empt the consultation, which some of these proposed clauses may do. That said, I hope that I can discuss the issues raised by the amendments further with Members from both Opposition parties, to discuss whether we might be able to agree on similar proposals as we move forward. As I say, we take these issues seriously. As I am the Minister for Creative Industries and a Minister in the Department for Science, Innovation and Technology, I take a special interest in this and agree with the spirit of what these amendments seek to achieve, but I ask that new clauses 17 to 20 not be pressed at this stage.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  It may assist the Committee to know that, when there is no great controversy about a clause and all I am doing is reminding people what is in the clause and the explanatory notes, I will move that the clause stand part formally. We are now starting to discuss part 5 of the Bill, which relates to GDPR. This clause is completely and utterly self-explanatory.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I will briefly add that the Information Commissioner already provides guidance in this sphere. We do not want to prevent the Information Commissioner from doing that in the future. The hon. Member is absolutely right: it has to be meaningful human involvement, and we think we have the balance right in the Bill.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I rise to speak primarily to new clause 27. The Government are committed to the independence of the regulator, which will continue to be accountable to Parliament. The Bill does not introduce a statement of strategic priorities, as the hon. Member for Harpenden and Berkhamsted seems to suggest in her new clause, nor does the Secretary of State issue discretionary guidance to the regulator. Neither the Bill nor existing legislation provides for the Secretary of State to amend or reject a code of practice. I therefore do not see that this new clause is necessary.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  New clause 5 seeks to strengthen parliamentary oversight of regulations that could amend the recognised legitimate interest list or the provisions on automated decision making and special category data, which we will debate in detail later. The regulation-making powers in the clause are already subject to appropriate safeguards, and have been designed with retaining our EU adequacy decisions at the forefront of our mind—we will return to the topic of EU adequacy in more detail when we reach new clause 2. It is important to respect the European Commission’s processes and its discretion in how its adequacy assessment is undertaken. New clause 22 would require the Secretary of State to publish a statement explaining the purpose of any changes to the recognised legitimate interest list, to whom they would apply and for how long. As I think I explained earlier on a previous amendment, any draft regulations laid before Parliament under these provisions will be accompanied by an explanatory memorandum, which would lay out precisely the things the hon. Lady seeks. On that basis, I hope she will not push her two new clauses to a vote. Question put and agreed to. Clause 70 accordingly ordered to stand part of the Bill. Schedule 4 agreed to. Clause 71 ordered to stand part of the Bill. Schedule 5 agreed to. Clauses 72 to 76 ordered to stand part of the Bill. Clause 77 Information to be provided to data subjects Question proposed, That the clause stand part of the Bill.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I am not sure that I have a great deal to add. I feel caught between the rocks of “You are going too far” and “You are not going far enough,” which suggests to me that what we are advocating is probably proportionate and sensible, so I resist the new clauses and support clause 80. I simply add that I do not have Spotify on my phone because I choose not to stream—I prefer to pay for my music—but I note that my ministerial podcast is available on Spotify. Question put and agreed to. Clause 80 accordingly ordered to stand part of the Bill. Schedule 6 agreed to. Clause 81 Data protection by design: children’s higher protection matters Question proposed, That the clause stand part of the Bill.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I beg to move amendment 22, in clause 95, page 120, line 31, leave out subsection (1). This amendment removes a subsection which was inserted at Report stage in the Lords.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  First, the hon. Gentleman is right that there are other areas where there is a public interest test. In those other areas it is actually very narrow, however. The public interest test is currently only applied to research using special category data under schedule 1 to the Data Protection Act 2018 and public health data. It is quite specific. This is why we are nervous about extending the test across the whole of data protection. It is appropriate, we think, to have that extra protection for those particularly sensitive areas, but we think it would be disproportionate to make all researchers meet that standard, regardless of the type of data they are using. The hon. Gentleman mentions AI companies, and the matter was of course raised in the Lords. It is worth reminding the Committee that the clause narrows rather than expands the definition of scientific research. As the provisions of the Bill make clear, web scrapers seeking to reuse personal data for purposes such as training AI models must have a lawful basis. Before even considering the meaning of scientific research, a web scraper would need to pass the balancing test to use the legitimate interest ground. The Information Commissioner’s Office outcomes report, published last year, emphasised that: “Web scraping for generative AI training is a high-risk, invisible processing activity. Where insufficient transparency measures contribute to people being unable to exercise their rights, generative AI developers are likely to struggle to pass the balancing test.” In other words, AI companies should not be doing precisely that which he is concerned they would.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I rise mainly to speak to new clause 8, which was tabled by the hon. Member for Harpenden and Berkhamsted. It would require the Information Commissioner to review and publish an annual report on data sharing by law enforcement and the intelligence services. Any processing of personal data by law enforcement and the intelligence services must, by definition, be lawful, which inherently includes the requirement that the processing be necessary and proportionate. The Information Commissioner is obliged to provide an annual report to Parliament under the Data Protection Act 2018, and may also produce additional reports as they see fit. The commissioner has powers of investigation, monitoring and enforcement that they may exercise as appropriate to oversee law enforcement agencies and intelligence services. Given the current system of oversight, and the fact that the commissioner is already required to provide reports annually, I hope the hon. Member for Harpenden and Berkhamsted will not press her new clause to a vote.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I will try one more time to persuade the hon. Member, but I will be repeating myself. The Government are not expanding the meaning of scientific research. The Bill’s definition is completely in line with present ICO guidance, which states that commercial organisations can also carry out scientific research. Scientific research conducted by commercial organisations can have a life-changing impact, as many hon. Members have noted, but the definition does not cover any commercial activity: it only includes activities that could reasonably be viewed as scientific research. Amendment 13 agreed to. Clause 67, as amended, ordered to stand part of the Bill . Clauses 68 and 69 ordered to stand part of the Bill . Clause 70 Lawfulness of processing

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I am grateful to the hon. Lady because automated decision making and the precise definition of “meaningful human involvement” were a key issue in previous versions of the Bill, and she will know that we have changed this version from the previous one. Our reforms make it clear that decisions “based solely on automated processing” are ones that lack meaningful human involvement. The terminology we have introduced in this version of the Bill goes beyond the current UK GDPR and Data Protection Act wording to prevent cursory human involvement being used to, effectively, rubber-stamp decisions that have been made by automated decision processes. The point at which human involvement becomes meaningful is of course context-specific, which is why we have not sought to be prescriptive in the Bill. The Information Commissioner’s Office already sets out in its guidance its interpretation that meaningful human involvement must be active. Someone—a human being—must review the decision and have the discretion to alter it before it is applied. The Government’s introduction of the term “meaningful” to primary legislation does not change that definition, and we are supportive of the ICO’s guidance in this space. As such, the Government agree on the importance of the ICO continuing to provide its views on the interpretation of terms used in the legislation. Our reforms do not remove the ICO’s ability to do that or to advise Parliament or the Government if it considers that the law needs clarification. Broadly speaking, I agree with the hon. lady, which is why I do not think her amendment is necessary.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  Don’t get me started.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I beg to move amendment 13, in clause 67, page 75, line 26, leave out “and that is conducted in the public interest”. This amendment removes words from new paragraph 2 of Article 4 of the UK GDPR (meaning of processing for the purposes of scientific research). The words were inserted at Report stage in the Lords. The UK has a proud tradition of innovative research. Our researchers are at the forefront in fields from quantum computing to medicine—for example, leading on pioneering vaccine development during the covid-19 pandemic. Scientific research can bring life-changing benefits to our society and economy. Given that importance, the UK data protection framework contains certain accommodations for processing personal data for research purposes while maintaining key safeguards. The clause, as proposed by their lordships, would require an up-front public interest test for processing to be considered as scientific research and eligible for these accommodations. We disagree with that. We agree with wanting to avoid misuse of the term “scientific research”, but as the Royal Society has said clearly, the reasonableness test that is now in the Bill provides adequate protection against that. The new test, provided by the Lords, would also be at odds with the internationally recognised Frascati definition, which does not mention an up-front public interest test. Such a test would be a new burden on many researchers. The Royal Society is concerned that that could have a negative effect on the conduct of research. The Government agree and are especially concerned about the impact on basic and curiosity driven research. The public benefits from such research may not be known at the time, yet with hindsight may be overwhelming. Many of the great discoveries in scientific history, from penicillin to the electron, originated from research that had no anticipated public interest benefit. No one could know how valuable they would be to us now. Even the mRNA-based vaccines that saved millions of lives during the covid-19 pandemic drew on curiosity-driven research that for years had had no practical applications. That is research that we should be supporting, not stifling. An up-front public interest test could have a chilling effect on it, which is not in the long-term public interest. Our amendment would therefore remove the public interest test inserted by their lordships.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  Clause 70 and schedule 4 introduce a new lawful ground for processing personal data under article 6 of UK GDPR, allowing organisations to process data for recognised legitimate interests without conducting a balancing test. The aim is to provide legal certainty and facilitate faster data sharing for key public interest purposes such as crime prevention and safeguarding.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  First of all, I commend both hon. Members on their contributions. Let us face it; this is very difficult. It is a classic case of difficulty for the Government because, as the previous Government found, two sectors are really important to UK growth. The creative industries are one of the fastest-growing sectors in the UK and are representative of our future growth. Somebody put it to me the other day that there was a time when our economy relied on selling industrial products, then it was services, and, in the new era, perhaps one of the things that we are exceptionally good at is selling experiences, and a large part of that is through intellectual property from the creative industries.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  And are hated by others.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  If an area of research does not currently count as scientific research, it will not do so under the Bill. Researchers will benefit from having a clearer definition in legislation that reflects the language buried in the recitals and the current ICO guidance. We believe that improving clarity will reduce uncertainty, the risk of misinterpretations and misapplication of the law. The Government will of course monitor the reform’s impact and how researchers navigate the data protection framework. We think that will help us better understand if further changes are required. The fundamental point is that their lordships inserted a public interest line that we are seeking to take out. They inserted it because they believed it would mean that no data would be used in a way that did not lead to eventual good outcomes. The truth is that when someone starts a piece of research based on curiosity they might have no idea what the final outcome will be. That is an important part of how most researchers work, whether in a commercial or non-commercial setting. That is why the Royal Society has unambiguously stated that if we retain their lordships’ public interest provision, it will have a chilling effect on research in the UK. That is why I commend the amendment to the Committee.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  As we have several provisions here, it might be worth me making some comments. Clause 80 strikes the right balance between helping organisations to make the most of emerging technologies that drive up economic growth and productivity, while maintaining public confidence. Organisations will be able to make decisions that have significant effects for individuals based solely on automated processes in wider circumstances than presently, but they must implement stringent safeguards. Those safeguards include individuals’ right to challenge and obtain human intervention if they are not satisfied with the decision. Where law enforcement agencies process personal data for a law enforcement purpose, they will be able to apply an exemption to the safeguards in very limited circumstances, such as to safeguard national security. Where that happens, a human must reconsider that decision as soon as reasonably practicable after it is taken, and that review must be meaningful. For the intelligence services, where entirely automated decision making is used, we are making clarifications to provide greater confidence to controllers and the public. Schedule 6 contains minor and consequential amendments to UK GDPR and the Data Protection Act. Those amendments repeal and replace references to the current rules on automated decision making with the reformed rules in clause 80 of the Bill to provide legal clarity. On new clauses 1, 4 and 24, the Government’s algorithmic transparency recording standard, or ATRS, enables public authorities to publish information on how and why they are using algorithmic tools. That includes a description of the human role in the wider operational process of which the tool is part. More than 50 ATRS records are now published in the repository, with more to follow shortly. Where these amendments seek to ensure that such tools are evaluated, the blueprint for modern digital government, which was laid in Parliament in January, makes it clear that part of its role will be to offer specialist assurance support, including a service to rigorously test models and products before release. I hope this provides reassurance to the hon. Member for Harpenden and Berkhamsted. I will address new clauses 7 and 26 together, as they intend to achieve the same effect. I would again like to reassure hon. Members—I am trying to offer a lot of reassurance to the hon. Lady and to the hon. Member for North Norfolk—that the data protection framework has stringent safeguards in place for solely automated decision making. The UK GDPR transparency obligations already require organisations to notify individuals about the existence of solely automated decision making and to provide meaningful information about the logic involved. Under our reforms, after a decision has been made, organisations must also provide data subjects with information about that decision. These information requirements enable individuals to exercise the safeguards I mentioned earlier, and are in addition to the wider transparency requirements of the framework. The safeguards in the reformed article 22 are unnecessary for partly automated decision making, since these decisions already include meaningful human involvement by definition. When it comes to high-risk decisions, there are already additional requirements for processing that can result in a high risk to the rights and freedoms of individuals, including automated decision making. Controllers must carry out an impact assessment for such processing activities and consult the Information Commissioner’s Office where such an assessment indicates a high risk to individuals in the absence of effective measures. That process ensures that potential risks are identified and addressed. I therefore hope that the hon. Members for Harpenden and Berkhamsted and for North Norfolk feel that they do not need to press their new clauses to a vote.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I thought the debate might stray a little from the precise point my hon. Friend just made to into broader issues about young people’s use of smartphones and social media in general, and inevitably it has. This is a very live issue, of which the Government are painfully aware, as I tried to say in the debate last Friday. We are trying to work out the best way forward to a place where the rules that were implemented in the Online Safety Act, some of which only come into force in the spring—some have yet to get parliamentary approval; that will probably come in April—bed in properly and are adhered to before we take further action. That is simply because it is difficult to know otherwise whether the Online Safety Act has gone far enough. I wish that the Online Safety Act had been not the Online Safety Act 2023, but the Online Safety Act 2021 or 2019. Had it been, we might now be in a position to assess its effects. In the debate on Friday I referred to the feasibility study commissioned by the Department for Science, Innovation and Technology from the University of Cambridge, which is working with other researchers. Work on that will finish in May, so I hope to have further information then. There is already a lot of guidance out there for parents, teachers and schools, but if we need to provide more informed guidance in the future, we will certainly look into that. The precise targeting of young people by algorithms and so on is, at least theoretically, already dealt with by the Online Safety Act. That is why I do not think that new clause 21 is an appropriate measure to take forward at this time. Whether the age limit should be 13 or 16 was decided by the previous Government and agreed by Parliament after quite extensive consultation during the passage of the Data Protection Act 2018. All these matters have to be kept under review, and we are doing so in an urgent way, not least because a lot of Members are bringing up concerns raised by their constituents, families and so on. I sometimes worry that the concentration solely on schools is to the detriment of the wider issues we are facing, not least because, as teachers readily admit, they only ever see children for about 20% of their time, and we need to set this in a wider context. I understand the motivation behind the new clause, but I will still resist it. Question put and agreed to. Clause 81 accordingly ordered to stand part of the Bill. Clause s 82 to 85 ordered to stand part of the Bill. Schedules 7 to 9 agreed to. Clauses 86 to 88 ordered to stand part of the Bill. Clause 89 Joint processing by intelligence services and competent authorities Question proposed, That the clause stand part of the Bill.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I am afraid I do not accept the characterisation the hon. Lady has put on the clause. There is currently an exemption from notifying data subjects if it would constitute a disproportionate effort to do so or prove impossible—obviously, there are cases where it is impossible to notify somebody. At the moment, that exemption can be used only when data was not collected directly from the data subject. Clause 77 will create a new exemption for when data was collected directly from the data subject. It will be limited to processing only for research purposes, and only when there is a change of purpose. We believe that that will help longitudinal studies that originally obtained data from data subjects but that would struggle to notify them about a change in purpose of the study—for instance, due to having lost contact over years or due to a deterioration in the data subject’s condition. The clause is therefore essential to our research facilities in the UK, and I urge Members to support it. Question put and agreed to. Clause 77 accordingly ordered to stand part of the Bill. Clauses 78 and 79 ordered to stand part of the Bill. Clause 80 Automated decision-making

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  I have often wondered whether Kylie’s song “Padam Padam” is a reference to Edith Piaf’s “Padam padam…” because they are also quite similar. This is, of course, a well traversed space for people working in the copyright sphere: trying to make sure that people are not passing off or using other people’s work without permission. The economic and moral rights of rights holders are well established in UK law. We started the process of legislating for that in 1709, under Queen Anne. Dickens had an ambition to make sure that people could not just take copies of his books to America and sell them for free without any payment to him, which is part of why we ended up with an international copyright regime. We do not want to undermine that. Transparency is key, and it was one of the elements that we put into our consultation. We need to be careful about precisely how that transparency works out. The hon. Gentleman referred to proposed new clause 18, which he wants us to do something on within three months. As ambitious as he may be for me, that is a remarkably short period of time for parliamentary drafting. After all, a version of the Bill was first introduced four years ago, yet it still does not have Royal Assent. He refers to the terms “proportionate and effective” in that proposed new clause. To go back to “Hamlet”, aye, there’s the rub. What do proportionate and effective mean, and how do you balance the two? Different sectors will have difficult and competing sets of agendas and we may, in some shape or other, have to arbitrate. The hon. Gentleman is right to say that no one, anywhere in the world, has come to a proper settled position on this issue. In the United States of America, for instance, a lot of AI companies have been relying on fair use, under the slightly different copyright system there, but the most recent federal case found in favour of Reuters against an AI company—the court said that scraping material was not fair use. The EU has not yet fully developed its proposals and has not decided how to implement its transparency requirements. It could be argued that that is one reason why there has not been much additional licensing, which was one of the EU’s declared goals. There is also the question of how to enforce transparency. The clause—in a provision tabled by the admirable Baroness Kidron—specifically gives that enforcement power to the Information Commissioner. I am not sure that is the right place to put that power, or that the Information Commissioner has the expertise or resources for it. Undoubtedly, if there are to be new transparency requirements, we must have some form of enforcement. All those things suggest to me that it is not right to put this power as an addendum to this Bill. The matter should be seen in the round, after a consultation, and there should be a proper primary legislation process, which may not happen for another 12 to 18 months, or even two years. I do not know. The Secretaries of State for Culture, Media and Sport and for Science, Innovation and Technology, and myself, are keen to get to a place where there is more licensing of copyrighted material by AI companies. I do not think anybody expects that the labour of others should be handed over to third parties without recompense or control. That, in itself, is not simple. It might be simple for the Design & Artists Copyright Society to do all the licensing for artists and photographers, but how could that be done for people who works as individuals, rather than as part of a collecting society? That is another set of issues that need to be addressed. I know there are places in the world where one can buy an AI-generated book, and it might be perfectly readable. We might all have authors who we think have worked in that way in the past. But when I read a book, watch a film, or listen to a piece of music, I want to know that it has a human involved in it. Human creativity is a vital part of what renders that process of creativity so important. I think of humans as fundamentally social beings. One of the worst things that can be done to a human being is to put them in solitary confinement, because that denies our fundamental social being. What is so special about all the creative industries is that they enable a connection from human being to human being. I am passionate about not losing that or the value inherent in that. Amendment 22 agreed to. Clause 95, as amended, ordered to stand part of the Bill. Clauses 96 to 103 ordered to stand part of the Bill. Schedule 10 agreed to. Clauses 104 to 108 ordered to stand part of the Bill. Schedule 11 agreed to. Clause 109 to 112 ordered to stand part of the Bill. Schedule 12 agreed to. Clauses 113 to 115 ordered to stand part of the Bill. Schedule 13 agreed to . Clause 116 ordered to stand part of the Bill. Ordered , That further consideration be now adjourned. — (Kate Dearden.)

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Third sitting) · Hansard source

  More

  The new lawful ground of recognised legitimate interest in clause 70 and schedule 4 have been designed to give organisations greater confidence when processing personal data for important public interest objectives, such as preventing crime, safeguarding vulnerable individuals and protecting national security. They also ensure that non-public bodies can share information with public authorities where it is necessary and proportionate to do so without having to conduct a complex balancing test in situations where timely action is essential. Amendment 49 would remove that provision, making it harder for organisations to share data confidently and swiftly for those public interest purposes. I recognise that the hon. Lady might be concerned that the removal of the need to do a detailed legitimate interest balancing test in this narrow set of circumstances could reduce protections, but strong safeguards remain in place, as was recognised in the House of Lords, which did not approve such an amendment. Any processing must still be necessary and proportionate and comply with data protection principles under UK GDPR to ensure that individuals’ rights continue to be protected. Amendment 50 would remove the Secretary of State’s ability to amend the list of recognised legitimate interests using regulations, and delete the list itself from schedule 4 of the Bill. We believe that the ability of the Secretary of State to amend the list is a necessary safeguard to future-proof the framework. This power is not unrestricted. It is subject to strict safeguards, including parliamentary approval by the affirmative resolution procedure and the requirement that any additions must serve public interest objectives under article 23(1) of the UK GDPR. Removing the power would make it more difficult to adapt the framework over time. I have also considered amendment 53, which would prevent health data being processed under the new lawful ground, and I would argue that it conflicts with amendment 49. Health data would be processed under this new ground only in so far as that was necessary for one of the specified recognised legitimate interests in schedule 4 to the Bill. Any processing of health data would also have to meet one of the relevant criteria for processing specific category data in article 9 of UK GDPR and schedule 1 to the Data Protection Act 2018. On that basis, I hope that the hon. Lady will feel able to withdraw her amendments.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Fourth sitting) · Hansard source

  More

  The hon. Lady has tabled another amendment that calls for the Secretary of State to report to Parliament. I hope that I am proving that the requirement to put those reports in the Bill is unnecessary. The amendment would introduce a new duty on the police to review the retention of biometric data under clause 127, and a duty for the Secretary of State to report to Parliament on the use of that data. Clause 127 does not alter the existing duty in the Data Protection Act 2018, which ensures that the police retain only personal data, including sensitive personal data such as biometrics, as long as it is considered “necessary and proportionate”—precisely the terms that she advocated. The biometrics commissioner already has independent oversight of biometric data retained under the Counter-Terrorism Act 2008, and has a statutory duty to report to Parliament annually. The independent reviewer of terrorism legislation also has statutory oversight of all the powers in the 2008 Act, and reports annually to Parliament. For those reasons—without doubting the hon. Lady’s intent—I hope that she will not press the amendment to a vote. Question put and agreed to. Clause 126 accordingly ordered to stand part of the Bill. Clauses 127 to 134 ordered to stand part of the Bill. Clause 135 Compliance with UK copyright law by operators of web crawlers and general-purpose AI models Q uestio n put, That the clause stand part of the Bill.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Fourth sitting) · Hansard source

  More

  Excellent: we all agree that Baroness Owen has done a great piece of work for us, and we are grateful. Incidentally, I am also grateful to Ministry of Justice officials who worked with DSIT officials on the amendments before us today, which provide a more comprehensive version of what was originally argued for. The hon. Member for Runnymede and Weybridge asked me about the difference between solicitation and requesting. Often, it is considered that solicitation would require some form of exchange of money. Obviously, that would not necessarily be the case in this context, which is why we have “requesting”, a broader category than solicitation. A request includes doing an act that could reasonably be taken to be a request—for example, nodding or otherwise indicating agreement in response to an offer or complying with conditions of an offer. It also includes both making a request directed to a particular person or persons and making a request available to one or more people, or people generally, without directing it to a particular person or people. In other words, that is broader than what solicitation would have required. I think Baroness Owen agrees with us that this is therefore a more comprehensive offence. The hon. Gentleman asked about the “reasonable excuse” defence. Let us say that a software developer wants to ensure that he or she—probably “he” in this case—has developed the right safeguards in his software to stop people generating intimate deepfakes without the consent of the person depicted. In some circumstances, he will have a reasonable excuse where, in the course of the testing to ensure that the software does not create such images, he creates a purported intimate image. That might be an instance of a reasonable excuse. I do not want to lay out what reasonable excuses might be, because the courts are so used to dealing with the concept of a reasonable excuse. There are many offences to which it applies, and the courts, as I have said, are used to dealing with them. The hon. Member for Harpenden and Berkhamsted asked me about sharing—is sharing a deepfake an offence? Sharing a deepfake intimate image without consent is already an offence under section 66B of the Sexual Offences Act 2003. I hope that, without further ado, we can agree the amendments and the clause. Amendment 28 agreed to . Amendments made : 29, in clause 141, page 173, line 35, leave out from beginning to end of line 8 on page 174. This amendment removes a new offence of soliciting the creation of a purported intimate image of an adult. For a replacement offence, see Amendment 31. Amendment 30, in clause 141, page 174, line 26, at end insert— “(7A) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.” This amendment adds a defence of reasonable excuse to the new offence of creating a purported intimate image of an adult. Amendment 31, in clause 141, page 174, line 29, at end insert— “66EA Requesting the creation of purported intimate image of adult (1) A person (A) commits an offence if— (a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms), (b) B does not consent to A requesting the creation of the purported intimate image, and (c) A does not reasonably believe that B consents. (2) A person (A) commits an offence if— (a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else), (b) B does not consent to A requesting the inclusion or exclusion of that thing, and (c) A does not reasonably believe that B consents. (3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer). (4) References in this section to making a request (however expressed) are references to— (a) making a request directed to a particular person or persons, or (b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons. (5) References in this section to consent to a person requesting something are— (a) in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and (b) in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate. (6) An offence under this section is committed— (a) regardless of whether the purported intimate image is created, (b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and (c) regardless of where in the world the person or persons mentioned in subsection (4)(a) and (b) is or are located. (7) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request. (8) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both). (9) In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E.” This amendment makes it an offence to request the creation of a purported intimate image of an adult without consent. Amendment 32, in clause 141, page 174, line 30, leave out “soliciting” and insert “requesting”. This amendment is consequential on Amendments 29 and 31. Amendment 33, in clause 141, page 174, line 32, leave out “section 66E” and insert “sections 66E and 66EA”. This amendment provides that the definitions in new section 66F of the Sexual Offences Act 2003 apply for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E). Amendment 34, in clause 141, page 174, line 33, leave out “the creation of a purported intimate image” and insert “an act”. This amendment, and Amendments 35 and 36, adjust the definition of “consent” in new section 66F of the Sexual Offences Act 2003 so that it works for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E). Amendment 35, in clause 141, page 174, line 34, leave out “of creation”. See the explanatory statement for Amendment 34. Amendment 36, in clause 141, page 174, line 35, at end insert “(and see also section 66EA(5))”. See the explanatory statement for Amendment 34. Amendment 37, in clause 141, page 175, line 10, at end insert— “(8) The “maximum term for summary offences” means— (a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months; (b) if the offence is committed after that time, 51 weeks.” This amendment explains what is meant by the “maximum term for summary offences” in new sections 66E and 66EA of the Sexual Offences Act 2003. (New section 66EA is inserted by Amendment 31). Amendment 38, in clause 141, page 175, line 10, at end insert— “66G Creating, or requesting the creation of, purported intimate image of adult: time limit for prosecution (1) Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66EA if the information is laid or the charge is issued— (a) before the end of the period of 3 years beginning with the day on which the offence was committed, and (b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge. (2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact.” This amendment extends the period during which a person may be prosecuted for an offence under new section 66E or 66EA of the Sexual Offences Act 2003 (creating, or requesting the creation of, purported intimate image of adult). Amendment 39, in clause 141, page 175, line 12, after “66E” insert “, 66EA”. This amendment provides that references to an image of a person in new section 66EA of the Sexual Offences Act 2003 (see Amendment 31), like references to such an image in new section 66E of that Act, do not include an image of an imaginary person. Amendment 40, in clause 141, page 175, line 12, at end insert— “(3A) In the Armed Forces Act 2006, after section 177D insert— ‘ 177DA Purported intimate images to be treated as used for purpose of certain offences (1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). (2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).’” This amendment provides that deprivation orders can be made under the Armed Forces Act 2006 in connection with an offence under new section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). Amendment 41, in clause 141, page 175, line 12, at end insert— “(3B) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert— ‘ Sexual Offences Act 2003 38ZA An offence under section 66EA of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).’” This amendment provides that a person cannot be guilty, under Part 2 of the Serious Crime Act 2007, of encouraging or assisting the offence under new section 66EA of the Sexual Offences Act 2003 (requesting the creation of a purported intimate image) (see Amendment 31). Amendment 42, in clause 141, page 175, line 17, leave out “or soliciting the creation of”.— (Chris Bryant.) This amendment is consequential on Amendment 29. Clause 141, as amended, ordered to stand part of the Bill. Clause 142 Power to make consequential amendment Question proposed, That the clause stand part of the Bill.

• 11 Mar 2025 · Data (Use and Access) Bill [ Lords ] (Fourth sitting) · Hansard source

  More

  Clause 124 delivers on the Labour manifesto commitments to further support coroners, and procurators fiscal in Scotland, to access information held by online services after a child’s death. This is a very sensitive issue, and we have tried to address it as such. The provision will require Ofcom, when informed by a coroner, to issue a data preservation notice to specified online service companies. That will help to ensure that those online service companies retain all the relevant data they have on a child so that it will be available on request should a coroner later require it as part of an inquest into a child’s death. The clause demonstrates the Government’s commitments to keeping children safe online and supporting families that have endured unimaginable losses. I am conscious that some might want us to go further; further to the conversation we had earlier, we might be able to have a fruitful discussion on that before we reach Report. On new clause 29, I reassure the hon. Member for Harpenden and Berkhamsted that there are already strong powers to ensure that companies comply with data preservation notices. Those include the power to issue fines for non-compliance of up to £18 million, or 10% of qualifying worldwide revenue, and the ability to hold senior managers criminally liable for non-compliance. Those sanctions will help to ensure that online services comply with any notice issued under section 101 of the Online Safety Act 2023. Under a provision in that Act, the Secretary of State must already review the effectiveness of the Act’s regime, including the data preservation measures, between two and five years after it comes into force and must produce a report detailing his findings, which will then be laid in Parliament. I therefore hope that the hon. Member will not feel the need to press her new clause to a vote.