Economy and Fair Work Committee

Meeting date: Wednesday, November 22, 2023

Official Report 688KB pdf

---

Data Protection and Digital Information Bill

Our next item of business is consideration of a legislative consent memorandum and a supplementary LCM on the United Kingdom Parliament’s Data Protection and Digital Information Bill. The UK Government bill was reintroduced in the House of Commons on 8 November 2023. The bill makes changes to the legal regime for processing personal data and touches on a number of different policy areas.

I welcome Richard Lochhead, Minister for Small Business, Innovation, Tourism and Trade. He is joined by Helen Findlay, who is head of information assurance and data protection, and Eilidh McLaughlin, who is head of the digital citizen unit, both in the Scottish Government.

I invite the minister to make a brief statement on the Scottish Government’s position, and then I will move to questions from members.

Good morning and thank you for giving me the opportunity to discuss the legislative consent memorandum and subsequent supplementary LCM for the Data Protection and Digital Information Bill. This is a UK bill that seeks to amend the current data protection framework and improve digital information services. There are four areas of the bill for which consent has been requested. Those areas will help us to work towards delivering a key ambition for the Scottish Government, which is to ensure that Scotland becomes an ethical digital nation where people can trust public services to respect privacy and be open and honest about the way in which data is being used. We want to maintain that commitment and to build public services in the digital domain that are inclusive and practical.

09:45  

The provisions that enable digital verification will mean that people can choose to use that method to prove things about themselves in order to access a service. A trusted identification provider could, for instance, check against data that is provided by a consumer to the Department for Work and Pensions or His
Majesty’s Passport Office, such as when a customer is booking a flight or using a financial service, to help make that transaction more efficient for the customer. Customers will benefit from the smart data provisions when they are seeking lower prices or tariffs for energy bills perhaps. Smart data schemes will empower customers to make better use of their data in order to enable accurate tariff comparisons, compare deals and switch suppliers. The amendments to the Digital Economy Act 2017 mean that enterprise agencies will be able to better target businesses to help them to comply with any relevant law, grow their business and engage in trade activities, and to create green and sustainable businesses.

Police information-sharing agreements could help to mitigate the loss of law enforcement information that was caused by leaving the European Union. For example, an agreement with the EU or EU member states could include real-time alerts on wanted or missing persons, which would allow Police Scotland to know that someone whom the police are questioning at the roadside is also wanted in connection with a serious crime in the EU, or that someone who is found in a vulnerable position in Scotland was recently reported missing on the continent. Consenting to the bill will ensure that the people of Scotland do not miss out on the benefits of such measures, whether as consumers or when interacting with public services.

Finally, the sharing of law enforcement data is vital to ensuring that Scotland’s law enforcement agencies are able to cooperate with our counterparts in the UK and Europe following our exit from the European Union. Ministers and officials from the Scottish Government have engaged regularly with our UK counterparts over the past two years to ensure that our concerns about the bill have been heard. We have stressed to the UK Government our view that the bill’s benefits to organisations should not come at the expense of the rights of individuals and the continued adequacy decision from the European Commission, which is about allowing for easy flow of personal data from the UK to the EU.

Thanks for the opportunity to make some opening remarks. My officials and I—I hope that it will be mainly my officials—will be happy to answer any of your questions.

In recent times, we have seen some controversy with information sharing or companies taking over information completely and utterly, including the national health service south of the border using the US company Palantir for patient medical information. If we were to consent to the motion on the LCM, what impact would that have on medical data sharing and the involvement of large companies in such data?

The provisions that we are discussing today impact on public services’ sharing of information. Eilidh McLaughlin’s role is to oversee that in her own sphere, so I will bring her in in a second or two. The wider general data protection regulation issues are reserved to the UK Government, and that is a different part of the bill. Our provisions relate not to that but to the devolved bits.

In the health sphere in particular, there are very specific conditions to be met under GDPR in order to share information. I cannot comment on the context of the NHS England and Palantir deal because, obviously, I am not privy to all the terms of it, but I suspect, because it is required by law, that NHS England had adequately assessed the data protection implications of sharing that information and ensured that it had the correct legal basis for sharing it. However, that is for NHS England to consider, rather than for us.

The provisions of the bill do not specifically relate to health. I presume, Mr Stewart—forgive me if I am wrong—that you are thinking about the smart data provisions in clauses 65 to 81 of the bill. Those clauses can permit data sharing but, very clearly, at the customer’s request. Therefore, it is sharing securely at the customer’s request with authorised third parties for a benefit to the consumer. The objective of that is to improve data portability between suppliers, customers and relevant third parties, and it is then to help overcome information asymmetry between suppliers and customers. It is a positive data-sharing provision, but it does not negate the need under GDPR to have the correct legal basis to share information.

Thank you. You are saying that such sharing is on a positive basis and that folk have to give consent, but would it be possible, using regulation, to change that, or would that require primary legislative change? I will tell you what I am driving at. The Delegated Powers and Law Reform Committee highlighted the fact that

“it remains the case that the Secretary of State may make regulations within the devolved competence, acting alone. There is no requirement for the Secretary of State to obtain consent or to consult with the Scottish Ministers before exercising the power.”

Could that positive aspect of folk consenting to data sharing be changed using regulation, or would that require primary legislative change to turn all of that on its head?

I believe that that would require primary legislation, because it would mean amending the UK GDPR at that point.

As Kevin Stewart said, the UK Government could legislate to make changes to regulations without consulting the Scottish Government or the Scottish Parliament. What arrangements are in place between officials with the Scottish Government to ensure that we have knowledge of that if it were to happen? Can the minister give a commitment that he will keep the Scottish Parliament up to date if there are any changes?

Yes, we will certainly do our best to keep Parliament up to date with anything that we become aware of. You will perhaps recall that I have come before the committee several times, with various ministerial hats on, to talk about some of these negotiations over the LCMs and about what we can and cannot support in relation to UK secretaries of state retaining power to intervene without consulting the Scottish Government.

We have to take a decision sometimes. In this case, of course, we have got a concession whereby Scottish ministers have a role and were added in to what was originally clause 93—I think that it is now clause 99. We have to weigh up the benefits and disbenefits; we took the view that, overall, in supporting this, there are more benefits than would otherwise be the case.

There are no other questions. I thank the minister for attending this morning, and I will briefly suspend the meeting to allow for a change of witnesses.

09:53 Meeting suspended.  

09:58 On resuming—