#
The DCMS Secretary of State is required to monitor all jurisdictions with UK adequacy decisions, including the US, to ensure that all UK personal data transferred abroad continues to be protected to the UK’s high standards. DCMS works closely with our international counterparts and with UK departments to understand the implications of developments relating to our adequacy decisions for UK data subjects.
#
I thank my noble friend the Minister for that Answer. She will be aware that the House expressed concerns before the Recess about UK digital sovereignty and the way that non-UK entities own much of our digital infrastructure, invest in data centres, process the data of UK citizens in key public services and, of course, transfer the data within adequacy agreements, as she has just addressed. Can she reassure the House that the Government will pay close attention to the vulnerabilities of this country in having some limitations to our tech sovereignty?
#
I note my noble friend’s point about the safety, security and sovereignty of UK citizens’ data. This Government will continue to pay close attention to how UK citizens’ data is transferred overseas and processed by non-UK data controllers. For our adequacy decisions, DCMS undertakes active ongoing monitoring processes, including the tracking of changes to relevant legislative frameworks and case law within third countries.
#
My Lords, we welcome the return of data protection to DCMS. The Government’s own Data (Use and Access) Act replaced the “essentially equivalent” test for adequacy for international data transfers with a lower threshold of “not materially lower”. Does the Minister accept that this weaker standard leaves UK citizens’ data more exposed to the gaps in foreign countries’ protections? What monitoring of that effect are the Government carrying out to safeguard real UK sovereignty over our data?
#
Our priority is the protection of UK citizens’ personal data, and we will monitor our adequacy decisions with this in mind. The DCMS has a statutory duty to monitor all our data adequacy decisions and a duty to amend or revoke them if the Secretary of State becomes aware that the standard has fallen below that of the UK GDPR. Officials are monitoring all existing adequacy decisions on an ongoing basis and the DCMS Secretary of State must be satisfied that the level of data protection afforded to UK data subjects in a given country or territory is not materially lower than that of the UK GDPR.
#
My Lords, given that the UK-US data bridge is estimated to be worth almost £1 billion to the UK economy and that, twice before, transatlantic data arrangements have collapsed following successful legal challenges, what are the Government doing proactively, with the US Administration, to strengthen the bridge now, rather than waiting for weaknesses to be exposed by a third legal challenge?
#
The United States is our close ally and tech partner and we are committed to ensuring that this delivers real benefits and protections for people on both sides of the Atlantic. British companies that contract with companies that have not signed up to US systems, and so are not covered by adequacy, will be obliged to ensure that there are contractual obligations for compliance with GDPR.
#
My Lords, according to an Answer to a Written Question that I received last week, the Government do not centrally record how much of Government’s critical digital infrastructure relies on cloud or computing services that are headquartered overseas or under the jurisdiction of a foreign Government. Will the Government take steps now to assess that exposure? Will Ministers commit to developing a digital sovereignty strategy to ensure that our national security and resilience, and the protection of citizens’ data, are not undermined by reliance on foreign-hosted systems?
#
The Government’s approach is to ensure that the UK has the right balance between access to the benefits of international data flows and carefully protecting both personal and non-personal data. This is underpinned by data protection law, UK security standards and established commercial rules.
#
My Lords, given the evolving legal landscape surrounding transatlantic data flows and potential future changes to US surveillance laws, what contingency plans do the Government have in place, should the current adequacy regulation be challenged in court? Under what specific conditions would the UK suspend the agreement in order to protect citizens’ privacy?
#
The Government take a balanced approach to this, ensuring that public sector systems are secure, resilient and effective while benefiting global innovation. The overarching point is that the Government remain committed to protecting UK citizens’ personal data and continuing to keep other countries’ obligations around personal data under careful review, with the Secretary of State for DCMS being satisfied at all times that the level of data protection afforded to the UK data subjects in a given country or territory is not materially lower than that of GDPR.
#
My Lords, what assessment have the Government made of the amount, type and usage of data transmitted to China by Chinese-manufactured cars?
#
That is a very specialist question. On my first outing on data at this particular Dispatch Box, I would like to say to the noble Lord that I would be more than happy to write to him with the details.
#
My Lords, what assessment has been made of the security risks associated with the use of US tech and digital suppliers, particularly given that the current US regime is focusing on protecting its technology from external regulation?
#
Risks linked to technology suppliers are managed through established security and resilience processes. Decisions in these areas are informed by evidence on security, reliability and long-term resilience. The Government seek to balance the benefits of secure international data flows with our high standards of personal data protection. We continue to monitor developments relevant to the US adequacy decision and to engage with international partners to ensure that our standards continue to be met.
#
My Lords, I have long been concerned about the internet of things, especially the internet of things that we tend to buy on eBay or Temu or one of those predominantly Chinese importation agents. How can we be sure that there are not data flows going on, particularly with the firmware updates that are regular with many internet of things items? Do the Government have any strategy to look at this? I can only imagine that it is down to local councils to manage importation of goods at source—and I would hazard a guess that it is perhaps beyond them.
#
DCMS aims to facilitate the flow of data to places that have high data protection standards, and will continue to monitor the threats to UK personal data. On the matter of other jurisdictions, including China, in determining where UK data can flow, we consider the risk to UK data subjects rather than jurisdiction.