Contribution
I rise to speak in support of amendment 10 tabled by the hon. Member for Leeds Central and Headingley (Alex Sobel), in my name and that of others. I congratulate him on the amendment, as it is worth talking about.
The amendment is quite simple, in a way, as its key point is that it prevents the transfer of UK user data to jurisdictions where data rights cannot be enforced and there is no credible right of redress. The core principle of data protection law is accountability, yet current UK law allows UK companies to transfer user data to their international partners in jurisdictions where there is no credible appeals process and no predictable rule of law. That basically puts power in the hands of those who have signed contracts containing standard data protection clauses. Those contracts create the illusion of protection, but in reality the data transfer is unsafe, either because the prospect of state interference is real or because the conditions for protection of data transfer simply are not present. We rely too much on the idea that, somehow, contract law in the UK will protect the data being transferred across to other countries, but this is about countries where such rules do not apply.
Transferring data to regimes such as China, for example, is not just a threat to UK citizens’ privacy but a national security risk. British citizens’ personal information, health records, financial details, biometrics, genomics or location data could be accessed under China’s national intelligence law, which compels organisations to co-operate with state intelligence work in secret. That is not speculation; it is the well-known and established law in China.
This is not only about China, but I use that country as a good example because it is a regular abuser of data. We have been unbelievably stupid across the board, in companies and so on, in assuming straightaway that the rules would apply to Chinese companies and they would enforce them. They cannot, because under the national intelligence law, they are told, “You will provide data as and when we require it from whatever source you have access to.”
The situation right now in Ireland is interesting. The Irish Data Protection Commission recently fined TikTok the not inconsiderable sum of €530 million and found that the company had illegally transferred data from users in the European economic area to China. The commission determined that Chinese law offers no essential equivalent to protection on GDPR due to state surveillance laws and the lack of judicial oversight.
That is not a lone example. I have written on a number of occasions about the stupidity of the contract law covering things such as pregnancy tests and covid tests, which were dominated by a Chinese company called BGI. It is the biggest genomics company in the world and it was allowed to hold about 15% of the data gathered for tests for use back in China. We now know that China is using that data, working with AI companies, to develop tests and to reference weaknesses in certain ethnic groups. We see what is already going on in Xinjiang, where a troublesome ethnic group is being deliberately targeted through genocide to get rid of it, but it is also looking at areas and weaknesses in Europe that may well in turn be usable. We have allowed it under this contract to have that data presuming that it would be protected. It is not protected at all; it has simply been transferred and is now being used for military purposes.
Those are just two examples, but it is interesting that Ireland has already taken action. Let us not forgot the Shanghai police database leak in 2022 in which the personal data of over 1 billion Chinese citizens, including criminal records and biometric details, was left openly accessible online for over a year without any enforcement action or Government accountability.
I congratulate the hon. Gentleman on tabling the amendment, because it goes to the heart of what it means to be a democracy that values the rule of law, privacy and the dignity of the individual. It rightly states that no third country can be considered adequate if it lacks credible means for judicial protection, administrative redress or statutory legal remedy. It aligns closely with the high threshold set by the Schrems II judgment, and it ensures that the standards do not fall below those we uphold, and are upheld among our friends in the European Union.