Iqbal Mohamed

I stand in support of the objectives and aims of the Bill. Having worked with data and technology for more than 30 years, I wholeheartedly support the ethical, responsible and equitable use of technology and data to benefit and make easier the lives of the people of the UK, and to increase the efficiency of service delivery in the public sector. I also pay tribute to campaign groups including Big Brother Watch and Justice for their work to protect the vital privacy and data protection rights of people in the UK. I want to share some concerns I have on the Bill, focused on two areas: clause 70 and clause 80. I urge the Government to take note and amend the Bill to ensure that the British public’s privacy rights and rights to equality and non-discrimination are not compromised. Clause 70 will weaken protections around personal data processing, thereby reducing the scope of the data that is protected by safeguards in data protection law. I am particularly concerned about the executive power to determine recognised legitimate interests, which will allow for more data to be processed with fewer safeguards than is currently permitted and reduce existing protections that ensure the lawful use of data. I am also concerned about the increased power of the Secretary of State to amend the definition of “recognised legitimate interest” through secondary legislation without appropriate parliamentary scrutiny. Currently, automated decision making is broadly prohibited, with specific exemptions. Clause 80 will permit it in all but a limited set of circumstances. That will strip the public of the right not to be subject to solely automated decisions, which risks exacerbating the likely possibility of unfair, opaque and discriminatory outcomes from ADM systems; limiting individuals’ rights to challenge ADM; permitting ADM use in law enforcement and intelligence, with significant carve-outs in relation to the existing safeguards; and giving the Secretary of State executive control over the ADM regulatory framework through secondary legislation. They may not be direct examples, but Horizon and the many Department for Work and Pensions scandals show the failings and risks of relying solely on automation and AI. The Bill introduces a new regime for digital verification services. It sets out a series of rules governing the future use and oversight of digital identities as part of the Government’s road map towards digital identity verification. The framework currently lacks important safeguards and human rights principles that prevent the broad sharing of the public’s identity data beyond its original purpose. Further, the Bill misses the opportunity to take a positive, inclusive step to codify a right for members of the public to use non-digital ID where reasonably practicable. Such a right is vital to protect privacy and equality in the digital age. The right to use a non-digital ID where practicable would protect accessibility, inclusion and people’s choice in how they choose to verify their identities when accessing public and private services, legally protecting the millions of people who cannot or do not want to hand over personal identity data online where an alternative is reasonably practicable. Returning to automated decision making, it is clearly insufficient to move the burden of safeguards from the data controller, who is currently responsible for preventing harm, to the individual to complain if the ADM is unfair, since people may not complain due to a lack of knowledge or confidence, intimidation and various intersecting vulnerabilities.