Lord Vallance of Balham (Lab)

I will now speak to the government amendment tabled in my name. The Government are firmly committed to protecting children’s personal data and ensuring that online services likely to be accessed by children are designed with their safety and privacy in mind. We have listened carefully to the concerns raised in this House during earlier debates and have worked quickly to bring forward this amendment, which reflects those discussions. During the debate on 21 January, I made clear that, while we could not accept Amendment 22 from the noble Baroness, Lady Kidron, which would have placed new duties on all data controllers, the Government were open to a more targeted approach that addressed the areas of greatest concern. This amendment delivers on that commitment. It amends Article 25 of the UK GDPR, which already requires data controllers to design appropriate organisational and technical measures to implement the data protection principles. The amendment strengthens these obligations for information society services providers, such as social media and the streaming sites likely to be accessed by children. They will be required to give extra consideration when deciding which measures are appropriate for online services likely to be accessed by children. Specifically, information society services providers must consider “the children’s higher protection matters” set out in the clause when designing their processing activities. These are: “how children can best be protected and supported when using the services, and … the fact that children … merit specific protection with regard to their personal data because they may be less aware of the risks and … their rights in relation to such processing, and … have different needs at different ages and at different stages of development”. The new duty expressly applies to “information society services which are likely to be accessed by children”. They are the same organisations that should already be following the ICO’s age-appropriate design code. Organisations that are already complying with the code should not find it difficult to comply with the new duty, but organisations that have treated compliance with the code as optional will now be under a clear legal duty to design their services with children’s rights and interests in mind. I also want to make it clear that other organisations that process children’s personal data may need to consider these matters on a case-by-case basis and depending on the context. Although this amendment creates an express duty on information society services providers, those matters may sometimes be relevant in other contexts. Proposed new subsection (4) makes that clear. I take this opportunity to thank the noble Baroness, Lady Kidron, and other noble Lords who have contributed to this important debate. I hope this amendment, together with the other steps we are taking in the Bill to protect children, including the new duty on the ICO to consider children’s interests when carrying out its regulatory functions, will be welcomed across the House. I beg to move.