Hansard

The UK Government’s Data Protection and Digital Information Bill engages the legislative consent process in a number of areas. The bill is UK legislation that seeks to amend the current data protection framework and improve digital information services. I will focus on the four areas that fall under the legislative competency of the Scottish Parliament and for which consent is required. Those will help us to work towards a key ambition for the Scottish Government, which is to ensure that Scotland becomes an ethical digital nation in which people can trust public services to respect privacy and to be open and honest in the way that their data is being used. We want to maintain that commitment and build public services that are inclusive and practical in the digital domain.

First, the provisions enabling digital verification will mean that people will be able to choose to use that method to prove things about themselves in order to access a service. For example, using data that is held by the Department for Work and Pensions or His Majesty’s Passport Office, a trusted identification provider could check against data that has been provided by a customer when conducting a commercial transaction, such as booking a flight or using a financial service. That will be done at the request of the individual only and will aim to make transactions more efficient for them. Customers will benefit from smart data provisions when they are seeking lower prices or tariffs for energy bills. Smart data schemes will empower customers to make better use of their data to enable accurate tariff comparisons, compare deals and switch suppliers. The amendments to the Digital Economy Act 2017 could mean that enterprise agencies will be able to better target businesses to help them to comply with any relevant law, grow, engage in trade activities and become green and sustainable. Consenting to that will ensure that the people of Scotland do not miss out on the benefits of those measures, whether that is as consumers or while they are interacting with public services.

The sharing of law enforcement data is vital to ensuring that Scotland’s law enforcement agencies are able to co-operate with their counterparts in the UK and Europe, following our exit from the European Union. Police information-sharing agreements could help to mitigate the loss of law enforcement information that has been caused by Britain leaving the union. For example, an agreement with EU or EU member states could include real-time alerts on wanted or missing persons, which would allow Police Scotland to know that someone who it is questioning at the roadside is also wanted in connection with a serious crime in the EU, or that someone who is found in a vulnerable position in Scotland was recently reported missing on the continent.

Finally, agreement with clause 131 of the bill, regarding the power to provide information for social security purposes, would allow us to maintain the agency agreements for the delivery of social security payments in Scotland and safeguard the important work that Social Security Scotland does.

Overall, we feel that the amendments provide a benefit to the people of Scotland. Beyond the legislative consent motion, concerns have been raised that the bill may weaken the data protection framework that was put in place prior to Brexit and that currently aligns with the EU standard. Ministers and officials from the Scottish Government have engaged regularly with our UK counterparts over the past two years to ensure that our concerns about the bill have been heard. We have stressed our view to the UK Government that the bill’s benefit to organisations should not come at the expense of the rights of individuals and the continued adequacy decision from the European Commission, which allows for the easy flow of personal data from the UK to the EU. We do not believe that the motion that is being debated will impact those rights or data adequacy, which is why I ask the Scottish Parliament to give its consent and agree to the motion.

I move,

That the Parliament agrees that the relevant provisions in the Data Protection and Digital Information Bill, introduced in the House of Commons on 8 March 2023 and subsequently amended, so far as these matters fall within the legislative competence of the Scottish Parliament should be considered by the UK Parliament.