Data Protection & Digital Information Bill & Smart Data: call for written evidence

1. This submission is made by the UK Competitive Telecommunications Association (UKCTA). UKCTA is a trade association promoting the interests of fixed line telecommunications companies competing against BT as well as each other, in the residential and business markets. Its role is to develop and promote the interest of its members to Ofcom and the Government. Details of membership can be found at www.ukcta.org.uk. Its members serve millions of UK consumers, we welcome the Data Protection and Digital Information Bill. It allows the UK to benefit from updating aspects of the UK General Data Protection Regulation without compromising protections.
2. However, we have concerns about Part 3 of the Bill, which will enable the introduction of Smart Data schemes across the economy. These schemes have the potential to be valuable, but the Bill as drafted allows them to be introduced across a variety of sectors – including communications – with little evidence of their effectiveness in supporting customers and at a very high cost to industry. Without changes to the legislation, these schemes could act as a significant drag on business resource, preventing the introduction of initiatives that will truly benefit customers.

Smart data and the communications sector

3. Part 3 of the Bill enables the Government to introduce Smart Data schemes in any sector in the UK via secondary legislation. This could include communications, energy and other utilities, insurance, retail (e.g., supermarkets) and even B2B services.
4. We believe there is currently no evidence to suggest that a Smart Data scheme in our sector – communications – would bring clear and tangible additional benefits to customers. Our sectoral regulator, Ofcom, also previously consulted on this in 2020 and came to the same conclusion.
5. The communications sector already has a very good range of measures to support consumers using data to find the best deal for them. For example, Ofcom introduced End of Contract Notifications in 2020 which tell customers when their current contract is ending and what they could save by signing up to another deal. It is also in the process of introducing One Touch Switching for fixed broadband which will make it easier for customers to move between providers who operate on different networks and consulting on proposals which will make it easier for customers to understand the range of technologies provided by our members.
6. Given this high level of existing regulatory support, we cannot see how the introduction of a new and expensive Smart Communications scheme – which the Government’s own impact assessment costs at up to £750m for industry – would bring additional benefits to consumers that match these implementation costs.
7. More broadly, we see little evidence of the success of Smart Data schemes internationally. Even in the UK, Open Banking is so far the only example of an operational Smart Data scheme and has cost the sector upwards of £1.5 billion despite being a less complex sector.
8. Given this, it is imperative that government weighs the costs of any potential scheme against the benefits before making a decision on its introduction. We also believe that, given their experience in examining pro-consumer interventions, sectoral regulators are also best placed to assess the costs and benefits and should be formally involved in the regulation-making process.

Changes to Part 3 of the Bill

9. The following amendments to Part 3 of the Bill would address some of the above concerns:
   1. To clause 62 (4) add The Secretary of State or the Treasury shall decide to make regulations under this section only if – (i) an impact assessment has been undertaken by or at the direction of the Secretary of State or the Treasury; and (ii) based on the findings of such impact assessment, the Secretary of State or the Treasury is satisfied that the likely benefits outweigh the likely costs. This would ensure that a full cost/benefit analysis is undertaken ahead of a regulation being introduced and schemes only introduced in sectors where there are clear benefits.
   2. A new clause should be added stating (a) The Secretary of State or the Treasury may direct a competent authority to exercise the power to make provision in connection with customer data under this section. (b) Where the Secretary of State or the Treasury directs a competent authority under subsection (5)(a), reference to “regulations” under this Part means ‘such conditions as the competent authority may impose in exercising the power under subsection (5)(a)’ and reference to “the Secretary of State or the Treasury” means such competent authority. This would allow the Secretary of State/Treasury to choose to direct the power to introduce a smart data scheme to a relevant sectoral regulator.

Unlawful Direct Marketing

10. Clause 85 in the Bill amends the Privacy and Electronic Communication Regulations (“PECR”) and introduces a new duty to on public electronic communications services and networks (respectively, “PECS” and “PECNs”) to notify the ICO of any reasonable grounds it has for suspecting that a person is contravening or has contravened any of the direct marketing regulations using their service or network.
11. As of today, a significant amount of communications providers already share volumetric data and intel on call traffic trends or patterns with Ofcom and other bodies seeking to tackle scam and spam calls. Therefore, the sector is willing to work with the ICO on developing appropriate and technically feasible guidance on what ‘reasonable grounds’ there may be for suspecting contravention of direct marketing regulation when looking at call traffic.
12. However, this clause also brings into scope email traffic. Internet Service providers (ISPs) are not able to able to identify from traffic patterns whether a use is sending emails, let alone whether that activity is likely to be direct marketing activity that breaches PECR.
13. Given this, it is unclear what ‘reasonable grounds’ ISPs could have for reporting. The legislation risks creating a duty with which providers are unable to comply.
14. Government should make clear that the duty only applies in so far as it is technically feasible.
15. To the extent the Government plans to proceed with the duty to report, we believe that the Bill should be amended to recognise the need for comms providers to be provided with this guidance before: (i) implementing operational processes to comply with the new Reg 26A PECR and (ii) any notification obligations commence. This would be best achieved by including an additional subsection to Reg 26A, stating that these subsections will come into force after the ICO publishes its guidance and has allowed for an implementation period of, for example, at least a year after the publication of the guidance.