Conclusions and recommendations
The opportunities for big data
1.The UK is a world leader in big data research across disciplines and our Tech sector, especially in London, dramatically outperforms the rest of the economy on growth and productivity indicators. By identifying big data as one of the Eight Great Technologies, and investing significant financing in large scale data infrastructure, the Government has signalled that realising the full potential of big data is a priority. However, investing in capital infrastructure projects alone will not deliver this. Urgent action on the digital skills crisis, overcoming public distrust over data sharing, further progress on ‘open data’ and greater clarity over prospective data protection legislative changes are essential if the UK is to set the pace on big data. We discuss these pre-requisites [below]. (Paragraph 19)
Skills and Infrastructure
2.The digital skills gap is approaching crisis levels and this not only has economic implications but also puts the quality and security of this data at risk. There is a range of Government initiatives to help develop computing and digital skills, but the wider set of ‘big data’ skills is not being strategically addressed. This risks UK business being unable to grow the big data sector at the pace it should. In the meantime, this skills gap is forecast to grow exponentially as big data reaches further into the economy. The evidence we received on the digital skills crisis was so concerning that we have launched a further inquiry specifically into this issue on which we will report shortly. In the meantime, the Government should commit to (a) a continuing substantial role in developing data analytics skills in businesses, with others already working in this field; (b) increasing big data skills training for staff in Government departments; and (c) promoting more extensively the application of big data at local government level. But the Government must also address the wider context of its policies on apprenticeships and immigration control. As it develops its approach in these areas, it should explicitly address widespread concerns that these could jeopardise the necessary big data skills-base that the UK will increasingly need. The Government should also set out in detail how the Government Digital Services’ budget, including the additional funding announced in the Spending Review, will be spent. (Paragraph 27)
3.While investment for big data research is welcome, we believe that the Government should explore further ways of making publicly-funded infrastructure and expertise available to more businesses. The Digital Catapult is a good start but it is essential that ongoing resource investment in the Catapult is maintained so that it can consolidate and expand its work. As big data becomes an increasingly significant part of our economy, the Government should set out its strategy for longer term big data infrastructure development and how it will work with industry to provide a coherent programme of business support. (Paragraph 31)
Open data and data sharing
4.There are enormous benefits in prospect for the economy and for people’s lives from making the nation’s core data infrastructure ‘open’. The Government’s work in this area has put the UK in a world-leading position. But there is more to do to breakdown departmental data silos, to bring data together in order to further improve public services, as well as to improve data quality. The Government should set out how it can build capacity to deliver more datasets, increasingly in real-time, both to decision-makers in Government and to external users and, in particular, should work to establish a right of access to data for the Office for National Statistics. The Government should also establish a framework—to be overseen by the Government Digital Service, the Office for National Statistics or another expert body—for auditing the quality of data within Government departments amenable for big data applications, and for pro-actively identifying data sharing opportunities to break departmental data silos. (Paragraph 42)
5.Patients and GPs are more likely to be content for their personal data to be used for healthcare and medical research if the benefits—both to the individual and to society—are clearly explained and adequate safeguards are in place. But the track-record of ‘care.data’ shows that this cannot be taken for granted. The Government cannot afford a second failure from a re-launched scheme. The Government should take careful account of the lessons from the pathfinder projects as well as the experience of the similar, successful, scheme in Scotland. To help bring patients onside and to streamline healthcare across different NHS providers—hospitals, GPs, pharmacists and paramedics—it should give them easy online access to their own health records. (Paragraph 52)
6.While the private sector is making great strides in identifying opportunities for bringing different datasets together, it is understandably more challenging for businesses in a competitive market to share valuable data with one another or with Government. The Government’s Digital Catapult therefore plays a vitally important role in facilitating private sector data sharing in a ‘safe’, trusted environment. The Government should map out how the Catapult’s work and its own plans to open and share Government data could be dovetailed. The Government should also consider the scope for giving the Office for National Statistics greater access both to Government departments’ data and private sector data. (Paragraph 56)
Data protection
7.It is important to note that personal data is only a small proportion of big data—there is huge value still to be realised from novel uses of non-personal datasets like transport data, weather data, etc. Nevertheless, given the scale and pace of data gathering and sharing, distrust arising from concerns about privacy and security is often well founded and must be resolved by industry and Government if the full value of big data is to be realised. We recommend below the establishment of a Council of data Ethics to help address these issues. (Paragraph 60)
8.Businesses and governments that communicate most effectively with the public, giving the citizen greater control in their data transactions by using simple and layered privacy notices to empower the consumer to decide exactly how far they are willing to trust each data-holder they engage with, will gain a huge commercial and societal advantage. Although the length of a privacy notice will be dictated by the service or data application involved, it should be best practice to draft them as simply as possible. Furthermore, if informed, freely given consent must be the bedrock of a trusting relationship between a consumer and a data-holder, then it must always be part of that deal that consent freely given can also be freely withdrawn.
(Paragraph 66)
9.As citizens’ personal data is being used in ever increasing volumes and for ever changing purposes, it is vital that the Information Commissioner’s Office has the powers it needs to help ensure data protection. With a new EU data protection regulation now agreed, we welcome the Government’s commitment to review current penalties for data protection breaches. The Government should nevertheless introduce as soon as possible a criminal penalty for serious data protection breaches by commencing sections 77 and 78 of the Criminal Justice and Immigration Act 2008. The Government should not regard the two-year implementation period of the recently agreed EU data protection regulation, which will provide for bigger fines, as a reason for delaying this. (Paragraph 75)
10.The Government should agree to the Information Commissioner’s request to perform compulsory data protection audits on local government. (Paragraph 76)
11.The Government should set out its anonymisation strategy for big data in its upcoming Digital Strategy, including a clear funding commitment, a plan to engage industry with the work of the UK Anonymisation Network and core anonymisation priorities. (Paragraph 77)
12.The Information Commissioner has developed a data protection kitemark, ready for use now. The use of such kitemarks, acknowledging good behaviours, would complement the greater sanctions of criminal penalties for bad behaviours that we have recommended. The Government and Information Commissioner should work with industry to ensure that the UK’s already developed kitemark is adopted as soon as possible, and initiate a campaign to raise public awareness of it. (Paragraph 82)
13.The Data Protection Act will have to be revised to accommodate the recently agreed EU Data Protection Regulation, which will come into force with the next two years or so. We do not share the Government’s view that current UK data protections can simply be left until then. Some areas in particular need to be addressed straightaway—introducing the Information Commissioner’s kitemark, and introducing criminal penalties rather than relying only on the prospective greater fines envisaged by the new EU Regulation. (Paragraph 100)
14.The new EU Regulation appears to leave it open for data to be re-used, and potentially de-anonymised, if “legitimate interests” or “public interest” considerations are invoked. This is an issue that urgently needs to be addressed as big data becomes increasingly a part of our lives. There are arguments on both sides of this issue: Seeking to balance the potential benefits of processing data (some collected many years before and no longer with a clear consent trail) and people’s justified privacy concerns will not be straightforward. It is unsatisfactory, however, for the matter to be left unaddressed by Government and without a clear public-policy position set out. The Government should therefore clarify its interpretation of the EU Regulation on the re-use and de-anonymisation of personal data, and after consultation introduce changes to the Data Protection Act 1998 as soon as possible to strike a transparent and appropriate balance between the benefits of processing data and respecting people’s privacy concerns. (Paragraph 101)
15.Given the UK’s leading position in big data and the Government’s stated commitment to capitalise on the potential innovation and research opportunities it promises, the Government should establish a Council of Data Ethics within the Alan Turing Institute as a means of addressing the growing legal and ethical challenges associated with balancing privacy, anonymisation, security and public benefit. Ensuring that such a Council is established, with appropriate terms of reference, offers the clarity, stability and direction which has so far been lacking from the European debate on data issues. (Paragraph 102)
© Parliamentary copyright 2015
Prepared 11 February 2016