1.The Government thanks the Committee for its report on the Big Data Dilemma, and for its helpful recommendations. We are pleased that the report recognises Big Data as a UK success story, and agree with the Committee’s assessment that Big Data has the potential to provide substantial economic and societal benefits for the UK.
2.We are living in an increasingly data-driven world and, when used responsibly, data can stimulate business innovation, accelerate new research breakthroughs and help deliver more personalised and responsive public services.
3.Since 2010, the Government has invested over £520 million in developing the UK’s big data e-infrastructure, developed a world-leading open data programme, and has made important changes to the UK’s education and training system. Later this year we will publish our Digital Strategy, which will set out how we will continue to support the adoption of digital technologies.
4.We will also publish later this year the National Innovation Plan that will layout how we will put the UK at the forefront of using the power of data to drive innovation.
5.The Government agrees there are significant challenges to address if the UK is to remain at the forefront of the use of data analytics. We recognise that people have concerns about how their data is collected and used, and we understand the need to create an environment that both respects peoples’ privacy and supports business growth. Further action is also required to meet the growing demand for data skills.
6.Responses to each of the Committee’s recommendations are provided below.
The digital skills gap is approaching crisis levels and this not only has economic implications but also puts the quality and security of this data at risk. There is a range of Government initiatives to help develop computing and digital skills, but the wider set of ‘big data’ skills is not being strategically addressed. This risks UK business being unable to grow the big data sector at the pace it should. In the meantime, this skills gap is forecast to grow exponentially as big data reaches further into the economy. The evidence we received on the digital skills crisis was so concerning that we have launched a further inquiry specifically into this issue on which we will report shortly.
In the meantime, the Government should commit to (a) a continuing substantial role in developing data analytics skills in businesses, with others already working in this field; (b) increasing big data skills training for staff in Government departments; and (c) promoting more extensively the application of big data at local government level. But the Government must also address the wider context of its policies on apprenticeships and immigration control. As it develops its approach in these areas, it should explicitly address widespread concerns that these could jeopardise the necessary big data skills-base that the UK will increasingly need. The Government should also set out in detail how the Government Digital Services’ budget, including the additional funding announced in the Spending Review, will be spent. (Paragraph 27)
A) The role of Government to build data skills, working with industry and academia:
7.The Government recognises the challenge of developing the data analytics skills that the UK needs to make the most of big data. To achieve this, we are working with stakeholders from the supply and demand side and taking action across the education and training pipeline. This begins at school level, where the reformed computing curriculum is equipping young people with the computational thinking that will prepare them for continued study or employment in digital roles—including data analytics.
8.The Government is working closely with the Higher Education sector to ensure they are providing the data skills that industry needs. We are providing £19.5 million for the Q-Step initiative to support the development of specialist data-specific undergraduate programmes, and over £40 million is being invested in Centres for Doctoral Training in different areas of data science. From October 2016, the Alan Turing Institute will support data scientists through its doctoral studentship programme. The Government is also funding computer science degree conversion pilots. These have been designed by industry and will allow graduates from a range of disciplines (such as engineering) to gain data analyst skills. The first tranche of students will graduate in summer 2017.
9.The Government is also working in partnership with employers to ensure apprenticeships meet the evolving needs of industry. For example, reformed apprenticeships are putting industry in the driving seat to design standards that meet their needs. The Data Analyst apprenticeship standard (which is currently being approved) will ensure apprentices are gaining the data skills that employers require. In addition, over forty employers and nine universities have collaborated on the new Digital Degree Apprenticeship to provide the right mix of technical and professional skills. There is a ‘data fundamentals’ element in every programme of study, and two universities offer a specialism in data science.
10.The Government is also supporting a business-led Data Skills Taskforce which is considering recommendations made in reports published in 2015 by Universities UK and NESTA. The Taskforce is engaging with organisations identified in the reports, and other bodies involved in the development of data skills, to take forward the recommendations.
B) Activity to build data skills training for government staff and C) to promote the application of big data at local government level:
11.It is essential that government is building the capability and expertise to make the most of big data innovations and the numerous available data sets. To ensure expertise is developed, the Government is providing data science training across government departments and professions. There are several initiatives underway, organised centrally or run by departments, with senior level oversight coming from a cross-government Data Leaders Network.
12.The Data Science Accelerator programme, run by the Government Data Science Partnership (GDSP), is a training programme for budding data scientists in government. To date, the programme has been completed by 20 analysts. The fifth round of the programme has just been launched in three hubs in London, Sheffield and the South West. The offer is being extended beyond central government—for example the Greater London Authority is now participating in the programme. This model of training is also being adopted by other bodies, such as the Office for National Statistics Data Science Academy.
13.The analytical professions recognise government’s need for data science skills and are considering new tools, techniques and data sources in the development of its professions. The statistical, operational research and economic professions all have data science objectives in their competency frameworks and skills development programmes. A growing community run by the GDSP brings together over 200 analysts for events every 6–8 weeks. The intention is to extend this to different regions of the country to ensure local authorities and locally based departments can participate. This would allow local authorities to showcase some of the great data science work they are doing.
14.The Local Government Association is working with NESTA to examine the role of data in local government, and to identify the areas of greatest potential gain. The Economic and Social Research Council (ESRC) Business and Local Government Data Research Centre, at the University of Essex, is working with local authorities including Essex, Kent, Medway, Norfolk and Southend to use data more effectively.
15.The Government recognises the importance of looking across its policies to consider opportunities to build UK data skills capability. In relation to migration, four digital roles—including a data scientist role—were added to the Shortage Occupation List in 2015. This will enable companies to access the brightest and best data analyst talent from around the world. In addition, in October 2015, the Government announced the Tech Nation visa—a dedicated route, with 200 visas available per year, to help digital businesses secure world-class talent from outside the EU.
16.The Government’s ambition for 3 million apprenticeship starts this Parliament provides an opportunity to increase the number of people embarking on data apprenticeships. As set out above, reformed apprenticeships enable employers to set standards that meet their needs. In addition, the apprenticeship levy should incentivise more companies to take on apprentices, with those companies paying into the levy in England able to use levy funds to pay for apprenticeship training. The 2016 Budget announced that employers will receive a 10% top-up to their monthly levy contributions in England and this will be available for them to spend on apprenticeship training through their digital account.
17.Government Digital Service’s plans for the spending review, along with those of the Cabinet Office, have been published in the Cabinet Office’s Single Departmental Plan.
While investment for big data research is welcome, we believe that the Government should explore further ways of making publicly-funded infrastructure and expertise available to more businesses. The Digital Catapult is a good start but it is essential that on-going resource investment in the Catapult is maintained so that it can consolidate and expand its work. As big data becomes an increasingly significant part of our economy, the Government should set out its strategy for longer term big data infrastructure development and how it will work with industry to provide a coherent programme of business support. (Paragraph 31)
18.The Government recognises the great value unlocked by helping businesses to participate in the evolving digital economy. This is why we have provided advice and investment, and have supported both the Digital Catapult and the Open Data Institute in their efforts to connect businesses to one another.
19.The Government has also established new centres of knowledge and research such as the Alan Turing Institute and, in his budget of 16 March 2016, the Chancellor confirmed Government investment of over £10 million to create a new Office for National Statistics hub for data science and a centre for excellence in economic measurement, in line with Professor Sir Charles Bean’s recommendations in his independent review of economic statistics.
20.Catapult centres remain a priority for the Government’s innovation programme and the Government will continue to review and develop the infrastructure needed to maintain the UK’s leadership position as this field continues to develop.
21.In March 2012, the Government established the E-Infrastructure Leadership Council to provide strategic advice around e-infrastructure and high-performance computing in the UK. The Government has now asked the Council to refresh their strategy on research infrastructure, including how it can further enhance the relationship with industry.
There are enormous benefits in prospect for the economy and for people’s lives from making the nation’s core data infrastructure ‘open’. The Government’s work in this area has put the UK in a world-leading position. But there is more to do to breakdown departmental data silos, to bring data together in order to further improve public services, as well as to improve data quality.
The Government should set out how it can build capacity to deliver more datasets, increasingly in real-time, both to decision-makers in Government and to external users and, in particular, should work to establish a right of access to data for the Office for National Statistics. The Government should also establish a framework—to be overseen by the Government Digital Service, the Office for National Statistics or another expert body—for auditing the quality of data within Government departments amenable for big data applications, and for pro-actively identifying data sharing opportunities to break departmental data silos. (Paragraph 42)
22.The Government agrees that more needs to be done to unlock the power of data. Proportionate, secure and well-governed sharing of information between public authorities can improve the lives of citizens, support decisions on the economy which allow businesses to flourish, and improve the efficiency and effectiveness of the public sector.
23.The Government is proud to have led the world in the release of open data, with over 24,000 datasets having been released through our data.gov.uk portal. The Government is committed to improving the quality, reliability and availability of the datasets we hold, both within the public sector and externally. This will be achieved in part through the Technology Code of Practice set out for government and public services which requires that all technology-related projects make data open by default and be consistent with Open Data principles of structure, readability and discoverability.
24.The Government launched a public consultation on Better Use of Data in Government on 29 February 2016. The consultation includes proposals to:
25.The Government Digital Service’s work on creating canonical registers provides the basis for improving data quality in government. Creating a register for a particular type of data will ensure it is clear who is responsible for that data, its quality, and the business processes surrounding it. Under this process, data quality issues can be identified at source through a public record of feedback. This can remove the need for retrospective quality assurance of datasets, which is both costly and time consuming.
26.The Government also recognises a need for better awareness amongst civil servants of what data is available across government. We will work to create tools that aid discovery of available data and help users understand the data quality and structure. The Government is for example looking to build on the current system by which public sector organisations can access Ordnance Survey data through the Public Sector Mapping Agreement by exploring how to enable the public sector to have free at the point of use access to Land Registry data for policy development and service delivery purposes.
Patients and GPs are more likely to be content for their personal data to be used for healthcare and medical research if the benefits—both to the individual and to society—are clearly explained and adequate safeguards are in place. But the track-record of ‘care.data’ shows that this cannot be taken for granted. The Government cannot afford a second failure from a re-launched scheme.
The Government should take careful account of the lessons from the pathfinder projects as well as the experience of the similar, successful, scheme in Scotland. To help bring patients onside and to streamline healthcare across different NHS providers—hospitals, GPs, pharmacists and paramedics—it should give them easy online access to their own health records. (Paragraph 52)
27.The data collected by the NHS and the wider care system is a rich resource, with enormous potential to be used to drive improvements in health and care. However, our ability to fully exploit these assets is limited because of professional, technical and behavioural barriers to data sharing. Additionally, there has in the past been a tension between the principles of transparency and the desirability of sharing data on the one hand, and public concern about privacy and the potential for misuse of data on the other. It is vital for the future of the health and care system that we overcome this.
28.In September 2015, The Secretary of State for Health commissioned the Care Quality Commission to undertake a review of data security in the NHS. In parallel, the Secretary of State has commissioned Dame Fiona Caldicott, the National Data Guardian, to undertake an independent review of data security and consent that will work to:
29.The National Data Guardian’s independent review will report shortly. The Government will then consult on the recommendations and respond to them in due course.
While the private sector is making great strides in identifying opportunities for bringing different datasets together, it is understandably more challenging for businesses in a competitive market to share valuable data with one another or with Government. The Government’s Digital Catapult therefore plays a vitally important role in facilitating private sector data sharing in a ‘safe’, trusted environment.
The Government should map out how the Catapult’s work and its own plans to open and share Government data could be dovetailed. The Government should also consider the scope for giving the Office for National Statistics greater access both to Government departments’ data and private sector data. (Paragraph 56)
30.The Government recognises the valuable contribution of the Digital Catapult in reducing barriers to collaboration between private sector organisations, and the important work undertaken on data sharing by other bodies, including the Open Data Institute. We will continue to work closely with the Digital Catapult and other stakeholders to ensure our work on data—including open data—is aligned.
31.Data is the fuel of the digital economy and the Government is committed to ensuring that, through the our data programmes and our work to improve data infrastructure, more data is available, more widely and at higher quality, to enable ever-greater innovation throughout the economy.
32.The Government’s consultation on Better Use of Data in Government, launched on 29 February 2016, includes proposals to provide a new statutory gateway for the UK Statistics Authority (and the Office for National Statistics as its executive arm) to access data held by Government departments, other public bodies, charities, and large and medium-sized businesses.
33.In the Chancellor’s budget of 16 March 2016, the Government has also confirmed investment of over £10 million to establish a new Office for National Statistics (ONS) Data Science Campus. Building on existing initiatives in the ONS and the Government Data Science Partnership, the Data Science Campus will act as a hub for the whole of Government to gain practical advantage from the wider investment in data science research, and help cement the UK’s reputation as an international leader in data science. By partnering with academia, the ONS will develop more ‘real-time’ economic statistics so that emerging issues and trends are seen quicker and understood in greater detail.
It is important to note that personal data is only a small proportion of big data—there is huge value still to be realised from novel uses of non-personal datasets like transport data, weather data, etc. Nevertheless, given the scale and pace of data gathering and sharing, distrust arising from concerns about privacy and security is often well founded and must be resolved by industry and Government if the full value of big data is to be realised. We recommend below the establishment of a Council of Data Ethics to help address these issues. (Paragraph 60)
34.The Government’s response to this recommendation is set out in paragraphs 56 to 59 of this paper.
Businesses and governments that communicate most effectively with the public, giving the citizen greater control in their data transactions by using simple and layered privacy notices to empower the consumer to decide exactly how far they are willing to trust each data-holder they engage with, will gain a huge commercial and societal advantage. Although the length of a privacy notice will be dictated by the service or data application involved, it should be best practice to draft them as simply as possible. Furthermore, if informed, freely given consent must be the bedrock of a trusting relationship between a consumer and a data-holder, then it must always be part of that deal that consent freely given can also be freely withdrawn. (Paragraph 66)
35.The Government welcomes the consultation launched by the Information Commissioner’s Office (ICO) on 2 February 2016 on “Privacy notices, transparency and control–a code of practice on community privacy information to individuals”. In the consultation, the ICO highlight that all too often privacy notices are “too long, overly legalistic, uninformative and unhelpful” and individuals often choose to ignore them and thereby miss out on important information. To address this, the ICO is recommending “a more blended approach”, using different techniques of providing privacy information so as to engage more with individuals.
36.The consultation also looks at the question of consent in the context of third party marketing and proposes a standardised approach across the sector. We are pleased to note that this work is being considered with the advent of the new EU General Data Protection Regulation in mind and we will work closely with the ICO in this regard.
37.The new European regime will aim at providing a strengthened and harmonised approach to consent, which will include a unified definition of consent as freely given, informed, specific and unambiguous. It also makes it clear that as a general rule consent should not be implied, but requires either a statement by the data subject or a clear affirmative action.
As citizens’ personal data is being used in ever increasing volumes and for ever changing purposes, it is vital that the Information Commissioner’s Office has the powers it needs to help ensure data protection.
With a new EU data protection regulation now agreed, we welcome the Government’s commitment to review current penalties for data protection breaches. The Government should nevertheless introduce as soon as possible a criminal penalty for serious data protection breaches by commencing sections 77 and 78 of the Criminal Justice and Immigration Act 2008. The Government should not regard the two-year implementation period of the recently agreed EU data protection regulation, which will provide for bigger fines, as a reason for delaying this. (Paragraph 75)
38.The Government’s overall aim throughout the negotiations on the EU General Data Protection Regulation (GDPR) was to achieve workable and proportionate EU data protection rules that support the protection of personal data while creating the right conditions for innovation and economic growth in the UK. This was done in recognition that a balanced framework will support the digital single market, a key Government priority.
39.It is expected that the Regulation will come into force in Spring 2018, and the Government will use the implementation phase to work closely with the Information Commissioner’s Office to ensure we have a robust domestic data protection framework that is fit for purpose for the digital age.
40.The Government recognises that the sanctions available for the misuse of data must, where possible, keep pace with the advances in technology and that there are safeguards and deterrents to meet the challenges presented by the increased use of big data. Other measures, such as transparency of processing, raising the public’s awareness of how their personal data may be used, and the adoption of robust measures by organisations to mitigate the risks of re-identification, are also important. The Information Commissioner’s Office provides advice and guidance to organisations on the issue of anonymisation, including in their code of practice, ‘Anonymisation: managing data protection risk’.
41.Implementation of the GDPR will give us the opportunity to stress test the existing sanctions available in relation to the misuse of personal data and in particular, review current penalties for data protection breaches and aim for sanctions that act as effective deterrents against the misuse of personal data in all contexts. This review will cover all aspects of the sanctions regime including whether it is appropriate, or legislatively practical, now to implement sections 77 and 78 of the Criminal Justice and Immigration Act 2008.
The Government should agree to the Information Commissioner’s request to perform compulsory data protection audits on local government. (Paragraph 76)
42.Under section 41a of the Data Protection Act 1998, the Information Commissioner has the power to conduct compulsory audits of central government departments and public sector health bodies, to evaluate compliance with the data protection principles.
43.The Government agrees that local authorities should treat all personal data with the utmost care, and we will continue to work with the Information Commissioner to ensure he has adequate powers to enforce compliance with the Act. This includes keeping under review whether it may be appropriate to extend the Information Commissioner’s powers of compulsory audit to other organisations.
44.The designation of local authorities for compulsory audit would require consultation of interested parties prior to an Order being made by the Secretary of State, and the Government must also consider the benefits of any new regulations against the burdens they would place on local authorities.
45.The Government has noted that, through joint work with the Information Commissioner’s Office and the Local Government Association, the percentage of data security incidents that can be attributed to local councils has now halved. In view of this progress, we consider that compulsory data audits for local authorities may not be required at this stage.
46.Instead, we feel that local authorities should continue to be provided with support to further improve their performance on handling personal information. This should however still include challenge to local authorities when standards are not being met and poor performance is identified.
The Government should set out its anonymisation strategy for big data in its upcoming Digital Strategy, including a clear funding commitment, a plan to engage industry with the work of the UK Anonymisation Network and core anonymisation priorities. (Paragraph 77)
47.The Government’s Digital Strategy, which is due to be published later this year, will set out how we will support the adoption of digital technology and tackle barriers to new businesses entering and creating new markets.
48.The Government is working closely with partners in the public, private and third sectors to develop proposals for the Strategy, and we anticipate that the Strategy will include a strong focus on data including open data, accelerating the uptake of digital technologies, and increasing trust and confidence on how personal data is handled by the organisations in the public and private sector.
49.The Government will engage with the UK Anonymisation Network as the content of the Strategy is developed.
The Information Commissioner has developed a data protection kitemark, ready for use now. The use of such kitemarks, acknowledging good behaviours, would complement the greater sanctions of criminal penalties for bad behaviours that we have recommended.
The Government and Information Commissioner should work with industry to ensure that the UK’s already developed kitemark is adopted as soon as possible, and initiate a campaign to raise public awareness of it. (Paragraph 82)
50.The Government agrees with the view of the Information Commissioner in his written evidence to the Committee that complying with data protection principles not only helps to protect privacy rights but also supports good practice in data management within industry.
51.We understand that the Information Commissioner’s Office (ICO) are continuing to develop their proposals for a Privacy Seals scheme. Under the current proposals, the ICO would endorse scheme operators who would award an ICO privacy seal to organisations that meet the assessment criteria and can demonstrate that they are following the high data protection standards. The ICO is also currently considering the provisions related to seals and certification under the recently agreed EU General Data Protection Regulation, which is expected to come into force in 2018. The ICO will make an announcement later this year about their plans for the scheme.
52.The Government will continue to engage with the ICO to discuss these proposals.
The Data Protection Act will have to be revised to accommodate the recently agreed EU Data Protection Regulation, which will come into force with the next two years or so. We do not share the Government’s view that current UK data protections can simply be left until then. Some areas in particular need to be addressed straightaway—introducing the Information Commissioner’s kitemark, and introducing criminal penalties rather than relying only on the prospective greater fines envisaged by the new EU Regulation. (Paragraph 100)
53.Implementation of the EU data protection package, comprising the General Data Protection Regulation and the associated law enforcement Directive, will require significant changes to the UK data protection landscape, much of which will require legislation. The Government is considering how to approach the legislative and administrative requirements to most effectively provide a data protection framework that will work for citizens and business alike. Whilst no options are being ruled out at this stage, the Government considers that there would appear to be clear advantages to taking a holistic approach to the modification of the existing legislative framework, rather than to risk approaching this in a fragmented manner.
The new EU Regulation appears to leave it open for data to be re-used, and potentially de-anonymised, if “legitimate interests” or “public interest” considerations are invoked. This is an issue that urgently needs to be addressed as big data becomes increasingly a part of our lives. There are arguments on both sides of this issue: Seeking to balance the potential benefits of processing data (some collected many years before and no longer with a clear consent trail) and people’s justified privacy concerns will not be straightforward. It is unsatisfactory, however, for the matter to be left unaddressed by Government and without a clear public-policy position set out.
The Government should therefore clarify its interpretation of the EU Regulation on the re-use and de-anonymisation of personal data, and after consultation introduce changes to the Data Protection Act 1998 as soon as possible to strike a transparent and appropriate balance between the benefits of processing data and respecting people’s privacy concerns. (Paragraph 101)
54.The Information Commissioner’s Office (ICO) provides advice and guidance to organisations on the issue of anonymisation. We will use the implementation phase of the EU General Data Protection Regulation to work closely with the ICO to ensure we deliver a new domestic regime that strikes the right balance between the benefits of processing data and respecting people’s privacy concerns, within the scope of the principles and definitions provided for.
55.In addition to effective sanctions being available, the Government recognises the need for a range of measures, including transparency of processing, raising the public’s awareness of how personal data may be used, and the adoption of robust measures by organisations to mitigate the risks or re-identification or de-anonymisation of personal data.
Given the UK’s leading position in big data and the Government’s stated commitment to capitalise on the potential innovation and research opportunities it promises, the Government should establish a Council of Data Ethics within the Alan Turing Institute as a means of addressing the growing legal and ethical challenges associated with balancing privacy, anonymisation, security and public benefit. Ensuring that such a Council is established, with appropriate terms of reference, offers the clarity, stability and direction which has so far been lacking from the European debate on data issues. (Paragraph 102)
56.Data science provides huge opportunities and harnesses new forms of data with increasingly powerful computer techniques, which allow for huge improvements and innovation across a wide range of sectors. However, we also know that data science creates new challenges, many of which have been raised in the Committee’s report. We need to give data scientists the confidence to innovate with new data and tools, but also to ensure that data science is conducted in an appropriate way.
57.The Government has already established a number of internal mechanisms to consider ethics and data science, but we recognise the need for leadership in this field for the UK as a whole. Therefore, the Government agrees with the Committee’s proposal for independent oversight and will consider how a Council for Data Science Ethics should be established. This body would address key ethical challenges for data science and provide technical research and thought leadership on the implications of data science across all sectors. The Alan Turing Institute is well placed to play a leading role and to be a convening power. Clarifying and providing guidance on ethical, legal and technical issues will allow data science to develop more quickly and appropriately, giving the UK an opportunity to gain a global advantage.
58.The Cabinet Office is developing an ethical framework for government data science. The framework is being developed with open public dialogue, and the Government has published the key principles on the gov.uk data blog. We intend to publish the whole framework in the next few months.
59.Some Government departments already have their own ethical committees of experts in their policy areas. For example, the UK Statistics Authority have established an independent National Statistician’s Data Ethics Advisory Committee to consider projects and policy proposals relating to access, use and sharing of data for statistics and research purposes. The committee provides ethical advice on proposals from the Office for National Statistics and government. Advice is also offered to government and third sector researchers who wish to access the Administrative Data Research Network.
26 April 2016