My Lords, last Tuesday I facilitated part of an event at BAFTA organised by Innotech. One of the speakers was a young man, Jamie Woodruff, who has autism but probably earns a good income from being what I think is described as a white-hat hacker. He is a benign hacker who hacks into computer systems but has an ethical agreement whereby he gives people 28 days’ notice to resolve the security problems. If they do not resolve them, he can publish the problems. He did a live hack during the event to show how easy it is to hack into websites and expose the weaknesses that many sites have. That raises a question in my mind about quality.
I raise this issue to give the Minister an opportunity to say a little more about Clause 34(3) in respect of how quality is defined in this context. The word “safety” is used in Clause 34(3)(c). A company may have a business-to-consumer relationship in the course of which it collects a whole bunch of data. The service may be of very high quality in terms of what is described and what the consumer pays for. Indeed, the whole experience may be fine but subsequently it transpires that that business has not bothered to make the consumer’s personal data secure, it is hacked into and they lose their personal data. Does the word “safety” cover that scenario so that the consumer is protected and can have proper redress against that company?