My Lords, it is a pleasure to make my first foray at the Dispatch Box on this Bill in what has been an interesting Committee stage thus far. I thank my noble friend Lord Lucas and the noble Baroness, Lady Jones of Whitchurch, for tabling these amendments and other noble Lords who have signed and spoken to them in support.
Many people are irritated by repetitive pop-ups that appear on websites seeking consent for cookies and other similar technologies. The current cookie rules apply to all organisations placing cookies on a person’s device. Rather than engaging with these banners, people will select “accept all” so that they can access the webpage as quickly as possible. We want users to be able to make more meaningful choices over their privacy. One way in which web users may be able to reduce the number of consent pop-up banners that they see is by using automated consent management technology.
New Regulation 6B, which Amendment 202 seeks to remove, is important as it will allow the Secretary of State to require relevant technologies to meet certain standards or specifications, thereby ensuring that individuals using this technology have effective control over their privacy when they are online. Amendment 203 seeks to amend Regulation 6B by making it clear that consents given on individual websites should override any prior choices made using automated technology. However, this could pre-empt the outcome of consultation with relevant sectors, civil society and regulators on the design of any new regulations. I fear that this amendment could have the effect of encouraging the continued use of consent banners, may not reduce the overall number of pop-up banners and could increase the risk of influencing consumers to give up more personal data than they intended.
We feel that Amendments 204 and 205 are unnecessary and duplicate existing requirements and standard practice. There is already a requirement in new Regulation 6B to consult. We have engaged extensively with stakeholders
on this Bill and will continue to do so in the context of using any of the new regulation-making powers linked to these clauses. Our engagement so far has highlighted the complexity of the ecosystem and the range of impacts on different interest groups. We will continue to consider these impacts carefully when considering whether to use the new regulation-making powers. Impact assessments are generally required for all interventions of a regulatory nature that affect the private sector, civil society organisations and public services.
The Government have taken powers in the Bill to remove consent requirements for other purposes if the evidence supports it while recognising that this is a complex and technical market. The Government will therefore continue to engage fully with all players before introducing any new exemptions or deciding to set standards for the market.
The new power in Regulation 6B recognises that there is a range of different stakeholder interests that would need to be considered before making regulations. The Secretary of State must consult the Information Commissioner, the Competition and Markets Authority and any other person the Secretary of State considers appropriate. While browser-based or centralised consent options have been discussed as a possible solution, nothing in the Bill mandates them. The regulation-making power, which follows the affirmative resolution procedure, would allow the Secretary of State to set standards of design that will be key to ensuring that the regulations can move with technology.
Amendments 199 and 200 would permit the storage of information or accessing information stored on a person’s connected device, including the internet of things, to enable the organisation to generate audience measurement information. This proposed new exemption does not explain what data would need to be gathered to meet the objective of the amendment and is potentially broad in its application. For example, if it permitted activities such as tracking and profiling, it may not be appropriate to permit it without the consent of web users.
4.15 pm
We know that some stakeholders would have liked us to go further with the exemption in new paragraph (2A) and remove consent requirements for a wider range of uses. Any additional exemptions should not be added to the Bill in haste. There is a balance to strike between removing cookie consent requirements to drive growth and innovation in the advertising sector and ensuring that people retain some choice and control over how their data is used. The Government know that there are people who want to continue to make an active choice over cookies that are used for more intrusive purposes, such as tracking and profiling users.
The delegated power in the Bill ensures that exemptions to the consent requirements can be kept under review and amended in future where the evidence supports it, and we can devise appropriate safeguards to minimise privacy risks. We are satisfied that the current list of exemptions applies to a limited number of low-privacy intrusive purposes and can be used by any organisation placing cookies on a user’s device. This regulation applies to complex—