Dame Chi Onwurah
MP for Newcastle upon Tyne Central and West · Labour · United Kingdom
“An extraordinary debate is going on right now inside and outside AI companies about whether the possibility of AI destroying humanity is more or less than 10%. The European Union is moving ahead with a comprehensive AI regulatory framework, but the UK continues to rely on existing regulation.”
“The Pope also highlighted how the billions of online digital twins constitute an unprecedented concentration of power in the hands of a small number of men. Among the many consequences of the 40 years of neoliberalism repeatedly called out by the Prime Minister is a libertarian attitude to technology.”
“But this stealth digital twinning violates the integrity, uniqueness and very personhood of our constituents and of all of us. Digital twins can take many forms, from content creation algorithms and deepfakes to chatbots that reflect aspects of our personalities back at us. It is particularly worrying when children are the target.”
“The automated version of our kids will grow with them, using the power of AI to target advertising and products at them, and worse. The Science, Innovation and Technology Committee has heard about some of the tragic consequences of online grooming by algorithms and chatbots—a vulnerable boy persuaded to kill himself; a vulnerable girl fed…”
“In the arts, entertainment and tech industries, many performers are agreeing to the creation and use of digital replicas as part of their work—think of ABBA Voyage. But performers increasingly encounter unauthorised digital replicas of themselves, which pose a threat to their career, livelihood and reputation.”
“Since then, deepfakes have proliferated. The hon. Member for Mid Norfolk (George Freeman) was shown crossing the Floor in Parliament to join Reform, to his constituents’ consternation and his own—it was a fake. Then there were the horrendous photos of naked women and girls that Elon Musk’s AI created on demand.”
The complete record
Every one of 5,139 lines we hold for Dame Chi Onwurah, in date order, each linked to its source. Free to read, in full, without an account. Page 14 of 103.
“Great. Ms Thomas, presumably all the automated decisions will be subject to employment law. Would employees have the information they need to appeal decisions and take them to an industrial tribunal? Dr Tennison: You asked what kind of abuse I am particularly concerned about. I echo some of Anna’s concerns around the work context and what that looks like. We have recently been doing some case studies, which again I can share, and they really bring home the kinds of issues that workers are subject to as automated decision making is rolled out in organisations. More broadly, though, I am concerned about the gradual drift of reducing trust in the public sphere when it comes to the use of data by Governments and organisations.”
“Q I know that you are very supportive of the Bill, but I wonder whether you see risks to patients and service users from facilitating a greater sharing of health and care data. Could you each answer that question? Jonathan Sellors: I think that data sharing, of one sort or another, absolutely underpins medical research. You need to be able to do it internationally as well; it is not purely a UK-centric activity. The key is in making sure that the data that you are using is properly de-identified, so that research can be conducted on patients, participants and resources in a way that does not then link back to their health data and other data.”
“Q So it has to be de-identified. We will return to that. But you do not see any other risks? Jonathan Sellors : Let me put it this way: poor-quality research, undertaken in an unfortunate way, is always going to be a problem, but good-quality research, which has proper ethical approval and which is done on data that is suitably managed and collated, is an essential thing to be able to do.”
“Q I agree with you. Sorry, I did not quite hear what you said—approval by whom? Jonathan Sellors : Approval by the relevant ethics committee.”
“Q Right. Is it a requirement of the Bill that the research should have the approval of the relevant ethics committee? Jonathan Sellors : I do not think that it is a requirement of this Bill, but it is a requirement of pretty much most research that takes place in the UK.”
“Q But not all research, surely, because the definition of research is something that can “reasonably be described as scientific” research. You would see concerns, then, if data was to be shared for research that was carried out outside of ethics committee approvals. I do not want to put words into your mouth, but I am just trying to understand. Jonathan Sellors : Sure. I think it depends on the nature of the data that you are trying to evaluate. In other words, if you are looking at aggregated or summary datasets, I do not think there is any particular issue, but when you are looking at individual-level data, that has to be suitably de-identified in order for research to be safely conducted.”
“For all practical purposes, it is actually de-identified. Saying something is completely de-identified is quite difficult.”
“Q On the point of de-identifying or pseudonymisation, do you recognise that there have been examples of pseudonymised data that has been re-identified, and that, particularly given the rise of huge datasets, artificial intelligence and so on, there is a risk of un-de-identifying pseudonymised data? Jonathan Sellors : There is always a risk, but I think the way it is expressed in the Bill is actually quite measured. In other words, it takes a reasonable approach to what steps can constitute re-identification. There are a certain police-related examples whereby samples are found on crime scenes. The individuals can be identified, certainly, if you are on the police database, but if they are not on a reference database, it is extremely difficult to re-identify them, other than with millions of pounds-worth of police work.”
“Q Yes, I certainly agree with that—it is almost impossible—but I do think it is possible to re-identify data without spending millions of pounds, especially when it is correlated with other large datasets. Would you recognise that? Jonathan Sellors : I definitely recognise that. That is one of our principal bits of concern, but usually the identifiers are the relatively simple ones. In other words, you can re-identify me quite easily by my seven-digit postcode and my age and my gender. Obviously, when we release data, we make sure not to do that. Releasing quite a big bit of my genetic sequence does not make me re-identifiable.”
“As an example, there are very few data pieces that we need for our digital surgery business, but we might need gender, weight and age. The Bill will allow customisation to say, “Okay, what are you going to do to make sure that only two or three data scientists see that data? How are you going to house it in a secure, separate environment? How are you going to make sure that you have security controls around that?” I think the Bill allows that flexibility to try to create personalised medicine, but I do not believe that the Bill opens up a new area of risk for re-identification provided that the GDPR safeguards remain.”
“Currently. Jonathan Sellors : Currently—I accept that. Tom Schumacher: I would say a couple of things. It is important to know that the Bill preserves the full array of safeguards in the GDPR around data minimisation, access controls and making sure that you have de-identified the data as much as possible for the purpose you are going to use it for. The opportunity that our company is quite concerned about is that, without some elements of real-world data, we are not going to be able to eliminate the bias that we see in the system. We are not going to be able to personalise medicine, and we are not going to be able to get our products approved, because our regulating bodies are now looking at and mandating that the technology we use is tested in different attributes that are relevant for that technology.”
“I do not believe that using data for political purposes would constitute research in the way that you would think about it in this Bill. Certainly the UK ICO is well regarded for providing useful interpretation guidance. I think that that office would be able to issue appropriate guardrails to limit those sorts of abuses. Jonathan Sellors: If you look at a scientific hypothesis, it might not be a scientific hypothesis that you like, but it is much better to have it out there in the public domain, where the data that underpins the research can be evaluated by everybody else to show that it is not sound and is not being conducted appropriately.”
“Q Let me ask a follow-up question. I recognise that your intent in research is ethical—there are ethics committees involved. Given the definition of scientific research to be anything that can be reasonably described as scientific, what is to stop data being shared for the purposes of, for example, justifying anti-covid vaccination conspiracy theories? Do you recognise that there are purposes that could be described as research but which many people would not want their data to be used for? Tom Schumacher: In isolation, that would be a risk, but in the full context of the interrelationship between the data owner and controller and the manufacturer, there would be a process by which you would define the legitimate use you are going to use that data for, and that would be something that you would document and would go on your system.”
“Q Yes, but people might not want their data to be used for that. They would have no control over it in this case. Jonathan Sellors: There has to be some element of scientific flexibility, but scientists themselves have to be able to make a decision about what they wish to investigate. The main thing to ensure is that it is transparent—in other words, somebody else can see what they have done and the way in which they have done it, so that if it does come up with a conclusion that is fundamentally flawed, that can be properly challenged.”
“If as a consumer I want to take more control of my data, I will want to be able to use it across multiple services and get a much more holistic view not just of my finances, but of my health information and so on. One area that is particularly developing at the moment is the concept of self-sovereign identity, which enables me as a consumer to control my identity and take the identity provider out of the equation. I do not want to get too technical, but it involves storing my information on a blockchain and sharing my data credentials only when I need to do so—obviously it follows data minimisation. There are evolving schemes that we need to ensure the Bill caters for.”
“It will have to be certified against a register, which means that as a consumer I will know that I can trust that organisation because it will be following the trust framework and the policies that sit within it. That is critical. Similarly, if we are setting up schemes with smart data we will need to make sure that the consumer is protected. That will come through in secondary legislation and the devil will be in the detail of the policies underpinning it, in a similar way to open banking and the pensions dashboard. Further to the previous session, the other thing I would say is that we are talking on behalf of financial services, but parts 2 and 3 of the Bill also refer to other sectors: they apply equally to health, education and so on.”
“Q You have both spoken very passionately, if I may say so, about the importance of citizens being in control of their data, particularly with open banking. We all take very seriously our financial data and the importance of trust and empowerment in these services. Can you say how the Bill will improve trust and control for citizens, or how it should do so? Harry Weber-Brown: Part 2 of the Bill sets out the trust framework, which was being developed by the then Department for Digital, Culture, Media and Sport and which now comes under the Department for Science, Innovation and Technology. It will give certainty to the marketplace that any firm that wishes to store data—what is commonly known as an identity provider—will have to go through a certification regime.”
“That will evolve, but within the frameworks that are set up—trust schemes, in the jargon—there will be those who provide digital identity services and those organisations that consume them, which could be retailers, financial services providers or banks. It is likely that the relying parties, the consumers, would pay the providers. Harry Weber-Brown: But not the individual consumers. If you wanted to open a bank account, and the bank was relying on identity measures provided by fintech, the bank would pay the fintech to undertake those services.”
“Q Thank you very much for those points. You mentioned data verification services. Briefly, can you help the Committee to understand who would be providing those services and who would be paying for them? You gave the example of tethering my property or other ownership. Who would be paying in that case? Would I be paying for the rest of my life to keep that data where it is? How do you see it working? Phillip Mind: Who will provide the services? There is already a growing list of verified providers. There is a current market in one-off digital identity services, and I think many of those providers would step in to the reusable digital identity market. What is the commercial model? That is a really good question, and frankly at this point I do not have an answer.”
“I want to caution against going to a degree of artificial intelligence algorithmic-based hiring, where someone is not actually ever in front of a human, whether by Teams video or in person, and a robot is basically assessing their suitability for a job. We have those risks and would have them anyway without this Bill. It is really important as we go forward that we make sure we build in provisions somewhere to ensure that hiring remains a human-on-human activity in some respects, not a completely AI-based process.”
“Digital identity could sever location to allow people more opportunities to work remotely across the UK. There were really good questions about other information. The Bill has a provision for other data sharing. Again, there is the potential and the opportunity here to make UK hiring the fastest globally by linking other datasets such as HMRC payroll data. Rather than looking at a CV and wondering whether the person really worked in those places, the HMRC data could just confirm that they were employed by those companies. There is a real opportunity to speed up the verification but, as I want to acknowledge and as you have referred to, there is certainly also a risk. Part of our mission is to make UK hiring fairer, not just faster and safer.”
“There is a real opportunity to right that. It means that one in five work seekers right now cannot use digital identity to get a job, because they do not have an in-date British or Irish passport. If you have a visa or an in-date British or Irish passport, that is fine, but if you are among the one in five people in the country who do not have an in-date passport, you cannot. Those people have to visit the premises of the employer face to face to show their documents, or post their original documents across the UK. This has really created a second-class work seeker. There are real dangers here, such as that an employer might decide to choose person one because they can hire them a week faster than person two. There is a real issue about this location problem.”
“Q Thank you very much for your evidence so far. It is going to be informative about the use of digital ID in recruitment. You said earlier that it helps to separate away from geography, which implied that the digital ID did not reference the location or the home address of the person who was being ID’d. What does the digital ID ID? Part of the reason behind that question is this: is it simply providing identification, or could it also be used as part of the triage process? Can that be done algorithmically, with some of the dangers that we see in algorithmic, automated decision making? Keith Rosser: Those are several really good questions. I will use an example about location from the other perspective, first of all. At the moment, Home Office policy has not caught up with digital identity, and we are addressing that.”
“If we wanted to do something with Driver and Vehicle Licensing Agency data and automatic number plate recognition data, we could not join together those two large datasets to enable mass analysis because there would be privacy rights considerations. If want to search datasets from other parts of that Act, we have to do that in quite a convoluted administrative way that perhaps we can share within law enforcement. It is more about the speed of exchange.”
“Q I think you implied that there was data that you would like to have access to but currently do not have access to. Can you elaborate on what data you do not have access to in terms of data sharing and the barriers? What would be helpful for investigations? Aimee Reed: It is not so much about specific datasets; it is about synchronisation and the speed with which you can exchange data that enables you to make better decisions. Because the Data Protection Act is split into three parts, and law enforcement quite rightly has a section all of its own, you cannot utilise data analytics across each of the parts. Does that make sense?”
“Q Is it about the speed of exchange with other Government agencies or with local government agencies? Aimee Reed: It is more with our local partners. I am sure that our partners would say they are equally frustrated by the speed at which they can get data from the police in large datasets to enable them to make better decisions in their local authorities. That is just how that Act was constructed, and it will remain so. The recent ICO guidance on sharing has made that simpler, but this realm of the Bill will not make that synchronisation available to us.”
“Q Do you think it should be available to you? Are there reasons why it is not available to you? Aimee Reed: It is about getting right the balance between what we do with people’s personal data and how the public would perceive the use of that data. If we just had a huge pot where we put everybody’s data, there would be real concerns about that. I am not suggesting for a second that the police want a huge pot of everybody’s data, but that is where you have to get the balance right between knowing what you have and sharing it for the right purpose and for the reason you collected it in the first place.”
“Q Just to follow up on the questions about the different types of regulation, do you feel that the balance has been struck appropriately when it comes to biometric data, particularly for facial recognition, for example? Helen Hitching: Sorry—could you repeat that?”
“Has the balance between sharing and the regulation of biometric data, particularly facial recognition data, been struck in the right way? Helen Hitching: I do not think facial recognition data is captured. Aimee Reed: On facial recognition, given that we have deployed it—very high profile—I think that the balance is right. We have learned a lot from the South Wales judgment and from our own technical deployments. The Bill will also highlight how other biometric data should be managed, creating parity and an environment where biometric data that we do not yet have access to or use of is future-proofed in the legislation. That is really welcome.”
“Having that conversation between the workforce and the employer can come up with a solution that is not only good for our members, because they stay safe and understand what the safety regime is, but good for the employer, because days are not lost through illness or accidents. For me, that sense of using legislation like this to underpin good work conversations in the data setting is what the mission of this Bill should be about.”
“We have good examples. We represent members in the nuclear sector who are involved in fusion, small modular reactors or other technology, where the employer-union relationship is critical to the UK’s intellectual property and the drive to make those successful industries. In the motor industry and other places where the UK has been successful, we can see that that sense of social partnership has been there. We have examples around using AI or the monitoring of conversations or voices. Again, I mentioned GPS tracking, but in safety-critical environments, where our members want to be kept safe, they know that technology can help them.”
“That has always been how productivity has improved or changed, in effect, the shop floor. If you are asking, “What problems are you using technology to solve?”, it may well be a question better asked by the people delivering the product or service than necessarily the vendor selling the software, whether that is old or new technology. I encourage the Committee to look at the strong evidence among our competitors who rate higher, in terms of productivity and innovation, than the UK, where higher levels of automation in the economy are matched by higher levels of worker participation. Unions are the most common form, but often it can be works councils or small businesses in terms of co-design and collaboration. We see that social partnership model of the doers, who identify and solve problems, being the people who do that.”
“Q Welcome to both of you. Apologies for my misuse of my own technology earlier. The Minister talked about the need for growth, which has been sadly lacking in our economy for the last 13 years. Obviously, technology can make huge improvements to productivity for those in the workforce. Mr Pakes, as someone whose members are involved in technology, scientific and IT organisations, I wonder whether you would agree with this, which comes from my experience in the diffusion of technology. Is it possible to get the best from technology in an organisation or company without the people who will be using it, or the people on whom it will be used, being an active part of that diffusion of technology, and understanding and participating in its use? Andrew Pakes: Absolutely.”
“Beyond that, there should be negotiation to understand how that data is used. The critical point for us is that most companies in the UK are not of a size where they will be developing their own AI products—very few will be; we can probably name a couple of them. Most companies using automated decisions or AI will be purchasing that from a global marketplace. We hope many of them will be within certain settings, but we know that the leaders in this tend to be the Chinese market and the US market, where they have different standards and a range of other things. Ensuring that we have UK legislation that protects that level of consent and that redresses that power balance between workers and employers is a critical foundation to ensuring that we get this right at an enterprise level.”
“Q In terms of data sharing, should there be provisions in the Bill to ensure that workers can give free and informed consent to the sharing of their data, or will the asymmetry of the relationship in the employment contract make that challenging? Andrew Pakes: We think there should be a higher bar, because of the contractual nature. Whether it is self-employed workers contracting for a piece of work or an employment relationship, there is a fundamental difference in our view between my individual choice to go online and enter my data into a shop, because I want to be kept appraised of when the latest product is coming out—it is my free choice to do that—and my being able to consent in an employment relationship about how my data is used. As Mary said, the foundation stone has to be transparency on information in the first place.”
“Again, we have very similar concerns to Andrew about the use of technologies rooted in international companies and the inevitable international transfers of data, and workers essentially losing control over and knowledge of what is happening with their data beyond the workplace. In addition, I would also like to make a point about the importance of transparency of source code, and the importance of ensuring that international trade deals do not restrict that transparency, meaning that workers cannot access information about source code once data and AI-powered tools are rooted in other countries.”
“Q Have you identified any provisions to achieve that in the Bill as it stands? Andrew Pakes: We would like to see more. We are worried that the current legislation, because of things such as DPIAs, drops that level of standards, which means that the UK could end up trading on a lower standard than other countries, and that worries us. Mary Towers: We are also concerned about the change to the test for international data transfers, which might make the requirements less restrictive. There is a change from adequacy to a more risk-based assessment process in terms of international data transfers.”
“That is one of the major barriers for academics at the moment: they cannot get access to the data they need. The Bill does nothing to incentivise or compel data controllers such as online platforms to actually share data and get it moving around the system for the purposes of academic research. This is in stark contrast to the approach being taken elsewhere. It is an issue the EU is starting to grapple with in a particular domain of research with article 40 of the Digital Services Act. There is a sense that we are falling behind a little bit on that key barrier to academic research with personal data.”
“Q We heard from some witnesses today that greater ease of access to data will increase competition for those such as Google and Meta that have large amounts of data as it is. What do you think the impact of this Bill will be for big tech? Alex Lawrence-Archer: I think the Bill is quite big tech-friendly, and the way that it deals with research is well illustrative of that. One of the objectives of the Bill is obviously to boost the use of personal data for academic research, which is a really laudable objective. However, the main change—in fact the only change I can think of off the top of my head—that it makes is to broaden the definition of academic research. That helps people who already have lots of personal data they might do research with; it does not help you if you do not have personal data.”
“I am sceptical as well that there will be major benefits to many businesses who will continue to need to do business in Europe. For that reason, we will need either to have dual compliance or simply to continue to comply with EU GDPR. You can see this benefiting the largest companies, which can start to segment their users. We have already seen that with Meta, which moved its users on to US controllership, for example. I would see that as more beneficial to those large companies, which can navigate that, rather than, say, SMEs.”
“Q We also heard that existing cookie management and subject access requests and so on represent a real burden, particularly for smaller companies. Do you recognise that? Do you know why there is less support in technology to help small businesses deal with, if you like, the data management challenges? How is that to be traded off against the privacy rights of individuals? Alex Lawrence-Archer: I certainly recognise that the requirements of GDPR place compliance burdens on businesses of all sizes. I am sceptical that the right balance is being struck in trying to ameliorate the burdens of the costs and challenges that ordinary people will face—in terms of knowing how they are being profiled and tracked by companies—and resolving things when they have gone wrong.”
“T4. Today, manufacturing body Make UK warned the Government that, to tackle regional inequalities and compete on a national stage, we need a national industrial strategy as a matter of urgency. Do Ministers recognise that the reason wages in the north-east are falling under the Tories is their lack of an industrial strategy and their failure to follow Labour’s example and commit to a modern industrial strategy that invests in the industries of the future and delivers good-quality jobs across our country?”
“I welcome the Secretary of State to her position and wish the right hon. Member for Chippenham (Michelle Donelan) well in her maternity leave. Three years on, the Tories have failed in their manifesto promise to associate to Horizon Europe, and Britain has paid the price in lost jobs and scientific research. Their plan B short-changes British scientists and they are fudging the figures in other ways. Will the Secretary of State confirm that, whereas Horizon funding was counted as international science spend, she is planning to count the same money as British science spend to meet her commitment to double the British science budget? [Interruption.]”
“It seems that the Tory science superpower is actually just cooking the books. Ministers promised to increase science spend outside London and the south-east by a third while doubling it overall, so our regions continue to miss out. Now they are refusing to replace European regional development science funding, slashing £600 million from what should be our regional powerhouses. That is not levelling up—it is holding us back. The country knows it. Does the Secretary of State?”
“The conflict in Sudan is a humanitarian disaster not only for the 46 million Sudanese but for the east African region and the continent, with the expectation of hundreds of thousands, perhaps millions, of refugees. What discussions has the Minister had with the African Union to promote African leadership, involvement and mediation and a successful resolution?”
“The courage and determination of the Ukrainian people in the face of Putin’s aggression is an inspiration to us all, but it is also a challenge to us to ensure that if we cannot match it, we at least reflect it in the level and consistency of our military and humanitarian support. We cannot do that unless we replenish and backfill our military stockpiles, so can I ask the Minister for a plan or some indication of how our defence procurement is changing or adapting to ensure that our military stockpiles are at the levels that are needed?”
“We have all watched Sudan’s descent into civil war with horror, but for the Sudanese diaspora in Britain and British nationals in Sudan this is a time of immense trauma and suffering, recalling the trauma and suffering involved in the evacuation of Kabul. The situation is different, but the casework that I am seeing and what we are hearing today are very familiar. The Secretary of State says that visas are not his responsibility. Will he confirm that he is working with the Home Office, as a matter of urgency, to establish a consistent and humane approach to those who do not have the requisite travel documents? That includes babies born recently, spouses in the process of applying for visas, and, as we have heard, people who live here and are on holiday in Sudan.”
“I congratulate my hon. Friend on securing this excellent and incredibly important debate. In Newcastle, where NHS dentistry access has become almost impossible for so many of my constituents, a whole generation of young people and children are growing up without access to an NHS dentist. Does she agree that that is causing immense suffering now and storing up not only pain and suffering but additional costs for the future?”
“The Minister is forever promising better bus services for tomorrow, but tomorrow never comes—much like the buses—leaving my constituents stranded at bus stops. When will he deliver better buses for Newcastle and when will he hold the bus companies to account for the atrocious services my constituents are experiencing?”
“T5. The experience of my constituents who are on prepayment meters is atrocious, and today’s announcement from Ofcom will do absolutely nothing to protect vulnerable groups such as those with Alzheimer’s, the under-fives and those who are over 75 but under 85. Will the Secretary of State answer the question he did not answer earlier, and say why he is not protecting the vulnerable from prepayment meters and the lack of energy support?”