Can I begin by thanking Anthony and his colleagues for organising this very important event at Tech UK. I am very pleased to be here today to talk about how the UK can create a positive regulatory environment and a culture of consumer and professional confidence that will accelerate data-driven growth.
Earlier this month the European Council and Parliament formally adopted the EU Data Protection Regulation and the Law Enforcement Directive, with a formal signing tomorrow. We are looking working forward to work with you to implement the Regulation in the most advantageous way for the UK.
I’d like to start by taking a moment to consider ‘data protection’ as a concept. ‘Data’ represents units of information that pass through systems; and ‘protection’ refers to the technical or procedural means by which that information is protected. Strictly speaking, this is accurate. This is the lens through which organisations often view data protection issues. They have been seen first and foremost as technology or IT issues.
I see data protection through a different lens. The ‘data’ element represents people. Individuals with personal lives, reputations, and livelihoods increasingly enmeshed with the technology we rely on through the data they share. If organisations misuse or lose this data they are breaching not only people’s rights, they are invading their privacy. They risk damaging people’s wellbeing not just data sets.
In the correspondence I receive as a Minister, people don’t talk about breaches and technology failures, they talk about their distress, fear, anger and an erosion of trust. Technology shouldn’t therefore be the starting point for a response. ‘Protection’ should be about respect for individuals and the personal information they share in good faith. That should shift the focus in the board room from a techie issue to a reputational and commercial one.
And it is clear that it makes good business sense. £1 of every £5 earned by UK companies now comes from the internet; and a 2014 Nesta study of 500 UK firms found those making greater use of online customer data were up to 13% more productive.
The growth in data-driven industries has generated both excitement and apprehension. And it is only going to continue. The digital universe is predicted to increase 10-fold – from 4.4 trillion gigabytes to 44 trillion gigabytes between 2013 and 2020.
If we look back in time, we can see that the way people respond to new technologies and the threats and opportunities they bring, hasn’t changed. When I visualise the growth in data flows today, I like to draw the parallel with the dawn of the age of electricity. This excerpt from an article in 1900 sums up the hopes – but mostly fears – people held at that time:
If you believe the likes of Mr. Jules Verne and the proponents of the upcoming 1900 World’s Fair – electricity may someday replace the coal furnace, eliminate the icebox, eradicate the plough, outstrip the printing press, modernise the outhouse, and put the cart horse permanently out to pasture. But will we become the masters of the lightning or its slaves? What will we do with endless hours of sunlight and ceaseless days of leisure? What will we build with the power of the gods at our fingertips? Sure, it’s fun to light up the Eiffel Tower, but Portsmouth?
The untapped electrical fluid leaking from these outlets and wires, we are told, may cause serious bodily damage and – with prolonged exposure – possibly death. We are certainly gaining momentum in this Modern Day, but can anyone tell us where we are headed?
My serious point is that people are inevitably sceptical about rapidly evolving technologies that touch on their everyday lives. In time, they begin to see the benefits to them – as long as their concerns about safety are taken seriously. The data business is a two-way street; companies need individuals to share their personal data willingly so they can provide profitable services. As I said at the outset, erode trust and that flow of data is undermined and business lost.
My focus, my vision
So, data protection is clearly an important and rapidly evolving subject. There are many developments in the data protection space that you need to prepare for and seek to harness if you are all to benefit from the growth today’s event anticipates. I will talk about some of those developments, such as the EU DP Regulation, EU-US Privacy Shield and the Digital Single Market a little later. These are matters which occupy a significant amount of my time and are rightly my focus.
But first, I want to take a step back and talk about my strategy.
What the data market – indeed, what any market - needs
To be fair, competitive, and successful, there are three ingredients any market needs which Government can help to provide:
Knowledgeable and confident consumers who believe that the market will protect their best interests and benefit them personally; this brings people to the market
An effective system of regulation, upholding a clear legislative framework; this protects consumers once they are using the market and protects business’ own interests by forcing them to reduce risks and correct failure quickly
An eye on the future; this helps ensure that the regulatory environment keeps up with, and supports development and innovation
We need to deliver these elements in the data protection space, working with business, the regulator, and international partners.
Knowledgeable and confident consumers
Take the first ingredient - Knowledgeable and confident consumers are the lifeblood of any business.
Consumer confidence is easily knocked by breaches or complexity. Nearly two-thirds of the public consider they have lost control over how their data is collected and processed.
People need to understand how sharing their data benefits them directly. And to be given the tools to control who they share their data with and how and for what purpose it will be used.
We are looking at awareness-raising to help people understand how they give ‘consent’ when sharing their data and ensure they understand the implications. This is particularly important in our push to address nuisance calls where people inadvertently give consent.
We are looking at how under 18s can better protect their reputations in the digital space. We are also looking at what happens to people’s personal data after their death.
An effective system of regulation
The market also needs an effective system of regulation.
It must be clear and accessible, easy for business and consumer alike to navigate. When looking beyond the UK, the regulatory environment should open up markets, enabling trade across borders. That is why we recently agreed to the new EU Data Protection Regulation.
The regime must be consistently enforced, in this case by the Information Commissioner’s Office. With as much support and guidance as possible available to help organisations reduce the risk of breaches and champion good practice.
An effective system of regulation also undermines rogue operators and pushes them out of the market, creating space for my friends the legitimate players.
An eye on the future
Finally Government needs to ensure that the regulatory environment keeps up with and supports development and innovation.
We listen to business, as I am doing today, to understand the direction the Government’s work to support the consumer and the regulator needs to take.
It is important that we learn from all-comers, international partners and players in other fields.
We must always check the balance between individual privacy, and business and Government use of data, is correctly calibrated.
The Government’s digital strategy is a key part of the jigsaw.
My role is to protect individual rights and create the right environment for data-related growth in the big data revolution.
The Government is preparing for implementation of the EU Regulation and I would encourage everyone here to prioritise their own organisation’s preparation.
Progress has been made on a renewed ‘Safe Harbour’ agreement with the new EU-US Privacy Shield. It is very important to have a stable agreement in place to ensure trusted data flows to the US. The Commission and US are meeting today to discuss adjustments.
The Government is developing a new Digital Strategy. This includes measures to further support the adoptions of new technologies across the economy. It will also cover how data can empower citizens and consumers.
I am looking forward to hearing what our speakers from the Information Commissioner’s Office, and the European Commission say about the detail of these two developments.