I have tabled three amendments that seek to strengthen the provisions made for data protection in the Bill. New clause 1 would require the Secretary of State to report to Parliament on the collection of personal data from automated vehicles within one year of the day on which the Act is passed and every year thereafter. This report must cover

“levels of compliance with data protection legislation within the automated motor industry,…instances where the Secretary of State has made regulations under section 42(3) of this Act…and the impact of those regulations on personal data protection, and…any significant trends in the collection of personal data and whether further action is needed to regulate the collection of personal data.”

For sustained public confidence in automated vehicles and the data protection issues that arise, it is important that we have this continued monitoring and reporting. With a new technology, it is inevitable that new issues will arise over time, particularly as automated vehicles learn and change their behaviour accordingly. The reporting is necessary to keep the regulations on data protection under review as the technology develops. The Government must give further assurances in the Bill that people’s personal data will be protected before this Bill becomes law and commit to the annual reporting set out in this new clause.

This Bill would also be strengthened by new clause 2, which would require the Secretary of State to consult the Information Commissioner’s Office before making regulations in relation to the provision of personal data relevant to automated vehicles. As I have mentioned, new clause 1 would maintain monitoring of the provisions made for data protection, and new clause 2 would make this monitoring and reporting process easier, as advice can be taken from the ICO rather than using parliamentary time. Again, this will instil public confidence in the legislation as the advice will come from an independent body.

In order to operate, automated vehicles must be able to collect data, and much of this data will be personal. The information collected will help to make AVs safer as the system learns more about the road and those using it. Strengthening the process of how any changes to future protections are made will again assure the public that their personal data will be secure. Further assurances would be given by amendment 8, which seeks to probe a number of concerns about data protection and ownership, and seeks to prevent the authorisation of companies as self-driving entities unless robust data practices are in place. This amendment would ensure that a person may not be an authorised self-driving entity unless they meet the following requirements:

“they have obtained a certificate of compliance with data protection legislation from the Information Commissioner’s Office for their policy in regard to the handling of personal data,…their policy in regard to the handling of personal data clearly outlines who has ownership of any personal data collected, including after the ownership of a vehicle has ended, and…they are a signatory to an industry code of conduct under the UK General Data Protection Regulation.”