Examination of Witness
Caroline Normand, Director of Policy, Which?
Q161 The Chairman: Ms Normand, thank you very much for coming to speak to the Select Committee on Communications. You should know that the meeting will be broadcast online and a transcript will be available in due course.
I am going to ask you the first question but I wonder if, when you answer it, you could wrap in just a bit of background about yourself—wrap with a W, not with an R, by the way—and tell us anything you want us to hear by way of introduction. That would be very helpful. The first question I wanted to ask you is about the strengths and weaknesses of the regulatory framework of the internet that currently exists in relation to protecting consumers online, and whether the current regulatory bodies, in particular the ICO and the CMA, with which I know you are very familiar, are effective and properly resourced. Can I ask you, since it has come up recently, whether you could include in your answer some comment on recent research from Which? on fake reviews? That would be of great interest to the Committee.
Caroline Normand: We very much welcome the opportunity to assist the Committee in this inquiry on what is a very important issue of the day. Which? is a completely independent charitable social enterprise. We have over 1 million members and supporters, and our mission has always been to make consumers as powerful as the organisations they deal with. Obviously, increasingly today the way in which we interact with those organisations is digital. Our recent focus has very much been on how business accesses personal data and how that has changed the consumer world.
We know that digital markets and greater data flows have brought a great deal of good for consumers, for individuals. Shopping is more convenient, we can all book holidays online, we have greater choice, we can manage our fitness, and indeed we can even control specific health problems, from diabetes through to cystic fibrosis; there are some great online communities that are really helping people. However, we undertook a large programme of research for our report, Control, Alt or Delete, and we found that while people love technology, when you start to talk about data they are much more conflicted. They are conflicted about who and whether to trust the data ecosystem that operates the online market. We found a widespread sense of disempowerment and disengagement among individuals, with many people unsure about the impact that data use has on them, or whether it is worth doing anything about it when there are practices that they do not like.
From our perspective at Which?, we do not think that is a sound foundation for the future. From our perspective, yes, we think that more regulation for some aspects of the online world is definitely needed, but, going back to my first point, it has to be considered regulation. Herein lies one of the big problems that we faced in trying to do our report, because the deficit of transparency about the system is a huge hurdle in understanding what is going on, what the problems are and therefore what the right and appropriate solutions are.
In the light of our research we made a series of recommendations calling for, first, companies to provide much more transparency about the impact of data use on individuals at the time of use. People did not talk to us about privacy concerns; they talked to us about, “How is my data being used? What is the impact on me? What is the impact on my credit rating or on my insurance quote?” That is what they wanted to know. Complementary to that, we think that Governments and regulators rapidly need to understand more about the impact of data use at a global level. That is the first recommendation.
The second recommendation was around the flows of data. Something that really struck us from our research with consumers was how much they disliked data-sharing or data being sold, even though that is the way in which the system works. Over 80% of people we spoke to were concerned about data-sharing and data flows. It is very hard to reassure people about how the system works if you do not know what the governance framework is for said data flows. We think that the Centre for Data Ethics should conduct a review of data in motion, to understand how the flows of data work, to make sure that any regulation is fit for purpose.
Our final recommendation, which will be familiar to you, is that the Competition and Markets Authority should conduct a market study into the digital advertising industry, looking both at the concentration in the industry, which is something that drives the ecosystem of the industry, but also at the impact of digital marketing on people’s lives. That is what our report recommended.
As our research showed, the voice of the individual and the consumer is pretty lost in this space. We think that that is another aspect of this environment that needs to be looked at, both by the dominant players, the players in the marketplace, but also by the Government. There is a really strong sense from individuals that they do not really know where to turn and have no redress when things go wrong. It may be that, when there is a security breach or some other event happens, people are informed about what to do, but they do not have the trust or feeling that they are, and that whole environment is not really there.
Finally, another final and important aspect of this is that, while it is encouraging to see all of the activity looking at this space and playing catch-up and trying to understand what is happening and what, if anything, needs to be done to improve the experience for consumers and others, it is very confusing in its own right. There are lots of initiatives, there are lots of regulators, there are underlaps and there are overlaps. We think that that needs to rapidly be sorted through, so that we have the appropriate level of regulation and the appropriate regulators as quickly as possible.
Your question was whether the regulators are appropriately resourced. This is a huge challenge. The speed and scale of change in the digital world is enormous and is difficult for regulators to keep up with. It is very good to see that the CMA has its new data unit, and we look forward to seeing some of the outputs from it. We need to make sure that that work is properly resourced and does not suffer in the light of all the extra work that will come to the CMA from Brexit.
There are huge challenges for the ICO just in keeping up with the skills and the understanding compared with those that they are regulating, and that is a challenge that other similar regulators around the world face as well. It is one of the big challenges for regulation of the day.
As I have said, it is not all just about resourcing. There are also some challenges about co-ordination, between regulators and the Government, and who does what and how. That is not just the ICO and the CMA, but economic regulators like Ofcom. Ofgem is thinking about a number of data issues relating to consumers, but also vulnerable consumers, and that level of co‑ordination is, at the moment, lacking and needs to improve.
There are questions also around transparency. For example, the ICO should publish more details about its work on some issues like data-brokers, so that we can understand more about what it is learning.
There are some final issues that are more generic, but are important, in relation to consumer enforcement, which have been highlighted in the Government’s consumer Green Paper around the landscape of consumer enforcement as a whole and how we make sure that is as effective as it can be, potentially with a greater sense of leadership in the centre, possibly for the Competition and Markets Authority, and greater powers for some organisations like the CMA to be able to issue fines where there are problems for consumer enforcement, so that they can provide greater deterrents quickly, which is particularly important in an area like this, which moves so fast.
Q162 Lord Gordon of Strathblane: You made a point about who regulates and what—could I add in, “and how quickly”? It appears that there is a major problem in that if a statutory body recommends to Government that there be legislation, frankly, by the time the ink is dry on the legislation the game has moved on. How do we cope with the internet? How do Government cope with it?
Caroline Normand: It is a big challenge. The speed with which things are moving at the moment is very challenging. I do not think that means you give up and you stop before you begin. Obviously there are different types of tools and different types of investigation that different regulators can use. I have just mentioned the CMA’s ability to issue fines for consumer enforcement matters, and not just the current recourse they have to the courts. That is one way that you could speed things up.
In relation to the way that competition cases and other things are conducted, there are ways in which we would like to see some of those cases being prosecuted as fast as possible, but we are in a world where things are moving quickly.
Lord Gordon: Is there not a case for Government to have somebody employed, at a fairly senior level, to guess what is coming next, so that we are ready for it when it comes, rather than reacting all the time to things that are already in place?
Caroline Normand: That is one way of addressing it. The only other thing I would point to is that in other areas—for example, in the communications area more broadly or in the energy area—you have consumer panels, you have means of understanding complaints that are coming in and you have consumer bodies, ombudsmen and others who can translate the complaints back to the regulator to see what is happening in real time. We do not have that kind of a mechanism at the moment working well in the area of the internet more generally. That kind of early warning and real-time issue that people have is not getting through the system easily and readily.
The Chairman: You have talked about a number of different regulators, and you are obviously worried that there is not sufficient co-ordination between those different regulators, irrespective of whether they have enough power or enough resource. To follow up on Lord Gordon’s question, is it any part of your view that we are missing another regulator to regulate the regulators?
Baroness Bonham-Carter of Yarnbury: It sounds like a backstop backstop.
The Chairman: To put it another way, is there a co-ordinating body, rather than an individual, that should have the job of making sure that that joining-up happens?
Caroline Normand: There are a few answers to that. I do not think that the regulators at the moment, or the levels of power, necessarily fit together well. Some of that is because some of these bodies are just recently set up, and some of the problems are relatively recently being understood. I do not have a blueprint for how those regulators and those bodies should fit together, other than to say that they should fit together better. I am not sure that creating another body over the top is necessarily the right solution. One could argue that, to a certain extent, the Government should be providing that overview, coming from DCMS.
I would point out, sitting where we sit in Which?, that it is quite hard to understand who is doing what, with what powers and therefore who to go to in order to try to solve things. My observation is that sometimes we find that we have bits of recommendation going to a number of bodies, and we are relying on them to co-ordinate between themselves in order to understand what is going on.
Q163 Baroness Kidron: I want to pick up on two things. They both relate to things you have already said, so you have partially answered them. If, instead of trying to invent the new, we were to rely on existing consumer laws and principles, but then we did the piece of the puzzle that you have already alluded to, which is to have some transparency, would those principles and laws, effectively and robustly applied, give you a lot of the levers that you need? We could bring the digital world into our existing understanding of consumer law, rather than trying to reinvent something new.
Caroline Normand: In relation to consumer law—the part of the law that is really around consumer protections—the consumer protections should be more or less at the same standard whether you are online or offline. If you buy food online or order a washing machine, et cetera, you should expect that you will be covered in the same way that you would be if you buy from the high street. Those protections are more or less in place, and in certain places you actually get more protection online because of what I was going to call the distance selling regulations but which, translated into the UK, are actually the consumer contracts regulations, which allow a bit more time, cooling-off-period time. In the sense of purchasing there are a number of consumer protections in place. In fact, the UK, with the Consumer Rights Act, has itself been innovative in having protections for digital downloads, so not just goods and services but digital goods.
There are some caveats. Consumers, when they are buying something, need to know whether they are buying from a trader, so a business, or whether they are buying from an individual, where their rights will not be quite the same. That is an important distinction for people to know when they are buying things.
When we are talking about consumer protections—I am very much in that world—there are two particular places we would highlight as concerns for us. The first is about purchasing online where you may be purchasing from another jurisdiction. It is difficult to return goods to enforce your rights, and at the moment there are a number of conventions that work with the EU that allow people to prosecute and to get their rights in the UK, even if they buy from a company in another jurisdiction. What will happen post Brexit is not clear, so it is something we are concerned about, to make sure that that is as easy as possible.
The second area—and I can also bring in the fake review piece—is just a concern about the prevalence of unsafe products that are sold online, and whether platforms are doing enough to protect people from these. As part of our campaign on potentially unsafe products, we have made a lot of progress on issues like CO2 alarms, where over 250 listings were removed from Amazon and eBay. We also had experience with the children’s toy slime, where all 11 products we found to contain unsafe levels of boron were removed by Amazon. They were as a result of our having done the testing. We are concerned that we regularly find unsafe products for sale online.
At this point, it is also worth bringing up our fake online reviews investigation, which you will have heard about, where our investigation has revealed how easy it can be for some sellers to bypass rules to offer free products in exchange for false and highly rated reviews. We think it is an area that the CMA in particular really needs to keep a lid on and make sure it is enforcing the rules appropriately, so that we see deterrent action taken against this kind of fake review.
Q164 Baroness Kidron: That is a rather nice segue into my second point, which is that actually what you are saying is that, within reason, the idea of the product itself is being dealt with, could be dealt with, with these caveats. The other area we are really interested in is the relationship between the user and the service. You talked about data and we are interested in whether terms and conditions are an unfair business practice, for example. One of the things that is frequently mentioned is that there is no opportunity to pay instead of giving your data, so your data does become currency. I wonder whether you can talk a little bit about what your feeling is about the flow of data in that regard. Are the sorts of deals that are out there fair on the consumer?
Caroline Normand: The question of whether consumers could pay, instead of getting product for free or access to services for free, is potentially fraught with difficulty. The example I have here is of the Washington Post, which has a premium EU ad-free subscription. This idea is starting to be experimented with. There are a number of risks that come with it. The first is that if you can afford it, you can protect yourself, in so far as that is the appropriate language, from data flows, and if you cannot, you cannot. We know from our research that it is often people who are most vulnerable who are most worried about where their data flows, so that does not seem to us to be a potentially good outcome.
Looking at it the other way round, there is the experience of Facebook in India, which you may have heard of. It is looking at the experiment the other way around. They offered something for free but restricted it. The backlash from people shows that this will only go so far with consumers. Companies should think about those things with care.
The realistic position on this one is just where consumers are, so they may be worried about data flows and they may be concerned about what can happen with those flows, but there is quite a sense of resignation and rational disengagement that goes on with consumers. That is maybe because they do not think there is anything they can do; it is sometimes because there are no alternatives to the services they are using, so even if they are concerned, there is not much that they can do about it; it is sometimes because they think that the horse has bolted and their data is all out there anyway, so what is the point? There are a number of questions that may mean that, even if those services were provided, very few people would take them up.
Baroness Kidron: If I could quickly pick up on your other point, where you said we should be more concerned about impact, do you think that, where the impacts are negative, the people providing the service have a responsibility?
Caroline Normand: If we understood more about impact, and if it was more transparent, what the impact was, it would allow us, business and consumers, to know whether to trust or to think that the thing that they were being offered was fair, which would allow people to take more choice. Let me give you an example of, say, an insurance quote. If you know what that insurance quote is built on, you will have a better idea about whether you think that is an appropriate quote, whether it is fair and whether it is one you will stand by. In those actions by a consumer in relation to that, no doubt, depending on what consumers decide to do, business will adapt.
Baroness Kidron: Equally, regulators will be able to see?
Caroline Normand: Exactly. Regulators will be able to regulate. The transparency would then allow the practice to be out in the open air, such that you can do something about it, whether it is the consumer, the business or the regulator.
Baroness Quin: I wanted to pick up on something you said when you talked about the pressure that you had put on Amazon and others to make redress and take off certain things that they were advertising. What sort of length of process was involved with that, from your making representations to their taking action?
Caroline Normand: I do not have the specifics with me today, so I am very happy to write to you with a sense of how long it takes. I do not think it is a very long and lengthy process per se, but obviously we have to test the products, then we have to do the discussions and then the products get removed. It is going to entail a certain length of time because of the necessity to test the products, but I will come back to you.
Q165 Baroness Quin: I would just like to know and see whether it is something that we need to have any concerns about.
My question is about the responsibility of consumers themselves, given that consumers are a huge range of people and some of them are vulnerable in this area, without any doubt. What responsibilities do you feel that consumers have for looking after themselves and protecting themselves from online crime or whatever? If they have got responsibilities, how can they best be empowered to be able to assume those responsibilities effectively?
Caroline Normand: My answer to that would be that consumers have responsibility where they are best placed to control the risk that they are facing. In many instances of online business, it is the business that will have much more knowledge and tools to control the risk than the individual does.
I will give you an example of the 2016 super-complaint by Which? on bank transfer scams, which we made to the Payment Systems Regulator. Which? set out evidence showing that if banks faced different incentives, the protection for the consumers against these authorised push payments—this is where consumers are scammed into transferring sometimes very large sums of money—the outcome for consumers would improve. What we have learned since then is that scammers have a range of extremely sophisticated techniques to identify and deceive consumers. In our strong view, banks are best placed to take systematic action to reduce this risk. The same must apply more broadly. This is a specific one, and it involves large sums of money, because it is in relation to banking, but the same principle must apply for other online businesses.
I have already mentioned the question about where you go when things go wrong, but let me come back on to how you might empower consumers to help themselves a bit more. First, there is not an obvious place for people to go and there is not an obvious point of help and resource and redress, so obviously they turn to people like Which?. Quite rightly, we provide people with advice around their rights, through our consumer rights website, to help them be aware of scams, the latest types of scams and how to spot and report them. We cover the differences between scams, rip-off deals and all of those sorts of activities that take place online. We also advise on the likely targets of scams—often things like investment scams will be aimed at retirees—and how to make a complaint to whoever you need to make a complaint to. We provide a lot of information.
Another thing that is worth pointing out is, even when an individual is proactive and does something about the problem, what happens. Our research last month found that over 96% of the cases that were reported to Action Fraud, which is the UK’s fraud reporting centre, go unsolved. Less than one in 20 crimes handled by Action Fraud result in a suspect being charged, cautioned or dealt with in the justice system. We provide information about scamming but scammers are sophisticated. It helps up to a point. As I said, companies are often better placed to understand, and when consumers go to the place that exists for them to go to, it is not at all clear that much happens.
Baroness Quin: The obvious question then is what Government should be doing about those statistics that you have quoted, and I suppose the EU and so on. It is all very well consumers coming to you with their concerns, but it sounds like there needs to be some kind of much more effective enforcement mechanism at some level; I am not quite sure which level.
Caroline Normand: We argue now, and we have argued in the past, that there need to be much more effective systems of redress for consumers across the piece. Obviously there will be different types of redress for different types of activity. Here I am talking about scamming and fraud, but it is a real problem and online there are potentially many ways in which scammers and fraudsters can operate.
The Chairman: Could you just tell us, briefly if you could, whether it was clear to you, when you looked at those statistics, what it was that was preventing these things from being taken forward? You are talking about criminal activity here in the main. Was it lack of evidence? Was it lack of resource in the investigating bodies? What was preventing those things from being taken forward?
Caroline Normand: I do not have that information here. If we have it, I will certainly let you have it.
The Chairman: Thank you. If you could write to us with any other information you have, that would be very helpful.
Baroness Chisholm of Owlpen: Do you feel there should be a thorough review about enforcement and where people can go to get redress when there has been a problem? Do you feel that is what is really lacking at the moment?
Caroline Normand: Across the space that individuals and the consumer would regard as the internet—because people think in the terms that they think and consumers will think about this being online—it is not at all clear where people go and can go. There will be different places that will take different types of action. Obviously the ICO has some powers, there is Action Fraud, and there are things in between. How they join up, what the impact is, what the effective outcomes are, and, critically in the middle of this, what the redress for the consumer is is not entirely clear. Some of these enforcers will enforce in order to right the wrong or to prosecute the individual, rather than to provide redress to the individual consumer. There is a range of issues in this space that I do not think are well understood, and I do not think they contribute to the trust that people have in the system and what I have already described about data flows and so on.
Q166 Viscount Colville of Culross: I wanted to ask about the design of algorithms. Should we be legally requiring the tech companies to open up their algorithms, even if they are commercially sensitive, which is obviously the objection, or should we just be concentrating on the decisions that are made by the algorithms so that they can be challenged properly?
Caroline Normand: From our perspective, and what we heard from consumers, the key thing is what the impact is, so what the outcome is. From a Which? point of view, we are always interested in the outcome on individuals. We are interested in the outcome in terms of what comes out of an AI decision, if you like. From our perspective, that is the most important thing. If that requires transparency and opening up how the algorithms are constructed, maybe it does, but from our perspective the outcome of those decisions is not well understood, and that is where we would start.
Viscount Colville of Culross: How would you enforce that?
Caroline Normand: I am not at the enforcement point. I am at the transparency point. We are back up the line. Our observation on trying to do the work that we did was that we need to understand what is going on before we can enforce things, and it is not transparent. It is not understood where algorithms are being used and what the impact of those decisions are. I go back to the point I was making about the impact of use at the time of use. That is one device by which you could get at some of the outcomes of what is happening from algorithmic decisions. I just reiterate that an organisation such as Which?, a consumer body, has tried quite hard to understand what is happening, but there is really not much transparency when trying to get to grips with this. That is why I am going back up the story, because individuals do not understand this either.
Viscount Colville of Culross: That explanation of how the decision is made, in your view, should be very clearly laid out, so that the consumer can understand what the effect of the algorithm has been in that decision.
Caroline Normand: I am sorry if I sound like I am repeating myself, but what the consumer wants to know is, “Why am I seeing what I am seeing?” It may well be that at the moment it is quite challenging to answer that question on the back of an algorithmic decision, but that is what the consumer wants to know. They want to know why they see that advert, why they get that credit score or why their insurance quote is this. We have had scare stories in the past, right or wrong, that people with Hotmail addresses were getting more expensive insurance quotes than people with Gmail addresses, for example. Whether true or not, it is an example of the kind of thing where people would just like to be sure they understand why they are getting what they are getting.
In understanding that, that then forces questions around, “What is behind this decision? What went into the algorithm?” It is quite likely that this is not well understood by the companies operating all the decision-making, because obviously this is a quick way of getting to decision-making. It poses its own challenges when you look at the final outcome and say, “Why?”
The Chairman: I will ask Lord Allen to add his question at this point, because it might give you an opportunity to unpack this issue.
Q167 Lord Allen of Kensington: This leads on from what you have just been discussing. I was particularly interested in your written evidence regarding things like individual profiling and micro-targeting. It specifically is around a risk of algorithms being used to discriminate in terms of pricing, so, whether it is Baroness Kidron or myself, you could have data that may suggest that we would respond differently to different levels of pricing. That is a fairly obvious issue. The question is whether you have any thoughts about what could be done about it?
Caroline Normand: On the personalised pricing point, we did not come across any evidence of specific personalised pricing of the type where, for example, a pen costs more for one person for some reason compared to someone else. Obviously across marketplaces and elsewhere, differential pricing is something that you see, and sometimes we are happy with it; sometimes it is the way in which markets operate, whether it is because you are encouraging new entrants by vouchers or something. Sometimes we are not happy with it, because it is targeted at vulnerabilities or it is targeted at people’s inertia or misbalance in information, and so on.
Lord Allen of Kensington: I can understand the demand and supply thing. If you look at it with airlines, we all pay different pricing on the airlines, so I can understand that. The specific targeting of individuals and discriminating against them is the area I am trying to unpick a little bit.
Caroline Normand: No, I understand. I am afraid this argument is a bit circular. What we need to know is what has gone into the targeting of individuals and the pricing decision that they are seeing, or the voucher or the deal that they got. Why have they got it and what has gone into the decision, AI or otherwise, to get them to that point? That is what is not understood, and that is what is not known.
Our response to that is, “Tell us what went into the decision so that we can see what you have used. What about the individual have you used in order to come up with that price?” That could in turn mean that the wrong pieces of information have been used about the individual, or inappropriate pieces of information—for example, an email for a credit report. It could uncover instances where profiles have been made about individuals, and used, that are inaccurate. That is another thing that concerns individuals. In that world where profiles are constructed, if you trace back through or do an information request you can find that sometimes those profiles are remarkably inaccurate. That has its own problems.
Q168 Baroness Kidron: I think I know what you are saying, but maybe it would be useful to hear it this way round. There has been a lot of concentration, particularly amongst people like us, on AI. What you are saying is that you do not care how you get there so long as you can tell the story in words. What you want is a list of attributes that made a material difference, not some magical formula.
Caroline Normand: I am going to hesitate on the word “list”. Essentially what we are looking for is some means for individuals to understand why they are seeing the thing that they are seeing or the result that they have got. They need to be able to understand where it comes from and what has gone into it. Those are the things that they need. We are not expert in this, and we know that consumers do not want reams and reams of information, because they will not read it.
Having said that, Google has started to have a go at this in some areas, in providing a bit more information about where ads come from; you can press a button and you get a bit more information. Let us not forget that these companies have invented the digital advertising market, which puts adverts in front of your eyes in milliseconds. I do not claim to have all the answers, but I also do not think it is beyond the wit of the companies that we are talking about to start to think about it more seriously. It is a really important thing in order to build the trust that is required to make this thing continue in a stable and solid form.
Q169 Baroness Bonham-Carter of Yarnbury: Going slightly backwards, Which? was established in order to champion consumers in a very different world. We were talking earlier about whether the regulatory framework needs be beefed up, or changed, or whatever. You also said you are not expert yet, but is there a place for a more technological version of Which?? I know you do your reports and stuff. We are all agreeing the consumer is in the dark, so I am trying to go backwards to the original conception of Which? Is there an opportunity for something like Which? for the modern world, or is it just too much beyond? I do not mean Which? itself; you know what I am trying to say here.
Caroline Normand: I do, but I am nevertheless going to respond and say Which? is very much for the modern world. This report that we put together is a no-brainer. We have to understand this better. It is just challenging. We are not alone. We are not the only people trying to understand what is going on; there are many people doing that. We are absolutely in this and for it, and need to, but we will never be technology experts. We will never be at the cutting edge. We will do what we need to do, and we need help in the form of greater transparency, in order to help do our job. That is one thing I will say.
At the beginning I did say that there are a number of other regulators around the space that have been invented a number of years ago, because we had energy suppliers, we had communications and so on, who had the benefit of more information around the problems that consumers face, whether it be complaints or understanding from a consumer perspective. Our observation is that is not present at the moment in the digital sphere. There is a good question as to whether it should be, but Which? will be there.
The Chairman: In the modern world.
Caroline Normand: We are in the modern world, and we will be doing our job.
Baroness Bonham-Carter of Yarnbury: I was not trying to suggest you were not. I was trying to suggest quite the reverse. I was suggesting that maybe you are very much part of the answer. That is what I was trying to say.
Caroline Normand: Indeed we are.
Q170 Lord Gordon of Strathblane: It seems to be almost inevitable that companies that provide a service on the internet acquire market dominance of the field totally. Once you get to 51% to 49%, it is a fairly rapid run to get to 90%-10% and total market dominance. Do you think it is inevitable or is there anything we can do about it, or can we mitigate any harmful effects?
Caroline Normand: There are a lot of areas of the digital world where there is a lot of competition, often in the early stage, but there are a number of areas where competition is vigorous and exists. Equally, as you say, the tale rapidly grows into some very large companies who dominate. There is some really interesting work that Oxera did for us around some of those questions around dominance and around the role that data plays within it. For example, your access and your ability to get hold of data, the cost of acquiring it and the depreciation of the data mean that there are some types of data that are much more precious.
Lord Gordon of Strathblane: Do you mean time-sensitive data?
Caroline Normand: I mean time-sensitive data or data that is hard to get hold of. That might help dominant companies more than some other types of data. For example, it is not that hard to get hold of people’s age, their addresses and so on. It is quite hard to get hold of the sorts of data that you might have through messages and what people write about. That is much more time-sensitive and much harder to get hold of, so there are some interesting questions that come into play around dominance, what causes dominance and what can help people to stay dominant.
Those questions on data raise, as you will well know, many new issues for our competition authorities. How does your assessment of market power shift in light of how much data you have of different types? How does it shift in relation to the networking effects that you have from the different services that you offer and the number of people who connect into you? There are interesting questions in merger cases: how do you look at the acquisition of a pretty small company, for example, that might not even make the merger thresholds but that holds a lot of personal data? All of those things are important. We are very pleased to see Professor Furman’s review that HMT is conducting, because we think those are very important things to get right and to start to develop, so that they can work in practice and not just theoretically.
I would go on, and I do not need to repeat myself, but in particular we think that the digital advertising market, and the dominance of two players in that, is a particularly important part of this, just because it drives so much of how the system operates.
Lord Gordon of Strathblane: In a way, it could also be argued that it enables the company to provide a better service, having more complete information. It is a question, perhaps, of evening up the balance. Do you think that data portability would help even the balance slightly in favour of the consumer?
Caroline Normand: Data portability is an important right in GDPR, and it has pretty significant potential, but it requires certain conditions. The one that I would underline the most is that people need to trust in order to be happy to adopt data portability. The sorts of concerns that they might have about data-sharing and security are really important things in order to make sure that data portability can work. In addition to that, our experience to date is that there needs to be a certain degree of mandation. So, for example, the experience of my data, in energy, which was based on a voluntary standard, took many years to get anywhere, and I question whether it has. Obviously, open banking was mandated through PSD2, and therefore mandated open APIs has allowed that to develop more quickly.
Having said that, and going back to my first point, we are seeing that play through in open banking. There is a question of awareness, of course; I think only about 28% or 30% of adults were aware of open banking in August, which is about eight months after it came in. At the same time, 77% of people said that they were concerned about allowing companies other than their main bank to access their financial data for security reasons. In the data portability world, if it is going to be used for switching, for new services and for innovation, people need to be comfortable and to trust in order to use it, and that takes me back to some of the points I was making earlier about trusting where your data flows to, what the appropriate governance framework is for the way in which data flows and where it stops. Does it stop?
The Chairman: We are approaching the witching hour for the Committee. As you see, we are about to start haemorrhaging members. I am going to ask that Lady Chisholm’s question, which she is about to ask you, is the last; and ask you, if Lady Quin is content, to write to us on the subject of the impact of Brexit—which we always come to at the end of the Committee’s proceedings. If you would be kind enough to write to us with any thoughts you have on that, we would be very grateful. In the meantime Lady Chisholm will ask her question.
Baroness Quin: Could I add a rider to the Brexit question? You said what you think the effect of Brexit is. I would be interested in how you see the role of Which? working within the European consumer networks, which I know have been very important over the years. I would like to know whether you see that continuing after Brexit and, if so, how?
Caroline Normand: Absolutely.
Q171 Baroness Chisholm of Owlpen: As we know, there are widespread concerns about the ethics of data collection, and, indeed, you mentioned earlier how the consumer’s voice is lost in that. Do you feel that for them to have meaningful control over their data after it has been gathered we need change in regulation?
Caroline Normand: Consumers do not necessarily feel that they are in control, but equally I am not sure their being in control is necessarily feasible. What we have heard from consumers is how resigned and powerless they feel. The best example of that is the reaction to Cambridge Analytica, for example, where we heard that 24% of people said that as a result of that they would consider leaving Facebook and 6% did, and then actually the number of people logging on to Facebook went up.
The control bit may not be realistic. What we think people want is to know that there are controls, and they want to know that the system that they are operating in is not a wild west, that there is some degree of governance. They may not put it in terms of governance, but they want to know what would happen when something goes wrong. They want to know that there are rules around where their data goes. They want to understand how their data has been used, and to see how it has been used, and as a result of seeing that they can be more confident that it is not being used for nefarious or harmful purposes.
For us, that question of control is not so much putting people in the driving seat, with all of the responsibility that that creates, because that may not be what they really want. They want to know that they have a system they can trust in, that they can have confidence in, where they know that there are rules, that they can do something about the rules and that they have somewhere to go when things go wrong.
Baroness Chisholm of Owlpen: Should we go back to the beginning, so that there is transparency at the beginning when they first sign up to the data, so they know what the purpose of that data is? Do you think that would help?
Caroline Normand: Up to a point, through GDPR, we already have the requirement for people to understand what their data is being used for. That is a good step in the right direction, but it does not give them the specificity that allows them to understand later on, when they have probably forgotten what they signed up to, why they are seeing what they are seeing. It does not give them answers. Consumers as a whole think when they provide data that they are providing it into a bounded world. They do not really think that they are giving it into a world where data flows. They are finding that out and are then not able to find an answer saying, “It is okay because we have rules around where your data flows”. We cannot say that, because there are not. That sense of a system that has a degree of control about it is what is key here.
The Chairman: Thank you very much indeed for your evidence. Just to reiterate the point that Lady Quin made, could you write to us on matters to do with your international connections and the effect that Brexit may have on those networks?
There was just one other thing, which arises out of the question that you have just been answering, which is on the slightly narrower point of people’s awareness of their rights under existing data protection law. If you have anything that you could say to us about what assessment you have made of whether people are aware of their rights, and how willing or otherwise they are to exercise them, that would be very helpful.
In the meantime, thank you very much, again, for your evidence. I am sorry that it has felt a little pressured at the end, but you have been most helpful and we are very grateful. Thank you.
