Digital, Culture, Media and Sport Committee
Oral evidence: Immersive and addictive technologies, HC 1846
Tuesday 2 July 2019
Ordered by the House of Commons to be published on 2 July 2019.
Watch the meeting
Members present: Damian Collins (Chair); Clive Efford; Julie Elliott; Paul Farrelly; Simon Hart; Ian C. Lucas; Brendan O’Hara; Jo Stevens.
Questions 1464 - 1553
Witnesses
I: Elizabeth Denham, Information Commissioner; and Steve Wood, Deputy Commissioner (Policy), Information Commissioner’s Office.
II: Margot James, Minister for Digital and the Creative Industries.
Examination of witnesses
Witnesses: Elizabeth Denham, Information Commissioner; and Steve Wood, Deputy Commissioner (Policy), Information Commissioner’s Office.
Q1464 Chair: Good morning. I call this meeting of the Committee to order and welcome the Information Commissioner to give evidence this morning as part of our inquiry on immersive and addictive technologies. Elizabeth, welcome back to the Committee, and welcome to Steve Wood as well. We have been taking quite a bit of evidence during the course of this inquiry, not just from social media companies but other companies that gather and hold large amounts of data, and in particular games companies. It does not appear to be particularly clear to us just how much data they are gathering and how it is being processed and used. We have heard that some companies gather data to create profiles on types of gamers. We have heard that companies share some data with social media platforms like Facebook if they have a Facebook log-in. I want to ask whether this is something that the Information Commissioner’s Office has looked at, the gathering of data about games players by games companies and what that is used for. If you have looked at it, do you have any areas of concern?
Elizabeth Denham: Thank you very much for the invitation to appear before you and discuss this important topic. I suppose that when it comes to data protection and the mandate of our office, we are a subset of some of the concerns that you are studying in terms of addiction, immersive technologies, and the wellbeing of people who are interacting with online companies. We have been doing a lot of thinking about addictive technologies in the context of data, mostly in the context of children online. The reason that our policy thinking is focused on children is because we are drafting, as you know, the age-appropriate design code. We are looking at games that children are playing and how data is gathered. We are looking at social media sites, search engines, any kind of online services that are likely to be accessed by children. We are laser focused on that because of our children’s code.
We have heard from the interactive entertainment industry and the gaming industry in the context of their response to our age-appropriate design code. We feel that that industry, e-gaming, has some maturation to do in understanding what their obligations are in data protection law. That industry is quite concerned about our code because it feels that it will undermine or impact the business model of those games through nudges and reward loops and the way that those techniques are built into games. We are happy to speak about that. We do not have any active investigations going on with the gaming industry.
Steve Wood: Just to add a little bit more to what the Commissioner said, it is where online games are likely to be accessed by children, because that is the wording in the Data Protection Act that has set out the requirement for the age-appropriate design code. Obviously, a significant number of games online are likely to be accessed by children, so what the age-appropriate design code produces is absolutely relevant to this area. It is a fast-moving, innovative sector, and we are seeking to learn more about the sector while we are doing this work.
The other thing I want to stress is that once we have published the age-appropriate design code that will not be the end of our work in this area; there will be a longer-term children’s privacy strategy. We have identified it as an area of regulatory action priority that we will follow up and use our powers where necessary to use the code that we have developed as a template to do audits, to look at practices, and to see whether we are getting that step change, which is really privacy by design, and putting the best interests of the child at the centre of the way these services are designed. That has not happened extensively yet. That is the overall headline.
Q1465 Chair: What you have set out certainly is of interest to us, even if it is not part of an active investigation. Some of the questions that we have been putting to the games companies have been to try to gain a better understanding of how data is being gathered and used. Is data being gathered about styles of games play in order to make the games more efficient at creating prompts and nudges for people to either spend more time or, indeed, to engage with different forms of content, or make purchases through the games as well, and that the purpose of gathering data is to facilitate the prompting and improve the design of the game?
Elizabeth Denham: The focus that we have on our age-appropriate design code is really again back to putting children in the centre of design decisions and to make sure that there is robust protection when children are accessing those games. As I said, the work that we are doing on children is a subset of what your Committee is looking at. This industry is one where there are large companies involved and there are small providers involved. It is a good testing ground for us entering those kinds of dialogues so that they can focus on design that is transparent, that is fair, where data collection is minimised, and those services are designed to provide privacy by design, which is a requirement in law. We are, as Steve mentioned, engaged with that industry through their responses to our consultation on the children’s code.
Q1466 Chair: First of all, as an overall principle, is it your belief that any games player that made a data request to a games company should expect to receive the data that company holds on them?
Elizabeth Denham: Yes. Under the GDPR individuals have that right of access to their personal information.
Q1467 Chair: Just as much from a games company as they would do from Facebook or anyone else?
Elizabeth Denham: Exactly.
Steve Wood: They are classed as a controller under GDPR, and they have the obligation and responsibility to respond to those requests.
Q1468 Chair: Yes. In terms of the consultation on the age-appropriate design code, what have been the principal areas of concern raised to you by games companies?
Elizabeth Denham: The concern is that the age-appropriate design code as a fundamental principle requires that children’s wellbeing be a prime consideration in the design of information society services, including games. There is a concern that the default settings for children being set to high privacy setting, so a default to protect children, to limit the amount of data that is collected on them as they are interacting with the game, to limit the kind of personalisation and profiling that is happening online, would interfere or undermine the business model, which is based on collecting more and more data, keeping eyeballs online, playing the game in order to provoke more rewards, more playing, bringing more people on to the game, and so on.
Steve Wood: The other piece of feedback we have had is about what the transition looks like for them to move to this particular stage in terms of implementing privacy by design standards in the way we set out in the code. We recognise that it is quite a diverse sector and there are a large number of small businesses in the sector. We have had quite a lot of feedback explaining how the sector is structured, which obviously we will take away and think about, particularly how the smaller businesses would need to be supported in the transition in terms of what they need to do.
We have also launched what we are calling a regulatory sandbox at the ICO, which is a space where businesses can come in for innovative uses of data and get advice and input from the ICO about how to do that in a privacy-friendly way as well. We are aware there is a transition, and a support, and an evolution. There is particularly an opportunity for new businesses setting up to get this right the first time, to perhaps try to build in the innovation and even sell themselves on the basis of caring about data and putting the interests of privacy by design in at the same time.
Q1469 Chair: In terms of the scope for this, there have been some concerns raised about the age-appropriate design code from organisations that would see themselves as having younger people who engage with their content but it is not necessarily designed for younger people, as opposed to businesses such as Snap, who we saw earlier in the inquiry, who are clearly designing tools that are being predominantly used by younger audiences. Do you think there needs to be a distinction made between tools that are being created for young people, or predominantly used by younger people, and general media that anyone can consume but has a relatively low audience number for younger people?
Elizabeth Denham: Having the fundamental principle of designing tools and websites and games and any online services likely to be accessed by children—those are the terms—is the legal basis that defines the scope of the code. That said, on the wellbeing of children in the context of news media, we want to encourage children to find out about the world. We want children to access news sites, so the concern about the impact of the code on media, editorial content and journalism I think is unfounded. We have work to do to explain the code more, to explain the scope of the code, and to explain our proportionate response to enforcement. We have more work to do there, but we do not think there will be an impact on news media sites in this context. They are already regulated. We are not a media regulator.
Q1470 Chair: Is it your view that, as far as you are concerned, the enforcement of the age-appropriate design code will not bring in any additional obligations on news media companies beyond those that they already work to under their own regulatory system?
Elizabeth Denham: No, we do not. We have more explaining to do, and we have meetings coming up with the NMA and the Society of Editors. We are in touch with them, but that should not be a concern about the code. There is a concern about the ad-tech industry that funds many of the services online, because that industry needs to be more transparent and clear about the data that is being collected. There are some concerns about the ad-tech industry that we are working at addressing.
Steve Wood: I want to return to the questions about the news media and the different context in which this code will apply. What we have learned from the consultation is that we will go away and think about how we better articulate the sliding scale of risk you have here, starting off with services that are expressly designed to appeal to children, obvious things like the BBC’s CBeebies website, things that are designed for children, and then going out to services where there is very strong evidence that they are very heavily used by children, like social media. There is very strong research and secondary evidence to show those sorts of services are used by children. Then you are moving further and further out on the spectrum where, equally, the way the data is gathered and the way children use those services means the risk is getting less.
We are saying that the news media are out there on that outlier. We do not want to create any barriers to children accessing news content as well, because children also have the right to freedom of expression, to learn about all sorts of different topics, and that is also important for us in terms of the UN Convention on the Rights of the Child and the freedom of expression aspect as well. We are going to go away and think about how we are going to articulate that. We have listened carefully to that. The challenge of the code is that the concept of “likely to be accessed by a child” is so broad and it covers so many different industries that we are having to work across a pretty broad canvas.
Q1471 Chair: You said that that is something you wish to provide some reassurance on, particularly for the news media industry. For the benefit of the Committee, could you set out how you think you will be able to reassure them?
Elizabeth Denham: We have meetings coming up over July with the News Media Association and the Society of Editors. We will be able to explain the code more and I think allay some of their fears about whether this has an impact on freedom of expression. It is challenging to draft a code that covers all of these different industries. One of the things we have heard from all 450 responses to our consultation is that everybody agrees that there needs to be a different experience for children online, just as there is offline, and there needs to be more protection for children. Our code is not about keeping children off sites or games or websites. It is about making sure that their experience is fit for purpose for their age.
It is really important work. There is so much interest in this code from the US, from Australia, and from the Asia-Pacific region. Everybody is watching this code because it is the first code that articulates the GDPR requirements of privacy by design and the special rights of children online. It is really important work, and Parliament had the foresight to require the drafting of these design specifications for children’s services. It is just fascinating and important work.
Q1472 Chair: Yes. A final question from me on this, going back to games companies as well. As we touched on earlier, we have raised questions about the amount of data that games companies gather about users and the way they seek to profile games players with that data. Do you have any concerns as well about the amount of that data that is shared with companies like Facebook? Where someone is using a Facebook log-in, and many of these online games do use Facebook log-in, it is not clear to us at every stage of this inquiry just how much data and information is shared back to platforms like Facebook and what knowledge or informed consent the user has given for that.
Elizabeth Denham: We are concerned about that, but the GDPR rules apply to gaming companies in the same way they do any other company. To share information they need consent or another legal basis, there has to be transparency, and there has to be the right to challenge. It is an area where there needs to be more focus around their privacy obligations and transparency, looking at nudges and looking at likes and streaks. How the whole system works is an area of focus. We are pleased that the Committee is studying this, and we are certainly focused on it for our enforcement and policy work.
Q1473 Simon Hart: One of the problems we have had in the last evidence sessions and in our discussions with various gaming companies sat where you are, in the context of online harm and online addiction, was the lack of evidence that they apparently had. In every line of inquiry we have pursued we have met with, “We do not collect that kind of data”. That was frustrating in one respect, because if we are going to be able to increase our knowledge about potential harm that online addiction is doing, clearly there needs to be some dataset to which we can refer. On the one hand, we are hearing from you that there is a presumption against collecting too much data, but on the other hand, in order to understand the potential damage that online addiction is doing, particularly to young people, we need more data. We need the lead to be taken, we might argue, from the gaming companies to acquire that data so that we can understand what, if any, harm it does. How can we square those two dilemmas? We need data, but we do not want to do it overbearingly.
Elizabeth Denham: We need data, but not too much data. People have to understand if they are being profiled, or if research is being done to determine whether or not there needs to be an intervention, or if somebody is suffering an addiction online, is that the nature of your question?
Simon Hart: Yes.
Elizabeth Denham: I wish that the gaming companies would come and talk to the ICO about this, because we are certainly not against research. We understand that there may be ways of intervention to help people. At the same time, people’s rights have to be respected in terms of targeting them or putting them in a category or determining that they might be someone who could suffer from addiction. There are ways to square the circle on this, but we need to be involved in real proposals that companies might have to be able to help individuals. We certainly get these kinds of questions in the financial sector, for example, around how we can help the vulnerable when we see that because of their financial records they may have a gambling addiction or they might be about ready to declare bankruptcy. We know this because we can see it from the data that we have.
There are ways to do it in the public interest. There is research that could be carried out. The Samaritans could bring forward data in a look-alike audience that could be used. However, these are questions that need to be brought to the regulator so that we can help carefully balance the public interest and individuals’ rights not to be targeted in a way that they do not understand.
Q1474 Simon Hart: Do you think that there should be an obligation on gaming companies to undertake the research that would demonstrate one way or another the extent of these potential harms?
Elizabeth Denham: I do not think it is for me to say whether they should be investing in that. We have seen in the gambling industry, for example, some of the big companies providing funds for research and funds to support civil society organisations that are studying these issues. We have seen that in other kinds of industries. I do think—going back to online harms, going back to the White Paper, and thinking about a duty of care for all of these companies—there is a societal expectation that they understand the risk they are creating for others and take steps to mitigate those risks.
Q1475 Simon Hart: Sorry, Steve, jump in if you want to add anything.
Steve Wood: Just very briefly, you can also draw a distinction between what we call aggregated data and anonymised data. I know there is great interest in transparency reporting, and that is of interest in the wider online harm space. Much more detailed data can still be available in an anonymised form so that people can understand the trends and issues and there can be interactions with those types of data. Where you want to use someone’s personal data in real time, to perhaps use algorithms for good because you want to prevent harm, that is where we know we need to work in that situation to make sure it can be done in a privacy-friendly way. It is too crude an analogy to say, “The GDPR prevents this”. We are happy to myth bust that. We also have a grants programme at the ICO, and it is well designed for those sorts of areas to help support some research to find the solutions.
Q1476 Simon Hart: If it emerges that the evidence base is changing around online harms, do you see that as coming under your jurisdiction to adjust and evolve the code accordingly to keep abreast of changing knowledge and science in this area?
Elizabeth Denham: I think the benefit of the code is its 16 headline standards are principle based. There is a broad code and they are principle based. We know that our knowledge of these harms and how they should be mitigated is going to evolve over time. The code is open enough to evolve over time because it is principle based. As more evidence is produced, as we have more robust understanding of the impact of these technologies on children and others, then yes, I think the law is set up in a way that the codes can be amended and changed. This is a journey, this is an evolution, just like the GDPR has been. There are transition periods to get industries ready for the kind of changes that they have to put in place.
We know that the internet, games, websites and search engines, and social media companies were not designed with kids in mind, yet 20% of the users of the internet in the UK are children. The kids are not all right, and I think we need to focus on the kids. What the kids’ code does is give a design imperative for these companies, be they interactive entertainment or other, to think about how they can design for children. We need to make sure that we have good digital citizens in the next generation. We are really excited about the work that we are doing. It is an ambitious code. We have a lot of support. Nobody is saying this is a bad idea. Some companies are saying, “It is not possible”, others are saying, “It is absolutely possible to integrate these standards into the services”. With time, with a transition period, we can get there.
Q1477 Brendan O’Hara: Just going back again, you touched on earlier the age-appropriate design code. It is my understanding that the code will apply to all users unless platforms already have a robust age verification mechanism in place. Is that right? What is your definition of robust and how will it be applied before you decide that a company already has these sufficient safeguards in place?
Steve Wood: I am happy to answer that question. We have had quite a lot of feedback about the concept of age verification in the consultation, which we are going away and considering. What I want to re-emphasise from the outset is that it is the 16 standards in the code and the overarching approach that is the key here, because as the Commissioner said earlier, we cannot protect kids by keeping them away from the internet or off the internet. We have to protect them while they are in there, in that environment, and accept the reality of the young age at which children go online. That means that you have to have things like default settings and things like geolocation being switched off by default. All those things need to be there. In order to present those standards, organisations, if they do not apply those standards as default to all users, will need to be able to distinguish children from other users so that they can still put children into that safer space.
All we want to do is advocate a risk-based approach, so the most robust age verification mechanisms are used for the riskiest situations, perhaps where there is the most in-depth profiling and the use of algorithms. Therefore, there will be a sliding scale of measures that organisations will be able to take to verify. In terms of the robustness of age verification, we are certainly aware that there is a concept of self-declaration. We have said in the code that clearly that has a number of weaknesses, and I know that the Committee has taken evidence on that point. That is one approach that clearly will often not be robust unless it is backed up with other technologies and other mechanisms. One of the areas we are really interested in, and we think there will be a call for action for the market to provide much better solutions, is for the big tech companies who do have the muscle and the ability to innovate here to develop very privacy-friendly mechanisms to do age verification.
Certainly, we would be concerned if there was wide-spread age verification collecting hard identifiers from people, like scans of passports. We very much do not want that to be an outcome from this code. However, we are interested in concepts like age estimation, which is where you can use algorithms running behind the scenes using different types of data linked to the self-declaration of the age to work out whether this person is the age they say they are when they are on the platform. Some of these technologies we recognise are still maturing and still developing, which is why I think we are probably going to have to evolve to get to the right point. We also really want to get third parties to provide solutions, because small businesses will not be able to develop this in-house, and third-party solutions that are certified, safe, federated systems, where the organisation that wants to verify does not hold the information but a safe third party holds it, is the way to go.
We know there is more to do to nudge and move the market on to provide some of these solutions. It is a moving area. We are going to go back and revise some of the guidance to set out that risk-based approach. It is a difficult area. The last point is to say we know there are workarounds, the same as children will go into shops to buy alcohol or cigarettes or get into cinemas. There is not a foolproof system. However, we have to make sure that the right mechanisms are in place in relation to the risks that are out there.
Q1478 Brendan O’Hara: There is no questioning that your desire to find a solution is there. Is the technology there? Is the will of the companies you seek to be robust there? How far away are we from this becoming a reality?
Steve Wood: We are doing quite a lot of work on that at the moment. We have a technology policy team at ICO that are working on this issue and speaking to a number of key players in the sectors, including some of these third parties that are starting to provide solutions, to bring them to the market. In terms of the big tech companies and some of the social media companies, they are engaging with us on this issue and they are starting to show signs of opening up a little bit more. We want to understand what exactly they are doing in terms of running these algorithms behind the scenes to start to do this age estimation approach as well. We want to understand whether this is a solution or not, so we need more information from them to understand that.
We are undergoing that process at the moment before we finalise the code to set that out. There is cause for hope that, with an evolution, different standards—I think certified standards—will come on the market that will start to make this possible. I want to finally say that the age verification in itself is not the silver bullet, so we are not putting it absolutely front and centre in this, because there are so many other things that need to be done to provide the safe environment for kids online as well. It has its place.
Q1479 Brendan O’Hara: Going back to my final point, how far away are we from making this happen, do you think?
Steve Wood: We will want something to be in place by the time the transitional period of the code ends. We are still deciding on how long that transitional period would need to be. Parliament has given us a year. Once the code is laid in Parliament, which will be later this autumn, we can then set a transition period up for a year. It will be very important that steps take place during that year so that it is in the right place by the time that transitional period ends. Our biggest concern is probably smaller businesses who are not in a position to develop this in-house and would be more reliant on the third-party market to provide them. What we would be saying as well is this is an evolutionary journey. You should be developing your children’s data strategy now, looking at all of these different areas about what you need to do.
The same as we said with GDPR, if you are on the journey and you are demonstrating your commitment with the steps you are taking, if we come to audit you or look at you, then you are going to be able to demonstrate a case as to how you are evolving. However, in particular as a message to the big tech companies about the whole code and thinking about how they may need to provide that environment and distinguish the ages of younger users, it is very important they start to think about this now, and it will be an ongoing dialogue between us.
Q1480 Brendan O’Hara: You are right to identify that any determined 13 year-old can circumvent it, and we have heard evidence from many people saying that. How on board are the big companies here? We have heard lots of evidence, even just in the last week from Epic and EA, wherein they identified tension between age verification and data protection. Epic in particular was saying that it did not want to collect more data because it wants to move to a model of data minimisation. There seems to be a gap between what you want to achieve and how that is being translated into what the big tech companies want to do and are doing.
Steve Wood: I think you are just highlighting there is a really knotty policy problem with the different balances between making sure that we minimise the data that is collected and it is done in a privacy-friendly way against the benefits in some situations of having that type of verification system in place. In other areas we have managed to make that balance. Data can be collected, for example, to monitor for security issues, information security online and virus checking, and people’s data is monitored in those ways. There are some other parallels where it does not mean that the GDPR will prevent this happening, but there is a risk if it is done in a very crude way, which is people sending in scans of passports and those sorts of hard identifiers flying around on the internet. That is not the approach we want to take.
That is why some of the larger players will have to innovate, and it is using their knowledge and skills in algorithms and in AI to develop some techniques that are less privacy intrusive to be able to assess and monitor the ages of those who are on their platforms. They invest heavily in understanding their customers for other reasons in terms of wanting to monetise and wanting to understand the trends of what their customers are doing, so we are holding the mirror up and saying we want them to innovate in the same way for this area.
The other risk in age verification is that we have to be very careful, particularly if it was to become widespread—and we do not want it to become widespread across the board—that it does not exclude people who do not have access to the right identifiers. It has to be used in a careful and proportionate way, which is why this is a really tricky policy balance that we have to get right. That is why we have consulted on it, we have the feedback, and we are thinking about it deeply.
Elizabeth Denham: Because the code does not require age verification, it requires the 16 standards to be complied with and has an overall accountability structure to it, some of the criticism that we have heard from the larger companies about age verification does not hold up. Design in these companies is fairly mature and, as Steve said, there has been so much innovation that has been done around personalisation, profiling and using algorithms to target messages to individuals that what we want to do is create the design imperatives in these companies to ensure that children are protected online, the least amount of information is collected, and that defaults go to high privacy settings. Our ask is really to push to provoke better design by the companies in the context of children.
That is also going to create much more innovation in the space, including in age estimation and age verification. I would also say that the larger companies already know a lot about who is online and can easily estimate their age now, so I would challenge that. We do not have access to their homework. They have not told us about this. It is true of some of the gaming companies you have been asking questions of and they are not telling you. Because we have not seen their homework we do not know the extent of what some of these larger companies know. This is a push back to the companies, challenging them to innovate and challenging them to do this work. It just cannot go in the too-hard pile.
Q1481 Paul Farrelly: I have a couple of follow-up questions. To call this a moving area or a moving target is an understatement. It is a nightmare, really. If it is a nightmare for you—although perhaps not so much of a nightmare for the big companies—where do small games developers start?
Elizabeth Denham: Where do they start? One of the ways of looking at the 16 standards is that it does give clarity for the smaller companies as to what is expected of them. If you look at the GDPR, it is pretty much inaccessible to small companies. The design specifications and the design guidance in the children’s code gives some clarity to small companies. To Steve’s point earlier, our proportionality, our risk-based enforcement, the assistance that we provide for small companies on our advice lines, our support and our sandbox, all of these tools will help small companies. The transition period will as well. We are giving them more guidance than many other sectors have in order to understand what their GDPR obligations are.
Q1482 Paul Farrelly: The Government are already subject to another delay on age verification for other media for over-18s, so this is an issue across the board. Is it easier to age verify or create mechanisms and rules that apply when payment is made or requested?
Steve Wood: It is certainly one mechanism that is used in certain areas that sometimes a credit card can be used as an identifier. Certainly, that might be used as a mechanism in other sectors, like gambling, for example. It is part of a solution, but we have to be aware that we are dealing with quite a broad spectrum here and, again, use of that sort of identifier could raise a privacy risk in itself. It is unlikely to be a solution on its own. That is why we want to look at a range of ways of doing this. However, you are right, use of a credit card is one identifier, but that in itself is obviously a piece of information that, if it is not dealt with in the right way, can equally create risk if it is provided.
Q1483 Paul Farrelly: It again demonstrates the conflicts.
Steve Wood: Yes, it does.
Q1484 Paul Farrelly: If I have children who are constantly on screen, I am concerned about that. I would be even more concerned if their bank accounts were being used for payments. That fortunately has never been the case. In terms of addressing that level of concern about some of the practices in gaming, we have had at least one case where—although it was not an under-18 year-old—the parents had to step in to bail their son out. How would your code interact with companies improving their act in terms of age verification through data through request and consents through request when financial information is submitted?
Steve Wood: What we would say is that it needs to be on a sliding scale of risk in relation to the game. The more data the game is collecting the more stringent the application of the standards we have set out in the code are, including all of the default settings. Potentially, as well, if you need to offer a version of the game that would apply the 16 standards of the code, but also a version of the game that could be played by adults, you might need to be in an age verification type scenario. In those situations there will need to be robust mechanisms in place to be able to do that. Certainly, it would be important that the child is placed into the right environment and does not have the opportunity to easily surrender financial data or to connect themselves to information within the system in a way that could expose them to risk. That is also something I think we will need to learn about and monitor to see how those risks transpire in relation to data protection, because we are always about following the data rather than the wider risks.
Q1485 Paul Farrelly: All of this is technically solvable. When you give your CVV code it is not stored; you have to ask for it again. Information can be used to verify and then can disappear.
Steve Wood: Yes. There are particular security standards in the credit card industry relating to financial regulations that are already in place. There are a number of barriers and mechanisms to prevent and to reduce the risks of fraud and so on that are already in place in that area. If there is evidence about how that interacts with how the child’s data is used that is something we still would be particularly concerned about. Of course, there are a number of ways that children can spend money online. They can use these vouchers and cards that are not an actual credit card to pay for credits and still provide data and access online. That is why I think it is probably important we look at it all in the round, how the whole UK system works and what the different risks are for children in that context. That financial area is one component of it.
Q1486 Paul Farrelly: Finally, could you explain briefly when your code comes into practice—and hopefully by then it is not such a moving area, but it will still by definition be—what the sanctions are? What thought have you given to the nightmare of how you apply the sanctions so that they are not challengeable?
Steve Wood: Yes. We are looking at this all through the prism of our powers through GDPR. We are focused on the collection and use of personal data in the context of the code. The GDPR also for the first time sets out very clearly what it expects in terms of protecting children as a particular group in the recitals. All of that drives us to set out what we are expecting in the code.
When organisations process personal data on services likely to be accessed by children, this code is what we are expecting them to do. Therefore, if we come and audit or investigate an organisation, this code will be the starting point of the questions we ask of them. The code also has a higher statutory status in that it can be taken account of by a court or a tribunal, and we will take account of it ourselves in our investigations. If we found that an organisation processing personal data of children has breached the GDPR, then ultimately the full range of sanctions in the GDPR apply still, so 4% of global turnover. We have the power to issue enforcement notices to stop them using personal data, and we have the powers of compulsory audit to go in and put things right. It is within our sphere of GDPR as a regulator.
The one thing we just have to say is we cannot solve every problem in this area, because once it starts to go into that broader context, as the Commissioner said at the start, some of these wider issues about addiction online and immersive technologies do go beyond data protection and wellbeing. We will probably have to have an interface and a strong relationship with the new proposed regulator for online harms in the future as well. Partnership working will be important as well. We cannot set out that we can do everything ourselves in the area, so we need to work with other experts, whether it is the Children’s Commissioner or the Chief Medical Officer, to get all of the different strands coming together.
Q1487 Clive Efford: When you gave evidence to us earlier this year you referred to an investigation into apps targeted at children and how personal data may be differentiated from what is used for gaming data. Can you give us an update on where you have got to with that?
Elizabeth Denham: We did what we call a sweep, where we looked at various apps and their services to children. We can certainly forward to you the report that was done. We did that with many international partners where we looked at children’s apps across the world. We are also investigating a company called TikTok right now. We are looking at the transparency tools for children, we are looking at the messaging system, which is completely open, and we are looking at the types of videos that are collected and shared by children online. We do have an active investigation into TikTok right now, so you can watch that space.
Q1488 Clive Efford: Is it clear that players and game makers understand what forms of game-play data constitute a person’s personal data, and can companies, therefore, make decisions about what they can and cannot do with data?
Elizabeth Denham: We have not investigated a gaming company at this point. I have been following some of the commentary and some of the witnesses that have appeared before this Committee with a lot of interest. Again, I think there needs to be more understanding about their data protection responsibilities and the collection and the retention of aggregate information versus personal information. There is a lack of clarity with many of the gaming companies on their data protection responsibilities.
Q1489 Clive Efford: You have seen the evidence that we have been taking, and clearly the companies have been reluctant to let us know just exactly what data they hold and what they do with it. Are you able to satisfy yourself that you have access to how these companies are operating and how they are using data to be able to do your job?
Elizabeth Denham: With the new powers that the office was given in 2018 we do have the ability to audit these companies and we do have the ability to investigate. We can compel information to be provided to us in the context of investigation. As I said, we have an investigation going on right now into TikTok. That is not a gaming company. We do expect to use our powers. Watch this space. When the code is published and after the period for transition is completed we will be interested in that. Even now, if we had a complaint or investigation, we have the ability to go in and to compel information from the companies and understand how designs are in place to collect personal information.
Q1490 Clive Efford: Do you fear with technology moving ahead so fast that you have the future mapped out in how you are going to stay on top of this? For instance, new technology that can follow eye contact, like in virtual reality games. If the technology is developing that fast, are you confident that we are on top of it or understand it enough to be able to regulate it?
Elizabeth Denham: If you get into virtual reality and more sophisticated, immersive games where biometrics are collected, are you thinking about what happens next and what is the next iteration of data collection?
Clive Efford: Yes. Are you thinking about it is what I am asking.
Elizabeth Denham: Yes, we are thinking about it, and we have a technology policy team that is getting stronger. We have been given new resources in the last year to expand our staff. We have doubled the staff that we had two years ago. We have AI experts. We are starting to really build our team. That said, it is always going to be an arms race, isn’t it? We are against some of these companies that have the expertise. I would balance that by saying we have the powers to compel information and to investigate, and we have strong sanctions now thanks to the GDPR and the Data Protection Act. We have been pulled into the modern world, but only recently, and we have to work really hard to stay up on these issues.
Steve Wood: The other lever we are going to use is the international dimension to this as well. Because of the challenges that the Commissioner outlined there in terms of the arms race and needing ever more resources to tackle this, it is very important that we join up with our international counterparts to collaborate on research, pool resources, and also try to push for a common approach so there is something like this code globally at some point, or even at the European level. That then sends the same strong message globally when there is a stronger lever there in terms of the regulators around the world taking a similar approach.
That is going to take time, but the ICO has just taken on chairing the international conference with all the data protection regulators around the world. This is clearly one of the key themes. We want to push there to tackle that challenge globally, because that will create a stronger pressure, we feel, for organisations to get things right and not just see this as a UK initiative. This is a problem around the world that needs to be tackled in a similar way.
Q1491 Chair: Thank you. I will follow up with a few questions. In regards to your investigation into TikTok, when did that start?
Elizabeth Denham: It started in February this year I believe. We still have some time, and we are using our information notice powers to collect more information. You will have seen, probably, the Federal Trade Commission in the US conducted an investigation enforcement into the company.
Q1492 Chair: Is your principal concern about how data is being gathered or how that data is then being used and who else might have access to it?
Elizabeth Denham: That is correct. We are also concerned about the open messaging system where any adult can message any child. We are looking at the protections for children online in that game.
Q1493 Chair: Under the terms of the age-appropriate design code might you then require TikTok to have different settings to protect younger users?
Elizabeth Denham: We would. The age-appropriate design code, or the GDPR now even without the specifics of the code, requires the companies to provide different services and different protection for children.
Q1494 Chair: When do you think you will complete that investigation?
Elizabeth Denham: I think in the fall.
Q1495 Chair: Okay. With the age-appropriate design code itself, I think when we discussed this last time you gave evidence that suggested you might be taking enforcement action based on the code by the end of this year. Is that still your expectation?
Elizabeth Denham: Our expectation is that we are going to provide the code to the Secretary of State in the fall, and I think we will make the statutory deadline that we have been given. Then it will be up to the Secretary of State and Parliament for the laying of the code. The transition period is an open period. We are looking at whether or not there needs to be a longer transition period to get the industry, especially small players, ready for the code. We have not made that decision yet. We still have some more policy decisions to make in response to the submissions, the evidence and the meetings that we have held with stakeholders in industry groups.
Q1496 Chair: How long a transition period do you think might be required?
Elizabeth Denham: I have the discretion to go up to a year in terms of a transition period. We are thinking about that and we are taking evidence and commentary from industry associations and experts in this area.
Q1497 Chair: Okay. You mentioned earlier on when we were discussing the implication of the age-appropriate design code for the news industry some further concerns around ad-tech. There have been issues raised around the digital ad market not just by this Committee but by the Furman report as well. Indeed, the Chancellor of the Exchequer has asked the Competition and Markets Authority to look into this area. I would like to know if the CMA has been in touch with the ICO about this at all and whether you would see yourself having a role in adding expertise and insights into any broader investigation by the CMA into the digital ad market?
Elizabeth Denham: Yes, we have been speaking to the CMA about their work on ad-tech. A couple of weeks ago we released a report on real-time bidding and ad-tech, and data protection implications of broad sharing of, in some cases, sensitive information through the ad-tech system by many players without proper notice and consent. We have given the industry a warning from a data protection perspective that they really need to get their houses in order when it comes to transparency, fairness and legal basis. When was that report issued, two weeks ago?
Steve Wood: I think so, yes.
Elizabeth Denham: In six months we will start looking at some of these companies in the real-time bidding process in the context of data protection. Yes, we are working with the CMA on these issues.
Q1498 Chair: Finally from me, I think again when you last gave evidence to us you highlighted the ongoing work that you have done into Cambridge Analytica and said you expected your final report on Cambridge Analytica to be published in the autumn. I want to check whether that is still your expectation.
Elizabeth Denham: It is still our expectation. We are coming to the end of our forensic examination of the servers and all of the data on the servers from Cambridge Analytica. There will be a report in the autumn, and I think it will be an interesting report. We hope it will be our last report into this investigation. We released our “Democracy disrupted?” in our investigation almost a year ago now, so this will be our final report into the investigation. We also have other investigations in relation to mainstream media and some of the campaigns, data harvesting and advertising in the context of those campaigns. Again, in the fall there will be a report on that.
Q1499 Chair: You will report on those separately, presumably, from Cambridge Analytica?
Elizabeth Denham: Yes.
Q1500 Paul Farrelly: By mainstream media do you mean Mainstream Network?
Elizabeth Denham: Sorry, Mainstream Network. That is a different investigation, but again that is coming along and we expect to be reporting in the fall, but Facebook and Cambridge Analytica final report in September or October.
Steve Wood: We would also just like to alert the Committee to something we are doing this month, which I know we have previously talked to you about: our recommendation for there to be a statutory code of practice for the use of personal data in political campaigning. The discussions with the Government about that are ongoing, but we have moved to produce draft guidance anyway. We are launching that for consultation at the end of this month because obviously there were concerns about when it might be needed. We can write to the Committee and inform you about when that guidance comes out.
Chair: Yes, I would certainly appreciate that.
Q1501 Paul Farrelly: There is one rider. Clearly, we all read the report regarding Mainstream Network and the involvement of individuals in CTF Partners. Could you say on that whether you are gaining co-operation from individuals employed or associated with that company, which has a role in the current process that will lead, no doubt, eventually to a new Prime Minister?
Elizabeth Denham: We are getting co-operation, but this is a live investigation that will take some time. For a public inquiry and a live investigation I cannot say more than that.
Q1502 Chair: Thank you. I am sure we will look forward to seeing the reports in the autumn. That concludes the questions from the Committee this morning.
Elizabeth Denham: Thank you.
Witness: Margot James, Minister for Digital and the Creative Industries.
Q1503 Chair: Thank you for joining us this morning for the second panel on this morning’s evidence session. Again, we are continuing our questions as part of our inquiry into addictive and immersive technologies. As you know, the Committee looked at a number of the issues that are associated with the Online Harms White Paper and, in particular, the obligations of social media companies towards their users. We agree that the companies have a duty of care to the people that use their services. During the course of this inquiry we have started to look at the scope of that duty of care outside of purely social media companies, looking at other businesses that have developed a large platform and content that people engage with, including the bigger games companies. I want to ask whether the Department believes that companies like Epic, EA and King, which make large, very popular video games, should consider their practices to be in scope of the Online Harms White Paper and, indeed, that their businesses may be businesses that a future regulator takes an interest in in terms of how they meet their duty of care obligations to their customers.
Margot James: Thank you very much for inviting me here this morning. In answer to your first question, we have just completed the consultation on the Online Harms White Paper. Over the summer and early autumn my Department will be reviewing all the responses that we have had and will be developing the final Government response prior to introducing legislation in the next session. It is probably too soon to be definitive about exactly which companies will and will not be in scope of the Online Harms White Paper and subsequent legislation. However, we have purposely drawn the net quite wide in the development of the White Paper because we would not want the harms that are given a lot of airtime in the media and associated with some of the big social media platforms to be the only ones that we would be seeking to regulate. There is no reason why companies with huge numbers of people active on their sites, like games companies, would not be in the scope.
Q1504 Chair: Do you think the scope could be based on active user base as a number rather than just particular media or the type of online company you are? In Germany I think the enforcement of hate speech law is based on a threshold of the number of active users, and if you are above that threshold you are in scope for enforcement action. Do you think we may see something similar here with the online harms legislation?
Margot James: I would not want to repeat what I have just said in terms of the stage we are at, and it is not possible at the moment to be definitive. Such a threshold is one way of assessing what is in and what is out of scope, but only one. If one were to apply that in the context in which it is applied in Germany, one of course would leave out of scope potentially some sites with smaller user bases that could be doing more harm, albeit to fewer numbers of people, than a larger user base with appropriate controls and safeguards. We have to bear all those things in mind before we come down definitively on how to assess which companies are in scope and which are not.
Q1505 Chair: From what you have said, it sounds like it could be the role of a regulator in that case to make an assessment based on a scale of harm and risk and then to decide what organisations are considered to be within the scope of its powers or not based on that risk assessment.
Margot James: That sounds a more likely route forward. It also underlines the importance of the regulator having the freedom to assess things from year to year because new ways of using the internet and social media platforms will emerge over time and it is very important that the regulator has the space to keep abreast of technical developments.
Q1506 Chair: Would it be fair to say that final decisions have not been made and things have not been ruled in and have not been ruled out either? We were discussing with some of the video games companies, in particular EA, about FIFA, where there is both a voice and a text-based mechanism designed within the game to help players talk to each other while they are playing. That could also be used to share harmful content or for cyberbullying or something similar. From what you are saying, it would sound like that sort of activity could well fall within the scope of online harm if the regulator defined it as such.
Margot James: That would be a logical assessment, yes.
Q1507 Chair: We talked in an earlier session with Elizabeth Denham just before you joined us about the age-appropriate design code. She raised in particular that she felt the concerns raised by the News Media Association about the age-appropriate design code were not warranted. She did not see that the level of risk associated with younger people accessing news websites and news information would create problems under that design code. News Media also raised concerns about online harms and whether journalistic content could fall foul of the online harms regulations as well.
Again, while I accept you are still assessing the results of the consultation, I wondered if there is anything you could say about some of the wider concerns that have been raised about the unintended consequences of what is in the White Paper. Are those concerns founded? Do you feel you can reassure people there? Do you feel that news websites should come under the scope of online harm just as much as other platforms do?
Margot James: Underlying your question is a concern about the role of regulation in respect of free speech and freedom of expression. We are in the Department very concerned to make sure the harms we are seeking to address through the legislation do not inhibit the freedom of expression. Of course, we are aware that that can be quite a difficult line to draw depending on the context of whatever is expressed online. At the moment, my Secretary of State has said that he does not envisage news channels and news websites being in scope.
During some of the consultation I undertook while the White Paper was being developed, I was interested to hear from a representative of the National Union of Journalists, who shared some research with me about the scale of abuse in the comment sections underneath editorial. What was interesting to me about what she shared was that there was an assessment done based on the gender of journalists that found that the vast majority of abusive comment was directed at female journalists. That did concern me because I have had a particular interest in the impact of abuse and harassment on women in public life, be they politicians or journalists.
I thought that was quite relevant, but that might be a digression in the central purpose of your question. I would like to return to the fact that we are very sensitive to the need to protect freedom of expression and that is a driving purpose behind what we are doing with the Online Harms White Paper.
Q1508 Chair: One of distinctions that has been drawn is between the role of the oversight of user-generated content and the responsibilities platforms have to content they do not necessarily create themselves but nevertheless facilitate the distribution of. Is there a distinction that can be made between a registered organisation or company like a news organisation, for which there are existing complaints procedures and mechanisms and existing lines of redress, versus what might be created by an organisation or an individual where there are no such possibilities in place and, therefore, the only arbiter of what they do or do not do online is whether the platform allows it? Is that a distinction you would draw in looking at the way the online harms recommendations could be enforced?
Margot James: That would be a reasonable distinction to draw, yes. The best platforms are moderated in terms of news organisations, but when you are talking about a global social media platform and the sheer volume of content that is uploaded every second of the day, it creates a very different challenge and one that would be more into the scope of what we are discussing.
Q1509 Chair: We have received evidence during this recent inquiry from organisations that are involved in content moderation of designed technologies to facilitate that and identify harmful content in real time. Do you believe there are technologies out there that the big social media platforms could be using now to facilitate the work of moderating and removing harmful commentary and content?
Margot James: I think there are technologies that they are already using. Of the videos taken down by YouTube, for example, approximately 75% are identified and removed by artificial intelligence. The same would probably go for several other large platforms. There are technologies already in existence and they will become more and more important, particularly where encrypted or private parts of the internet are concerned. They will have a particular role to play in those environments.
I think there will undoubtedly be emerging technologies—you have heard from the proponents of them or the developers of them during this inquiry—that will be an opportunity for platforms in the future to deploy, but the technologies have to be tested and assessed thoroughly before they are let loose across a large platform. We cannot expect that just because a technology is emerging, it is automatically into use straight away.
Q1510 Chair: There has been a lot of focus on the Christchurch terror attack and the way footage of that was streamed live on Facebook and then shared, principally through Facebook and YouTube, around the world. Are you content that the companies did all they could and do you think we should expect them to do better in the future if there was a similar attack?
Margot James: We can expect them to do better in the future if there was a similar attack simply because it has happened once and there was such a focus on it. Law has been changed because of it in some countries. Clearly, we would expect companies now to have learned from that awful tragedy and its implications for social media. I would expect them to be putting in place, if they have not already, some protective measures.
Do I think they should have done more at that point? From what I read, some platforms like Facebook were engaged in the automatic removal of hundreds of thousands of attempted uploads of the terrible video footage. Clearly, they did not do enough, but whether they could have done in that scenario with an event that was unfolding in real time I do not have the expertise to necessarily comment on. They did quite a lot.
Q1511 Chair: Isn’t the problem here that we just do not know? We do not have any way of assessing whether they did enough or not.
Margot James: In the absence of proper regulation, I would concur with you. Fast-forwarding to the time when we have our online harms regulator in place, it will have the powers to investigate and to call companies to account for those companies’ duty of care and how effectively they are deploying that duty of care. If there was a freak event in the future that resulted in an extraordinary set of circumstances emerging online, then it would be quite within the remit of that regulator, I am sure, to zone in on that particularly egregious example and scrutinise it.
Q1512 Chair: You would expect, after a situation like that, a regulator would go in and audit a company to see how effectively it had responded?
Margot James: I think it would provide a tragic but good example of what we could expect in the future, yes.
Q1513 Chair: Just finally from me, you said earlier—as the Secretary of State said when he came to give evidence—that the Department had put in a bid for legislation in the next session of Parliament to deliver the Online Harms White Paper and legislation. We do not know when the next session of Parliament will start. Will the Department be ready at that point to have a Bill ready for the Queen’s Speech if the next session started later this year?
Margot James: The Department would be ready with a synopsis in order to guarantee a place in the Queen’s Speech, whenever that might come. The actual drafting of the Bill and legislation will take longer, but there is no reason that should not be done concurrently with the publication of the final response to the White Paper consultation, which we expect to be before the year end.
Q1514 Chair: Would the Department envisage a process of prelegislative scrutiny before the final Bill is published?
Margot James: That is a decision that will take place later and it would be premature to comment. We have discussed this and I will share with you what we have discussed.
On the positive side for prelegislative scrutiny, there is the undoubted benefit of the scrutiny. For Bills that have particularly House of Lords and House of Commons membership of a prelegislative scrutiny community, the legislation can undoubtedly be improved. But it will delay the introduction of it and, as it is both important and urgent, there is a tension there. It will be very much dependent on the parliamentary timetable of the next session as to whether time is permitted for that part of the process or not.
Q1515 Chair: With that in mind, has the Department considered whether it would be sensible to maybe introduce these measures as a series of Bills rather than as one big Bill? There may be some things that are relatively simple and clear to act on. We would probably contend that some of the changes in electoral law, which I appreciate are Cabinet Office rather than DCMS, could fall into that category. There might be other aspects of it that are more complex and a bit of delay to get them right might be a sensible approach.
Margot James: That is certainly worth considering. We want to get as much as we can in terms of the final scope of the online harms regulation into one Bill. You are quite right that there are elements that might be possible to do sooner, although we want to get this done as soon as practically possible, and there will be elements whose natural place is perhaps in another remit. One could not rule your approach out.
Q1516 Brendan O'Hara: You may have seen a couple of weeks ago that EA and Epic Games came before the Committee to talk about loot boxes or, as EA rather bizarrely called them, “surprise mechanics”. Since they appeared before the Committee, certainly I—and I am sure other members of the Committee—have had loads of gamers writing to me about loot boxes. Overwhelmingly, the opinion has been that there is very little difference between loot boxes and gambling. A number of our European colleagues, notably the Netherlands and Belgium, have taken action. Do you think the UK regulatory framework needs to catch up and recognise that loot boxes are in fact gambling?
Margot James: There are a number of assumptions I have heard while listening to your question that I would not necessarily agree with. For a start, a number of European countries have, as you say, intervened by defining this aspect of gaming as gambling, but then their offline gambling laws are different to ours as well. You have to see their actions in a wider context.
In the UK, not exclusively but a central part of our gambling laws revolves around whether something is a game of pure chance. The fact that other European countries have taken action is much more to do with the enforcement of their offline gambling laws online, and our gambling laws are different.
I would also contest the assumption that loot boxes are gambling. Not all the evidence I have read from your Committee’s hearings would support that assumption either. Loot boxes are a means of people purchasing items, "skins" as they are called, to enhance their gaming experience, not through an expectation of an additional financial reward. Also, importantly, they cannot be traded offline for money. There are big differences and it is not true to say that loot boxes are gambling.
Q1517 Brendan O'Hara: You have no concerns about loot boxes?
Margot James: I did not say that.
Q1518 Brendan O'Hara: What concerns do you have about loot boxes?
Margot James: I would be concerned if evidence was presented to me that loot boxes are a gateway to problem gambling. I would be concerned by that. With the gaming community, you are talking about large numbers of young people, but by no means exclusively young, of course. Gaming is a pleasure that is pursued by all age groups. But with particular reference to young people, we have to be vigilant. If evidence does emerge that loot boxes can be a gateway to problem gambling, then we need to take that seriously and we need to take some action. But the evidence is not there yet. There are not many studies.
That is not to say that we should not be initiating more research. I do not want to give you the impression that I fall back on the fact that there is not much evidence and, therefore, there is no problem. I do not think that, but you need the evidence as a justification for taking action, particularly if you are talking about regulation.
Q1519 Brendan O'Hara: You will be aware of the work of Dr David Zendle, who has looked into this quite extensively. He says that loot boxes do act as a gateway into problem gambling, particularly among the young. Are you or your Department doing anything in terms of looking into at least the potential harms of loot boxes or are you waiting for something to happen before you act?
Margot James: No. We are looking at this in the round and your inquiry is extremely helpful to us as we deliberate on what, if any, action is needed.
You mentioned Professor Zendle. I think that he would acknowledge that even his work is correlational and that we must be careful. We cannot necessarily assume that because there is a correlation between A and B, there is a causal link. Those two modes of research are different and we should respect that.
Q1520 Brendan O'Hara: Are you or your Department talking to the Gambling Commission about loot boxes?
Margot James: Yes. My Department regulates gambling as well and the Gambling Commission is a very important body, regulating that industry, which comes under my Department. There is a dialogue between the two.
Q1521 Brendan O'Hara: The Gambling Commission acknowledged that loot boxes bear a close resemblance to the playing of a game of chance and the playing of a game of chance for prizes or prize money is gambling under UK law. Forgive me, but it does seem that your Department is being rather complacent in this matter. We are getting lots of evidence from gamers and from professionals saying that this is a problem, but it would appear that you are waiting for something to happen before actually tackling it.
Margot James: You did acknowledge and you used the term “close resemblance”. That is probably where we are at. We are looking at links. We are looking at evidence that is emerging. It is quite a young area of research. We could discuss why there has not been more research, but we are not complacent. We are looking at this very closely. As I said, your inquiry is informing the debate that goes on with my Department and in our relations with the industry. We are far from complacent, I can assure you.
It is important that before regulation and action of that nature is attempted we get a better understanding of the root causes of the sorts of problems you are alluding to. If we are talking about problem gambling, that can at its worst become an addiction. But by treating one aspect of addiction—namely whether you are addicted to loot boxes, gaming, alcohol or whatever it is—if you are going to treat only the actual symptom, you may well be missing an important part of the underlying problem driving that behaviour.
It is important that we do not just sit back and wait for evidence but that we lean forward and look for evidence but are dispassionate and objective. That is important.
Q1522 Paul Farrelly: Just one supplementary on loot boxes and the current position. You mentioned the different approach taken by regulators in Belgium and the Netherlands. You said that their offline gambling regulations are different. Can you tell us how?
Margot James: It has to do with the role of chance and the monetisation of it. I would have to—
Q1523 Paul Farrelly: That is all very general.
Margot James: Yes, it is general because my knowledge of it is general. If you are questioning me about gaming, I can be specific. If you are questioning me about gambling per se, I might have to write to you because that is not my area of close responsibility. But I would be glad to write to you because it is very important.
Q1524 Paul Farrelly: I would be grateful because you were quite categoric—
Margot James: Yes, I can be categoric.
Paul Farrelly: —in answer but very general in the categorisation.
Margot James: Yes. In terms of Belgium, it is my understanding that there does not have to be the role of chance in the definition of what constitutes gambling offline, as there does in the UK. That is my understanding.
Q1525 Paul Farrelly: Perhaps you can write to us with that.
Margot James: I will write with more details to the Chair, but that is an important distinction between the UK law on gambling and some other countries within Europe.
Q1526 Paul Farrelly: Could you spell out your understanding?
Margot James: I certainly will. I will go into some detail in my letter to the Chair.
Q1527 Paul Farrelly: In essence, we are all playing catch-up here. Not a single parent, I imagine, who has been frustrated about how much time their children have been online would say that there is not potentially a problem, although you have to take it all in the round. What we call some people’s addictions our children might call football, rugby, sport or books an addiction. They are just doing something different.
One of the things you have just alluded to is that before you take a position on a move by the Government or the Gambling Commission in respect of these loot boxes or other items that cost money as well as carry a compulsion, you have to decide whether that is proportionate and it is very difficult to do that without evidence. You were saying that on the one hand we cannot be complacent, but you kept referring to evidence emerging. The word “emerging” is a complacent word. What are the Government doing to try to play catch-up and address the issue as to whether there is a problem that needs to be tackled?
Margot James: First of all, I was answering questions that were quite specifically about loot boxes. You have widened the topic to include the time spent and the elements of compulsion, about overall time spent—
Paul Farrelly: It is a potentially connected issue in the round.
Margot James: Yes, I understand that and I am very alive to that because it brings in the wider use of social media by people who might be spending what many would consider an unhealthy amount of time online, whatever they are doing online. I certainly would not shirk from agreeing with you that that can be a big problem.
You have heard evidence from specialists who have more expertise in terms of the health implications of living most of your life online than I have. In terms of gaming, the general view among specialists is that approximately 1% of gamers have a serious problem, which has given rise to the WHO definition and that area of scrutiny. I would not sit here and be in denial that some people can have a very serious problem, and you have heard from experts who have shared with you the symptoms that that can give forth.
I keep saying we are not complacent and we are not. We are not just sitting around and waiting for evidence. We are scrutinising the evidence. I did say that I thought it strange that there was so little in this area. Gaming has been a big business for a long time, a good 20 years, and there has not been a lot of evidence in this area. There should be more research, definitely.
Q1528 Paul Farrelly: We are going around in circles here. Whether you think it is right or wrong or illiberal or not, some countries in the Far East have recognised that there may very well be a problem and have introduced strict time limits for children. These are countries that are pioneers in the online gaming world.
I just asked the very simple question there. What are the Government doing to facilitate or commission research to expand the evidence and to see whether there is a problem that, in a proportionate way, we might need to regulate?
Margot James: Thank you. I will answer your question but I wanted to comment on what you said about other countries because that is very important. A lot of the research, of course, does come from elsewhere, particularly south-east Asia.
It is important to remember that when you are reviewing things that can potentially have an addictive quality, there are three things going on, essentially. There is the individual themselves and their propensity to become addicted to anything. There is the environment in which that individual lives. There is the nature of the game in this context or the substance or whatever it is. You cannot divorce one from another.
Coming back to your point about all the research coming from south-east Asia, the environment there is extremely different. The family environment is very different. The emphasis on academic success to the exclusion of all else is very different. I hear anecdotally—and I know you have in the Committee—reports from some families in that part of the world who are relieved to see their children doing some gaming because, otherwise, those children would do nothing but study for their exams. They are so focused on those goals to what might be considered an obsessive degree. In those cultures, gaming can be considered a relief.
It is important that we look at where the research is from, which underlines the need for more research here, which is where I will come to answering the second part of your question.
Paul Farrelly: It was the first part.
Margot James: No, the second part of your question was about what we are doing, what the Government should be doing and what it is—
Paul Farrelly: You know what the question is. The first part was a comment.
Margot James: I am sorry if I have misunderstood you.
Paul Farrelly: I am keen to get to the good bits. That is putting it better.
Margot James: Coming on then to what is done, in terms of when something becomes a problem, whether it is a lifestyle issue or an addiction to some sort of substance, it comes under mental health and the Government are spending over £2 billion in addition to what they have already committed to spending out of the latest addition to the NHS budget of £20 billion on mental health.
There is a lot of need out there, but I do hope that some of that money will be put into research because this area is in need of more investment in local research. At the moment, there is a paucity of research done in this country, which holds the field back and holds treatment of people back. But it is good that we are seeing this extra investment into mental health. Did you want to come back on that?
Q1529 Paul Farrelly: No, we have to move on. There was no specific answer to a specific question.
Finally—and my colleagues want to get into this area later, perhaps, so I do not want to take all the questions—a week or so ago there was an expansion of funding for NHS treatment of children’s gambling addiction, which your Department and the Department for Health have signed up to. There was no mention of gaming within that, yet we have heard pleas from the same person who was involved in that initiative that much more does need to be done and funded in terms of gaming. If you could go away and have a look to see how that initiative might perhaps open up what is being done, looking at research and treatment of gaming addiction, we would be grateful.
Margot James: Thank you for reminding me about that. That is a very good point and I will ask my officials to engage with officials at the Department of Health and Social Care on that point.
The other point I did not mention in answer to my earlier question, of course, is the Chief Medical Officer’s work on the amount of screen time that children and young people are being exposed to, which is part of the wider picture. Although some of that work has been published and there has not been a huge amount of definitive new guidance that has come out of it, the work is an evolving thing and Public Health England has committed resources into supporting that work into screen time in the wider context.
I will follow up on your suggestion that we look at and encourage the Department of Health to incorporate gaming particularly into that area of research. That is a good suggestion.
Q1530 Clive Efford: I thought I heard you say that loot boxes were not gambling, but then later in the way you described them you seemed to accept that they were gambling but not proven to be harmful enough to act right now. Could you just clarify? What is the Department’s approach to loot boxes?
Margot James: I certainly did not say they are gambling. My concern would be that if research showed them to be a gateway to gambling, we would be very concerned and we would want to see action being taken. There is some evidence emerging that loot boxes can be a problem, but we cannot yet say that they are gambling. In response to the questioning earlier—
Q1531 Clive Efford: All right. Let me just pursue that. The playing of a game of chance for a prize of money or money’s worth is gambling under UK law. That is correct. If you pay a stake to gamble, to win money or something of monetary value, that is gambling under UK law. The reason loot boxes are not seen as gambling by the Gambling Commission is because they cannot be monetised. They are in-game prizes. But that is disputed. People can take the things they win and they can monetise them in various ways, as we have discovered in the evidence that has been presented to us. But in principle, because the money cannot be taken out of the game, the Gambling Commission says they are not gambling.
How are they not gambling? How are children not getting into the habit of gambling just because they cannot take the prize out of the game? It is still gambling.
Margot James: You just mentioned the definition as including the role of chance. I think that a lot of people who play games would regard the fact that there is a lot of skill involved and it is not purely a game of chance, so I would take issue with the way you have interpreted the definition in terms of chance and extrapolated it to the gaming environment. I take issue with that.
I do not want to give the impression that I am not concerned because I am, but it is important that we have a true understanding of what is at stake here before we take one action or another.
Q1532 Clive Efford: Okay. I know people want to move on, but just one more go at it. This is a playing of a game of chance within a game. Children are being exposed to all the emotions of gambling, even though they are not winning a cash prize that they can go out and spend in a shop. How is it that the Government do not see that as children being exposed to gambling in these online games?
Margot James: We have probably exchanged enough discussion about whether loot boxes equal gambling and the differences in terms of offline gambling between UK law and some other countries, so I am not going to go down that route.
Perhaps it would help if I shared the concern I do have about loot boxes, which is not so much relating to the gambling aspect, which may or may not be an issue. If children or young people are spending money they do not have in excessive quantities to make online in-game purchasing, of course that is a big issue and a big concern. Mr Farrelly mentioned in his questioning that, as a parent, if his bank account or that of his child started being emptied because the child was spending too much on these loot boxes, of course that would be a concern. That is clearly an issue for some young people.
If young people have a propensity to gamble and if they are excessive game users, I can accept that loot boxes could bring that out and could potentially elicit from them a greater enthusiasm for using loot boxes, which could lead on to other problems. I hope that demonstrates that I am concerned. It is just whether we say this is gambling when perhaps it is not. Perhaps we could agree that if it is a gateway to problem gambling, of course we do need to take action.
Q1533 Simon Hart: I have a quick one on the back of both of those questions. How much work has the Department done with the Department for Education in assessing teachers' views about the negative impact of prolonged periods of screen time?
Margot James: We are in constant dialogue with the Department for Education and the Department of Health in relation to the sort of work that is being carried out by the Chief Medical Officer and teacher organisations in relation to screen time quite generally.
In fact, two weeks ago, I chaired a roundtable of special educational providers and specialist colleges teaching young adults with learning difficulties. They expressed their great concern to me that a lot of young people were coming into their colleges not fit to learn because they had been up until 5 o’clock in the morning playing whatever the latest game was. So, yes, we are in constant dialogue with the Department for Education on that very important matter.
Q1534 Simon Hart: That suggests to me that there is a problem that possibly needs further investigation.
Margot James: Yes. I am glad someone has asked me a question about the general issue of screen time and the fact that some of it can be used in an online gaming environment and that for people, especially if they have a degree of compulsion or obsession within their personality, it can become a big problem. Thank you for moving the discussion on to a wider context than just loot boxes.
Q1535 Simon Hart: I am sure I am interrupting the flow here a bit, but it was relevant to previous hearings we have had. The most obvious example was Epic Games and the reference to Fortnite. If you look it up, there is global concern being reflected by people from a range of different backgrounds and a range of different age groups about the potentially damaging and addictive impact of that game. I do not want to choose them unnecessarily but it was a good example.
I was slightly surprised—I cannot speak for anybody else—about how the reaction was, “We do not know what the evidence is. We do not collect that kind of data”. I am not quoting them. I am paraphrasing them in my own crude way, but it was sort of, “It is not our problem. We just make the game”. At what stage do the Government deploy some precautionary principles in this?
Margot James: I have read some of the evidence and I share your concern that some commercial organisations did give the impression that they were about making a game and, if it was successful, great and, if it was not, move on. That is not an attitude that can prevail in this industry over the medium term because, as you rightly say, some of their products are so successful that they can cause users to spend such an inordinate amount of time on them that sleep and other activities of normal daily life are sacrificed. When that impairs their ability to work or study or socialise offline, we have a problem. It is not good enough just to create a game and wash their hands of the potential consequences.
I must say just before I finish that that is certainly not the attitude of many of the gaming companies that cross my path, but there is a problem with some of them.
Q1536 Simon Hart: Do you believe, though, as would be the case for any company producing a product for consumers, that it is their responsibility to undertake the research that would identify once and for all whether there was a harmful aspect to their product and their responsibility to introduce measures to mitigate those potentially damaging aspects, and that if they do not, it then becomes the Government’s responsibility?
Margot James: You made some very good points there. They have a responsibility to learn from the data they are collecting, indeed, and there are various measures that they could reasonably put in place and which are put in place in some other countries, particularly in the Far East. I am not necessarily advocating that we do the same thing, but it is possible. You make a good point.
I would caution against the assumption that it is only the industry that should be investing in the research, though, because there is an issue of independence. As the Government, we need to be satisfied that there is an independence in the research that is garnered or commissioned. There is a role there for public funding of research.
But the manufacturers should definitely be collecting data and, in time, if they are coming into the scope of an online harms regulator, they will be expected to have a duty of care to the user base. I think that most reasonable people would think that they do have a duty of care, with or without regulation, and that is what we will be looking to them to demonstrate over the next 18 months before the regulator comes into existence.
Q1537 Chair: I have a couple of questions to follow up on this. Do the Government accept the World Health Organisation’s definition of “gaming disorder”?
Margot James: The Department of Health and Social Care, which is the lead Department in that area, takes the WHO’s pronouncements and research and guidance extremely seriously and there is no reason why this should be an exception to that rule.
Q1538 Chair: On that basis, do you think that games companies should proactively monitor unusual activity, be it excessive spending, excessive gameplay, maybe a substantial increase in either by a user? Should that be something that games companies independently monitor and then seek to act upon?
Margot James: I have to be cautious answering your question because we are not yet at the state where we are issuing rules and regulations to gaming companies. As I said in answer to the previous question, we do expect a duty of care to users and we are seeking, as we have discussed this morning, to regulate, ultimately, on this and to require it.
Companies should take the WHO definition seriously. There is some controversy about it. I would like to add that. Even at WHO level, they acknowledge that there is a need for more research. However, gaming companies should take this seriously.
There are a variety of things they could introduce to support their user base to alert, as you have suggested in your questioning, excessive screen time on one game and that sort of thing. I would see that as a reasonable response to the concerns that the new definition has given voice to.
Q1539 Chair: We have taken evidence from some of the biggest games companies and they dispute the entire term “gaming disorder”. They do not accept the term and they do not think they are under any obligation to proactively identify people who may be suffering from gaming disorder.
Margot James: I did mention that there is some controversy around this. The WHO definition has come within its “disorders due to addictive behaviours” section. That is where it is lying. There are some US commentators and researchers who have alleged that this is part of a train of—I quote—“making a mental disorder of everything we like to do a lot”. Some members of the WHO’s working group for these impulse control disorders have suggested that there was insufficient evidence to justify gaming disorder’s classification. This is what I meant by an element of controversy over the definition. We should look more broadly at problem behaviours involving excessive screen time, the role of electronic devices and the like in a broader context.
That is a longwinded answer to your question. I can understand that some gaming companies have reacted against the definition because there is some controversy, even among the members of the committee who brought it into the public domain.
Q1540 Chair: It is more than that. The games companies do not want to have to police this. They are gathering data about their users to sell them more stuff, but they are not using that data to identify people who might be engaged in harmful or addictive behaviour. If someone self-refers, they might act on that. But if someone is suddenly spending vastly more than they were before or vastly more than is normal and becomes a massive outlier, they feel under no obligation at all to do anything about that. It is easy to sit back and say there needs to be more research, but if you as a company are holding on to the data that that research can be based on and are not making it available to anyone and are not obliged to do that, they will always question the research that is being done because it is not based on their data because they will not make it accessible.
Margot James: You make some very powerful points there. I heard the Information Commissioner state to the Committee earlier this morning that the approaches to gaming companies to get some of these data in the drafting of the child-friendly code had not been fruitful, which is very disappointing. I share your concern that you have mentioned there about companies sitting on a great wealth of data. If they are not sharing it, perhaps it is time they did or at least learned from it themselves.
One of your experts in one of your earlier sessions mentioned that gaming is several years behind gambling in relation to protecting the vulnerable. If that is true, then that is lamentable and the industry has a job to do.
Q1541 Chair: Do you accept here that there is something about the business model of modern games companies? They have an incentive to keep people playing as long as possible. When you have freemium games that are free to play but the company makes money through in-game purchases, the longer someone plays, the more likely they are to make those in-game purchases and the more money the company makes.
It is very different to a Netflix subscription. I could watch Netflix 24 hours a day and Netflix does not make any more money out of me doing that than if I watched it for one hour a day or did not watch it at all but had a subscription.
These companies have a financial incentive to get people to return as often as possible and to play for as long as possible because they make their money through in-game purchases. That is why we should take this more seriously. It is not just a question of screen time and addiction to all sorts of different media that people consume via devices and screens, but also that the companies have a financial vested interest in people being actively engaged with the product as much as possible.
Margot James: That model you have just described can give rise to those sorts of commercial objectives, I would definitely agree with that, but it does not always give rise to those sorts of commercial objectives. A more mature company should be seeing the benefits of demonstrating a care for its user base in the way you have outlined you would like it to do.
But there is a distinction between possibly young companies—I would not even say that because I can think of a couple of young gaming companies that have great regard for the care of their user base. It is like any industry. There are some companies that have a short-term view that, in crude terms, “The more time you spend on my site, the more money I make”.
That is not true of all companies in this sector or, indeed, of any other sector. There are companies that have a longer-term and more responsible attitude to their customer base compared with other companies that have a short-term and more regressive view of their user base. The latter need to be brought into line.
Q1542 Chair: Indeed. It is a big sector and there are lots of different players within it. But when we are questioning companies like King, which makes Candy Crush and has 270 million active users a month, it is reasonable for us to challenge these companies on the way their businesses run and whether they are seeking to exploit users and make money out of them and what duty of care they have to them. The consistent reply we have had from the companies that have given evidence to this inquiry has been that, basically, they dispute the existence of gaming disorder and they see themselves as under no obligation at all to proactively identify users who might be engaged in behaviour that could be considered to be addictive and, therefore, might be harmful to them and their interests.
We have had evidence, though, throughout the inquiry from people who have had gaming addiction and who seek to help others who have it, too.
Margot James: What you say is regrettable. I have not read all the evidence yet that companies have given you and I will. It is very regrettable if that attitude is commonplace. Certainly, some of the experts from the medical arena and independent researchers you have heard evidence from do give rise to concern.
Even if it is just 1% of gamers who are affected as adversely as this WHO definition implies, globally 1% of 1 billion people is a lot of people, so it is something that I would take seriously in my capacity as Minister for Digital, definitely. As I say, it might affect only a small proportion but, in terms of numbers of people, it can be quite a large number. From what I have read, you are talking about the people who are treating people with a problem of this nature. It is totally destructive of the rest of their lives and needs attention.
Q1543 Chair: The Centre for Data Ethics and Innovation is looking at things like algorithmic bias and whether companies like YouTube are responsible and whether their algorithms are directing people towards harmful content and so on.
Would it also be in the scope of their work to consider whether the way in which games companies gather data about the user experience to try to stimulate more activity is just about improving the performance of the game and people’s enjoyment of it? Should we also be considering whether they are stimulating or seeking to stimulate increasingly harmful levels of exposure to their products?
Margot James: Certainly, somebody somewhere should be researching what you have just outlined the need for. I am not sure if it would be the Centre for Data Ethics and Innovation, but there is definitely—as I said right at the beginning of this session—a need for and a role for independent research of that nature.
Q1544 Chair: This is an observation rather than a question. One of the frustrations we have had throughout this process is that no one is doing that work. The games companies have no interest in doing it and they will not make available the data. Someone else will need to do it. It is the same frustration that we have when talking to companies like Facebook that, again, are highly selective in the research they will allow people to do. Therefore, it is left to outside bodies to try to form a judgment as to what they think is necessary.
I want to touch finally on one thing. I do not want to go back over loot boxes again in detail. We have covered that sufficiently. But do you accept that there are different types of loot boxes? There is one form of loot box where, as you said, you are just buying skins for a character or you are buying enhancements to the game. There are other forms of loot box like the player cards in FIFA, where you are speculating on the quality of the players you will get. Someone is making a purchase that is effectively like spinning a roulette wheel. They do not know what they are going to get or how good it is going to be, but they are spending money to speculate on getting better players as part of their team.
Would you not see that those sorts of loot boxes come much more into the territory of questioning whether it is a game of chance and whether it is encouraging people to speculate real world money in the hope of a benefit within the game that they may not actually get?
Margot James: I accept that there are differences within the whole loot box environment, of course. I can see that some might be potentially more dangerous in terms of that correlation with the propensity to gamble and the emergence of problem gambling. I would accept your point there.
Q1545 Jo Stevens: I have listened very carefully to your evidence this morning and I was pleased to hear you say that even though gaming disorder may affect only 1% of gamers, you take it very seriously. You also talked today about the lack of evidence and the paucity of research to enable you to look at this.
Last year, your Department published its “Areas of Research Interest” document setting out those areas where you are encouraging new research and discussion. There is no mention of game mechanics or gaming disorder in that document and there is nothing in the Department of Health and Social Care’s equivalent document. Why not?
Margot James: I am not familiar with my own Department's document that you just referred to. I apologise for that and I will certainly get familiar with it.
As the Minister responsible for gaming, my concern about the issues that form this inquiry has been heightened by your inquiry. That would account for the fact that I have not been pushing for research to date. As a consequence of your inquiry I will do so as a direct result of your Committee’s work.
I cannot speak for the Department of Health and Social Care. It has a vast research remit. It would come under, I suppose, as I was alluding to in my answer to Mr Farrelly, the mental health disorders area of research. I would hope that the additional funding that is going into mental health will include some funding for research.
The other people to ask are the Medical Research Council, which has vast resources available for research, some of which surely goes into researching mental health areas. I would see this as coming into that.
Q1546 Jo Stevens: The document was published in May of last year.
Margot James: Thank you.
Q1547 Jo Stevens: I appreciate your honesty in telling us that you are not aware of it, but I find that quite surprising. Moving on, I have only one other question—
Margot James: Could you tell me the title of that document?
Jo Stevens: "Areas of Research Interest", it is called.
Margot James: All right. May last year. Thank you.
Q1548 Jo Stevens: Yes. I want to move on to a completely separate issue. We recently did a visit to Dundee and met Paul Durrant from the UK Games Fund. He told us that he is waiting for clarity about the future of the project. What are your Department's intentions for the UK Games Fund when funding runs out in March next year?
Margot James: We judged the UK Games Fund to have been successful and we would hope to have funding to continue its good work, but of course that would be a function of the next spending review so we cannot be completely definite about that. It is certainly something that we would want to continue.
Q1549 Chair: If I could ask a question about something related not to the inquiry today but to a previous inquiry, when do you think the Government will respond to the Committee’s inquiry into live music? We are currently seven weeks late for the Government’s response. We wanted to make sure it had not been forgotten.
Margot James: That is a very good prompt. Imminently. I do not know the answer to the week or the month, but it is certainly something I would expect to see over the course of the summer.
Q1550 Chair: Finally, we asked the Information Commissioner about the timetable for the delivery of the age-appropriate design code. The Department, I am sure, will have had lots of feedback about the code since it was published in draft form.
Margot James: Yes.
Q1551 Chair: What is your view on when the age-appropriate design code might be implemented? Do you feel it needs more work? When do you think we could see the Information Commissioner’s code being introduced in law?
Margot James: The consultation closed only at the end of May. I know that the ICO is, as we speak, going through all the responses received and will be doing some further consultation, I am sure. They will be weighing up what they have heard. There is a requirement on the ICO to bring the code forward within 12 months, I believe, but it is entirely up to the ICO as to when that will be. I know that some of the responses have called for more time for companies to adapt and amend their designs so that they are compliant with the final code. That will be something that the ICO will consider along with all the responses received.
Q1552 Chair: Has the Department welcomed the approach to preparing, drafting and presenting the age-appropriate design code? Does the Department welcome the principles that underpin it?
Margot James: I welcome it fully and wholly. It is absolutely vital. I played a key part in making sure that the data protection legislation last year was amended to include it.
Q1553 Chair: Very good. That concludes the committee’s questions. Thank you very much.
Margot James: Thank you very much and thank you very much indeed for this vital work.