Public Accounts Committee
Oral evidence: Challenges in using data across Government, HC 2492
Monday 15 July 2019
Ordered by the House of Commons to be published on 15 July 2019.
Members present: Meg Hillier (Chair); Sir Geoffrey Clifton-Brown; Nigel Mills; Layla Moran; Anne Marie Morris; Bridget Phillipson; Lee Rowley; Gareth Snell.
Gareth Davies, Comptroller and Auditor General, Linda Mills, Parliamentary Relations Manager, National Audit Office, Sian Jones, Director, NAO, and Marius Gallaher, Alternate Treasury Officer of Accounts, HM Treasury, were in attendance.
Questions 1-121
Witnesses
I: John Manzoni, Permanent Secretary, Cabinet Office, and Sarah Healey, Permanent Secretary, Department for Digital, Culture, Media and Sport.
Report by the Comptroller and Auditor General
Challenges in using data across government (HC 2220)
Examination of witnesses
Witnesses: John Manzoni and Sarah Healey.
Chair: Welcome to the Public Accounts Committee on 15 July 2019. We are here to look at how data is used across Government, which is a perennial issue for the Public Accounts Committee. We have made numerous recommendations over my time as Chair and previously about how the Government need to improve their use of data. Poor data is something that comes up in nearly every Report that we do. We are very keen to understand the strategic aim of Government, and how on earth it will ever be implemented. The NAO Report—I won’t go through it all—provides a useful backdrop to the complex challenge that there is there. We do not underestimate the challenge, but we are keen to hear from you about how the data strategy will work, and what you are able to do to tackle this.
I welcome our witnesses, from my left to right: Sarah Healey, the permanent secretary at the Department for Digital, Culture, Media and Sport, who is reasonably newly appointed and, I think, at her first hearing before us ever—
Sarah Healey: No. When I was at the Department for Education—
Chair: Forgive me. I remember—now I hear you speak, I remember your voice. Thank you for coming, and welcome. Also, John Manzoni, who probably needs no introduction as he such a regular attender at our meetings, the permanent secretary at the Cabinet Office. In between coming to the Public Accounts Committee, he runs most of Government. Thank you for taking a bit of time out to see us, though of course that accountability is vital.
Before we move on to the main issue, Sir Geoffrey Clifton-Brown has a couple of questions—as you might expect, Mr Manzoni—on how prepared we are for Brexit.
Q1 Sir Geoffrey Clifton-Brown: Good afternoon, Mr Manzoni. I am afraid the whole room will groan, but this is a vital matter for the country. We might leave on 31 October without a deal, so can you give us an update on what the preparations of Government are?
John Manzoni: Yes, I can. As you know, my position was that the Government internally were more or less ready on 29 March, to the extent that we could be—not to say that there weren’t issues associated with a no-deal exit on that date, or indeed on 12 April. Most of those issues were to do with what other countries needed to do in discussion with us, not to do with what we were able to do for ourselves. Since that time, preparations have continued. As you know, there are a series of projects; we are managing this in a series of projects. Some of those projects are better than they were on 12 April. That is where we had minimum viable products, where we had manual interventions where the products were not quite ready—all those sorts of things. Getting all of that is progressing. We are ramping up again, ready for 31 October. There has been and there will be quite a lot of activity over the summer. There have been some early policy decisions taken that were required. You will have seen reference to the ferry contracts, for instance, which have been reset. There are some other policy decisions pending about how we mitigate some of those impacts that we did not have time to mitigate for 12 April. Those will continue to flow through.
I would say the areas that were always there remain there. I don’t want to be political about it, but trader readiness is still an issue out there in the marketplace, so the discussion is about how we ramp up communications again to try to persuade those people who took no notice last time, if you like, or said, “No, I’m going to wait until it becomes real.” So there’s trader readiness. There is obviously the Northern Ireland issue and associated things; there are still some issues at the border that we need to resolve. There’s the data issue: the data adequacy agreements won’t be made on an exit date. So those issues that were there before are still there. In some cases, we will be able to mitigate them a little better than we were able to last time, because we have had a little more time.
We have remobilised the people aspects, so the hub that sat in the centre of Government and started moving people around in the last analysis last time has begun ramping up again. By the end of this month, we will have the demand in the Departments. As I said to a committee recently—not a parliamentary Committee but an internal committee—I believe it will be easier this time to move all those people around than it was last time, because the role definitions will be clearer. It wasn’t perfect last time, but I think it will be better this time.
So in those dimensions, projects continue and communications will be ramped up. We have obviously got to wait a little bit for some policy decisions by a new Prime Minister and Government before we actually hit the switch, and people—I think all of those are progressing.
Q2 Sir Geoffrey Clifton-Brown: One of the big areas where there is a key date, we hear, is in DEFRA and is the purchasing of freight contracts; you referred to this. We were told that really this needed to be done, if it was to be in place by 31 October, by the end of July. Is that timetable likely to be attainable?
John Manzoni: It is a framework. We have put out notices for a framework, so there will be in place a framework, which actually doesn’t last just for Brexit; it lasts for rather longer than Brexit. That is now in the marketplace. The securing of that framework is the next act. The calling off of actual ferry capacity from the framework I think doesn’t have to be done until sometime in September, but there are interim steps that need to be taken. But at the moment I don’t see any issues that will prevent that from happening.
Q3 Sir Geoffrey Clifton-Brown: The other issue, which you also referred to, is the number of businesses that need to make freight declarations and, indeed, the number of freight forwarding agents sufficiently capable of doing that on behalf particularly of small businesses that have never been registered for VAT before. We know that the number of people having to make declarations is going from 55 million to 255 million, so it is a massive increase. Is this still likely to be a problem, whether we leave with or without a deal, on 31 October?
John Manzoni: The truthful answer to that is, I’m not sure. Our last attempts to encourage small traders to be ready—we can track EORI numbers. I can’t remember the numbers; it’s about 150,000 traders. To be honest, I can’t remember, but I can find out for you where we are; we’re at about 70, I think, or something like that. So the first step is the EORI number. The second step is the paperwork following the EORI number. Sometimes that will need the help and assistance of agents. As you know, I think, last time there was some assistance from HMRC to encourage the agents to—or more agents. I have not checked recently as to where that’s going.
On the other hand, there are some alternatives being discussed. For instance, we are discussing this, and I don’t think a decision has been made—I cannot remember—we could check wagons on their way to the port, in order to confirm whether their paperwork is ready. If it is not ready way before they get to the port, we could send them back until it is ready. That would mitigate a large amount of the concern over the stacking up in Kent.
Q4 Sir Geoffrey Clifton-Brown: With great respect, that is all very well, but you want to cut that down to an absolute minimum, otherwise you will have complete gridlock at the courts. It is important, is it not, that we get many of these 255 million declarations done? That requires HMRC contacting those businesses, particularly the ones that have never had to do it before.
John Manzoni: They have recently written out again. HMRC are in touch with these businesses. You can take the horse to water, but sometimes—
Q5 Sir Geoffrey Clifton-Brown: What are the key dates in all this? I will come to the risk registers in a minute. Are there any key dates that you are concerned that we will not hit, and that we will therefore be in difficulty?
John Manzoni: To be frank, I don’t want to make it up, but I am not aware of any dates that we will not hit in this matter of freight.
Q6 Sir Geoffrey Clifton-Brown: No, not just freight but the whole preparedness if we leave the EU without a deal on 31 October.
John Manzoni: No. You catch us. We are ramping this up. The first piece of MI since April or May is coming in—in fact, we are having meetings about it this week. I have not seen it yet. It came in on Friday. We are literally days away from seeing the latest update on where Departments are—that set of milestones, if you like—but nothing has been flagged, other than the ones that have been well flagged already.
Q7 Gareth Snell: Briefly, on the back of Sir Geoffrey’s questions, you said earlier that businesses were getting ready for the prospect of no deal. I had two businesses down this morning at the Department for Exiting the European Union who both told the officials and the Minister that their working capital had been used up prepping for March, May and for June, and therefore that they were not doing as much prepping this time.
First, in their heart of hearts, they do not believe it is possible, because you have had three opportunities now, and it has progressed. Secondly, they do not have the resource available that they had in April. How confident are you that the smaller businesses, outside the big suppliers, are actually able to do the preparatory work that you know needs to be done if they have not already used that opportunity and have missed the boat?
John Manzoni: I think it has been consistent. There are reasons why it might be more difficult in October than it was April; working capital is one and the availability of warehouse space is another. The answer to your question is that, because I am not in touch with all those businesses, I do not know. However, in a general sense, it does not surprise me that there may be some more complexities. However, that is one reason why we are ramping it up a bit earlier, frankly.
Q8 Sir Geoffrey Clifton-Brown: On a different subject, you kindly provided—on Committee terms—the Government’s risk registers of their key strategic suppliers. That was some 18 months ago. Is it possible for us to have the updated ones? Given that such a large proportion of Government procurement is done by relatively few high-profile suppliers, it would be really helpful to the Committee to see those updated risk registers, albeit on the same confidential Committee reading room terms that we had before.
John Manzoni: I think you are talking about the strategic suppliers.
Sir Geoffrey Clifton-Brown: I am, yes.
John Manzoni: If you recall, I think as a result of discussions in this Committee, we concluded that the very existence of the risk registers could precipitate a condition for the company if they were to get public. We therefore concluded that we were going to change that process. If you remember, we replaced the risk registers—I am sure we have said this—with memorandums of understanding between us and each company.
I think one of your recommendations in a previous report was that the risk register was not working very well, so we had a rethink and changed the process. I am happy to go back and think about what we can provide for the Committee. I am not sure that it will be the risk register as you saw it last time, because I think we changed the process in response to one of your recommendations.
Q9 Sir Geoffrey Clifton-Brown: That is even more reason that we would like to see them, to see how the system is shaping up to all this, to see how immediately up to date it is.
John Manzoni: Let me take that away and come back.
Q10 Chair: I have to say that we have seen quite a lot of papers that were secret to Government. Obviously we are not publishing them; I suppose we reserve the right to—on that and on anything, potentially—but of course we have not leaked anything because we are the Public Accounts Committee. When we looked at some of them, they were not actually that exciting. Quite a lot of it is stuff that we would know—we are not exactly rank amateurs, but we are not necessarily world experts—in the areas that we are looking at. We have been looking at the European contracts, for which I thank you. We still have further information to look through there, because some of it is missing.
John Manzoni: I have signed a letter for you this morning, for the last 10.
Q11 Chair: Thank you. We want to see the detail of what is being discussed, so I think it would be very helpful for us to see that. If nothing else, it keeps the people who are producing these documents on their toes to know that somebody outside the civil service will keep an eye on what is going on.
John Manzoni: I do not disagree. I think the risk registers were quite tricky, simply because—as you are aware—any hint of whatever it might be in the marketplace can cause considerable stock movement on certain of the companies. That was one of the reasons why we thought, “This isn’t actually very sensible.”
Q12 Chair: But it was only one element, really, wasn’t it? It was the ranking.
John Manzoni: Yes. Well, it was the RAG rating.
Q13 Chair: The rest of it was pretty much public information.
John Manzoni: Yes.
Q14 Chair: So much of what is secret in Government is pretty much public information if you know what you are looking for. I just make that observation.
We need to move on to the knotty issue of data, which obviously plays a part in Brexit, but not just that. As I said, we have had many issues across every Government Department. Windrush was a recent one, and we had another Home Office data issue only last week about a third party doing English language tests for migrants. Every Department has some responsibility, but who do you think is responsible overall for the use and quality of data across Government, Ms Healey? In theory it falls on your Department, but is that really the simple answer?
Sarah Healey: I think that is, in essence, the simple answer. As with any complex topic, we work very closely across Government with a range of other Departments. I will talk a little more in a second about how closely we work with the Cabinet Office, GDS in particular, on executing our responsibilities, but DCMS has for some time now held responsibility for broad policy on data protection, data ethics and so on within the economy as a whole. In March last year, we also acquired responsibility for policy and governance of the use of data in Government and across the public sector.
Q15 Chair: That makes some sense on one level, but actually being in charge of making sure that all those complex projects, management systems and data collections are dealt with well across Government is quite a different thing from dealing with the ethics of how other bits of the economy deal with our data, which we will come on to later.
Sarah Healey: First, DCMS holds the policy on how this is used in Government and sets the ambition and the standard, but obviously we work extremely closely with GDS on the technical implementation and the follow-up. John’s role chairing the data advisory board is an example of that.
I suppose I would slightly question whether the assumption behind your point is absolutely right. It is true that the technical implementation is perhaps separate from holding policy on data ethics, but one of the fundamental reasons why Government—as in the rest of the economy—struggles to always use data as effectively as it might is precisely the concerns about the ethical use of data and about data protection. Allied with the desire to use data for innovation, those two things need balancing out.
Being a Department that has thought about that for some time now in the context of the economy as a whole, and being able to think about it for Government, which also faces many of the same issues, is really quite helpful to ensuring that the policy is as good as it can be.
Q16 Chair: You have only headed up the Department for three months. Much as we love DCMS, it is a small Department in relative terms; it is not delivering big areas of public policy directly, unlike DWP or HMRC, which deal with large amounts of data. Frankly, do you have the clout in Whitehall for your senior colleagues to say, “Aha—we must jump, because DCMS has set a policy on this”? Do you think you have the purchase you need across Whitehall to make sure that your policy ideas are implemented?
Sarah Healey: First, I would say that DCMS is much more a medium-sized Department than a small Department these days, actually.
Chair: Apologies—I have clearly hit a button there. I am sure that your damehood is on its way.
Sarah Healey: When I left DCMS as DG in 2016, I think that would have been a fair description, although at the time we were embarking on the job of translating the GDPR into the Data Protection Act and introducing the Digital Economy Act 2017. Those were both significant pieces of work in this space, establishing DCMS’s expertise in data.
In a number of other policy areas where DCMS has the lead, it is not clear to me that we are any less able to lead on data than on those other topics. We work closely with other Government Departments on digital policy, which is ultimately about a channel, rather than a specific thing. A huge number of other Departments have an interest in digital, yet DCMS is responsible for it. I think DCMS does a good job of driving innovation and new thinking on how to implement that and create the best conditions for success in a digital economy—but I would say that, wouldn’t I?
My personal view is that it does not have to be a big operational Department to lead policy well across Government. Fundamentally, we are talking about expertise in policy and the knowledge of how to work with others, so that they can implement that as effectively as possible in the places, which, as you say, have significant operational responsibilities and do significant amounts of data collection.
Q17 Chair: I am sure we will come on to that. Mr Manzoni, why did this move from the Cabinet Office to DCMS?
John Manzoni: Sarah has made a sensible argument for why it can sit in DCMS. I believe it can sit in DCMS.
Chair: The Cabinet Office is still quite critical to getting it delivered.
John Manzoni: I think it remains critical. The alternative model is a functional model, which sits in the centre and the function does the functions job. However, the finance function is led by the MOJ and the analysis function is led by the ONS, so there is no reason why this bit of activity—
Chair: Now I see the model more clearly.
John Manzoni: That is why I retained the chairmanship of the DAB—to help.
Q18 Chair: It did occur to us when we were planning for this that you chair a lot of committees, boards and bodies.
John Manzoni: Not that many. My intention was not to chair the DAB forever.
Chair: Is this a promotion opportunity?
John Manzoni: As I am sure you will get to, we are slightly slower with the chief data officer than we had intended at the time. That had been the intent.
Q19 Chair: The chief data officer, who is not yet appointed, will chair that.
John Manzoni: That is our intention.
Q20 Chair: Will that chief data officer be from the Cabinet Office?
John Manzoni: That is to be determined. We have not decided yet.
Q21 Chair: You haven’t decided yet, so you don’t know which Department that person will sit in.
John Manzoni: I will just explain it now, because I am sure that you will ask about this later anyway. I do think that Government need a chief data officer. Nine Departments have chief data officers. The Government need a chief data officer.
Q22 Chair: So it will be a bit like the Government finance function: you will have one in each Department, but someone in an overall role.
John Manzoni: Yes. Like all functions, part of the role is to convene the other Departments to create the data strategy for Government. That is quite tricky, because, like all these things, it needs a lot of influence, it does not have many direct levers, and so on.
In 2017, we said that we would hire a chief data officer by 2020. We are not in 2020 yet, but we have not hired one for two years. The reason we have not hired one is that up until fairly recently, I felt that the conditions for the success of that appointment were not quite there. It would likely have come from the outside. One doesn’t want to create a very senior position from the outside to fail. I think that is changing. That is why we gave ourselves the space from 2017 to 2020, so that the conditions could change. I believe that they are changing. The fact that we are having this hearing is helpful, for instance. I think the conditions are changing. The felt need across Government—“Could somebody please sort this out?”—is much clearer now than two years ago.
Chair: We will come on to the issues around the data strategy, which are feeding into what you are saying, a little later.
John Manzoni: That is why we have delayed, and that is why I find myself still chairing the DAB.
Q23 Chair: Ms Healey, would you like this chief data officer to be in your Department? Do you think that would make sense?
Sarah Healey: I think that John and I should just make a sensible decision between us. We should do that reflecting on where we get to in the initial work on the national data strategy. Fundamentally, the chief data officer’s job will be to implement the Government aspects of that, and we need to make a determination about where they best sit to enable them to succeed in doing that. Obviously, departmental boundaries matter, but this is about working together and collaborating sensibly on implementing cross-Government agreed strategies.
Q24 Chair: Which all sounds great, and with things such as the Government finance function and other functions, some of which Mr Manzoni has implemented—the Crown Commercial Service—we have seen some big improvements and changes there. The danger is that if you do not have a good system, it can rely on individual personalities. We have seen with GDS and, famously, the Rural Payments Agency, quite a clash of cultures and personalities that caused more problems. How will you make sure you embed this as a proper process rather than just hoping that people will get together and work it out because they are sensible people?
Sarah Healey: Do you mean “this” as in the person?
Q25 Chair: The person—we will move on to the strategy later.
Sarah Healey: I think that having a close relationship to a Government Department is hugely helpful for somebody doing a function that might otherwise sit in the centre, because it allows you to take the pulse of how Departments think about these things, how they prioritise them and how they go through their own internal process to try to build it into their business plans and their single departmental plans. I think that’s helpful. Clearly, the national data strategy has looked to set out a set of actions that will be taken, and it will be for that chief data officer, in chairing the data advisory board, to oversee the implementation of that. We have made a decision that that sort of board will be the overall vehicle for making sure that those recommendations are implemented.
Q26 Chair: When will you decide how much money this person will have to play with?
John Manzoni: That was one reason for pausing, because, outside of the spending round, it is quite hard.
Q27 Chair: When do you think the spending review will be?
John Manzoni: That is a very good question.
Q28 Chair: Or do you just laugh, like all your other colleagues? Sorry; that is what we are now getting from Whitehall. We might take bets with different permanent secretaries putting in sealed bids for when they think the spending review might be. What is your bet, Mr Manzoni? Will we have a spending review this year, do you think?
John Manzoni: I really don’t know.
Chair: That is very honest.
John Manzoni: The same work goes on. The same work needs to go on across the system, and it is. Whether they decide to do a one-year thing or a three-year thing this year or next year, who knows?
Chair: I am sure Mr Snell will be keen to pick this up.
Q29 Gareth Snell: With jocular intent, Mr Manzoni says, “Who knows?”, but surely somebody knows. We have this lovely chuckle around will there or won’t there be a CSR, but parliamentarians across the House are always told these issues will be looked at in the comprehensive spending review when it comes to matters regarding expenditure. We are told continually that these things are being delayed until the comprehensive spending review. Simply to say, “Nobody knows” or “Somebody will know one day” is a disservice to the country and to whether we spend public money, because the decisions that need to be taken to be effective are being rolled up into something that people dismiss by saying, “We don’t know when it will be”, as if that is a perfectly acceptable answer.
John Manzoni: Ultimately, the decision is the new Chancellor’s, so we are left to wait for that. Having said that, nobody is standing around. As I say, the work that is going on for a three-year spending round is going on in the system. Everybody is preparing. Whether or not there is a one-year piece of that or a one-year freezing while that work comes back, all of that work is carrying on. We are in an in-year budget, so we are in the last year of a spending round and all of that work is carrying on. There is no massive discontinuity in this. I think, therefore, the new Chancellor, whoever that is, will make a decision.
Q30 Gareth Snell: I appreciate that you are not going to be the new Chancellor—unless there is something you need to tell us, Mr Manzoni.
John Manzoni: No, thank you.
Chair: Now there’s an idea.
Q31 Gareth Snell: This Committee has continued to look at things such as the defence equipment plan, HS2 and Crossrail, which are all things that have a huge impact on public spending and the value of the spending that is done by this Government, Parliament and the country. If it is a one-year spending review, it still has an implication for the effectiveness and the value for money that we get later on in those projects. Although I appreciate what you say about the new Chancellor having to make a decision, delay in itself is a cost, and it is whether or not we can start to quantify what that cost is and at what point it becomes unbearable to the public purse for future spending commitments.
John Manzoni: All I will say to you is that there has not been a delay yet.
Gareth Snell: Yet.
John Manzoni: There has not been any delay yet in terms of the planned spending round that was due to take place in the autumn. As I have said, all of the same work is going on, but I am afraid you will need to ask the new Chancellor that question.
Q32 Chair: Sadly, we do not get the Chancellor in front of us, but our sister Committees will no doubt have the new Chancellor in front of them. The serious point here is that in the case of the chief data officer and the money for all of this, there is no skin in the game at the moment. There is no existing budget to be rolled over, as there is for a number of other very important service areas. Isn’t there a danger that with a delay, a change to the spending review or no spending review this year, this will just be pushed further into the long grass, and there will be further delay in tackling some of the big data issues that we highlight so often?
John Manzoni: All of this is contextual. A spending review bid is being put together for the funding of new data, and the data advisory board is due to consider that. In truth, because of the MoG and because of other things, that is now in its final stages of formulation. There will be a bid, but if there is a delay we will have to have a different conversation, and we may well go around Departments and do the normal thing.
Sarah Healey: We need to separate this out. There are some really useful things that we can bid for centrally in the spending review to do with holding strategic budgets, especially in these circumstances where the benefits of good use of data do not sit where the costs sit. One of the pieces of work that the data advisory board has been focusing on is starting to think through exactly what that kind of bid would be like, so that we are ready to make it. I do not think that we should necessarily think that, if that money is not bid for yet and is arriving anew in a new spending round, money is not being spent on improving data. Departments are really where money is spent on improving the use of data. We add extra things to it, but we are not the sole source of it.
Q33 Chair: They could already change what they are doing without extra money, potentially. Obviously, you have been, like every other Department, focusing on EU exit. I think you have acknowledged that that has taken some resource away from tackling data. Can you give us some examples of things that you have not been able to progress because you have had to take people off to deal with Brexit?
Sarah Healey: I think we would like to have made more progress on the national data strategy than we have up to this point. We had to take a view. Obviously, I was not around in the Department at this stage, but the senior leadership of the Department had to take a view earlier this year about where work needed to be paused in order to move resource to ensure that we were handling the very big, significant data protection risks that exist for no deal. Essentially, that meant moving 10 people who were part of the data strategy team off working specifically on that strategy for about four months. It probably held us back, therefore, by a little bit of time.
However, we quite deliberately ensured that one of the tasks that those people were doing, which needed to be done anyway for data protection and no-deal planning purposes, was to go around Departments and get a better understanding of the data that they had available that was relevant to EU exit, and what governance they had embedded in their departments to oversee their use of data, and to build good relationships with those Departments and the people who were managing data within them. Therefore, even though some of the direct work on the strategy was paused for a period of time, the work that that team was doing was genuinely helpful, and acts as a good basis for the work that they are now actively pursuing following the call for evidence on the data strategy.
Q34 Chair: That is quite interesting, and raises the question of whether at the same time they were able to look at some of the many legacy systems. In preparing for this, we discovered that in one database there were something like 13 different ways of spelling Scotland. We are still trying to work out every version of it.
John Manzoni: We have solved that one.
Q35 Chair: Ah—you have solved that one. Thanks to the NAO, I’m sure. I wonder, if the NAO had not pointed that out, whether you would have—
John Manzoni: No, no—it was one of the first registers: country names. It is remarkable; it took a long time, but there is now a register of country names that is cross-Government.
Q36 Chair: Given that we only have four countries in the UK, that is quite—
John Manzoni: It’s not just the UK countries.
Q37 Chair: Oh—it covers a bit more of the rest of the world. I was going to say that I know you like to see the positives, Mr Manzoni, but it would have been extraordinary to claim that that was a huge success. I am sure our Scottish colleagues are glad to know that they are now recognised properly.
Seriously, we hear all the time, and there are some examples in the report, about old systems being worked around still, and how it is easier to work around than deal with the legacy systems. Yet you have quite interesting examples with the DVLA, for instance. You can get your driving licence by matching up to your passport. There are bits where they have made it work, and others that are just so clunky that it is seemingly quicker, though not necessarily cheaper, to work around it on that one occasion. What is the biggest challenge for you, Ms Healey, in dealing with those? That is really hard for one Department to try to push through other Departments, where it is hugely expensive and challenging to change those legacy systems. What are some of the big concerns you have, and how are you planning to tackle them?
Sarah Healey: To be totally honest, the most important thing on legacy systems is to ensure that, when they are replaced, the issues with data are built in from the very beginning.
Q38 Chair: So how long will we be living with some of those legacy systems?
Sarah Healey: It obviously takes time to replace legacy systems. The more modern they are, the easier it is to tack on some of the links that can bring them together. Fundamentally, in the quest to work around legacy systems we absolutely must not lose sight of the fact that the most important thing is that we do not set up such problems for the future; and that, therefore, as Departments introduce new systems, they both draw on the work that GDS has done on data standards and think about such interoperability questions right from the beginning, rather than discovering them later down the line when they have made a significant investment. That is part of the purpose of the work that we are doing. The NAO Report has highlighted that it needs to go further and faster, to ensure that people are aware of those and build them in from the very beginning.
Q39 Layla Moran: On that point, do you have a full list of every legacy system that will at some point—maybe—one day come together, and what the issues are with it? Does anyone have that list?
Chair: Mr Manzoni, I see Ms Healey looks to you.
John Manzoni: Probably not a full list, but these things get attacked from many different dimensions. The replacement of legacy IT is about data; as soon as it gets into a legacy system, it is legacy data, and that is the problem with it. The replacement of legacy IT systems is, of course, a huge issue for Government, and we have to do this progressively.
Q40 Layla Moran: But, just at a very basic level, do you have a list of every single IT system?
John Manzoni: We could get one, but I don’t have it.
Q41 Layla Moran: You don’t have it?
John Manzoni: No, because there has been—
Q42 Layla Moran: But don’t you need that, and the problems with them, to create a strategy? That is the key question.
Sarah Healey: Departments have very comprehensive lists of their information assets, or the data that they hold, and we have a much better understanding of where all that is across Government now, because of the use of information asset registers, than we have ever had before. Whether that translates specifically into a list of every single legacy system, I could not say, but the most important thing is that we do know where data sits in Government now, in a way that we did not previously. You are absolutely right that without that, we cannot possibly identify opportunities to link those together and improve services as a result.
Q43 Layla Moran: So in the call to evidence, these are basically stakeholders; if, in the end, all the new systems are going to start to talk to each other, all the stakeholders need to be consulted to ensure that this will all work together.
Sarah Healey: That is part of the reason—
Q44 Layla Moran: If you are not nodding at me enthusiastically and saying, “I know exactly where my stakeholders are,” how do we know that your call to evidence is asking the right questions and will end up with the right answers?
Sarah Healey: I would distinguish two things. The first is who we are consulting in developing the national data strategy, which is a very broad range of stakeholders. We are consulting in both Government and the private sector; we are consulting businesses, SMEs, large businesses and small businesses; we are engaging civil society on this and we are talking to local government as well. Part of the reason we are running an extensive first-phase call for evidence followed by a longer, more substantial public consultation is to ensure that we are gathering that full picture. I don’t think that is quite the same thing as having a list of legacy systems.
Layla Moran: Understood. So there is a part 2; I had not realised that.
Q45 Sir Geoffrey Clifton-Brown: Mr Manzoni, does this cross-departmental data sharing present Government with a huge opportunity? A lot of the things we see going wrong in Government are inter-departmental, and if you could get data-sharing systems that could go around and between Departments so that there was no barrier between Departments, it would make the whole job a lot easier to manage and a lot more productive. That needs two things, doesn’t it? It needs cultural change within the civil service so that they do not just use the data in their own Department and have confidence to do it under GDPR, and it means having systems that are designed to work. What thinking is going on in that respect?
John Manzoni: Let me start. You are right that there is an enormous opportunity. It is cultural, but it is not only cultural; sometimes it is legal, hence why the Digital Economy Act had to cut through some of those specifically to provide the legal permissions to share some of those data. We will probably come to that. So I think everything that you have said is right. And of course, the pace of technology change has exposed that, and for a big system like this to catch up with that pace is really quite hard. That is what we’re finding. I do not disagree with anything you have said. It’s an enormous opportunity, if we could get it right. And it is cultural. It is also the existing legal system in some places, as well, that is preventing it.
Sarah Healey: I would totally echo what John has just said. I think that the cultural issues are always equally as important as the technical issues. We have made a significant advance in the Digital Economy Act in providing an easier mechanism for data sharing between Departments, and we have done quite a lot to communicate those potential benefits and get those data-sharing arrangements up and running, so that we can demonstrate the success of them—demonstrating the success, safety and security of them as absolutely vital to reinforce people’s use of them in future.
We need to recognise that there is a substantial amount of noise in the general public, in the media and so on about the risks and importance of data protection, and we always need to do all of this mindful of the fact that data protection is extremely important.
Of course, we have worked hand in glove with the ICO in developing the approach to data sharing through the Digital Economy Act, to ensure that it is consistent with GDPR. But people will always be concerned that they don’t want to take risks with people’s data when they see what taking risks with people’s data might produce.
So, we are constantly working on trying to ensure that people’s cultural approach to this recognises the benefits of innovation and understands how the risks attached to that can be managed. We think the Digital Economy Act is hugely helpful in managing that.
Your point about the technical skills really speaks back to this greater awareness in Government, for example, in the roles of chief data officers, so that all are taking seriously the fact that when they implement new systems, they should do so in a way with Government’s overall desire to exploit exactly those benefits that you have talked about.
Q46 Anne Marie Morris: You have talked about a lot of things that are going to be a problem and get in the way, but if I were to ask what the top three or four barriers are to trying to sort out this whole data problem, so that we have good-quality data and it is shared across Government, what would those barriers be?
Sarah Healey: I would probably identify three big ones, and John might think that I have got the priority list of that wrong. However, I would say that quality of data is a really significant barrier to making the most of this, and that is true across the private sector and the public sector; it is not the public sector alone that has questions and issues with the quality of data.
I would also say the consistent application of data standards—so, ensuring that we are doing things in a way that makes it easy for people to share information between systems and not have to develop those workarounds.
Thirdly, I would say the cultural barriers—so, the appreciation of what the potential benefits are and the keenness to overcome them.
John Manzoni: They are probably related, but I would add the issues we have discussed already: legacy, IT, and funding.
Q47 Anne Marie Morris: Okay. Let’s unpick some of those a little bit.
First of all, in terms of the data, do you feel that across the civil service there is a sense that this is an asset, and do you get a sense that they feel ownership of all Government data, or are we not there yet?
Sarah Healey: I would not disagree with the conclusions of the Report, which clearly conclude that we are not there yet. However, I think there is a greater understanding, month by month, of the value of this, the significance of it and the potential benefits that can accrue from it. But do I think we’re there yet? No.
Q48 Anne Marie Morris: How do you think we will we change that perception?
Sarah Healey: I don’t think you can change that kind of perception with one single big-bang reform. I think you need to set a really clear set of objectives; you need to ensure that the profile of these issues is being raised within Departments; and that you have demonstrated what the benefits are. So, we use things like the data-enabled change accelerator projects that the data advisory board has been overseeing, to demonstrate what can be done, and we communicate those benefits.
I think we do well to get people who have done those projects to talk to other people in Departments, because seeing how individuals have done it is a very big motivator to get over some of those barriers. Departments have a lot of things that they are told are a significant priority so essentially you just have to decide that you are committed to it and keep going at it until you start seeing some of that change happen. It is not an overnight, big bang-type thing.
Q49 Anne Marie Morris: No, it isn’t, but your challenge is that some of these other initiatives are discrete in their nature, whereas data affects everybody—every single civil servant—and until and unless you get the message down to all of them that this is a key asset that needs to be loved and nurtured, and it is absolutely crucial to get it right, you are not going to get that. I mean, that is a huge change programme. How are you going to do that?
John Manzoni: It is much easier to do with the stuff that is coming in now than the stock, if you like. On the flow, as Sarah has already mentioned it, the implementation of appropriate standards—I have talked about standards a lot in here, but we have made some early steps in the agreement and then implementation of data standards for new data coming in. I am not saying we are there, but we have made some early steps. There are 16 or so standards in existence that do not include how you register a name, as it happens, but they do include how you register a date and various things.
That is the first step, to sort of set standards. Everybody accepts the importance of those standards. We do not have a mandate from any particular place in Government to actually insist, but in general we find that provided we have made them sensible, we can broadly get agreement and implementation of those standards. There are data standards that I think are starting to take place now.
Q50 Chair: Can you give an example?
John Manzoni: Of standards?
Chair: Yes, of a standard that is taking place now that is making a difference. Think about Scotland.
John Manzoni: The trouble is that they are quite obscure. You mention Scotland; there is now a standard on country codes—you know, “This is how you put a country in.” I will give you some examples.
Chair: That matters quite a lot, if you are—
John Manzoni: It does matter. There is a standard on how you publish a grant, or how you document a grant that the Government give so that other people can see it. There is a standard on how you post a job online, so that other people—you know, they get quite obscure quite quickly, but there are 16 of those standards in existence now. How you publish contract data, as you know in a different context—
Chair: It is very helpful for us if it is similar.
John Manzoni: Quite. They are not always adhered to, but in general it is becoming more and more and more. I think that for the new stuff—by the way, some critical standards are not there yet, and we have to put them there and then start using them. I think that deals with the flow, and we are still left with the stock that is in the legacy systems, which is quite expensive to solve.
However, as Sarah says, the opportunity and upside of doing all of this has become increasingly clear as technology advances and the digital world comes to us, and we can see the benefits. That is increasing. We all see opportunity, and public servants want to do good for the public and they will see that there is benefit in doing that. I think that will accelerate from here.
Sarah Healey: The other thing I would say is that there are both ways in which you embed this in the thinking of all Departments, and technical ways in which you can improve some of the things that go wrong. For instance, on data quality, there are things you can do to ensure that as data is inputted, any problems with the quality are flagged up front rather than having to be fixed later on. The more we can make those kinds of things automatic, the easier it is to raise the level—
Q51 Chair: Do you mean it going red because you have typed it in the wrong way?
Sarah Healey: Which obviously can be very frustrating when you are trying to enter something very quickly, but really matters if you are not then going to have to go back and data cleanse.
Q52 Anne Marie Morris: How would you define data quality? When people come into the Department, do you explain to them what good data is and what bad data is, and what the implications of it are?
Sarah Healey: We do in DCMS. We talk about data a lot, because obviously we are the Department that owns it. I think other Departments that use a lot of data absolutely talk about what the importance of the quality in it is. For instance, I do not know a lot about what training HMRC specifically gives to its staff, but I am sure it talks about the importance of people taking the data in and inputting it in the right way.
I think this operates at a lot of different levels. In DCMS, we will talk about it because we will talk about the way in which we want to drive improvement in this, policy-wise, across the whole of Government. In other Departments, they will talk about the practicalities of how that needs to be done at an operational level, and it just needs to be part of the language of all Departments at differing levels, depending on what their particular role in improving data is. That is going to differ in places in lots of different ways.
Q53 Anne Marie Morris: It is, but it can’t be. How are you going to change that? If you are going to have systems that you can share, surely there has to be some common standard.
John Manzoni: It is about the promulgation of the standards we have just discussed, which we need to accelerate. Another obscure example is that there is a standard about how you write an API, which is the way to get data out of old systems with a little bit of programming. There is a standard about how to do that, which apparently is taking off and going well. There are various standards, and I think we should carry that on. Capability and awareness helps. We are at the early stages, but there are an increasing number of courses available on data itself, and that will pick up pace. In the GDS academy, there are early phases and a couple of courses in there. Some 10,000 people have been through the GDS academy. They have not done the data courses, because they have only just gone in there. There is the data science partnership and the data science accelerator. The data science accelerator has trained 200 or so people in the basics of data science, and those people really get the importance. Another 60 are going through and we are on the fifteenth cohort. It has been going for a while, but it is not a quick process. I do think we need to accelerate awareness and capability across our system.
Q54 Anne Marie Morris: Given the absence of the strategy, which we all look forward to, is there at least a plan so that when you are developing these standards, you have a list of the ones that are crucial and some prioritisation of which ones you will do first, second and last?
John Manzoni: Yes. I think there is a plan. Do I think it has got the airtime at the senior level yet? That plan for standards has not come to the data advisory board yet, but it will do. It is going on among the data science community and the data leaders network—it is going on at that level, but it needs some more horsepower.
Q55 Layla Moran: Who currently owns the workstream to create the standards?
Sarah Healey: GDS.
John Manzoni: GDS.
Q56 Layla Moran: Which sits in?
Sarah Healey: The Cabinet Office. It is a really good example of how these responsibilities split. DCMS owns the policy on the importance of data standards and the fact that we would like to see data standards being adhered to across Government whenever systems are developed. [Interruption.] We don’t draw up data standards; GDS does that.
Q57 Layla Moran: Who is in charge of ensuring they are implemented across all Departments correctly?
Sarah Healey: GDS does that, convening data leaders.
John Manzoni: It is a community. There is no mandate. We don’t have that in Government—we don’t have those accountabilities—but none the less, everyone will see the benefit. There is not a mandate, but there is an invocation to meet the standards.
Q58 Anne Marie Morris: I have to say, it all sounds like a bit of a mixed bag to bring in policy from implementation and a plan that has got a few bits here and a few bits there. I am looking forward to your strategy officer, who hopefully will be able to put it all together. The one thing we have not dug down into is culture, which is one of the first things that you talked about, Ms Healey, and the challenge of the fear that people have with what they can share and how they can try to input data. How do you see yourselves as being able to resolve some of those problems? You have talked about courses, training and trying to explain the Digital Economy Act and the opportunities and so on, but clearly from the evidence in the Report, we have not yet got to a point where people are not fearful. How are you going to change that? Perhaps that is a challenge for Mr Manzoni.
Sarah Healey: As ever, it is for us to tackle some of those issues in the strategy and to set out again the principles that we want the Government and the wider economy to follow, such as to balance the importance of innovation with the need to follow the law on data protection and to have data protection in mind when they do that. I think the Information Commissioner’s Office has done a good job of putting out some helpful information that gives people confidence that they are doing what they need to do on data protection. We have spent a substantial amount of time out and about and on the road talking about the benefits of the Digital Economy Act and helping walk people through how they can apply this with confidence, believing that they are following both provisions at once. Inevitably it will be an ongoing task to communicate that and to ensure that people feel confident about entering into data-sharing arrangements. I would also highlight in Government that the appointment of a chief data officer—indeed, the increasing appointment of chief data officers in Departments—will assist hugely in giving Departments confidence that they can get both elements of that right.
Q59 Anne Marie Morris: Trust?
Sarah Healey: Trust, yes.
John Manzoni: Can I add to this? In my own experience, dealing with culture doesn’t come from dealing with culture; it comes from dealing with business. So the more examples we can find—that’s why the data accelerators are there; that’s why there’s the Digital Economy Act we can push. The more examples we can find where people say, “Actually, that was really good, because it’s helping me do my business”—that’s the fastest way of changing it.
Q60 Anne Marie Morris: I would agree, but that’s about the positives. I’m concerned—
John Manzoni: It’s about the—
Anne Marie Morris: The positives, as in “This is how they can help me.” There’s the negative, which is “Am I going to land up doing something completely inappropriate?”
John Manzoni: Sure, there’s a bit of—
Anne Marie Morris: “I need to be able to trust what I’m doing. These people are telling me; they’re giving me these wonderful examples, but am I sure I’m not suddenly going to land on the wrong side of the law?”
John Manzoni: Yes.
Sarah Healey: That is why we offer the huge amount of advice that we offer in combination with the ICO. It’s so that people’s fears about that—we can walk through how they manage them and how they can ensure that they are on the right side of how they should use data.
Q61 Anne Marie Morris: That is all about telling, and as Mr Manzoni said, it really isn’t about telling.
John Manzoni: But it’s happening.
Q62 Anne Marie Morris: It’s about trying to help them, almost like at a surgery: when they have a problem, they just pick up the phone and say, “Can I do this?”
John Manzoni: It is happening under some of the pillars of the DEA right now. They are not all moving forward at the same pace, but 36 or so data-sharing agreements have already been struck, particularly in the fraud and error space and in the fuel poverty space. The more of those we can—we are in the encouragement mode. People can say, “Oh, actually, that’s working.” Some of them are more difficult, but the more of these we can get—that’s why the accelerators are important; all of these become important. And that will just make people feel more comfortable. The teams are then on hand to reassure people.
Sarah Healey: It is not just about telling; it’s about selling. It’s also about ensuring that we are talking about the benefits of this and selling the possibilities in a whole series of engagements with local authorities on the troubled families programme and the opportunities that exist there.
Q63 Chair: Well, with troubled families, they have to give permission to have their data shared, don’t they? So there is a very clear permissive environment. That is slightly different, isn’t it?
Sarah Healey: Yes, although we are obviously always looking for opportunities to join up data between services to be able to serve citizens better. We have done quite a lot of work in trying to find ways in which we can use data better in the troubled families programme.
Q64 Anne Marie Morris: Have you set out some sort of statement of what the ethical principles are by which you manage data—one that is not simply a matter of taking those two bits of legislation, but is something that is at least a guiding principle for people?
Sarah Healey: There are a lot of sources of information. I don’t think there is a single source of information that covers absolutely all circumstances. There is some really clear information available on how you use the Digital Economy Act to share data, and as I say, the ICO has done a really good job, I think, of translating the Data Protection Act into some really practical advice for businesses about how they manage data protection. And we have made sure that those two things marry up.
Q65 Anne Marie Morris: How long will it take, once we get this individual in after the spending review, to get to a point where our data is clean and connected?
John Manzoni: Legacy?
Chair: Will we still be alive?
Anne Marie Morris: Yes, will we be alive?
Sarah Healey: I am not even sure that in the economy as a whole we are going to reach a point where we say, “That is it—nirvana. We have data in exactly the place where we want it,” because the possibilities will constantly be expanding, the data that is available will be changing and the challenges that we face in using it well will be changing as a result. Therefore, I don’t think there is a single point. This is a continuous improvement process. It is never going to stop, because the opportunities are so vast and the availability just grows constantly. Therefore, I think we will be doing it forever.
Q66 Anne Marie Morris: When will you at least get to the point where you stop people bringing in new systems and putting in new data—sorry, old data, legacy data? You have the old stuff; you have the new stuff. You have old systems; you have new systems. In a sense you are going to corrupt or undo some of the work you have done by not at least isolating the things that you mustn’t touch with anything because they don’t work, it’s not good data, or it’s not a good system. So don’t put good data into a system that doesn’t work and don’t put a new IT system in for data that fundamentally is flawed. When are we going to get to sorting that out?
Sarah Healey: My personal view is that we should be already at the point where, when people introduce new systems, they are doing so in full cognisance of what the potential benefits would be of getting the data to be available and therefore are always opting to make that as high quality as possible and are using data standards and ensuring that they are not contributing to a long legacy list of problems. I think we should already be there in terms of new systems. How long it will take to deal with the legacy issues is a much more difficult question.
Q67 Anne Marie Morris: Clearly, the great British public need to trust that what you are doing with all their data protects their rights. What would you say to them about your overall focus and strategy to ensure that none of their data is corrupted, or out in the private domain? Clearly, data has a value in its own right, and ultimately the Government could use it if you anonymised it. What sort of guarantee can you give the public that you could do that safely? That is particularly across the NHS, I am guessing, and the DWP. How are you going to give that trust to the public?
Sarah Healey: I actually think the Government have done a pretty good job of implementing the General Data Protection Regulation and implementing the Data Protection Act. That gives the public some assurance that their data is being used in accordance with the legal position and the principles set out there. Obviously, everything that we do always has that balance between data ethics and innovation. Our centre for data ethics is a centre for data ethics and innovation because we both want to provide better services for the public, because I think they deserve that. They deserve for us to use their data to provide better services for them, while at the same time making sure that we are using it appropriately.
I also think that there are some examples of where the communication of that and the trust have not been there from the beginning. Care.data is an example of that. I think the public sector has learned that you do not simply decide to use people’s data without thinking very carefully about how you build people’s trust in how it is going to be used, because that will undermine the purposes for which you want to use it.
Q68 Anne Marie Morris: Is there a central clearing system to make sure that some of the big decisions and new systems coming in cannot possibly happen in whichever Department without clearance from you or from Mr Manzoni?
Sarah Healey: There are two things here. I do not think that we would ask for all decisions to be shared and tested internally, because we trust Departments to implement legislation and to follow the law. That would be the first thing I would say, unless John wants the job of checking that everybody has been compliant in all these instances with the Data Protection Act, which I don’t think he does.
John Manzoni: No, thanks.
Sarah Healey: Secondly, the kind of register approach in the Digital Economy Act is precisely one of the ways in which we want to be transparent about how we have reached agreements on how data should be shared so that the public are aware of it and can see how it is being done.
Q69 Anne Marie Morris: And somebody goes through that data regularly to see what it is in it, and to make sure there is no—
Sarah Healey: It doesn’t go on the register unless that has been—
John Manzoni: These are published registers of data-sharing agreements, so the public can see them.
Q70 Anne Marie Morris: Who checks it before it goes up on that data?
John Manzoni: There is an approval process before it goes on. There is a board in each Department that formally approves that that data-sharing agreement is sound.
Sarah Healey: And that it follows the principles of the Act. In fact, there is a mention in the NAO Report—the one aspect that I did not wholly agree with—of how lengthy and clunky some of the Digital Economy Act implementation provisions were, partly because we have been very keen to ensure that a process is gone through before those agreements are reached. I happen to think that it is significantly faster and significantly more systematic than it was when each Department would have to take through primary legislation to share data, which is obviously a really unacceptable situation. We do not do it like that precisely because we want to ensure that that trust is always at the heart of those agreements.
Q71 Anne Marie Morris: One final question. Where do you store this data, because there is an issue, is there not, about the public having confidence that, however hard you try, that data cannot be stolen or corrupted? How do you store it?
Sarah Healey: John is probably better placed to talk about the Government’s approach to cyber-security.
John Manzoni: Increasingly, and by design, in the cloud, because the commercial cloud is at least as secure as anything that we have. That is not to say that all data sits in the cloud, but we have a progressive strategy in Government to move to the cloud. For instance, as part of the Brexit thing, we have been examining where those clouds sit. They currently sit—
Q72 Chair: Exactly. Where do they sit? We have had some interesting evidence from UKCloud. You can probably guess from its title what it thinks.
John Manzoni: Because of Brexit, we are examining all of that and making sure that they are in the right places. They are not all there yet, but we are moving in that direction.
Q73 Chair: I didn’t quite hear that. Are you saying that it will be in the UK?
John Manzoni: I cannot guarantee that it will all be—it won’t. There are some non-European countries. There is an agreement with the US; I cannot remember the name of it now. A lot of it is in the US under the particular arrangements that we have on data access with the US.
Q74 Chair: We have hit problems with that because of the different data protection rules, because they can then have access to that.
John Manzoni: Of course none of this is perfect, but in a security sense, the public cloud is at least as secure as anything that we have—other than the top-secret stuff, which we deal with specially.
Q75 Chair: We will look at cyber-security and other areas. I guess that whatever you do, the whole cyber-security space looks at some of this stuff as well, and that will then inform your conclusions.
John Manzoni: Yes, and it bumps into the same issue. It bumps into the legacy IT and all the same issues that we are talking about, so these things converge.
Chair: And we all know that hacking can happen, even on our shores.
Q76 Sir Geoffrey Clifton-Brown: Two quick questions, Ms Healey. Do you have a list of milestones and the stages by which you expect to have adopted them—for example, when the new chief data officer will be appointed? Having a list of milestones would mean that when the Committee comes back to the issue in two or three years, we can say that you said you would do this by such and such a time, and you have—or haven’t—met that.
Sarah Healey: We have internal milestones on the production of the national data strategy; we have said that we want to produce it during next year. We do not currently have a set of milestones on its implementation, because we have not written it yet—but when we do write it, we will absolutely have a plan for implementation that holds us to account for meeting milestones.
Q77 Sir Geoffrey Clifton-Brown: When is that likely to be available?
Sarah Healey: We have said that we are looking to publish the national data strategy during the course of next year. We are running a call for evidence at the moment; we will then run a full public consultation before we produce the strategy during the course of the autumn.
Q78 Sir Geoffrey Clifton-Brown: And the implementation bit?
Sarah Healey: The implementation will follow the production of the strategy.
Q79 Sir Geoffrey Clifton-Brown: The next thing is: when you look at these various systems, are you looking at the best private sector exemplars? I remember reading Bill Gates’s book “Business @ the Speed of Thought” some 10 years ago, and he reckoned then that Microsoft could improve its productivity by 20%, but most firms could increase their productivity by 50%—I guess that that figure is probably even greater now. What are you doing to look at the best private sector exemplars?
Sarah Healey: We always look at opportunities that come from following private sector practice—and indeed good public sector practice—to improve how we use data. The kinds of numbers that you are talking about for how good use of data can improve productivity sound very plausible to me. Part of the reason that we spend so much time doing external work on this—this is one of the benefits of DCMS having a view about how data is used in the economy as a whole, as well as in government—is that it allows us to gather examples through all our discussions with business about they are using data and how we create the right environment for them to do that safely and securely.
Q80 Layla Moran: You said that the strategy would come in “the course of next year”. Will that be the beginning, the middle or the end of next year?
Sarah Healey: I am not going to give you an exact date, but it will be during the course of next year.
Q81 Layla Moran: Does it depend on Brexit?
Sarah Healey: No, not entirely. To be fair, our current plans do not involve pausing development of the national data strategy should we need to ramp up no-deal planning. We are not currently intending to pause that. As I explained, when we paused some of the work on the strategy last time, we used that time to good effect; we think that we have done that mapping work across Government about the governance of people’s data and what is relevant to EU exit.
I don’t think it is particularly Brexit-dependent, but I don’t want to sit here and say, “It will definitely be by x.” That is partly a decision for Ministers about when they are comfortable with the quality of it, and when we feel that we have made the best we possibly can of the results of the call for evidence and the full public consultation.
Q82 Layla Moran: The call to evidence is still open. When does it close?
Sarah Healey: Quite soon, I think. I cannot tell you exactly which date?
Q83 Layla Moran: Is there a set period of time that you will wait before you open the public consultation?
Sarah Healey: We will obviously want to reflect on the call for evidence and what we have found in it, and then we would look to put out a full public consultation in the autumn.
Q84 Layla Moran: Through the call for evidence so far, have you had a sense of the cost of data that is not up to par? With respect to your levers for getting Departments to comply, would it not be helpful for them to know how much their bad data is costing them?
Sarah Healey: I actually don’t think that a new number on that will look substantially different from lots of other analysis that shows how costly bad data is both in the economy at large as well as in government. I don’t think anyone would contend that bad data doesn’t cost us lots of money. I just think that translating that into people taking action to improve it in future is the challenge.
Q85 Layla Moran: Mr Manzoni, do you think the Treasury understands the cost of bad data?
John Manzoni: I am sure that it does. We have had conversations before in this Committee about the strictures that it is under and my own experiences investing in change. That is why a legacy IT is so difficult. It takes a lot of investment to sort it all out before you can get any benefit, and that is very hard.
Q86 Layla Moran: How well do you think the Departments understand it?
John Manzoni: I think increasingly. I really do.
Q87 Layla Moran: A brand-new system really isn’t talking to many other systems.
John Manzoni: Which one?
Layla Moran: Universal credit. The all-singing, all-dancing, talking-to-everything system.
John Manzoni: It’s not talking to everyone, but the big link between DWP and HMRC on RTI is certainly a big one. That gives you a sense of how difficult this stuff is, because that took years. It took a big investment over many years to get that, and now it is working and they are using it. UC is not being held up by a lack of being able to join up with other data.
Q88 Layla Moran: Well, it has got massive fraud in it, partly for that reason. We had an urgent question in the House on this last week.
John Manzoni: UC is a whole different area, and I don’t want to stray too much into it.
Q89 Layla Moran: It’s the data.
John Manzoni: Yes, but of course UC is a big machine. We could fix the fraud if it was the right thing to do to pull people off whatever else they are doing on UC and put them on the digital solution to that fraud. That could be solved; it is just a question of when. I think that if you asked the UC team, they would say, “We can do something by the end of July, and we can do much better by the end of November to solve that particular problem.” It is a digital problem, but it is as a result of what we have done with the advances in UC. These policy decisions are all related.
Q90 Layla Moran: I get that. Coming back to the original premise of the strategy, which is to position the UK as a global leader on data, which includes business, the economy and everything, surely we should just get our own house in order first. If we cannot get systems like UC to work, why don’t we just focus on something that is a bit more deliverable? Ms Healey, do you have anything to add?
Sarah Healey: I think it would be a real shame if the desire to improve Government systems meant that we did not try to ensure that business and the wider economy could make the best possible use of data, because we have got the right policy environment for them to do so. We have got a responsibility to do both. We absolutely have a responsibility to meet the needs of the wider economy and we have a responsibility to improve our own systems.
Q91 Layla Moran: What is the priority?
Sarah Healey: I don’t think that we can compare those two things that easily.
Q92 Layla Moran: But they have to be compared. You have got the joint digital identity unit, for example.
Sarah Healey: You are not necessarily trading off exactly the same funds or people in deciding how you do that. Improving the data policy environment in the wider economy is probably a legislative regulatory matter. Improving it in Government is about investment in systems and standards and finding the solutions to these problems where the costs are felt here and the benefits are felt somewhere else. I think that we are right to be as ambitious as we are in the national data strategy in tackling those at once.
Q93 Layla Moran: Do you feel there is a trade-off between privacy and the cost of managing these systems?
Sarah Healey: Do you mean the cost of the data being bad and not being usable?
Q94 Layla Moran: No, what I mean is that in order to develop these very expensive, complicated systems, it might well be that you go and outsource them to a private company, but in doing that you are passing citizens’ data into the private sphere to avoid costing more money. The DCMS and Cabinet Office are to create a joint digital identity unit, and, critically, there will be no further Government money invested: a key point pushed across by Government. Coming back to the point that Ms Morris made about selling it to people, I remember the NHS plan did not work because people felt that their data was being given to private companies. My question is, do you feel that there is a trade-off to be had? If money is not going to be invested in this from Government for Government use, is the trade-off between privacy and money?
John Manzoni: Let me answer that in the context of the way that it was raised. On the identity issue, as I have said before in this Committee, there is no question that the bar that has been set in the design—let us say it’s Verify—has been extremely high, because it is triple blind. In other words, no participant in that system can see whose data it is and has access to that data. That is enormously complex when interacting between the public and the private sector, and that is why it has been really hard. None the less, technology keeps working, and the environment is catching up with that.
I still believe—I have said it before—that that was incredibly prescient when it was set; it was just really, really hard to implement. The environment in the outside is now catching up with that and understanding how complex it is to set a triple-blind requirement so that individuals’ data can be properly protected. It is still my view that we will end up—whether it is Verify or some other system—with a set of standards that require that sort of triple blindness in the matter of digital identity. As an example, I don’t think Care.data was at the same level of privacy requirements, or the public were not educated to the same extent, and so on. This is both us and the environment moving forward, I think.
Sarah Healey: I think what we saw in that Care.data example—and, as John was saying, the comparison with digital identity—was that if you do not protect people’s privacy and assure them that you are protecting their privacy, as I said before, you will not meet your objective because in the end, the public will not be happy to go along with your plans. That can end up just being more of a cost.
Q95 Layla Moran: How much are we learning from countries like Estonia that are smaller, but very advanced in this area?
Sarah Healey: Certainly, my digital teams are part of a collection of countries—the D7—that kind of engage; Estonia is one. They have quite a lot of engagement and travel to Estonia, but also to other countries including Israel, to talk about what we can learn from each other. The UK is pretty good at some of this stuff.
Q96 Layla Moran: There are bad examples. India is an interesting example.
Sarah Healey: We are actually pretty good at this. We need to be careful that we do not overstate the fact that we must learn from lots of other people and not celebrate the fact that the UK does this pretty well, especially in Government.
John Manzoni: Estonia was greenfield, by the way, not brownfield, so Estonia was able to—
Q97 Layla Moran: No, I entirely appreciate that it is an entirely different level of complexity. However, one of the things they did, and I am curious to know whether it is being looked at, is that as a citizen, you can go into a Government portal and look at where your data is, who has it and who is looking at it. Are these some of the things that we are considering as part of this strategy? In terms of embedding public trust in what we are hoping to do, that seems to me the obvious place to go.
Sarah Healey: I would not rule anything out at this stage.
John Manzoni: No. In the end, they were able to build that from day 1, so it was a lot easier. We have all the problems we have just spent half an hour talking about; they are all in silos, so you might go to one bit of data—by the way, if you allow a citizen to roam across data systems once they get inside, you need to have a very high bar to get inside, and you are back to digital identity.
Chair: I wryly observe that with identity cards, it would have been possible to see how often your identity was being checked and whether it was you who was doing it.
Q98 Layla Moran: That is a whole other thing, but I suppose this comes back to the scope of what we are trying to do here. My worry about the strategy being so large is this: if you look back over the last 20 years of interventions, are we going to miss another opportunity here? How assured can we be—given that whatever taxpayers’ money goes into this strategy and into implementing it across Government is so important to the work we do—that it is actually going to deliver what it says it is?
Sarah Healey: The first thing I would say is that this is one of the reasons we want to get it right and take our time to get it right, and have such a broad, open, two-stage consultation process in developing it. I suppose the second thing I would say is that we ought to be ambitious in this area, because many of the attempts to deal with this in the past have looked at some aspects of it and not the whole picture. It is important to bring together in a single place the links between what we make available as Government data, and as open data, and how that impacts on business, and how businesses can make use of that. Yes, it is ambitious, but I don’t—
Q99 Layla Moran: Do you think that is what it is going to do differently?
Sarah Healey: That would be my intention—that this really exploits the benefit of having this looked at from a Government perspective and an economy perspective in DCMS, as never before, and alongside the work on digital. When I last worked in what was then the Department for Culture, Media and Sport, we had policy on the internet but we did not have data protection. Then we had policy on the internet but we did not have the digital economy.
We now have all these critical aspects to making the most of the availability of data, and the power of what we can do with that, all in one Department. We therefore have a real opportunity to come up with something comprehensive and holistic that can make the kind of cultural change that Ms Morris was talking about. I genuinely think that we ought to try to do that, rather than default to something a bit more low key and piecemeal that does not make that change. Are we going to be able to do it? Well, we will do everything that we can to try to make it work, and to use the resources of Government across Whitehall behind it.
Q100 Layla Moran: What levers would you like to be able to make this happen?
Sarah Healey: I don’t personally think this is all about hard leverage; I think it is about persuasion, and hearts and minds. Obviously, what would be great are some of the things that we are trying to do in the spending review in terms of creating this approach to spending. This is in the Government bit of it; I am not talking about the economy bit of it, which is sort of separate again. In the Government bit of it, if we can really crack that and raise awareness and capability on use of standards and quality, we will have made a big difference. However, it is not necessarily all about mandation and forcing people to fill in forms or go through gateways. That only does part of the job.
John Manzoni: I think this vexed problem and question of digital identity for citizens is an important aspect. However we, crabwise, make our way towards that, I think that is going to be an important aspect to this.
Chair: I would say, “Hear, hear” to that, but that is me editorialising and taking a policy position.
Q101 Layla Moran: None of this is going to work unless you can get the Departments not just to do it for themselves but to talk to each other while they are doing it. How seriously do you feel this is being taken, given that in the data leaders board they are sending subs rather than the permanent secretaries? How seriously are Departments themselves behind—
Q102 Chair: Mr Manzoni, last time you were at the meeting, how many permanent secretaries were there?
John Manzoni: I can’t—
Chair: Roughly. Was it any?
John Manzoni: A couple.
Chair: Out of?
John Manzoni: There were probably 18 people.
Q103 Layla Moran: Are they not seeing the opportunities, or are they just bored?
John Manzoni: The permanent secretaries are all very busy.
Sarah Healey: Very busy.
John Manzoni: As I stated at the beginning, as technology advances and the opportunities become clearer—they are becoming clearer all the time—this comes higher and higher up the agenda. It will become important to fund it because right now funding, as you say, is one of the barriers. Everything about data sharing is across a boundary, and we do not fund stuff across a boundary very easily, so that is hard. That is why we have to address the funding of this, and why the spending round is important in that. We have to deal with that in the spending round.
Q104 Layla Moran: Have you any idea how much, roughly—back of envelope—this is going to cost?
John Manzoni: I wouldn’t dream of putting a number on it.
Sarah Healey: Also, the strategy itself will have various interventions in it. The actual expenditure is largely by Departments in pursuit of their objectives.
Q105 Layla Moran: But we know from our work on this Committee that unless you have very clear governance and shared budget structures, in the end the Department is always going to find something else that is more important than doing this. Is it going to be one bid, or is it going to be lots of separate bids that you are thinking of?
John Manzoni: I think what is emerging is a pattern. I will give you the legacy IT, which we are coming at through a cyber-security lens—not through a digital lens, and not through a data lens, but through a cyber-security lens—where the centre, with all the Departments, is co-ordinating spending round awareness. The Departments will bid. The centre will be working together. The security function, in this case, and HMT will be working together, and say, “Of all these bids, we should be doing that one first, that one second and that one third.” All those bids will be coherent and consistent to address that aspect of legacy IT. Whether or not there is enough money in the system to do that, that is what is emerging, and I suspect that that will emerge here too. We live in a system—
Q106 Layla Moran: I am so sorry to keep interrupting, but who will decide the priorities of which one gets done first, second or third across all these Departments? I am seeing a big mess. Where does the buck stop? Who decides?
John Manzoni: The decision about the priority order of funding will be made between the security function, in that case, and the Treasury. That will be a discussion that is had—
Q107 Layla Moran: Yes, and that is fairly well defined in one area, but when are we talking about a massive strategy, and about one thing, where is the buck going to stop? Is it the Secretary of State for DCMS? Is it the Prime Minister?
Sarah Healey: Obviously, ultimately everything just goes up the chain in terms of accountability, but in terms of day-to-day accountability—
Q108 Layla Moran: Who is the accounting officer?
Sarah Healey: For the individual bits of expenditure in Departments there will have to be an individual accounting officer. The crucial issue is to get up-front decisions made about funding. Fundamentally, money has to belong to a Department. That is part of the system of accountability, and there is no getting around that, but if that money has been given to that Department for a purpose, which is about a project that is joint between two Departments, there is no reason why some of those problems and barriers to funding, with funding being a barrier to doing this well, should arise.
John Manzoni: Can I help here a bit? In this instance, DCMS and Sarah are acting like a function. I have lots of them in the Cabinet Office, and the functions facilitate the dialogues across all the Departments. They convene those Departments. They get them together. I will just give you the IT: all across Departments, they did the work to say, “Here are the gaps. Here are the issues.” It is a lot of work. In this instance, it is DCMS who will, with the help of the Cabinet Office and others, convene those Departments around the issues for data in Government. It is not the data strategy in the economy but, in this instance, data in Government. That is what is happening now in the centre and through the functional axis. In this case, GDS will be part of the function but DCMS will convene all of that so that we can get a coherent—
Q109 Layla Moran: And then GDS will implement whatever you come up with.
Sarah Healey: GDS will implement it when it is for GDS to implement; otherwise, it will be Departments. I think we need to not get too hung up on large sums of money being attached to the strategy as the definition of whether it is successful or not. This is about an approach. It is about a set of policies for how Departments spend their money in future. It is not going to decide on every single amount of money that any Department spends on improving its data over the next x years, because that would not be sensible.
Q110 Layla Moran: I have been in a company that has tried to do this with our own data, and there is an initial cost in the set-up of the structure and the architecture on which everything gets built after that. We do not have an architecture, as far as I am aware. There isn’t a Government-level architecture that we are building this stuff on. That will require an investment that cannot sit in any one Department. To build that architecture, it has to be somewhere else, so who would be the budget holder for something like that?
John Manzoni: But it may be about standards and APIs, not fundamental architecturing.
Sarah Healey: Yes, I think that’s right.
John Manzoni: It may be about standards and APIs to get the data, not rebuilding all the legacy IT systems.
Q111 Layla Moran: Okay. What happens, when you have done these lovely standards—I genuinely believe that you are going to do a great job on those—if you have a Department that goes, “No. Doesn’t work for us. We’re going to do something else.”? What levers do you have to ensure that they do it? The thing is, if one Department gets—
Chair: It is the same question, Mr Manzoni, every time.
Layla Moran: It is a contagion, isn’t it? The point is that if you have some bad data in one Department and we are going to build this system that talks across the whole of Government, bad data becomes a contagion.
Sarah Healey: Can I say two things? First of all, we are not rebuilding the whole of legacy IT across the whole of Government via this strategy.
Layla Moran: Not immediately, but over 20 years.
Sarah Healey: Yes, via this strategy. It is not one shot, rebuilding the whole thing now—this is the plan for it, otherwise it is never going to happen.
Secondly, we always have the challenge of the balance between the benefits of individual departmental accountability and the risk that it means you cannot take a single cross-departmental approach. You find a kind of reconciliation between those two—it is the only way to do this. We designed Government to be a single authority and a single Department, and that produced a whole lot of other problems, because of the scale of what it was doing. We work with what we have and with the world that we are in; and the world that we are in has individual Department responsibility and accountability, and central co-ordination and strategic direction setting.
In the kind of instance that you are talking about, my expectation is that we have got the Treasury, and the Cabinet Office in its central IT function, on board enough that if a Department said, “For whatever reason I have personally, I am not going to do anything to do with your standard setting,” they would be challenged on that. Ultimately, the challenge would be at a political level, and they would be asked to change their approach. We cannot force it.
Q112 Chair: That would be serious enough to go up to politicians, do you think?
Sarah Healey: If it was a big system.
John Manzoni: The digital identity has.
Sarah Healey: If it was going to seriously undermine the delivery of a cross-Government, collectively agreed strategy, it would be only right. This will be a document that is collectively agreed by Ministers at Cabinet level, so one would therefore expect that Cabinet Ministers would abide by it.
Q113 Layla Moran: I have one final question about what we can expect when this strategy comes out. Will it have a clear objective about what we are aiming for? Is that the idea?
Chair: A vision.
Layla Moran: Yes. Is it a vision for 20 or 30 years? What timeframe are we looking at for the longevity of this document?
Sarah Healey: We will create a vision that we think we can deliver and stand behind.
Q114 Layla Moran: In what time period?
Sarah Healey: That depends on the evidence that we gather and the work that we do on what that ambition looks like. Clearly, we will want to make it a deliverable but ambitious vision.
Q115 Gareth Snell: This is a slight aside, but it links to Ms Moran’s line of questioning. All too often we hear in this Committee that where strategies lead to some form of change in Government function, software or processes inevitably end up changing and Government has to bring in an external provider to help rewrite software or design something new from scratch in order to meet those objectives. Normally, either I or Sir Geoffrey ask how Government will protect its intellectual property. Given that this will potentially be a huge new piece of bespoke software to manage data across Government—taxpayer money will be going in, and external suppliers will potentially come in to assist—how will Government protect its intellectual property as it develops this?
John Manzoni: I can’t imagine this will end up in one piece of massive software. I really don’t think that. Inside Government, this will look more like sets of standards. There is cultural change and behavioural change, and possibly legal change, but there are predominantly sets of standards that are progressively covering all aspects of data. It will certainly solve it for the new stuff. Progressively, as we invest out of legacy systems, the data that is currently sitting in one old legacy system on a particular Department’s service can be fixed against the new standards, which means that it is interoperable with everything else in Government. It will look a bit more like that than one big system.
Q116 Gareth Snell: So even if it is not one big system but a series of smaller subsystems inside each Department, you are confident that the existing software infrastructure is already in place to deal with meeting those new standards and manage the data.
John Manzoni: If it isn’t already, it needs to be fixed.
Q117 Gareth Snell: Who is going to develop that software with you? Who will develop that technology with you to allow you to meet those standards across each Department in a way that is interoperable?
John Manzoni: We use many providers, but increasingly we are doing a lot more of it ourselves. That is what has happened in the last five to seven years, because they are not big boxes any more; they are digital programming. I do not see the suppliers changing much. Where we need suppliers, we will be contracting them. Where we are building it ourselves, we will be building it ourselves. The truth is that we will need the standards to catch up, because we know they are not where they should be. There are a lot of them to do, and we need to catch that up and accelerate it.
That is how I see that happening. It will be the normal course of business, because it will prove too expensive to go in and invest to fix it all. We will have to get there progressively.
Sarah Healey: I do not think that it is necessarily a good use of resources, or possible, that you would successfully manage to change all those systems at the same time—certainly not with one big system, which, to me, seems fraught with risk. As John says, this is about an approach and a set of standards, and ensuring that those are applied in individual cases where Departments are making those kinds of reforms.
Q118 Sir Geoffrey Clifton-Brown: Mr Manzoni, an event usually takes place that enables a company to think about changing its entire systems—a company takeover, for example. We are about to experience such an event in Government, and it is called Brexit. Is there not a real case for investing a significant amount of money now to get the very latest systems in place, so that when we design new systems for the UK only—rather than relying on the EU, which was previously 28 countries—we are on the very latest system rather than on some old-fashioned system, and we do not have to go around and do it all over again in five or 10 years’ time?
John Manzoni: There are many systems. A number are being built, as you say, to replace what used to be—for example, TRACES and the chemicals database.
Sir Geoffrey Clifton-Brown: CDS.
John Manzoni: Right. Those are being done in a new and digital way. Those have all been built. If you just stand back from this, three years ago we might have done a blueprint, gone out to market and asked somebody to build it, but we have not done any of that. They have all been built in an agile digital way and are already modern. As you know, we are actually running CDS and CHIEF in parallel, but over time, as we get more confident in that—CDS has been built in a digital way, so they are digital systems. They are not old fashioned.
Q119 Sir Geoffrey Clifton-Brown: Is a new way of doing this emerging in Government? Increasingly, as with CDS, the Government are specifying systems rather than going out and getting some hugely expensive tailor-made system. Medical records are an example of that—huge amounts of money were spent.
John Manzoni: I really believe that four years ago we would have done a blueprint, tendered it and got IBM or someone to build it. We would have done it in a very different way. They are not perfect, but for that event, we have built those systems.
I do not think that all the data standards have yet caught up, so there is probably a bit of work to do there, but those systems have been built in a new way. When you stand back from the heat of the battle in Brexit, you say, “Well actually, that is pretty good; we have built quite a lot of systems in a very new way.”
Q120 Sir Geoffrey Clifton-Brown: You did not really answer my question. Would it would be good to put a lot of investment into it now so that we have the system design, and when we make a new system for chemical registration, for example, which we will have to do in the near future, we have the absolute latest and most up-to-date system designed for it, rather than doing it on some ad-hoc system and coming back to do it again in five years?
John Manzoni: No, every one of those is being built to the digital service standards and the technology code of practice. We have spent the best part of £2 billion building this stuff for Brexit, as you know—not all on the IT, but across the system. They are being built to the digital service standards and the technology code of practice. They meet those standards. Most of them are certainly meeting those standards. I do not know whether every one of them does, but they are being built to those standards.
Q121 Chair: Thank you very much indeed for your time. I mentioned at the beginning that Ms Healey had just been appointed to permanent secretary. It is interesting to note, Ms Healey, that you are the 40th ever female permanent secretary.
Sarah Healey: I am actually the 39th. Tamara Finkelstein is the 40th.
Chair: Oh, she was after you. I got you in the wrong order.
Sarah Healey: I looked up comparisons of various 39ths of things, and they seem less exciting than the 40ths, so I am a bit dispirited.
Chair: It is quite shocking. We in Parliament think that we are bad, but in the 64 years since 1955 there have been only 40 women permanent secretaries in the civil service.
John Manzoni: But they have all been really good, haven’t they?
Chair: Mr Manzoni, compliments will get you anywhere, but action would be better. It is great to see Ms Healey and Tamara Finkelstein there, but we hope to see more women. It would be good to see some people who are not white, too, but that is another challenge for another day. Thank you very much for your time. The uncorrected transcript will be up on the website in the next couple of days, and our report will be out at some point during the autumn, to use a civil service term.