Railways Bill (Fourteenth sitting)
Before I respond to that, Mr Western, is this my last opportunity to speak in the Committee?
Showing every spoken contribution, including 5,731 under 12 words. Hide short remarks
- Hansard source
- Hansard source
Railways Bill (Fourteenth sitting)
In that case, these are all straightforward ancillary parts to the Bill, and I have no comments to make. Question put and agreed to. Clause 89 ordered to stand part of the Bill. Clause 90 General interpretation Amendments made: 200, in clause 90, page 53, line 12, at end insert— “‘Passenger Transport Executive for an integrated transport area’ means a body which is the Passenger Transport Executive for an integrated transport area for the purposes of Part 2 of the Transport Act 1968;” This amendment defines Passenger transport executive for an integrated transport area for the purposes of the Bill. Amendment 263, in clause 90, page 53, line 31, at end insert “, except in relation to the expression ‘wholly owned by the Crown’ (as to which see section 151(2) of the Railways Act 1993)”. —(Keir Mather.) This amendment provides for the meaning in the Bill of “wholly owned by the Crown” to be that given by section 151(2) of the Railways Act 1993. Clause 90, as amended, ordered to stand part of the Bill. Clause 91 Extent Amendments made: 201, in clause 91, page 53, line 32, at end insert— “(A1) This Act extends to England and Wales and Scotland only, subject to subsections (A2) to (1). (A2) Section 86 and this Part extend also to Northern Ireland. (A3) His Majesty may by Order in Council provide for any of the provisions of section 86 and this Part, or any regulations under that section (whether made before or after the making of the Order in Council), to extend with or without modifications to the Isle of Man. (A4) The power under subsection (A3), so far as relating to regulations, includes power to provide for the regulations as amended from time to time to extend as mentioned in that subsection.” This amendment allows clause 86 and regulations under it to be extended to the Isle of Man by Order in Council. Amendment 202, in clause 91, page 53, line 35, leave out subsection (2).—(Keir Mather.) This amendment is consequential on amendment 201. Clause 91, as amended, ordered to stand part of the Bill. Clauses 92 and 93 ordered to stand part of the Bill. Question proposed, That the Chair do report the Bill, as amended, to the House.
- Hansard source
Railways Bill (Fourteenth sitting)
I am not going to suggest that we do not progress the Bill to its next stage, because I am not sure I would win that vote, but I want to take this opportunity to thank the Minister for the constructive approach that he has taken to addressing the various amendments and new clauses that the Opposition and the Liberal Democrats—I hope I can speak for them, too—have tabled. I am surprised that he did not adopt a single one of them, but he dealt with them in an unfailingly courteous and thoughtful manner, and I am very grateful to him. I am also grateful to the Chairs—including you, Mr Western—for agreeing to hold the ring, and to the Clerks, who have done an excellent job helping us to navigate a process that, for me, anyway, is just as complex and confusing at the end of the Committee’s proceedings as it was at the beginning. That must make me a very slow learner. Finally, I am grateful to all the Committee members, particularly those on the Government Benches. Having sat there myself for what felt like years, I know that it is deeply frustrating to be told by the Whips not even to intervene, let alone make a speech, while the shadow Minister expands at length. There are reasons why we do it, and I hope that those Government Members who have been on this side of Committees will remember them, but I am very grateful for the patience that they have shown me and for the work that they have done with the Committee as a whole. With that, I am happy for the Bill to progress to the next stage.
- Hansard source
Ministry of Defence: Palantir Contracts
(Urgent question): To ask the Secretary of State for Defence if he will make a statement on his Department’s contracts with Palantir.
- Hansard source
Ministry of Defence: Palantir Contracts
Thank you for granting this urgent question, Mr Speaker. Before I turn to the detail, let me say that the Mandelson scandal is truly shocking. When debating these matters, it is incumbent on all of us to remember the victims of Epstein’s crimes. Following Peter Mandelson’s sacking as US ambassador, serious questions surrounding his influence on MOD contracts have emerged, to which we have had no meaningful answers. Specifically, the MOD signed a contract with the US firm Palantir in December 2025 worth £240 million. Critically, at a time when UK defence companies are struggling for orders from their own Government, this contract did not involve a competition with British firms, and was granted to a US company by direct award. Why was that? For the record, this is not about Palantir or any other US company. From my time as the Defence Procurement Minister, I recognise the huge mutual gain to us and to our closest ally that results from our strong defence relationship. It is true that many contracts in the MOD are rightly let on a single-source basis, but this is about transparency. Above all, the question is: to what extent did Peter Mandelson and his firm Global Counsel, in which he was a controlling shareholder at the time, benefit from privileged access not available to potential UK competitors—access that was used to deliver a defence contract of some £250 million to a client of Global Counsel without competition? Regarding the meeting between the Prime Minister, Peter Mandelson and Palantir in February 2025 in Washington DC, is it true that no minutes were taken? If they were not taken, why not? Crucially, at the time of the meeting, was the Prime Minister aware that Palantir was a client of Mandelson’s firm? The Minister must answer that. In the build-up to the US state visit, we understand that Peter Mandelson lobbied the UK Government for deliverables. Will the Minister commit to publishing what those deliverables were? Did they involve any clients of Global Counsel? Finally, let me mention the actions to take. Given the public interest in this matter, will Defence Ministers follow the lead of the Health Secretary and publish all their correspondence with Peter Mandelson? In addition, in the spirit of the Humble Address, will the Government publish, as part of the Mandelson files, all relevant material relating to this contract award?
- Hansard source
Place-based Employment Support Programmes
It is a pleasure to serve under your chairmanship, Dr Murrison. I thank the hon. Member for Southport (Patrick Hurley) and congratulate him on securing this important debate. Getting people into work should be a core priority for any Government and I know Members across the House share that view. I, and the Conservative party, wholly believe that work is the best route out of poverty. Work brings independence, dignity, opportunity and the ability for people across the country to provide for themselves and their families. It gives meaning and purpose, and has real, proven mental health benefits. That is why successive Conservative Governments have put in place a lot of employment support schemes. The restart scheme was one example. Launched in 2020, it gave tailored, intensive support to jobseekers who were often in need of more support. I appreciate that the current Government recognise the challenges of joblessness and that there is a genuine desire to tackle the problem. Whether through local authorities or the private sector, there are many ways of attempting to improve employment outcomes and get people into work. There is a clear difference between broader national schemes and localised place-based approaches. It is clear that employment challenges in Carlisle, for example, are very different from those in Cardiff and that tailored, localised support can be a more effective way of helping people in those areas to gain meaningful, lasting employment. The JobsPlus scheme—started by the previous Conservative Government—is an example of that, and has been mentioned a few times already this afternoon. The scheme was inspired by the response to problems in the United States, and has been carried out in the UK through social landlords, and convened and organised by Communities that Work. These pilots were carried out in a diverse range of areas, such as Swale in Kent and Toxteth in Liverpool, as a useful road test for a scheme that would show how it would work in different parts of the country. The evaluation last autumn, written by the Institute for Employment Studies and Learning to Work, said that there had been “positive early indications that the JobsPlus model could be implemented effectively in the UK”. There is, of course, a long way to go. We hope for the success of place-based employment schemes and for each area to see an uptick in employment. There are hard-working and committed people in communities across the country who are doing their utmost to improve the life chances of others. Effective wraparound support is essential in tackling those complex barriers to work that so many of our constituents are facing in their own communities. We certainly know that a one-size-fits-all approach from Whitehall is often not the answer, and that devolving power down to local people and local decision makers can be the best way to achieve real, tangible progress and outcomes. However, we recognise that core principles apply to helping people throughout the country when they are trying to get a job. We must also guard against a postcode lottery, where some areas have a good level of support and others are, quite frankly, left behind. There is a clear balance to be struck, and I would like the Minister to explain how she will make sure that it happens. I would also be interested to hear the Minister’s view on private sector involvement. From my perspective, relying on state interventions alone does not work, and we will need to unleash private enterprise, particularly small and medium sized enterprises. One of the current problems in the British economy, and, indeed, in our jobs market, is that businesses of all sizes and in all communities do not have the confidence to hire in the current economic and regulatory environment. The Minister does not need me to repeat the impact on jobs of the Government’s decisions on things such as hiking national insurance or the Employment Rights Act 2025. I hear the impact from my constituents, and I do not believe that the Minister and others on the Government benches do not hear the same things too. A thriving economy and business confidence really is the best way to boost employment across the UK. That simply is not the case at the moment, with job vacancies down and unemployment up from 4.2% when the Government came to power in July 2024 to 5.1% today. There are 700,000 university graduates who are out of work and on benefits, and nearly 1 million NEET young people. These are sobering numbers and will impact on the constituencies and constituents of every Member in this room, across the length and breadth of the country. They impact people now, but also into their futures. Those numbers put a huge pressure on employment support programmes, and often overwhelm them. We want employers to feel comfortable in hiring people, not to impose hiring freezes because they are concerned about the state of the economy. I will briefly focus on my constituency, as others have today. I often talk in this place about the oil and gas sector and the impact that policies are having on jobs. Employment, particularly locally in north-east Scotland, is wholly reliant on the oil and gas sector. Every other sector and industry is related to it: hospitality, taxis, shops, and the housing market. Regardless of whether people support oil and gas or whether people believe in the energy transition, policies in this sector are having an impact on jobs. No other constituency in the country is seeing as many job losses in a single sector as we are across north-east Scotland. If this were happening in any other Member’s constituency, they would not be sitting silent; they would be fighting for the employment and future of their constituents. That is what I am doing, and it is what must be done if we are to ensure that place-based employment support is not needed in Aberdeenshire to the extent that it would be if the oil and gas sector were allowed to collapse. I certainly welcome robust place-based employment support, but I call on the Government to link it with broader economic changes that allow businesses to flourish and encourage them to take a chance on younger people and those currently out of work. I thank the Minister in advance for her response and the hon. Member for Southport again for securing this debate.
- Hansard source
Topical Questions
Thank you, Mr Speaker. “Our Governments seem stricken, almost delusional, in the face of onrushing disaster,” and we are seeing “arguably the most destructive industrial calamity in our nation’s history”. Those are the words of the GMB’s Scotland Secretary about the Government’s determination to tax and regulate the oil and gas sector out of business. Does the Minister agree with the words of his union friend?
- Hansard source
Energy Infrastructure Technology: Chinese Imports
17. What assessment his Department has made of the potential impact of energy infrastructure-related technologies imported from China on security.
- Hansard source
Energy Infrastructure Technology: Chinese Imports
Given reports from Norway and Denmark that Chinese-manufactured electric buses contain remote kill switch technology, and that the recent UK-China engagement appears to have delivered an embassy for the Chinese and little more than a Labubu for the United Kingdom, how can the Minister be confident that Chinese-made energy infrastructure does not pose similar national security risks? What steps is she taking to remove our reliance on Chinese-made infrastructure?
- Hansard source
Large-scale Solar Projects: Community Engagement
I do not think the Minister fully appreciates just how much communities threatened by large-scale solar up and down the country feel that they are having things done to them and not with them. The No. 1 complaint that I have heard from campaign groups represented by Stop Oversized Solar up and down the land, including some in my constituency, concerns the threat to food security. When they try to engage, they keep being given this bogus figure of 1%, but if we carry on in the direction the Government are going in, by 2035 an area the size of Greater London will be covered in solar. That is equivalent to nearly 2,000 farms capable of producing 2 billion loaves of bread. When are we going to get the truth about the threat to food security from solar?
- Hansard source
Local Power Plan
I thank the Secretary of State for prior sight of his statement. It is becoming increasingly difficult to tell whether the Secretary of State is at the Dispatch Box as the Energy Secretary or rehearsing for a future move to perhaps No. 11. Once again, he is more distracted by personal ambition than concerned about the bleak reality families are facing across the country with crippling energy bills. Today’s announcement is being sold as a bold shift of power to local communities, but cutting through the fluff, this plan does not make electricity cheaper and it does not offer value for the taxpayer. This plan does nothing to reduce wholesale prices, nothing to fix the grid connection backlog and nothing to tackle the structural costs. Instead, the Government are asking taxpayers to fund small-scale projects which, optimistically, will provide minor reductions in costs for a few local buildings while leaving families and businesses across this country still paying higher prices. There are no guarantees that the £1 billion committed through the Great British Energy scheme will deliver lower bills, no clear test of value for money and no convincing explanation of why subsidising small, piecemeal projects offers a better return for taxpayers than backing affordable, large-scale nuclear generation that would genuinely move the dial. Spread thinly across the country over several years and funnelled through yet another Whitehall-controlled body, this is not a serious intervention, but a press release masquerading as an energy strategy. Alongside the local power plan, the results of allocation round 7 this morning raise serious questions that the Secretary of State has yet to answer. In the Government’s own press release, they rely on “internal analysis” to claim that additional solar and onshore wind procured through AR7 could lower bills in the early 2030s, but that analysis has not been published. It looks only at a narrow scenario, excludes wider system costs and does not give a full picture of future bill levels. If Ministers are so confident of their figures, why will they not release the full impact assessment? What exactly is the Secretary of State hiding? AR7 also underlines the direction of travel under this Government: longer contracts, higher strike prices and greater risk locked in for bill payers. The extension of contracts for difference from 15 years to 20 years means that households will be tied into paying these costs for even longer, regardless of whether circumstances change. At the same time, the Government have relaxed planning requirements so some offshore wind projects can bid before planning consent has even been secured. All of this points to the root problem, which is that electricity prices are already too high, and the policies pursued by this Government are only pushing them higher. Doubling down on carbon taxes and loading more expensive wind and solar on to a system that is not ready risks driving up costs for both households and industry, making British business less competitive and leaving families to pick up the bill. Families are being asked to pay more, not less. Labour promised to cut energy bills by £300; instead, bills have risen by £190 since Labour came to power. That is the reality behind its rhetoric, and that is the reality every family up and down the land understands as they open their energy bills. At the centre of all this sits Great British Energy, an £8 billion taxpayer-funded quango that was meant to lower bills for everyone. So far, all we have is the promise of a highly paid chief executive, a new board and more bureaucracy. Why do we need another expensive state body to do what the market and existing institutions should already be delivering? That is the fundamental difference in approach. Our cheap power plan focuses on bringing down the underlying cost of electricity, saving the public sector and everyone else vastly more in the process, and doing so without costing taxpayers a penny. This Government are more focused on their own internal politics than on delivering the one thing people need: energy that is reliable, abundant and, above all, affordable for all our constituents.
- Hansard source
Railways Bill (Thirteenth sitting)
Will the Minister gently give way on that point?
- Hansard source
Railways Bill (Thirteenth sitting)
I gently take the Minister to task on that. Were not some of the first actions of Secretaries of State of this Government, when they came into office, to publish reports in which they—one can question how accurately—sought to look backwards over what the previous Government had done?
- Hansard source
Court Reporting Data
There is an obligation on anyone who is aware of a data breach to report it to the Information Commissioner’s Office no later than 72 hours after becoming aware of it. Can the Minister say when the MOJ was first aware of the issues relating to Courtsdesk, and when the MOJ reported those issues to the ICO?
- Hansard source
Court Reporting Data
(Urgent Question): To ask the Secretary of State for Justice if he will make a statement on the implications for open justice of the impending deletion of the Courtsdesk court reporting data archive.
- Hansard source
Court Reporting Data
Here we are again. Not even one week after this Government had to be forced to release the Mandelson files—looking out for themselves and not for victims—we are back with a Government who preach transparency and practise the opposite. The pattern is clear. They will not release migrant crime data. They fought our efforts to institute a grooming gangs inquiry every step of the way. That campaign was fuelled by journalists uncovering what was happening in our courts. What are the Government now intent on doing? Delete, delete, delete. They want to make it harder for journalists to report the truth. What is it that they are worried about? Could it be that they want to hide the fact that thousands of criminals will escape justice under their Sentencing Act 2026? Could it be that when they erode our rights to jury trials, they do not want the public to hear about the results? Can anyone draw any conclusion other than that they are determined to escape accountability for their damaging policies? The Courtsdesk project has been a huge success. Introduced by the shadow Home Secretary, it has revolutionised the transparency of our courtrooms. Courtsdesk reports that more than 1,500 journalists have used the platform. That is why so many journalists are rallying in support. What of the apparent data breach that the Government are using as an excuse for this? Have they engaged with Courtsdesk? No, they have not. There has been not one single meeting, despite multiple requests to the Minister. It is not just officialdom that is to blame. The Courts Minister has been written to by Courtsdesk and several major media organisations. She has been told directly how important this system is. This is a Minister who comes to the House and professes how vital magistrates courts are to the Government’s plans to take a sledgehammer to jury trials. She needs to tell us why she and her officials have refused even to meet Courtsdesk. What assessment have they made of the impact of this decision on open justice? Delete, delete, delete; stonewall, ignore and deflect—that is the character of this Government in their operations. We will not stand by and let them do the same in our courts.
- Hansard source
Court Reporting Data
On a point of order, Madam Deputy Speaker. We obviously benefit from enormous privilege in this House, because we are able to say things without any worry about what might happen legally. The Minister said several times in her statement that Courtsdesk has admitted that it breached the data-sharing agreement. Courtsdesk has been absolutely clear with me that it has never admitted that it breached the agreement. I wonder if the Minister might want to take the chance at least to caveat what she said in the Chamber.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
It is a pleasure to serve under your chairmanship, Dr Murrison, and it is always a pleasure to follow my hon. Friend the Member for Bognor Regis and Littlehampton. I will speak to clauses 15 and 16 and to new clauses 6 and 7, tabled in my name on behalf of His Majesty’s loyal Opposition. The previous Government stated in their consultation covering the subject of cyber-incident reporting that security breaches that did not result in a successful attack could still leave organisations open to follow-up attacks. It was identified that reporting how the breach took place would also allow regulators and other organisations to prepare for similar attacks in the future. It is therefore a welcome development that clause 15 significantly increases the scope and speed of cyber-incident reporting by regulated entities to competent authorities and the NCSC. That increase in scope is achieved by broadening the definition of reportable incidents from the current position, where only cyber-attacks having an actual adverse effect are reportable, to a position to where cyber-incidents that are capable of having an adverse effect on the operation or security of network and information systems must also be reported. The Government’s explanatory notes for the Bill state that this change in definition “is designed to include incidents that have compromised the integrity or security of a system without causing significant disruption yet, but that could have potential significant impacts in the future.” This has been broadly welcomed by industry stakeholders as a measure that should provide regulators with greater intelligence about emerging threats, leading to improved risk management and hardened resilience in their sectors. On the importance of intelligence gathering, we heard evidence from David Cook of DLA Piper and Chung Ching Kwong of the Inter-Parliamentary Alliance on China, among others, about the increasing use of prepositioning and “live off the land” technologies deployed by malicious actors. Once systems are infiltrated, attackers remain in systems, sometimes harvesting data, waiting for the moment when they can cause maximum harm and disruption. Those serious risks should be flagged to regulators wherever they are identified. Dr Sanjana Mehta of ISC2 described problems of underreporting in relation to the existing NIS regulations regime, and welcomed the principle of expanding reporting, as did Jill Broom of techUK. However, both cautioned that while some high-level factors have been provided as to the criteria indicating whether an attack should be reported, such as the number of users, impact, duration of interruption and geographical reach, what is not clear at present are the thresholds that are linked to those criteria. Those details are vital if reporting is to be successful in ensuring that regulators are kept appraised of the most serious threats. Dr Mehta summarised that concern succinctly in her comment: “In the absence of those thresholds, our concern is that regulated entities may be tempted to over-report rather than under-report, thereby creating more demand on the efforts of the regulators”. ––[Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 16, Q14.] Likewise, techUK has stated in its written briefings on the Bill that “technically any phishing email is ‘capable of’ having a significant impact if the organisation lacks adequate detection or response capabilities. This will lead to over-reporting of low-level incidents and potentially overwhelm regulators, thereby distracting attention from genuinely significant threats.” As in many aspects of the Bill, the problem is not on the principle but in the detail. We heard in oral evidence about the concerns of industry and regulators regarding the availability of suitably qualified personnel to build capacity for effective regulatory oversight. We must be alive to that important consideration in ensuring that thresholds are proportionate and risk-based. The Government have stated in their factsheets on the Bill that they intend “to introduce thresholds through secondary legislation before this measure is brought into in force” and after a period of consultation. They have also said that those thresholds will “clarify the points at which we would consider the impact of an incident to be ‘significant’, and therefore reportable to regulators”. What discussions has the Minister had to date with regulated entities and regulators about the approach to consultation on these thresholds? What is the feedback on what those organisations consider to be reporting priorities?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
I am more than happy to give way to the hon. Member for Harlow.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
The Opposition are trying to make it clear that ransomware needs to be in the scope of the reporting. It is really for the Minister to answer if he thinks there are problems with the new clause, and if so, how the Government will go about taking that forward. The widespread and highly damaging nature of ransomware attacks—which are often perpetrated by criminal groups at scale and speed—means that regulators need to have a detailed oversight of this area to prevent those attacks from being deployed more widely. Therefore, the new clause is intended to ensure that all ransomware attacks on regulated entities are reported, regardless of severity or potential severity, so that the risks are picked up. In tabling new clause 6, I am acutely aware of the existing reporting burden for regulated entities and regulators. Since tabling it, we have heard impactful evidence from Carla Baker from Palo Alto, who highlighted the number of cyber incidents and false positives that many companies encounter each day. As I said in response to an intervention, in the absence of measures brought forward by the Government to address the widespread and urgent risks presented by ransomware attacks—and as the Government themselves identify as part of the Home Office’s review—it would be proportionate to make specific reference to ransomware in the reporting requirements on regulated entities in the Bill. New clause 7 reflects the concerns of regulated bodies and industry representatives who have set out many, many times—in oral evidence and beyond—the need to ensure that reporting obligations are clear and, as far as possible, simplified across the many different incident reporting regimes that exist for providers of digital services. The new clause would compel the Secretary of State to publish an assessment of the impact of the new reporting regime on regulated entities in the Bill within 12 months of Royal Assent. Importantly, in line with the clear requests articulated by many stakeholders who gave evidence last Tuesday, it requires the Government to publish proposals for the creation of a single cyber incident reporting channel for relevant bodies.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
I thank the hon. Lady for her intervention. New clause 7 puts forward an assessment of the impact. It is not intended to make definitive changes, but to give time. I have confidence in the Government and the Minister that within 12 months—it is the kiss of death to say that one has confidence at the minute, is it not? [Laughter.] I apologise to the Minister.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
I very much take the hon. Lady’s point and the constructive spirit in which it was presented. Twelve months is a long time for the operations of Government to function, and I have faith—I will change my words—in the Government and all of their powers if they wanted to put their minds to bringing this forward. If there are concerns about the ability of the Department for Science, Innovation and Technology to take this forward, those concerns would spill over into all of the consultation requirements that have to be met to make sure that this Bill functions in the correct way. The argument on what we are debating today could swing both ways. Industry stakeholders have expressed strong concerns regarding the diverse incident reporting requirements that exist in several pieces of legislation, including UK GDPR, sector-specific regulation and the Telecommunications (Security) Act 2021. As we have already discussed, the Home Office may also bring forward guidelines for reporting ransomware incidents in future. Additional reporting requirements and procedures included in the Bill are viewed as adding a further layer of complexity to a legislative environment that is already very challenging to navigate. Stakeholders report that the current approach, with multiple different reporting procedures and platforms, increases regulatory compliance costs on businesses and detracts from the resources available to implement effective improvements in cyber-resilience. In view of that, will the Minister support this urgently needed review clause to assure industries that the Government have heard their serious and vital concerns on the matter?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
Clause 17 will amend the NIS regulations to provide a framework for regulators to impose charges on regulated entities to recover the costs incurred by them in carrying out their supervision and enforcement functions. The Government’s explanatory factsheet supporting the Bill suggests that those changes are needed to ensure that regulators are “better resourced to carry out their responsibilities.” We have heard at length from witnesses in oral evidence sessions that resourcing is a key consideration for regulators in meeting their new and expanded obligations under the Bill. The concept of our regulators’ being better funded is good. However, as with much of the Bill, the lack of detail around the regulator charging model is causing uncertainty among regulated entities that would be liable to meet the associated costs.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
Clause 18, which the Government seek to modify through amendments 14 to 18, creates new pathways for information sharing between regulators, public authorities and Government Departments. It also creates a power for NIS enforcement authorities to share information with relevant overseas authorities for specified purposes. The new regime is intended to remove gaps and ambiguities in the existing framework governing the sharing of information obtained in the course of competent authorities and the oversight role of NCSC, and to create legal certainty in this domain. In turn, it is anticipated that greater information sharing will assist with the detection of crime, enforcement activity and awareness of emerging cyber-risks and with ascertaining the effectiveness of the NIS regulations in building UK cyber-resilience. In particular, the Bill creates a new gateway to ensure that NIS regulators can share information with UK public authorities, and vice versa, as well as sharing and receiving information from organisations outside of the NIS framework, for example other regulators or bodies such as Companies House. The Bill strengthens safeguards on how information can be used once it has been shared under the NIS regulations by restricting onward disclosure. More effective information sharing will be vital for competent authorities to keep up to date with emerging risks and building resilience in their sectors, and the new measures were broadly welcomed by regulators in our oral evidence session. However, industry bodies such as techUK have called for further detail on the new information-sharing regime. What steps are the Government taking to ensure that regulators share responsibility for protecting sensitive data, and that information-sharing processes are coherent, proportionate and secure? Could the Minister elaborate on the discussions he has had with regulators on those matters, and on how secure information sharing will work in practice? Finally, on the detail of the text in Government amendment 14, proposed new paragraph (aa)(ii) refers to persons “otherwise in connection with…any other matter relating to cyber security and resilience,”. Given that this is an information-sharing power, that seems a remarkably broad “any other matter” provision. What disclosures that are not already covered in the Bill does the Minister conceive will come up in that scope? What guidance or consultation will the Minister produce to make sure that such powers are proportionate and not at risk of abuse?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
Clause 19 amends the NIS regulations and will require regulators to publish guidance on the security and instant reporting requirements of regulated sectors. In formulating their guidance, regulators are under a duty to co-ordinate and consult with other regulators to ensure consistency as far as is reasonably possible. Relevant provisions in the code of practice, to be issued by the Secretary of State under clause 36, must also be taken into account. Newly regulated entities will, no doubt, welcome proportionate guidance on meeting obligations, and existing regulated entities will appreciate any streamlining that comes from consultation between regulators and their approach. Can the Minister provide further details about whether consultation between regulators and the Secretary of State is under way on a consistent approach to regulation?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
Clause 20 grants regulators wide-ranging information-gathering powers, in relation both to regulated entities and to organisations currently outside the scope of the regulations. These new powers will be important to competent authorities in gaining access to the information necessary to consider which businesses should be designated as critical suppliers for their sectors. The Minister will remember that we had a very extensive discussion about the allocation, or otherwise, of critical suppliers. What assurance can he give that requests for information under this new clause will be exercised proportionately? That is especially relevant for SMEs, which might struggle administratively to meet broad requests for information within short deadlines. I know I will be told off by the Chair if I try to rehash the previous debate on clause 12, but one of the points I made during that debate was that the scope of what could fall under the definition of a critical supplier could, in my view, include any supplier to an operator of an essential service. Potentially, therefore, a request for information under this provision could be incredibly broad. Can the Minister give some reassurance about how this will work in practice, relating to the proportionality of data collection? The concern is that this could become a fishing or dredging exercise, rather than something that is proportionate and targeted on the most high-risk suppliers.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
Will the Minister talk through what the data exchange flow chart will look like? How will it work in practice? Will the OES proactively contact the regulator and say, “We have all these suppliers—go play”? Will the regulator contact the OES and say, “Give us a list of all your suppliers, and then we are going to start an investigation programme and decide what data we need”? What is the direction of communication in practice? Or—perhaps even worse—will the burden be on suppliers to an OES to contact the regulator and say, “Could we possibly be in scope?” How will it shake out in practice?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
The Minister has mentioned business continuity plans a second time as a justification for not going into detail on this, but the whole reason for the Government bringing in the powers in clause 12, and the designation of critical suppliers, is that there was no business continuity plan in place in the example of Synnovis. I do not see how that argument gets away from the need for clarity, for organisations that could be at risk of being in scope of being assessed and designated as a critical supplier, about what actions they have to take in response to regulation, proactively or otherwise, and the burdens on them. We have just discussed the cost of enforcement, which risks essentially becoming a cyber-security tax.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
I will come to my speech, but as we are having a debate on this point, but does the Minister’s answer not risk a gilded defensive posture being set up by MSPs? If they list terms and conditions for the use of their services that essentially bar everything, they can say that any liability—if there is ransomware or they get hacked—is completely on the client, as opposed to themselves. Does the Minister’s explanation not risk MSPs taking a very defensive posture to ensure that the client is liable for any problem? Given that the clients are usually not regulated entities, this provision effectively becomes meaningless.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
I think I will follow up in writing on my intervention to try to dig down into the explanation of how liability will be laid down when the client is not a regulated entity but is receiving services from regulated entities. That is an important point, because these are quite hefty fines. As my hon. Friend the Member for Spelthorne pointed out, even with £34 an hour lawyers, there will be a lot of industry activity to try to avoid liability in the context of a substantial cyber breach, which can be significant. More generally, the clause makes significant changes to enforcement practices under the NIS regulations, including to increase the financial penalties regulators can impose for infringement of the regulations, and to set out a clearer system of tiered penalties, based on the severity of infringements. The Government’s impact assessment states that these changes have been made because of concerns reported by regulators that “enforcement under the NIS Regulations has been constrained by unclear band structures and a maximum penalty which is insufficient to deter non-compliance across all NIS sectors”, which goes back to my previous point. Enforcement activity under the NIS regulations has been sparse, inconsistent and insufficiently effective to increase cyber-resilience to the levels necessary to meet the proliferating cyber-security risks to our most critical sectors. Fundamentally, the existing approach to enforcement has not achieved the necessary change in attitude to cyber-risk at the highest levels of regulated entities. It is concerning that board level responsibility for cyber-security has steadily declined among businesses since 2021, with 38% of businesses having a board member responsible for cyber-security in 2021, compared with 27% in 2025. The enforcement model clearly needs to be more effective, and increasing fines is only one part of that. Regulatory capacity to undertake supervision and enforcement remains a concern, as does perceived reticence on the part of regulators to impose fines on critical infrastructure providers, due to the risk of destabilising essential services and increasing costs for consumers. In our oral evidence sessions, many witnesses, including Richard Starnes of the Worshipful Company of Information Technologists, raised the issue of greater responsibility at the highest levels of management for cyber-resilience. What assessment has the Secretary of State undertaken of whether changes to the penalty regime are likely to influence board-level attitudes towards cyber-security?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Fifth sitting)
Part 3 is a very important part of the Bill. It gives the Secretary of State a range of powers, including ones to bring additional sectors into the scope of regulation, to update the NIS regulations, to publish statements of strategic priorities for regulators and to publish codes of practice that set out cyber-security measures for entities to comply with their regulatory duties. Clause 24 includes a power enabling the Secretary of State to specify new services that can be brought into the scope of the NIS regulations, and to designate additional regulatory authorities. Those powers are intended to allow the Secretary of State to identify additional critical sectors and respond to emerging threats quickly. That agility introduced by this measure has been broadly welcomed as appropriate, given the fast-evolving nature of malicious cyber-activity. Given the extent of the Secretary of State’s new powers, however, it is important to put in place guardrails to ensure that the appropriate response to emerging threats is indeed further regulation, rather than market-led or insurance-based mitigations. Can the Minister provide any further information at this stage about the procedure that will be followed in deciding whether to expand the scope of regulation to ensure consistency and transparency? Hon. Members have tabled several new clauses that would prompt the Secretary of State to use her duties under clause 24. I will speak to new clause 1, tabled by the hon. Member for Warwick and Leamington (Matt Western), and new clause 9, tabled by the hon. Member for Brecon, Radnor and Cwm Tawe, together, as they have some thematic overlap. New clause 1 seeks to bring all entities, other than small businesses and microbusinesses, in the food production, distribution and retail supply chain into the scope of regulation as operators of essential services. New clause 9 also touches on the regulation of food supply chains. It would require the Secretary of State to designate retailers of “food and essential goods (when part of a large-scale distribution chain)” and manufacturers of “critical transport equipment” as providers of essential services to be brought into the scope of regulation. Those new clauses reflect concerns about the cyber-attacks targeting the food retailers M&S and Co-op last year. New clause 9 reflects issues raised by the major attack on JLR, which cause such disruption and threatened the stability of regional jobs and supply chains. Those attacks caused significant public concern, but they would all remain out of scope after the Bill comes into effect.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
It is a pleasure to serve under your chairmanship, Mr Stringer. Clause 25 introduces a power for the Secretary of State to issue a statement of the Government’s strategic priorities in relation to the security and resilience of network and information systems with regard to essential activities. The statement will set out the responsibilities of regulators and specify objectives to secure the Government’s priorities. Competent authorities must be consulted in the drafting of the statement, and the Secretary of State must issue a report in every 12-month period on regulators’ compliance with meeting the objectives within it. The changes aim to address important challenges around consistency in the approach to regulation that were identified by the previous Government’s second post-implementation review of the NIS regulations. Importantly, the measures also provide for a regular review of competent authorities’ approach to discharging their regulatory obligations. That measure is necessary given the inconsistent approach to oversight and enforcement of the NIS regulations so far. We know that there are existing challenges relating to the capacity of competent authorities and there is the ongoing issue of securing sufficient cyber-security professionals to staff the teams. It is all well and good making statements, but they need to be followed. What strategies does the Minister anticipate will be needed and used to support—and, where necessary, drive up—standards of regulatory oversight when competent authorities fall short of the aims set out in the statement?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
The Minister is being generous with his time during this important debate. I was just thinking through his earlier response to the point made by my hon. Friend the Member for Bognor Regis and Littlehampton about using the cost reclaims to employ cyber-security professionals. That goes to the heart of the concerns about the Bill and its approach to regulation. We have heard that the industry, including regulators, is struggling to recruit cyber-security professionals. What gives the Minister confidence that, just because some money will be sloshing around in the regulators, there will be the ability to recruit cyber-security professionals, who are going to be essential to the implementation of the Bill?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
I confess, Mr Stringer, that I suspect I am also guilty of speaking a bit fast in our previous debates. I will do my best to slow down and speak in a lower tone, as I know that can also help, particularly with certain types of hearing impairment. To continue the theme of agile regulation, clause 29 enables the Secretary of State to update the NIS regulations through secondary legislation. Clause 30 enables the Secretary of State to impose requirements on regulated entities, which may include directions to take specific actions to increase cyber-resilience, to report on certain matters and to appoint a UK representative if the entity is based outside the UK. Furthermore, clause 31 specifies that the Secretary of State may direct competent authorities to undertake certain activities, including mandating functions in connection with monitoring and securing compliance with relevant requirements, investigating suspected non-compliance and mitigating the effects of non-compliance on the part of regulated entities. Clauses 32 to 35 provide for the Secretary of State to issue ancillary directions to facilitate information-gathering, investigation and enforcement activities on the part of regulators. Taken together, the clauses give the Secretary of State a strong suite of powers to respond to emerging cyber-security risks. Again, I recognise the necessity of being able to respond quickly in fast-changing circumstances. However, the Government should clearly be reporting on the Secretary of State’s exercise of the powers at regular intervals to ensure transparency. We will discuss that in due course when we come to clause 40, on the report on network and information systems legislation.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
Clause 36 provides that the Secretary of State may issue a code of practice for regulated entities to set out measures that they should take to demonstrate compliance with their duties under the NIS regulations, or any requirements imposed by the Secretary of State under clause 29. If done well, the code could be a repository of best practice, setting proportionate, consistent and effective standards for regulated industries. That will require constructive and open consultation with regulated sectors to identify the challenges facing those sectors and how best to address them. One issue that came up in oral evidence was the question of the lag between regulation making and industry adoption. David Cook of DLA Piper commented that, after laws come into effect, the process of businesses understanding where they need to get to “often requires a multi-year programme of reform.”––[Official Report, Cyber Security and Resilience (Network and Information Systems) Public Bill Committee, 3 February 2026; c. 5, Q1.] The code of practice is not envisaged to be legally binding, in the sense that a failure to comply is not of itself evidence of a failure to meet obligations under the NIS regulations or the Bill. However, clause 38 states that it would be admissible as evidence in legal proceedings so, in that sense, the code is binding in all but name. In view of that, and the fact that codes can be revoked and reissued, can the Minister provide reassurance to regulated industries that a lead-in time will be built into any requirements to allow businesses to prepare to achieve full compliance?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
For the sake of clarity on the legal status of the codes, I entirely agree with the Minister that it is important to get this right, and my understanding of codes of practice in a different area—statutory codes of practice relating to the Mental Health Act—is that case law says that deviation from the code of practice should be done only for cogent reasons. That is a pretty high bar to pass in terms of deviations. I should declare an interest as a former consultant psychiatrist and someone who operated subject to that particular code of practice. For absolute certainty, will the Minister write to the Committee and make the status very clear, along with reference to relevant case law in terms of other codes of practice? Does the clause override that jurisprudence or not? That would settle the question as the Bill goes through Parliament.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
Clause 40 requires the Secretary of State to publish a report every five years on the operation of the NIS regulations and parts 3 and 4 of the Bill. Reports should include a review of any exercise of powers under parts 3 and 4 by the Secretary of State. Given the wide-ranging powers granted to the Secretary of State under those parts, I have some sympathy for amendment 26, tabled by the hon. Member for Henley and Thame, which seeks to reduce reporting intervals from five years to three. The shadow Secretary of State, my hon. Friend the Member for Hornchurch and Upminster (Julia Lopez), raised this issue on Second Reading. She suggested that annual or biannual reviews might allow for effective parliamentary scrutiny of the NIS regulations and of the Secretary of State’s exercise of powers to respond to emerging threats. In view of the concerns voiced by the hon. Members for Henley and Thame and for Brecon, Radnor and Cwm Tawe, and by the shadow ministerial team, will the Minister explain why five-year intervals have been selected and whether the Government will look at this important issue again?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
I have two questions for the Minister. Given the impact on devolved legislation, can he confirm that the consultation will extend to devolved authorities should it impact on them? My second question is more generally on the theme of devolved authorities. Can he confirm that, as part of the publicised “reset” negotiations with the European Union, bringing Northern Ireland into scope of NIS2 regulations is totally off the table?
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
Clause 43 grants the Secretary of State powers to issue directions to regulate entities where there is a risk to national security, or where an action must be taken in the interests of national security. Directions can include requirements relating to the management of systems, the yielding of information and the removal or modification of goods and services. The Secretary of State may also require a regulated entity to engage the services of a skilled person to comply with directions issued. The Secretary of State has wide discretion to dispense with providing reasons for directions or consulting with the affected parties on the basis of national security considerations. Clause 44 clarifies that the Secretary of State’s directions under part 4 prevail if there is a conflict between those directions and another statutory requirement. The exercise of these powers by the Secretary of State could have far-reaching consequences for businesses, which may experience interruption to their commercial activities, as well as the potentially considerable time and expense in adhering to a request made on national security grounds. I have spoken on several occasions in the House and in this Committee about the critical risks posed to our cyber-security and national security by hostile state actors and their affiliates. It is, of course, right that the Secretary of State should have this power, but it should be used only in extremis. Like other extensive powers granted to the Secretary of State under part 3, it must be subject to oversight and guardrails. A report to Parliament, which may well be redacted, on the exercise of functions under part 4 will not be sufficient to ensure that this power is used proportionately. Has the Department considered introducing an obligation for the Secretary of State to report to the Intelligence and Security Committee when she exercises powers under part 4? We discussed the Chinese super-embassy earlier. Later in the Committee’s proceedings, I will talk about an Opposition new clause that would deal with that problem effectively.
- Hansard source
Cyber Security and Resilience (Network and Information Systems) Bill (Sixth sitting)
I really do not understand the Minister’s answer. If it has not been published on national security grounds, how will we know that it has been laid? The whole thing could be entirely secret. Surely it has to go to the ISC as an accountability mechanism.