While HMG has not issued a formal, comprehensive assessment of the Social Market Foundation's July 2024 report, Clearing the Air, its findings remain highly pertinent to ongoing digital market regulatory efforts.

This report was submitted as evidence to the Competition and Markets Authority (CMA) to support its in-depth investigation into competition within the UK's public cloud infrastructure services market. These insights are currently being reviewed to help shape future public sector commercial practices and guidance.

Furthermore, public sector procurement continues to align with the Digital, Data and Technology (DDaT) Playbook. The playbook establishes essential policy reforms aimed at safeguarding against vendor lock-in and maximizing value for money.

The Competition and Markets Authority (CMA) is responsible for gathering evidence relevant to its Strategic Market Status investigations and engages with a wide range of stakeholders. Government departments will assist the CMA as far as possible where the CMA requests that they do so, including providing evidence to the CMA where appropriate.

The Competition and Markets Authority is responsible for operating the digital markets regime. The length of Strategic Market Status investigations can vary due to a number of factors but must be completed within the statutory time limits imposed by the Digital Markets, Competition and Consumers Act 2025. The CMA has stated its intention to publish a roadmap.

The Competition and Markets Authority is responsible for operating the digital markets regime, including when to implement any conduct requirements. The Digital Markets, Competition and Consumers Act 2024 does not prevent the CMA from designing remedies in parallel with Strategic Market Status investigations.

The CMA expects to publish its final decision report on the Strategic Market Status investigation into Microsoft’s business software by February 2027. The CMA has already taken action in the cloud market outside of the investigation and secured voluntary commitments from Amazon and Microsoft, which will improve interoperability, reduce data egress fees and make switching easier in cloud services.

I thank the noble Lord for that question. The Government are actively looking at options to address nudification tools, and we hope to provide an update shortly. It is a matter that we take seriously. If such tools are used to create child sexual abuse material, UK law is clear that creating, possessing or distributing child sexual abuse images, including those generated using nudification tools, is already illegal, regardless of whether it depicts a real child or not.

The Competition and Markets Authority (CMA) has indicated in its provisional Cloud Services report that it will recommend to its Board prioritising Strategic Market Status (SMS) investigations into Amazon Web Services and Microsoft. Decisions on which SMS investigations to launch are for the CMA, as the UK's independent competition authority. The Government will consider any additional recommendations made by the CMA in its final report, which is not expected until Summer 2025.

We are committed to taking action to protect businesses and users from the potential harms associated with substantial and enduring market power in digital platform markets.

Earlier this year, we accepted all the strategic recommendations of the Furman Review and established the cross-regulator Digital Markets Taskforce to advise on the design and implementation of a new pro-competition regime for digital markets.

On 27 November we confirmed the establishment of a new pro-competition regime for tech giants. A Digital Markets Unit (DMU), housed in the Competition and Markets Authority, will be set up to begin to operationalise the new regime. It will work closely with key regulators, including the ICO and Ofcom, to ensure that the new regime is effective and coherent. The Taskforce has advised us that the DMU should prioritise firms active in particular activities, including app stores. We will consider the expert advice and respond in due course. Government will legislate to put the DMU on a statutory footing as soon as parliamentary time allows, following consultation in early 2021.

The Isle of Wight phase is intended to improve our understanding of how the different components of our COVID-19 response fit together and how parts of the healthcare system interact with each other. It is also an opportunity to test that the underlying technologies and systems work. Our evaluation of the Isle of Wight phase is designed to provide us with answers on the health behaviours of people who use the app and those who do not, the attitude of individuals to the contact tracing app and their experience of using it, how successfully the app fits in to the wider health service processes, and the app’s influence on wider health seeking behaviours. The Ethics Advisory Board is an advisory body and does not approve documentation. Notwithstanding, and in the interests of transparency, an early version of our evaluation questions was shared with them for advice and constructive challenge.

The Ethics Advisory Board (EAB) of the National Health Service COVID-19 app published a letter to the Secretary of State on 24 April which sets out its thinking on the COVID-19 contact tracing application.

In its letter, the EAB sets out six principles that must be upheld to ensure the NHS COVID-19 app achieves that balance. Given the importance of securing and maintaining public trust around this issue, these principles are based around maintaining public trust in the use of data; they include ensuring value, impact, security, accountability, transparency and control.

These principles have been accepted by the Secretary of State and the Board will continue to meet regularly to provide its advice on the app’s progress.

The advice and expertise of the Ethics Advisory Board (EAB) is crucial to everything we do and will continue to guide development of the app by identifying, defining, and examining the key ethical considerations, including consideration of the interests of citizens. Their advice will extend to policies and other documents under development by NHSX on the contact tracing application. This will be provided regularly and formally to the App Oversight Board. Advice may be both on questions set by the App Oversight Board, as well as issues which the EAB has proactively identified. This may include verbal advice as well as tabled papers. Minutes from EAB meetings will be published periodically and board members originating from the Centre for Data Ethics and Innovation are providing direct and ongoing policy support to the App Probity Team.

The NHSX COVID-19 contract tracing application is considered Class IIa under the Medical Devices Regulations (2002).

The legal requirements relating to clinical investigations are set out in the Medical Devices Regulations 2002 (section 16 and section 29) and the Medical Devices Directive (Annexes VIII and X).

A clinical investigation of a non-CE-marked device must be designed to establish that the performance claimed by the manufacturer can be adequately demonstrated, and that the device is judged to be safe to use on patients taking into account any risks associated with the use of the device when weighed against the expected benefits.

The Medicines and Healthcare products Regulatory Agency reviewed an application made by NHSX and authorised the supply of the non-CE-marked NHSX COVID-19 contact tracing app for a pilot on the Isle of Wight in the interests of the protection of public health under Regulation 12(5) of the Medical Devices Regulations 2002.

The Ethics Advisory Board (EAB) is an advisory body and does not approve documentation. Notwithstanding, and in the interests of transparency, an early draft of the Data Protection Impact Assessment (DPIA) was shared with the EAB on 29 April and subsequently developed.

Further DPIAs will meet the best practice guidance set out by the Information Commissioner’s Office and will be iterated for every stage of the rollout.

My Lords, it is not a go-it-alone app; others are following our lead on this. It is interoperable, and we are working with other countries to make sure it is. Testing with the public has turned out to be extremely positive and we look forward to publishing the audit shortly.

My Lords, we have put privacy at the heart of the app and the way it works. It is designed so that you do not have to give up your personal details to use it. We have worked in partnership with both the National Cyber Security Centre and the Information Commissioner’s Office throughout. We continue to hold discussions with Apple and Google. The app uses only software development tools and mechanisms that are supported by Apple and Google.