I beg to move amendment 6, in clause 12, page 7, line 29, after “security” insert “and provide safeguards against hacking”.

This amendment clarifies that smart charge points must have measures in place to safeguard against the risk of being hacked.

With this it will be convenient to discuss new clause 19—Cyber Security and hacking of electric vehicle charge points—

“The Secretary of State must, within 12 months of this Act receiving Royal Assent, consult with such persons as the Secretary of State considers appropriate on what steps will be required for the effective cyber security of electric vehicle charge points to protect those charge points against hacking.”

This new clause would require the Secretary of State to report within 12 months what steps would be required to protect electric vehicle charge points against hacking.

Amendment 6 and new clause 19 address the issue of cyber security and hacking in relation to charging points. A lot of what we covered this morning applies to the amendment and the new clause, so I do not want to repeat what has already been said. Any element of data, digital infrastructure or digital function is incredibly valuable and increasingly involves a risk of being hacked. The data infrastructure and digital function behind the charging infrastructure and its interface with electric and automated vehicles are no different. We need to address cyber-security and data protection in relation to all these areas, including charge points.

Amendment 6 relates to charge point cyber security. Clause 12 contains a range of non-exhaustive specifications —we discussed them a few minutes ago—that a charge point must comply with. It appears that will involve a large amount of data being transmitted from the charge point. Measures are therefore needed to ensure that charge points and the data they process are protected against attempts at hacking. I think that is what the Government are getting at in subsection 2(e). Will the Minister clarify whether that provision also covers cyber security and the risk of hacking? I also invite him to clarify who the information that clause 12 refers to is to be shared with and where.

We need safeguards. It is not beyond the realms of possibility that if the safeguards are not in place, information could be downloaded from an electric or automated vehicle being serviced that would allow hackers to obtain information or—perhaps worse—control safety-critical elements of the vehicle’s functions.

On new clause 19, I will not repeat the points made this morning, but I would be grateful if the Minister could indicate what work has already been done. I am aware that a great deal of work is being done behind the scenes, but it would assist us to know who specifically his Department is consulting.

In this useful dialogue we have got to the point of agreeing that it is necessary to have the information flow back to NGC, and that clause 11 does not provide for that to be mandated. The Minister ended his remarks on clause 11 by saying that clause 12 does allow the Secretary of State to mandate the provision of that information by charge points to the National Grid Company.

I said that I did not read clause 12 the way the Minister does, and that is because I suffer from this problem of reading the thing as if it were in English and I were a speaker of English. Let me illustrate to the Minister why a normal reader of English would not take clause 12(1) and (2), as currently constructed, to have the effect he is describing. If he can then explain to me why a lawyer reading it in some other language believes that it will have that effect, I will gracefully and happily give way, because I have no desire to engage in unnecessary redrafting.

In English then, clause 12(1) states:

“Regulations may provide that a person must not sell or install a charge point unless it complies with prescribed requirements.”

That is entirely about the design of the charge points; it says nothing about the provision of information. It is perfectly true that clause 12(2), again in English, states in the governing phrase:

“The requirements that may be imposed under subsection (1) include requirements relating to the technical specifications—”.

It then gives some examples—I take the point that this is not an exhaustive list—which do include, in clause 12(2)(g), the capability of the machine in question to be “accessed remotely” and, in clause 12(2)(a),

“to receive and process information provided by a prescribed person” and even more appositely, in clause 12(2)(c),

“to transmit information…to a prescribed person”.

I accept that clause 12 is drafted in such a way that, when read in English, it would enable the Minister to pass a regulation stating that the charge point in question must be designed to have the capacity to transmit information to the prescribed person—namely, the NGC, if the Minister prescribed that. I accept all that, but having a machine with the capacity to transmit certain information does not entail the person who has the machine in their possession actually transmitting or allowing the transmission of the data in question.

There is nothing here in English that gives the Minister the power to mandate that the person who owns or supplies the relevant charge point has to allow the transmission of those data. I know of no obvious principle of jurisprudence that would mean that having a machine of a certain capacity means that it has to be used in a way that lives up to that capacity. It would indeed be strange if there were such a thing, because there are many instances in which people have things with capacities that are lawful, or even mandated, without having the obligation to use them in that way.

If the Minister can explain why enforcing a rule that the charge point has the capacity to deliver the relevant information to the NGC will automatically entail the machines all doing that, I will be delighted and I shall stop inquiring about it. If he cannot, this clearly needs some adjustment so that he has the further power to mandate the flow of data and not just the capacity of the relevant equipment to transmit such data.

Let me deal first with the shadow Minister’s comments about cyber security. I am grateful for his brevity, because we dealt with this at length in your absence this morning, Sir Edward. The Government take cyber security very seriously, and the shadow Minister is right that we need to be mindful of the risks associated with malevolent activity, including, as he described it, the hacking of software and other matters. It is important that in the Bill the Government take account of the requirements relating to security, and I simply say to him that they do. If he looks at clause 12(2)(e), we specifically speak of complying with “requirements relating to security”. It is right that information should be shared with those persons who are prescribed in regulations. That would include security measures and, by the way, might also include the National Grid. We are taking powers in the Bill to ensure that information will be made available in the interests of ensuring security.

I turn to the remarks made by my right hon. Friend the Member for West Dorset about whether clause 12 is sufficient to provide the mechanism that I described earlier and the information that he sought in his speech—this is about creating greater clarity over electricity supply and demand, as he described it, and I will not repeat what he said for the sake of time. I am advised that that is the case, but I am inclined to reflect and write to the Committee. It may be, as with our earlier considerations, that in doing so I am able to satisfy him. When we were debating clause 1, he made the point that the wording of the Bill was not sufficient to make clear its full extent, and I think my supplementary letter helped to clarify that. I suggest that I might do that again, which will allow us to make more rapid progress. I know that will please the whole Committee, and not least you, Sir Edward.

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 12 ordered to stand part of the Bill.

Clauses 13 and 14 ordered to stand part of the Bill.

Clause 15