Protection and Disclosure of Personal Information (Amendment) Regulations 2025

Considered in Grand Committee

16:41:00

Moved by

That the Grand Committee do consider the Protection and Disclosure of Personal Information (Amendment) Regulations 2025.

My Lords, these regulations were laid before the House on 14 May and form part of the programme to implement the Economic Crime and Corporate Transparency Act 2023. This Government remain committed to fighting economic crime while ensuring that our country maintains its reputation as a place where legitimate businesses can thrive. These objectives are supported by the reforms within the 2023 Act. Much progress on these reforms has already been made, and implementation of the Act continues at pace. This instrument forms part of the next phase of reforms. It remains a key principle that those who are running and controlling companies should have their details publicly registered. This ensures that it is transparent to the public who those people are and that they can be held accountable for the company’s affairs. However, having personal information on the public companies register can put individuals at increased risk of harm, including fraud and identity theft and for other reasons such as in cases of domestic abuse. This instrument therefore aims to strike the right balance between transparency and privacy, ensuring that the register does not become a tool for wrongdoing. At the moment, individuals can already apply in certain limited cases to protect their residential address from the public register. Protection means that the registrar cannot display the address publicly. However, Companies House still retains the address and can share it with law enforcement and others who have functions of a public nature, if appropriate. This instrument delivers the second of several reforms to enhance the protection of personal information on the register. It builds on regulations that came into force on 27 January. Members of this House might recall that this previous statutory instrument expanded the circumstances in which an individual can apply to protect their residential address from the public register. This new instrument will further expand the protection regime, allowing individuals to apply to protect their signature, business occupation and date of birth. It will also allow applications to protect a residential address where it is not already possible to do so, with the exception of certain charge-related filings and company names. The exceptions here reflect the consequential impacts that protecting information from those filings would have, given that their transparency is key for due diligence purposes. The Government will keep this under review.

16:45:00

These reforms will help encourage enterprise and entrepreneurship, as prospective directors will have greater confidence that their personal information will be safeguarded should they decide to start a company or take up an appointment as a director. The instrument also removes the requirement for certain community interest company documents and statements of solvency to be signed. This will allow for a wider range of authentication methods, such as a printed name, which will help reduce the number of signatures on the register; in turn, this will reduce the risk of identity theft and other fraud.

Further, the regulations remove the requirement for directors of overseas companies to provide a business occupation. This aligns with the 2023 Act’s removal of the requirement for UK company directors to provide their business occupation and, therefore, establishes a consistent approach across different entities. The regulations also expand the grounds on which a person with significant control over a company—a PSC—can make an application to request that the registrar refrains from disclosing their usual residential address to a credit reference agency. Currently, a PSC cannot make such an application if the risk of harm arises in consequence of, for example, being a partner of a limited partnership. These regulations address this anomaly.

This instrument makes other minor amendments to secondary legislation relating to PSCs, which are applied to limited liability partnerships—LLPs—and eligible Scottish partnerships. It also applies the changes it makes to company law to the law governing LLPs and unregistered companies; the latter includes companies formed by royal charter, for example. This ensures that the framework for other entities keeps in step with that for companies.

In conclusion, these new regulations form a vital part of the effective implementation of the 2023 Act, striking the right balance between transparency and privacy. I hope that noble Lords will support them, and I beg to move.

My Lords, first, I declare my interest as the author of company law textbooks and the occasional lecture on company law. I thank the Minister for setting out the intent of these regulations with notable clarity. I should say at the outset that I have no problem with these regulations except that, I would argue, they probably do not go far enough. Surely it is right and consistent with the intention of the Economic Crime and Corporate Transparency Act that we enact these regulations. I wholly approve of the protection of the residential addresses of those people who may be the subject of fraud and identity theft; that seems very sensible. My questions to the Minister are twofold. In what limited circumstances will it be thought necessary to display the residential address, based on the points made by the Minister? Also, given that they are so few—if, indeed, there are any—should it not be the case that we simply do not show residential addresses? Based on the fact that Companies House will hold them anyway, the default position should therefore be that they are not shown, rather than that they are shown, and it should not depend on individuals applying through this process for them not to be shown. Natural inertia means that some people just will not do it. It seems to me that the reverse presumption would be sensible. I have just two further brief points. The first relates to how Companies House will publicise this procedure so that people are aware of it if we are to go down this route. Secondly, how long is the application procedure likely to take? In the meantime, the address will be there, and the potential for corporate fraud and identity theft will be present. With that, I am otherwise happy with these regulations.

My Lords, I thank the noble Lord, Lord Leong, for introducing this statutory instrument, which is part of a secondary legislation programme implementing the reforms of the Economic Crime and Corporate Transparency Act 2023. Combating economic crimes is a top priority for all noble Lords, and it is essential that we support our UK businesses to thrive and contribute to economic growth. His Majesty’s Official Opposition recognise that registering personal information of individuals, including their residential addresses, can lead to them being subject to an increased risk of fraud, identity theft and stalking. Currently, a director of a UK company or members of a UK limited liability partnership are able to apply to Companies House to prevent their residential address being displayed on the public register or disclosed to credit reference agencies. Aside from that, it is possible for an individual to protect their residential address from the public only in certain limited circumstances. The statutory instrument introduced today will bring in additional measures to enhance the protection of personal information on the register. It builds on regulations that came into force earlier this year and will expand the circumstances in which an individual can protect their residential address. This instrument also adds to the existing address protection regime by allowing for the protection of an individual’s signature, business occupation and date of birth. Under the legislation, any individual would be able to apply to suppress their residential address from public view, unless it is also the registered office address of an active company or part of the company’s name. The instrument will also remove the requirement for certain community interest company documents and statements of solvency to be signed, and the requirement for directors of overseas companies to provide a business occupation. It expands the grounds on which people with significant control can make an application to request the registrar to refrain from disclosing their residential address to a credit reference agency, as well as making other minor amendments to secondary legislation relating to PSCs, which are applied to limited liability partnerships and eligible Scottish partnerships. His Majesty’s Official Opposition support the measures being introduced. We recognise that having personal information on the company’s register brings an increased risk to exposed individuals, and we are pleased that today’s reforms will bring in protections for personal information on the public registers held by Companies House.

My Lords, I am grateful to the noble Lord, Lord Bourne of Aberystwyth, and the noble Earl, Lord Effingham, for their contributions. I will respond to some of the points raised by the noble Lord, Lord Bourne, and I need to declare an interest: I was the publisher of his major textbook, Bourne on Company Law, and I have known the noble Lord for several decades now. I can say with great pride that his book sold many copies. The noble Lord’s point about residential addresses is very important. We need to address two points here. When a company is live, it needs a registered address. If the registered address is the residential address of the director, it has to be shown unless an alternative address is shown as the registered address. That is something of which directors need to be mindful when they use their residential address as the registered address. Secondly, where there is a charge on a company, the director’s residential address may appear on the public record so that people know what property is being held as security for the charge. It is important that we ensure transparency in what is being displayed publicly. At the same time, we have to be mindful that we need certain protections, and these regulations support that as well. The noble Lord, Lord Bourne, also asked how Companies House is sharing or marketing what it is doing. Since the last regulations, Companies House has been emailing every director on its register to inform them of the new regulations coming into place. The last one is on identification, verification and all that, and it has tremendous support. I do not have the statistics in front of me, but Companies House has cleaned up a lot of the register and removed tens of thousands of names, as well as “fraudulent” companies, from the register. This is the next step in cleaning up the Companies House data. This is an ongoing process and there will be further regulations to clean up the database. Eventually, within the allocated five-year clean-up period, we hope that what we will have on the database will be up to date and relevant. In summary, today’s debate has once more showed that it is vital that we get the reforms within the 2023 Act right. These regulations are another step towards that goal and ensure the right balance between transparency and privacy.

Motion agreed.