Data Protection Bill [HL]

Report: 1st sitting: House of Lords
Monday 11th December 2017 Lords Chamber

Report (1st Day)

15:10

Relevant documents: 6th and 9th Reports from the Delegated Powers Committee

Amendment 1

Moved by

[Lord Ashton of Hyde]

1: After Clause 1, insert the following new Clause—
“Protection of personal data
(1) The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—(a) requiring personal data to be processed lawfully, on the basis of the data subject’s consent or another specified basis,(b) conferring rights on the data subject to obtain information about the processing of personal data, and(c) conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.(2) When carrying out functions under the GDPR, the applied GDPR and this Act, the Commissioner must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.”

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, it is with some degree of anticipation that I open the debate on the first day of Report on this Bill with amendments relating to the EU Charter of Fundamental Rights. While we have, in the great tradition of this House, managed to discuss and settle many of our differences over recent weeks while debating this legislation, it was this topic, concerning the charter, where we first found ourselves at odds, really since arguments at the other end of the Palace were sent here to tease us.

Since we last considered this matter, the European Union (Withdrawal) Bill has been making progress in the other place. On 21 November, there was an extensive debate on the future of the charter. My honourable friend the Minister of State for Justice and my honourable friend the Solicitor-General explained at length that the charter is not the original source of the rights contained within it; it was only intended to catalogue rights that already existed in EU law. Those rights, codified by the charter, came from a wide variety of sources, including the treaties, EU legislation and, indeed, case law, which recognised fundamental rights as general principles. All those substantive rights, of which the charter is a reflection not the source, will already be protected in domestic law by the European Union (Withdrawal) Bill. It is not necessary to retain the charter in order to protect such substantive rights.

Last week, on 5 December, the Government published a detailed memorandum setting out how each article of the charter will be reflected in UK law after we leave. That document explains in detail how the right to data protection is already reflected in our law. The Government are well aware of the economic benefit of ensuring that, once we have left the EU, we preserve the free flow of personal data with our main trading partners. Indeed, that is one of the guiding principles that underpins this legislation. On 7 August, when we published our statement of intent before we introduced this Bill, we set that out clearly, and we have repeated this time and again. Every amendment that noble Lords have proposed to this Bill has to be considered against that key test. Will it support or will it harm our arguments that we have wholly implemented the necessary data protection reforms to support the free flow of personal data?

There is no doubt in our minds that we have fully implemented the right to data protection in our law. No one has convincingly put forward any counter argument. None the less, our Amendment 1 is designed to provide additional reassurance on this point. Not only will it be clear in the substance of the legislation and all of the statements and announcements around the legislation; it will also be written into the Bill. This Bill exists to protect individuals with regard to the processing of personal data. Personal data must be processed lawfully. Individuals have rights, and the Information Commissioner will enforce those. The Bill does what it says on the tin.

15:15

The Government’s Amendment 1 does not confer new rights. We already have them. However, Amendment 1 should provide reassurance to noble Lords, as well as those beyond who will judge whether we have appropriate protections in place, that the UK has not just implemented EU law to the extent necessary but has gone further in legislating for a complete and total legal framework that covers all personal data processing across every sector of our economy.

I should say at the outset that, while I cannot agree to the noble Lord’s amendment, we have made significant progress in recent weeks through our discussions. I will reply to the noble Lord, Lord Stevenson, after he has spoken to his amendment, but I commit to continuing discussions after today and we may return to this at Third Reading. I beg to move.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I thank the Minister for moving his amendment and for his concluding remarks, which I will return to. I welcome this amendment, and the implication it carries that the Government have listened to the discussions we have had in the last few weeks and have moved from their initial position.

I will speak to Amendment 2, which I am delighted has also been signed by the noble Baroness, Lady Ludford. I am sure that your Lordships’ House will recognise that, in bringing forward a revised draft, we have reflected very deeply on the points made by noble and noble and learned Lords in the debate on the original amendment moved in Committee. In addition to noble Lords who spoke on that occasion, I thank the academic and practising lawyers—as well as many in industry—who have contributed to our emerging thinking on this topic. Before it was submitted to the gruelling process that happens to all amendments when they go to the Public Bill Office, I sent an earlier draft of this amendment to many Members of this House who spoke in that earlier debate. I am grateful for the comments I have received.

It is unusual to have two amendments bearing on very similar points. It is an advantage to be able to see the conflicting, and often overlapping, thinking that has gone into this. It is clear to all who have read both and thought about them that, while we are not yet in full agreement, we are very close. Indeed, I venture to suggest that there is more that unites us on this issue than divides us. What do we agree on? We both recognise that the key data protection rights currently enjoyed by citizens in the UK crucially underpin any assessment of adequacy that might need to be made by the EU post Brexit. They are crucial for the future of our successful data-handling industry. We both want the key data protection rights currently enjoyed by citizens in the UK to continue once the Bill becomes law, while the GDPR is in force, and then after Brexit—if that happens. We agree that the key question to be determined is not the exact wording of one or other but whether it is necessary for these key rights, currently enjoyed by UK citizens through Article 8 of the EU Charter of Fundamental Rights, to be expressed clearly for all to see on the face of the Bill, or whether their existence in various parts of the Bill—and in the GDPR and its recitals—is sufficient.

By putting down their own amendment on this issue, the Government seem to agree that explicit references in the Bill will be helpful, for the reasons given above. We now need to get together to find a form of words which will achieve this aim and which we can both support. I therefore agree with the noble Lord that the right thing to do is for both sides to withdraw their amendments on this issue today and for the Minister to confirm—as he has done—that the matter is of sufficient importance to be brought back for further consideration at Third Reading. If he will agree to that, I will not move my amendment when it is called.

[Baroness Ludford (LD)]

My Lords, I also welcome the fact that we are in touching distance of an agreement on this matter. I thank the Minister for bringing forward Amendment 1. However, there is a little way to go. Amendment 1 is declaratory of what is contained in the Bill, whereas Amendment 2 is rather stronger and clearer.

Embedding a general right to data protection inspired by the Charter of Fundamental Rights is not only important for UK citizens but, as we have agreed in many debates and exchanges in this House, it is crucial for unhindered data flows between the UK and the European Union if we Brexit. It is absolutely crucial for business and law enforcement to be able to exchange data and have access to EU databases, such as the Schengen Information System, Europol and so on. The Government’s review of the charter, which was also most welcome and was produced last week, says that,

“domestic courts will be required to interpret retained EU law consistently with the general principle reflected in Article 8, so far as it is possible to do so”.

Is the Minister able to elucidate what that caveat leaves out? What would not be possible?

In the Watson case, to which the Brexit Secretary was a party until he became the Brexit Secretary, the European Court of Justice found that the current UK data protection regime in relation to data retention and acquisition was incompatible with Article 8 of the charter. This demonstrated the deep importance that the European Union places on charter rights in the protection of privacy. The draft resolution that the European Parliament is due to debate and vote on this Wednesday, on the joint report on the phase 1 divorce agreement that was reached last Friday,

“underlines that it will accept a framework for the future EU-UK relationship as part of the Withdrawal Agreement only if it is in strict concordance with the following principles”,

including the,

“United Kingdom’s adherence to the standards provided by international obligations, including fundamental rights … data protection and privacy”.

So we can expect this to be a very important matter, on which there will be a spotlight in the consideration of an adequacy assessment by the European Commission, which I think we all agree it is essential to achieve.

As I said in Committee, the adequacy assessment will be wide-ranging, taking in all aspects of law and practice in the United Kingdom. Of course, this will include the law and practice in terms of national security, which at the moment—rather ironically, or perversely—are excluded under the EU treaties. Once we are outside—if we are—there will be closer examination of how privacy fares in relation to the demands of national security than there is while we are in the EU. In that context, the national security issues in the Bill, which will be further debated as well, will perhaps take on a heightened importance.

On these Benches we believe that the rights under the charter in relation to data protection should be reflected in the Bill so as to have a general right to the protection of personal data in UK law. I very much agree with the course advocated by the noble Lord, Lord Stevenson, to reflect further and to accept the Government’s offer to come forward at Third Reading with something that we could all agree on.

[Lord Pannick (CB)]

My Lords, the Minister said that Amendment 1 is designed to provide reassurance that existing EU law rights are fully protected under the Bill. I, too, welcome the Minister’s assurance that further work will be done on this amendment prior to Third Reading. I will suggest four points that need to be considered and included in this amendment.

First, subsection (1)(a) of the proposed new clause refers to the need for data “to be processed lawfully”, but it does not refer to the obligation under Article 8.2 of the charter for data also to be processed fairly. That needs to be included.

Secondly, Amendment 1 does not refer, in subsection (1)(b), to the right to have personal data rectified. Again, that right is conferred by Article 8.2 of the charter.

Thirdly, the government amendment uses weak language in subsection (2), which says that,

“the Commissioner must have regard to”,

and uses “taking account of”. The Minister will know that Article 52 imposes a much tougher standard for limitations. It is a test of necessity, which is echoed in Amendment 2 in subsection (6).

Fourthly, government Amendment 1 makes no mention of the principal of proportionality. Again, that is an important element of Article 52.1 of the Charter, which, again, is mentioned in Amendment 2.

If the objective of the government amendment is to echo the rights that are currently enjoyed under the charter, these issues need to be further considered and, I hope, can be included in the redrafted Amendment 1 that the Government will bring forward at Third Reading.

[Lord Faulks (Con)]

My Lords, I do not wish in any way to spoil the degree of harmony that appears to have grown up over these issues in Amendments 1 and 2. When I looked at both amendments, I was not convinced of the need for either. If, as the Minister rightly says, Amendment 1 does not create any new rights, given that we have a Bill of 242 pages with a number of complex provisions, it seems surprising that we need to restate the principles. Of course, if we restate them, we run into the danger of attracting the attention of the noble Lord, Lord Pannick, who can say, “If you’re going to restate the principles, you may restate them rather better”. Surely it is much more desirable to specify precisely what the Bill is intended to do in those bespoke provisions rather than resort to generality, which inevitably has imprecision.

On Amendment 2, I am not a great fan of the European Charter of Fundamental Rights. The position of the party opposite when it was first advanced was entirely correct: it should not add rights to any protection that already exists in our law. On this so-called right to protection of personal data, if an amendment is to be introduced at this rather late stage of the proceedings, surely the first question is: does it add clarity to the Bill? It does not. Does it provide better protection, doing something that is otherwise not covered by the Bill but ought to be? If that is the case, let us by all means have an appropriate amendment. Why does it not provide clarity? These provisions must ultimately be interpreted by a court, as is recognised by proposed new subsection (7) in Amendment 2, which invites the court to,

“take into account any relevant judgment, decision, declaration or advisory opinion of the … Court of Justice of the European Union; and … European Court of Human Rights”.

Interestingly, the word “must” is used rather than “may”, which is the way that Section 2 of the Human Rights Act invites courts to have regard to the jurisprudence of the Strasbourg court. So a court is going to have to try to make sense of the relevant decision judgment of the Court of Justice of the European Union or the European Court of Human Rights. The ECHR does not have quite the same system of precedent that we have, and courts have often found it difficult to distil from the jurisprudence precisely what they should or should not be following. What if there were a difference between the interpretation of the Court of Justice of the European Union and the ECHR? That would provide further difficulties for a court.

15:30

The noble Baroness, Lady Ludford, posed the question: what does “so far as it is possible to do” mean? The Minister will be invited to respond to that but presumably it means in so far as it is not inconsistent with the specific legislative provisions contained in the Bill—I do not know; the Minister may have a better answer than that. However, it seems to me that by invoking broad generalisations there is almost an admission that the Bill is not doing the proper job. It may satisfy a number of people’s understandable concerns about somehow striking the right balance between protecting personal data and allowing free access to data that is appropriate, but inserting, rather at the last minute, two general provisions of this sort does not seem to me to be making good law.

[Lord McNally (LD)]

My Lords, I follow with some trepidation my successor at the Ministry of Justice, the noble Lord, Lord Faulks. I do so because, for the three years before he took up his office, I was the Minister of State at the Ministry of Justice who had responsibility for the negotiations around the GDPR in its early stages. It is interesting that this debate reflects very much the early gestation of the GDPR. At that point, there was a very clear division between what I would describe as the Anglo-Saxon approach—which the noble Lord, Lord Faulks, has expounded—and the continental approach. I suspect that is something that has bedevilled our approach to law-making in the EU over 40 years.

The truth of the Anglo-Saxon approach is this: of course we believe in these things, and if we look here, there and everywhere we will find that they are all covered; but hold that against points made by people who have only very recently experienced the power of the state and its abuse of the law by the Stasi and others. They want a much clearer definition that can be clearly observed. Thanks mainly to the hard work of my noble friend Lady Ludford in the European Parliament, we got a GDPR that was not overprescriptive in that direction but satisfied those very real concerns. We are at the same point again in this Bill.

Of course the noble Lord, Lord Faulks, is undoubtedly right about the various guarantees found in this and other legislation, but the politician in me says that if we are to get the adequacy we want in due course, we must not—to use a phrase of an old mentor of mine, Joe Gormley—build platforms for malcontents to stand on. We must not leave in everybody’s mind the question of why they did not want this in the Bill, when it is such a clear statement of their beliefs and our beliefs.

To revert to my old job as a political adviser, my advice to the Minister is this. In doing what he has been asked to do—to withdraw the amendment—he should work with the amendment tabled by the Opposition and bring through at Third Reading something that will cover our Anglo-Saxon desire to see these things in law but also reassure in a very political way those who have genuine concerns and want to see us carry out and stand by these responsibilities.

[Lord Mackay of Clashfern (Con)]

My Lords, I find this situation slightly difficult because it looks to me as though what is wanted is to say that there is something in the charter that is not already in the Bill; otherwise it does not seem very much to the point. If it is already in the Bill, the two proposed new clauses—which are not intended to be additional but optional—are unnecessary. If it is not in the Bill, surely we should put it in the Bill and not leave it. I do not know whether I am Anglo-Saxon, Celtic or what, but I do not distinguish between these various matters. As for being political, I am not sure that I want to be that either.

I want the Bill to be as precise as it can be in a difficult area. Both the government amendment and the opposition amendment strike me as vague. I will say a few words about the opposition amendment because the government amendment, as the Minister says, is not intended to confer any new rights. That is a clear situation. Proposed new subsection (5) of the opposition amendment states:

“Restrictions on the rights of a data subject and any limitation on the exercise of the right to the protection of personal data under this section must be provided for by legislation”.


I would like to see it stopping there. I do not see how you can start to judge the legislation that has already been passed by considering whether it respects the essence of that right. If it does not, it should not have been passed as legislation.

Proposed new subsection (6) has the same effect. It states:

“Subject to the principle of proportionality, the restrictions and limitations under subsection (5)”—


these are restrictions brought in by statute, according to subsection (5)—

“may be made only if they are necessary to support a democratic society”,

and so on. I think I know where that comes from. The point is that if that is right, it should not be in the legislation. This is a requirement about the nature of the legislation which, on the theory of proposed new subsection (5), has already been passed.

It is not appropriate for the Bill to try to control legislation which, according to this, does not seem to have been passed, unless it is already in this Bill, in which case we should accept it.

[Lord Ashton of Hyde]

My Lords, I turn first to the amendment of the noble Lord, Lord Stevenson. During the course of the Bill I met the noble Lord frequently, both formally and informally. When I met him two weeks ago he told me that he was working on his Amendment 2 and he had a look of foreboding about him. He said, “Wish me luck”. I had sympathy with his position—I almost felt sorry for him—because this is a legally and constitutionally complex area. Amendment 2 reads well—it sounds attractive and has seductive packaging—but when taken out of that packaging and slotted into this Bill it is not only ineffective but damaging. It is rather like pouring diesel into a petrol engine.

The amendment makes great play of creating a new and freestanding right. Unlike the government version it is not framed within the context of the Bill. It is a wider right. Indeed, it is far wider even than article 8 of the charter. It is not constrained to the context of EU law but applies to everything. It is attractive, perhaps, but it is seriously problematic.

How is the court to interpret this new right? If this was in the context of the Human Rights Act, there is a framework within which to operate, so if a court finds primary legislation to be incompatible with a convention right, it will make a declaration of incompatibility. The Human Rights Act sets out the effect of that finding on the validity, continuing operation and enforcement of the legislation. This simply would not exist if we were to agree Amendment 2, so the consequences of any finding would be unclear. That could create legal, regulatory and economic chaos.

How would data controllers operate if they could not tell whether the apparently incompatible legislation they were operating under was still effective or not and there was no mechanism to fill any gap? What if the courts found parts of the GDPR incompatible with this new super-right? Rather than enabling the free flow of data we could be crippling it. Further, how would the courts approach other legislation in light of this new right and how would they approach other rights? Could this new right be balanced against other rights, and if so, would it carry additional weight?

Apart from these legal problems, in our view Amendment 2 is simply unnecessary. The general principles of EU law will be retained when we leave the EU by the European Union (Withdrawal) Bill for the purposes of interpretation of retained EU law. The GDPR will be retained. Indeed, this Bill firmly entrenches it in our law. The right to protection of personal information is a general principle of EU law and has been recognised as such since the 1960s. The European Union (Withdrawal) Bill requires our courts to interpret the GDPR consistently with the general principle reflected in article 8, and with retained CJEU case law so far as it is possible to do so. In that context, the jurisprudence of the CJEU will continue to have influence in much the same way as the judgment of a court in Australia might have an influence on how common legal principles should be applied.

The amendment also refers to the status of judgments of the European Court of Human Rights. This is completely unnecessary and unwelcome. Section 2 of the Human Rights Act already requires our courts to take into account relevant judgments of the Strasbourg court. If we write this here, where else must we write it? We do not want to cast doubt on our absolute and total respect for human rights on any issue, not just data protection. The Government have reaffirmed and renewed our commitment to human rights law. It is reflected through UK national law as well as in a range of domestic legislation that implements our specific obligations under UN and other international treaties, from the convention against torture to the Convention on the Rights of the Child. Of course, the principal international treaty most relevant to the UK’s human rights laws is the European Convention on Human Rights. I am happy to repeat the commitment made by my fellow Ministers in recent months that the Government are committed to respecting and remaining a party to the ECHR. There will be no weakening of our human rights protections because we are leaving the EU.

All of these issues interlink. Article 6 of the Treaty on European Union makes clear that due regard must be had to the explanations of the charter when interpreting and applying it. The explanations for article 8 of the charter confirm that the right to data protection is based on the right to respect for private life in article 8 of the ECHR. The European Court of Human Rights has confirmed that article 8 of the ECHR encompasses personal data protection.

It is easy to conclude that we are spiralling in circles on this matter, and in a sense, we are. We believe that there is simply no problem here of any substance. The right to data protection is fully implemented in our law and it is fully enforceable. Government Amendment 1 makes it clear that this is the case. While Amendment 2 seeks to do the same it trips and falls, creating confusion rather than the clarity the noble Lord is after. So I hope that he will feel able to withdraw his amendment. I wish to press government Amendment 1. As the noble Lord, Lord Pannick, said, we are seeking to provide reassurance. I said at the beginning that we would remain open for discussions on this, and if we can provide any further reassurance, taking into account some of the four points made by the noble Lord, Lord Pannick, we will do so.

The noble Baroness, Lady Ludford, gave a long explanation of why adequacy is important and some of the extra issues that will be taken into account when we have to approach an adequacy decision from the EU, including for example areas of law which at the moment are not susceptible to EU jurisdiction, such as national security. I agree completely that that will be taken into account when we go for an adequacy arrangement. That is exactly why we have tried to apply the GDPR principles to all our laws, so that we have a complete and systematic data protection regime. On that basis, I accept the four questions asked by the noble Lord, Lord Pannick. We will consider those issues in the discussions.

15:45

[Baroness Ludford]

I thank the Minister for his response. I was glad that he addressed the question of an adequacy assessment at the end of his remarks, but with respect, it is not enough—or adequate—to address an adequacy assessment only at the point of asking for it. We must lay the foundations now. I cannot see the point in storing up potential problems when we could solve the problem of the basis. We ought to do everything in that prism. We can have delightful legal discussions—it is important to get the law right—but this is also crucial to business. We have had so many representations on that point. I am sure that the Minister’s colleague, the Secretary of State for Digital, Culture, Media and Sport, is preoccupied with this question. Surely we need to front-load our response? We cannot wait until the UK applies for an adequacy assessment to be told, “Well, it’s a pity that you didn’t enshrine the principles and the essence of article 8 of the charter”. We have a chance to do that now and ensure a solid platform for requesting an adequacy assessment. I admit that I am puzzled as to why the Government would not want to do that; it is important for law enforcement as well. Why would we not want to solve that problem now, instead of finding later that we have entirely predictable problems as a result of not doing so?

[Lord Ashton of Hyde]

I completely agree with the noble Baroness. We have applied the GDPR principles to areas such as defence, national security and the intelligence services in different parts of the Bill so that when we seek an adequacy arrangement, we can say to the EU that we have arranged a comprehensive data protection regime that takes all the GDPR principles into account, including areas that are not subject to EU law. That is why, contrary to what we said in Committee, we have taken the arguments on board and tabled government Amendment 1 to provide reassurance on that exact point. We originally said that the rights under article 8 were contained in the Bill, but we are now putting further reassurance in the Bill. Other areas of the Bill, without direct effect, signpost how the Bill should be regarded.

The noble Baroness supports the amendment but would like, I think, to create a free-standing right. I have explained why we do not agree with that. Before Third Reading, we will try to seek a form of words in our amendment that provides more reassurance, so that when it comes to seeking an adequacy decision—we cannot do that until we leave the EU—there will be no doubt about what this regime provides. That would be the best way to do it, I think.

[Lord Pannick]

Does the Minister also agree that a further answer to the points made by the noble Lord, Lord Faulks, and the noble and learned Lord, Lord Mackay of Clashfern, is that it is absolutely inevitable that the detailed provisions of the Bill will be, on occasion, the subject of dispute, uncertainty and litigation, and that it would be very helpful to have a statement of principle on what is intended at the commencement of the Bill? This would not be the first time that a Bill has done that. Everybody would then know what the principles were. Of course, the Minister still needs to consider before Third Reading what that statement should be, but that is the point, as I understand it, of government Amendment 1.

[Lord McNally]

Why does the Minister feel it so necessary to push ahead with his amendment when it is quite clear that the best and most constructive way forward would be for both amendments not to be pressed to allow constructive discussion and resolution at Third Reading?

[Lord Ashton of Hyde]

Government Amendment 1 provides a basis for the discussion that we will have before Third Reading. Of course, I accept that it could be amended at that stage.

As for the remarks of the noble Lord, Lord Pannick, I will have to read my noble friend Lord Faulks’s words. I was not entirely sure that he was as supportive as the noble Lord feels, but I may have misinterpreted him.

[Lord Faulks]

My Lords—

[Lord Pannick]

As I understand them, both the noble Lord, Lord Faulks, and the noble and learned Lord, Lord Mackay, doubt the need for any amendments of this sort. I am suggesting to the Minister that there is a real need for a statement of principle—that is all.

[Lord Ashton of Hyde]

I thank the noble Lord. As I said in Committee, we too saw no need for this. The Government have moved because they are always listening and we hope that we can make this more acceptable. I will read what was said by the noble Lords, Lord Pannick and Lord McNally, and my noble friend Lord Faulks, but I would like to press my amendment so that we might have it as a basis for further discussion before Third Reading.

[Lord Stevenson of Balmacara]

My Lords, the Minister has received quite a lot of comment from around the Chamber on this and I made it clear in my opening remarks that I though the best solution was to have neither amendment. If we are to have a genuine discussion, it does not seem helpful to have in the Bill the wording which the Minister has alighted on at this stage in his conversion. It would be much better to start with a blank sheet and try to work to a common solution. I beg him to reconsider his view and withdraw his amendment; I will not press mine. We could then move to Third Reading with a clean slate.

[Lord Ashton of Hyde]

My Lords, I understand what the noble Lord is saying. This amendment has been around the houses in government; it has had many people from many departments looking at it from top to bottom. The feeling of the Government at the moment is that it is better to have something on paper as a basis for discussion. I would like to press my amendment.

15:52

Division 1

Ayes: 172

---

Conservative: 139
Crossbench: 28
Democratic Unionist Party: 1
Bishops: 1
Independent: 1
UK Independence Party: 1

Noes: 139

---

Labour: 74
Liberal Democrat: 40
Crossbench: 17
Independent: 5
Green Party: 1

16:07

Amendment 2 not moved.

Clause 6: Meaning of “public authority” and “public body”

Amendment 3

Moved by

[Baroness Chisholm of Owlpen]

3: Clause 6, page 4, leave out line 34

[Baroness Chisholm of Owlpen (Con)]

My Lords, I am pleased to be moving the Government’s technical amendments this evening, and, in particular, Amendments 3, 4 and 5 which respond to the concerns raised by the noble Baroness, Lady Royall, and others on behalf of the UK’s universities, schools and colleges. They were worried that the Bill would restrict their ability to process the data of alumni for fundraising purposes. As the noble Baroness explained in Committee, universities, schools and colleges were concerned that being badged as public authorities by Clause 6 would mean they could not rely on the legitimate interests processing condition in article 6(1)(f). This is because the final sentence of article 6(1) states:

“Point (f) … shall not apply to processing carried out by public authorities in the performance of their tasks”.


Universities also doubted whether, in the context of alumni relations, they could rely on article 6(1)(e) of the GDPR, which relates to processing necessary for the performance of a task carried out in the public interest. Although there is a good argument that any fundraising or similar activity which allows universities to improve facilities for students would be considered a “public interest” task, the Government can see why universities might doubt whether all their fundraising work would fall into that category. If universities could not rely on article 6(1)(e) or (f), they say they would be left without an obvious processing condition in situations where obtaining the data subject’s consent, at least in the GDPR sense of that term, was not a realistic option.

Government Amendments 3, 4 and 5 address these concerns by making it clear that public authorities will be treated as public authorities for data protection purposes only when they are carrying out their public tasks. To the extent that they carry out non-public tasks, they would not be defined as a public authority for the purposes of the GDPR and would not be prevented from relying on the legitimate interests processing condition.

We recognise that the amendment does not refer to universities, schools or colleges by name. This is deliberate, meaning that any public authority which is processing data for non-public functions will be able to rely on this provision. The education sector is not the only one to have these worries. I know, for example, that our museums and galleries would welcome the same degree of flexibility, and this amendment will ensure they have it. I am grateful to the noble Baroness for raising this matter and I hope these amendments will provide universities and other similar organisations with the reassurance they need.

I will not go through the remaining amendments in the group one by one, but instead pick out a few which I think may be of broader interest—for example, Amendments 145 and 146. In Committee, my noble friend Lord Hunt of Wirral was among those to express concerns about the inclusion of the term “other adverse effects” in the definition of damage in Clause 159. He asked whether this was broader than the definition in the GDPR. As I set out then, the Government’s intention in including a definition of damage in Clause 159 was to provide clarity, specifically in relation to the inclusion of distress. Clause 159 does not seek to provide a wider definition of damage than is currently provided in the GDPR; nor indeed could it.

None the less, in light of the concerns expressed by my noble friend, the Government have reconsidered this issue and decided to amend the definition to ensure that it is as clear as possible and to minimise the risk of any uncertainty such as that which concerned noble Lords. The amended definition now simply states that the reference to “non-material damage” in the GDPR includes distress. The definition of damage for the purposes of the law enforcement and intelligence services regimes is set out separately in Clause 160. Amendment 146 makes a similar change to that definition so that it is as clear as possible and no longer refers to “other adverse effects”. I beg to move.

[Lord Patel (CB)]

My Lords, I will comment on Amendments 3, 4 and 5. The Minister and the noble Baroness may well feel that I do not give up, and I agree: I do not. I of course understand clearly what the Government are trying to do with the amendment from the noble Baroness, Lady Royall of Blaisdon—that they have agreed to get that into the Bill. It is helpful to know that public bodies need to be defined as such when they are processing data for tasks that are not defined as tasks in the public interest. This opens up the possibility of their instead using legitimate interests as a legal basis under some circumstances: for example, as has already been mentioned, for universities contacting alumni for fundraising purposes.

My point is different: universities and their research activities and how that is recognised, which we discussed. Here, it is more pressing to be clear on what counts as a task in the public interest, since public bodies will need to determine which legal basis is appropriate to the processing they are undertaking in different circumstances. For example, is research conducted in universities a task in the public interest, in which case the university would be considered as a public body for the purposes of the Bill, or is it not? In the latter case the university is not a public body for research purposes, and the research is therefore conducted on the legal basis of legitimate interest.

These differences matter, particularly as the GDPR requires data controllers to be clear on the legal basis they are using. How are public bodies such as universities to make this determination? The clearest answer would be, as I indicated in Committee, that the ICO gives guidance. I understand that the Government cannot direct the ICO to give guidance, so a way needs to be found to clarify which tasks fall under the public interest basis, specifically using the example of university research to provide that clarity. I would be grateful if the Minister commented on that.

16:15

[Lord Macdonald of River Glaven (LD)]

As the Minister knows, I put my name to the amendments from the noble Baroness, Lady Royall, to which this amendment is a response. I am grateful to the Minister for meeting a group of us to discuss this issue, for bringing forward this amendment, and particularly for the clear way in which she has indicated one of its purposes, which is that when universities are not acting in the public interest in the exercise of their official functions they will be permitted and empowered to rely upon the legitimate-interest condition, which was our original concern. I believe this amendment meets that concern, and I am very grateful.

[Lord Smith of Finsbury (Non-Afl)]

My Lords, I remind the House of my interest as master of Pembroke College, Cambridge. I give a warm welcome to Amendments 3, 4 and 5, and I am grateful that Ministers have listened to the concerns of universities and colleges and very helpfully addressed them in these amendments. I know I speak also for the noble Baroness, Lady Royall, in this respect.

The two most important issues that have been of concern to universities and colleges have been, first, maintaining good relationships with alumni and the way in which that can lead to successful fundraising for universities and, secondly, the need constantly to improve what we do in outreach work to schools and the widening of participation from the broadest base of potential students to draw them into the best of our universities. In both these respects, relying on legitimate interests, as we do at the moment, is going to be extremely helpful. I very much hope that that is the Government’s understanding of the purpose and effect of the amendments.

[Lord Clement-Jones (LD)]

My Lords, I hope to be as brief as the Minister, who I thought was admirably so in introducing the government amendments. However, there are some issues that arise. I applaud the noble Baroness, Lady Royall, and others who have been so instrumental in persuading the Government on this. As the noble Lord, Lord Patel, indicated in various ways, there are ambiguities; the particular way in which the Government have chosen to amend the Bill potentially leaves a gap. I wonder, for instance, whether alumni fundraising for, say, a research institute can never be in the public interest. Is there not a possibility that it might fall outside the exemptions as a result? Perhaps the Minister can give me the correct interpretation. It is very important that this is on the record and that it is very clear what the formulation means. It would have been much more straightforward to have approached the subject directly in the Freedom of Information Act, but that is not the way the Government have chosen to help alumni fundraising in universities. In talking about universities, I should declare an interest as chairman of the council of Queen Mary University as well.

Another question arises. By and large there is nothing particularly controversial in the remainder of the amendments, but I do not quite understand why new Section 76C of the Freedom of Information Act, which was introduced in the original version of the Bill, is now being taken out by Amendment 198. Is it because Clause 127 already provides the necessary duty of confidentiality of information by the commissioner and employees of the Information Commissioner’s Office? The Minister might have given us a bit of explanation about that, which would have been extremely helpful.

Otherwise, many of the other provisions are welcome. Amendments 119, 182 and 197 demonstrate that it would be a good idea to have prompt enactment or implementation of legislation, so that weird and wonderful new clauses such as are introduced by those amendments would be unnecessary.

[Lord Kennedy of Southwark (Lab Co-op)]

My Lords, I thank the noble Baroness, Lady Chisholm of Owlpen, for her explanation of the government amendments in this group, which are largely in response to issues raised in Committee. I do not intend to speak for long on this group, because the amendments are largely to be welcomed. I want to pay particular tribute to my noble friend Lady Royall of Blaisdon, who raised the concern of the university sector during Committee that, under the Bill, universities could find themselves in difficulty over fundraising activities with alumni. We were pleased to see today that the Government have listened and addressed that. My noble friend cannot be with us today because of the weather making it difficult for her to travel to London. Generally, the higher education sector and others are grateful for what is proposed, although a couple of noble Lords have raised particular concerns, so it would be useful if the Minister could address those in her response. There may be one area that has not quite been resolved.

There are a couple of issues to mention. We are happy to support the amendment on police sharing of information for law enforcement purposes, as I am the amendment in respect of the Prisoner Ombudsman for Northern Ireland and the technical amendments on tribunals and courts to ensure consistency of language.

I shall not go on any further, because I am conscious that we have two Statements today and one will take at least an hour and the other 40 minutes, and the dinner break business for an hour, which will eat in to our time for Report today. I shall leave it here and say well done to the Government: thank you very much for that. It is better that we spend our day looking at issues that we have not quite resolved.

[Baroness Chisholm of Owlpen]

My Lords, I thank all noble Lords for the points they made. In answer to the noble Lord, Lord Patel, as my noble friend Lord Ashton explained in previous debates, Clause 7 was never intended to provide an exhaustive list of public interest tasks but, rather, to ensure continuity with respect to those processing activities that cover paragraph 5 of Schedule 2 to the 1968 Act. However, I am happy to reiterate that medical research—and other types of research carried out by universities for the benefit of society—will almost always be seen as a public interest task. I appreciate the sector’s desire to have greater guidance from the Information Commissioner on the issue, and I shall certainly pass that on, but the noble Lord will appreciate that it is not for me to dictate the Information Commissioner’s precise programme of work from the Dispatch Box.

I thank the noble Lords, Lord Smith and Lord Macdonald, for their kind words. I think we have put universities on a safe footing in this regard. I reiterate my thanks to them for coming to see us and helping us with that amendment.

The noble Lord, Lord Clement-Jones, asked: is alumni fundraising always in the public interest, and what about medical research?

[Lord Clement-Jones]

No, can it sometimes be in the public interest?

[Baroness Chisholm of Owlpen]

I think that gets more rather than less muddling, but I think I see where the noble Lord is coming from.

The amendment should relate to and rely either on article 6(1)(e) or (f). That should solve any possibility raised by the noble Lord.

Amendment 3 agreed.

Amendments 4 and 5

Moved by

[Baroness Chisholm of Owlpen]

4: Clause 6, page 4, line 36, leave out “, subject to subsection (2)”

5: Clause 6, page 4, line 37, at end insert—
“subject to subsections (1A) and (2).(1A) An authority or body that falls within subsection (1) is only a “public authority” or “public body” when performing a task carried out in the public interest or in the exercise of official authority vested in it.”

Amendments 4 and 5 agreed.

Clause 7: Lawfulness of processing: public interest etc

Amendment 6

Moved by

[Baroness Chisholm of Owlpen]

6: Clause 7, page 5, line 11, after “enactment” insert “or rule of law”

Amendment 6 agreed.

[Baroness Chisholm of Owlpen]

My Lords, as it is 4.25 pm and the Statement is due sometime after 4.30 pm, it would be unwise to start on another amendment now, particularly a very long amendment, so I need to adjourn the House during pleasure for four minutes until 4.30 pm.

16:26

Sitting suspended.