Data Protection Bill [Lords]

3rd reading: House of Commons & Report stage: House of Commons
Wednesday 9th May 2018 Commons Chamber

Consideration of Bill, as amended in the Public Bill Committee

New Clause 19

Guidance about how to seek redress against media organisations

“(1) The Commissioner must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or has failed to comply with the data protection legislation.

(2) In this section, ‘media organisation’ means a body or other organisation whose activities consist of or include journalism.

(3) The guidance must include provision about relevant complaints procedures, including—

(a) who runs them,

(b) what can be complained about, and

(c) how to make a complaint.

(4) For the purposes of subsection (3), relevant complaints procedures include procedures for making complaints to the Commissioner, the Office of Communications, the British Broadcasting Corporation and other persons who produce or enforce codes of practice for media organisations.

(5) The guidance must also include provision about—

(a) the powers available to the Commissioner in relation to a failure to comply with the data protection legislation,

(b) when a claim in respect of such a failure may be made before a court and how to make such a claim,

(c) alternative dispute resolution procedures,

(d) the rights of bodies and other organisations to make complaints and claims on behalf of data subjects, and

(e) the Commissioner’s power to provide assistance in special purpose proceedings.

(6) The Commissioner—

(a) may alter or replace the guidance, and

(b) must publish any altered or replacement guidance.

(7) The Commissioner must produce and publish the first guidance under this section before the end of the period of 1 year beginning when this Act is passed.” .—(Matt Hancock.)

This new clause would be inserted after Clause 172. It requires the Information Commissioner to produce guidance about how individuals can seek redress where a media organisation (defined in subsection (2) of the new clause) fails to comply with the data protection legislation, including guidance about making complaints and bringing claims before a court.

Brought up, and read the First time.

13:49

[The Secretary of State for Digital, Culture, Media and Sport (Matt Hancock)]

I beg to move, That the clause be read a Second time.

[Madam Deputy Speaker (Dame Rosie Winterton)]

With this it will be convenient to discuss the following:

Government new clause 22—Review of processing of personal data for the purposes of journalism.

Government new clause 23—Data protection and journalism code.

New clause 18—Data protection breaches by national news publishers—

“(1) The Secretary of State must, within the period of three months beginning with the day on which this Act is passed, establish an inquiry under the Inquiries Act 2005 into allegations of data protection breaches committed by or on behalf of national news publishers and other media organisations.

(2) Before setting the terms of reference of and other arrangements for the inquiry the Secretary of State must—

(a) consult the Scottish Ministers with a view to ensuring, in particular, that the inquiry will consider the separate legal context and other circumstances of Scotland;

(b) consult Northern Ireland Ministers and members of the Northern Ireland Assembly with a view to ensuring, in particular, that the inquiry will consider the separate legal context and other circumstances of Northern Ireland;

(c) consult persons appearing to the Secretary of State to represent the interests of victims of data protection breaches committed by, on behalf of or in relation to, national news publishers and other media organisations; and

(d) consult persons appearing to the Secretary of State to represent the interests of news publishers and other media organisations (having regard in particular to organisations representing journalists).

(3) The terms of reference for the inquiry must include requirements—

(e) to inquire into the extent of unlawful or improper conduct by or on behalf of national news publishers and other organisations within the media in respect of personal data;

(f) to inquire into the extent of corporate governance and management failures and the role, if any, of politicians, public servants and others in relation to failures to investigate wrongdoing at media organisations within the scope of the inquiry;

(g) to review the protections and provisions around media coverage of individuals subject to police inquiries, including the policy and practice of naming suspects of crime prior to any relevant charge or conviction;

(h) to investigate the dissemination of information and news, including false news stories, by social media organisations using personal data;

(i) to consider the adequacy of the current regulatory arrangements and the resources, powers and approach of the Information Commissioner and any other relevant authorities in relation to—

(i) the news publishing industry (except in relation to entities regulated by Ofcom) across all platforms and in the light of experience since 2012;

(ii) social media companies;

(j) to make such recommendations as appear to the inquiry to be appropriate for the purpose of ensuring that the privacy rights of individuals are balanced with the right to freedom of expression.

(4) In setting the terms of reference for the inquiry the Secretary of State must—

(k) have regard to the current context of the news, publishing and general media industry;

(l) must set appropriate parameters for determining which allegations are to be considered;

(m) determine the meaning and scope of references to national news publishers and other media organisations for the purposes of the inquiry.

(5) Before complying with subsection (4) the Secretary of State must consult the judge or other person who is likely to be invited to chair the inquiry.

(6) The inquiry may, so far as it considers appropriate—

(n) consider evidence given to previous public inquiries; and

(o) take account of the findings of and evidence given to previous public inquiries (and the inquiry must consider using this power for the purpose of avoiding the waste of public resources).

(7) This section comes into force on Royal Assent.”

This new clause would require the establishment of an inquiry under the Inquiries Act 2005 as recommended by Lord Justice Leveson for Part two of his Inquiry.

New clause 20—Publishers of news-related material: damages and costs (No. 2)—

“(1) This section applies where—

(a) a relevant claim for breach of the data protection legislation is made against a person (‘the defendant’),

(b) the defendant was a relevant publisher at the material time, and

(c) the claim is related to the publication of news-related material.

(2) If the defendant was a member of an approved regulator at the time when the claim was commenced (or was unable to be a member at that time for reasons beyond the defendant’s control or it would have been unreasonable in the circumstances for the defendant to have been a member at that time), the court must award costs against the claimant unless satisfied that—

(d) the issues raised by the claim could not have been resolved by using an arbitration scheme of the approved regulator, or

(e) it is just and equitable in all the circumstances of the case, including, for the avoidance of doubt—

(i) the conduct of the defendant, and

(ii) whether the defendant pleaded a reasonably arguable defence, to make a different award of costs or make no award of costs.

(3) If the defendant was not an exempt relevant publisher and was not a member of an approved regulator at the time when the claim was commenced (but would have been able to be a member at that time and it would have been reasonable in the circumstances for the defendant to have been a member at that time), the court must award costs against the defendant unless satisfied that—

(f) the issues raised by the claim could not have been resolved by using an arbitration scheme of the approved regulator (had the defendant been a member), or

(g) it is just and equitable in all the circumstances of the case, including, for the avoidance of doubt—

(i) the conduct of the claimant, and

(ii) whether the claimant had a reasonably arguable claim, to make a different award of costs or make no award of costs.

(4) This section is not to be read as limiting any power to make rules of court.

(5) This section does not apply until such time as a body is first recognised as an approved regulator.”

This new clause would provide that court costs of non-abusive, non-vexatious, and non-trivial libel and intrusion claims would be awarded against a newspaper choosing not to join a Royal Charter-approved regulator offering low-cost arbitration, but that newspapers who do join such a regulator would be protected from costs awards even if they lose a claim.

New clause 21—Publishers of news-related material: interpretive provisions (No. 2)—

“(1) This section applies for the purposes of section (Publishers of news-related material: damages and costs (No. 2)).

(2) “Approved regulator” means a body recognised as a regulator of relevant publishers.

(3) For the purposes of subsection (2), a body is “recognised” as a regulator of relevant publishers if it is so recognised by any body established by Royal Charter (whether established before or after the coming into force of this section) with the purpose of carrying on activities relating to the recognition of independent regulators of relevant publishers.

(4) “Relevant claim” means a civil claim made in respect of data protection under the data protection legislation, brought in England or Wales by a claimant domiciled anywhere in the United Kingdom.

(5) The “material time”, in relation to a relevant claim, is the time of the events giving rise to the claim.

(6) “News-related material” means—

(a) news or information about current affairs,

(b) opinion about matters relating to the news or current affairs, or

(c) gossip about celebrities, other public figures or other persons in the news.

(7) A relevant claim is related to the publication of news-related material if the claim results from—

(d) the publication of news-related material, or

(e) activities carried on in connection with the publication of such material (whether or not the material is in fact published).

(8) A reference to the “publication” of material is a reference to publication—

(f) on a website,

(g) in hard copy, or

(h) by any other means,

and references to a person who “publishes” material are to be read accordingly.

(9) A reference to “conduct” includes a reference to omissions; and a reference to a person’s conduct includes a reference to a person’s conduct after the events giving rise to the claim concerned.

(10) “Relevant publisher” has the same meaning as in section 41 of the Crime and Courts Act 2013.

(11) A relevant publisher is exempt if it satisfies Condition A or B.

(12) Condition A is that the publisher has a constitution which—

(a) requires any surplus income or gains to be reinvested in the publisher, and

(b) does not allow the distribution of any of its profits or assets (in cash or in kind) to members or third parties.

(13) Condition B is that the publisher—

(a) publishes predominantly in Scotland, or predominantly in Wales, or predominantly in Northern Ireland or predominantly in specific regions or localities; and

(b) has had an average annual turnover not exceeding £100 million over the last five complete financial years.”

This new clause would provide that the penalty incentives in New Clause 20 would not apply to companies which publish only on a regional or local basis and have an annual turnover of less than £100m. It sets out that only data protection claims are eligible, and provides further interpretive provisions.

Amendment (a), line 33 leave out subsection (10) and insert—

“(10) ‘Relevant publisher’ has the same meaning as in section 41 of the Crime and Courts Act 2013, subject to subsection (10A).

(10A) For the purposes of this Act, a publisher shall only be a ‘relevant publisher’ if—

(a) it has a registered address in England or Wales; and

(b) its publications are published in, or in any part of, England or Wales.

(10B) A relevant claim may be made under the data protection legislation only in respect of material which is published by a relevant publisher (as defined by subsections (10) and (10A)) and which is read or accessed in England or Wales.”

Government amendments 146 to 150 and 145.

Amendment 144, page 122, line 10, in clause 205, leave out “Section 190 extends” and insert—

“Sections (Publishers of news-related material: damages and costs (Amendment 2)), (Publishers of news-related material: interpretive provisions (Amendment 2)) and 190 extend”.

Amendment 14, page 156, line 4, in schedule 2, at end insert—

“(d) any code which is adopted by an approved regulator as defined by section 42(2) of the Crime and Courts Act 2013.”

This amendment would give the Standards Code of an approved press regulator the same status as the other journalism codes recognised in the Bill (The BBC and Ofcom Codes, and the Editors’ Code observed by members of IPSO).

[Matt Hancock]

The Data Protection Bill sets out a full new data protection regime for Britain, giving people more control over their data.

First, I wish to address new clauses 20 and 21, before turning to the other new clauses. These new clauses are essentially the provisions contained in sections 40 and 42 of the Crime and Courts Act 2013, although they would apply only to breaches of data protection law and only in England and Wales.

Let me first set out exactly what these new clauses would mean and then our approach to them. They would set new cost provisions for complaints against the press, which means that any publication not regulated by IMPRESS would have to pay the legal costs for any complaint against it, whether it won or lost. Many would object to that and say that it goes against natural justice. It is grounds enough to reject these new clauses on the basis that the courts would punish a publication that has done no wrong, but that is not the only reason. Let us consider the impact of these new clauses on an editor. Faced with any criticism, of any article, by anyone with the means to go to court, a publication would risk having to pay costs, even if every single fact in a story was true and even if there was a strong public interest in publishing. Let us take, for example, Andrew Norfolk, the admirable journalist who uncovered the Rotherham child abuse scandal. He said that section 40 would have made it “near impossible” to do his job. He went on to say that it would have been “inconceivable” to run the front page story naming one of the abusers in a scandal that had ruined the lives of 1,400 innocent young people with disgusting crimes that had gone on for years and years and years. Without Andrew Norfolk’s story, the scandal would have gone on for years and years more.

[Ian C. Lucas (Wrexham) (Lab)]

If the Secretary of State is so opposed to section 40, why did he support it?

[Matt Hancock]

I will come on to what has changed in the many years since 2013, not least of which is the fact that we now have a full-blown independent press regulator, the Independent Press Standards Organisation, which did not exist back then.

[Bill Wiggin (North Herefordshire) (Con)]

I am most grateful to my right hon. Friend for giving way. First, IPSO is not a press regulator, because it does not comply with the requirements to be a regulator; it is merely a complaints handler. Secondly, he may have inadvertently misled the House, because it is not necessary to join IMPRESS as he said earlier on. It is necessary for regulators to comply with the rules, which is slightly different.

[Matt Hancock]

There is no recognised press regulator other than IMPRESS. As many journalists have pointed out, the truth is that these new clauses would have made it near impossible to uncover some of the stories of abuse, including the abuse of all those children in Rotherham. Another example is that of Mark Stephens, who represented phone hacking victims. He wrote today that the new clauses would

“return Britain to the legal Dark Ages and make it easier for wealthy people to suppress negative stories.”

The impact on local newspapers, too, risks being catastrophic. I say do not just take my word for it. The editor of the Express & Star, well known to the hon. Member for West Bromwich East (Tom Watson), said that the new clauses could spell the end of newspaper printing in this country on a large scale and are a

“ludicrous and patently unfair…piece of legislation.”

[Liam Byrne (Birmingham, Hodge Hill) (Lab)]

Will the Secretary of State confirm to the House that the BBC, Channel 4 and every other broadcaster operates under much more stringent rules, and yet nothing seems to have got in the way of their powers of interrogation and investigation? Does he think that they are operating second-class investigations today?

[Matt Hancock]

We have three separate systems of media regulation in this country: a separate system for broadcasters; an essentially self-regulated system under IPSO for newspapers; and then there is the issue of how we make sure that what happens online is properly regulated as well. I will come on to that last point, because it is a very important part of the debate. The impact of the new clauses on the local press should not be underestimated. Two hundred local newspapers have already closed since 2005, and these new clauses would accelerate that decline. However, there is one national newspaper that is carved out in the small print of the new clauses as it only covers newspapers run for profit. Which newspaper is exempted? It is The Guardian. If those who tabled these new clauses thought that they were making friends with The Guardian, they were wrong. The Guardian has said that

“the Data Protection Bill should not be used as a vehicle for imposing an unfair and partial system on publishers.”

It did not ask for the measures, and it, too, opposes them. Indeed, in a recent consultation, 79% of direct responses favoured full repeal of section 40, compared with just 7% who favoured full commencement.

[Chris Philp (Croydon South) (Con)]

The Secretary of State quoted The Guardian. In fact, its statement released this morning went even further. The Guardian News and Media said that these new clauses would

“further erode press freedom and have a chilling effect on the news media.”

[Matt Hancock]

It did, yes. I am trying to ensure that we have a debate on these measures that takes into account the fact that, yes, we want a free press that can hold the powerful to account, but also that it is fair. I know—as does everyone in this House—that there has been irresponsible behaviour by the press. Although I want to see a press that is free to report without fear or favour, to uncover wrongdoing and to hold the powerful to account, I also want to see a press that is fair and accurate. I am determined that we have a strengthened system so that people have recourse to justice when things go wrong.

[Tom Tugendhat (Tonbridge and Malling) (Con)]

Does my right hon. Friend agree that, in many ways, there are two forms of media already operating in this country? One is printed, published and broadcast from reputable sources, which have assets in this country that we can take action against, or not, and the other form is websites that have either very low assets or no assets in this country with very different accountability. Bizarrely, could we not find ourselves in a position under this system where the only people who can get justice are those who are rich enough, such as Peter Thiel, to destroy the website Gawker, in this case, because it was acting against him, rather than those of us on more modest means who would have absolutely no recourse against these organisations, but yet all the news would have gone online because these regulations would force out our newspapers?

[Matt Hancock]

My hon. Friend is completely right about the gap between online and print in terms of standards of regulation. That is because IPSO was brought into force—I was glad to see it being introduced in 2014. He is also right that tackling the problems online is critical. Our internet safety strategy, which will be published in the next couple of weeks, will address that matter directly. I know that there are many Members who have concerns about the impact of content online, of abuse online, and of the ability to get redress online, and we will not let that rest. We will ensure that we take action to tackle the problems online in the same way that IPSO deals with the press and indeed that these new clauses deal with publications in the press.

I am glad that IPSO now has the power to require front page corrections as it did, for instance, just a couple of weeks ago with The Times. As the House knows, I have pushed IPSO to bring in further measures. It recently introduced a system of compulsory low-cost arbitration. This means that ordinary people who do not have large sums of money can take claims to newspapers for as little as £50. Almost all of the major national newspapers have signed up to it. That means that anyone who has been wronged by a national newspaper can, for the first time, ask for arbitration and the newspaper cannot refuse. The scheme applies not just to words, but to images. This must be the start of a tougher regime, and not the conclusion.

[Mr Peter Bone (Wellingborough) (Con)]

Is not one of the problems that the scheme does not include everyone? It is compulsory, but does not include everyone. When MailOnline is excluded, does that not leave a whacking great hole in it?

[Matt Hancock]

I have a lot of sympathy with the views of my hon. Friend. MailOnline is, of course, an online publication, and we are looking at that as part of our internet safety strategy. I am very happy to talk to him about how that can be done. Only in the past week, however, many publications have joined the IPSO low-cost arbitration scheme, which is binding on them, and I very much hope that more will join in the future.

[Mrs Anne Main (St Albans) (Con)]

Will my right hon. Friend also confirm that the new scheme will allow for a higher maximum level of damages of up to £60,000 and that it can be run for as little as £100?

[Matt Hancock]

That is absolutely right. The minimum access cost will be £50, which means that everybody has access to justice at low cost. There is more to it than that, however. Some people argue that the £60,000 limit on damages is too low, but the arbitration scheme does not stop somebody going to court, so there is access to justice where damages should be higher. The arbitration scheme is an addition to, rather than a replacement for, going to court. It introduces a robust and fair system that is easy for everybody to access, so everyone can have access to justice.

The section 40 amendments would, ironically, have the opposite effect, because anybody with the means to take small newspapers to court could stop them publishing stories for fear of having to pay the costs, even if they get everything right.

[Dr Andrew Murrison (South West Wiltshire) (Con)]

Is it not the case that IPSO proposed its arbitration scheme only when a number of colleagues had tabled amendments that were distinctly unhelpful to the print media? Can we trust that organisation? Will my right hon. Friend be extremely careful about removing the boot from the neck of IPSO, particularly in relation to the review period? I know that he will come on to talk about that shortly, but will he consider tightening the review period, because at the moment it gives IPSO the best part of a decade before there is any prospect of further change if the industry does not behave itself?

[Matt Hancock]

I agree with the sentiment, which is that we have to ensure that the press remains free but also fair and reasonable, and that is the purpose of the amendment proposing a review period of four years. We will not let matters lie.

Some have asked, “What happens if newspapers pull out of the IPSO scheme?” I think that would send a terrible signal of the newspaper industry’s attitude to the standards that it rightly ought to sign up to. The review is there precisely to address my hon. Friend’s concerns.

[Vicky Ford (Chelmsford) (Con)]

I am pleased to hear the Secretary of State refer to a low-cost scheme. People have told me about their concern that £60,000 may be too low because there needs to be a deterrent. Will the four-year review also cover that £60,000 cap?

[Matt Hancock]

Given that this is a Data Protection Bill, the review will consider data protection issues, but I would expect it to be as broad as necessary, to ensure that all those matters are considered.

We have listened to concerns raised during the passage of the Bill, including in this debate.

[Liam Byrne]

I am grateful to the Secretary of State for giving way just before he moves off the subject of IPSO. He has set out arguments in IPSO’s defence. It is not just MailOnline that is outside the arbitration scheme; that is also true of Newsquest and Archant, so a significant chunk of the press is outside it. Brian Leveson said that the regulator needed to have independent board members, independence of operation, fair remedy for complaints, the ability to carry out investigations, the ability to issue fines, and universal arbitration. None of those conditions is put in place by IPSO, so which of those principles does the Secretary of State think should be retired?

[Matt Hancock]

On the contrary, the scheme introduces new, compulsory, low-cost arbitration to ensure that people can have exactly the recourse to justice mentioned by the right hon. Gentleman. In order to address some of the concerns, we have tabled two new clauses. First, new clause 19 requires the Information Commissioner to publish information on how people can get redress. The point is to ensure that there is a plain English guide to help anyone with a complaint to navigate the system. Secondly, new clause 22 requires the Information Commissioner to create a statutory code of practice, setting out standards on data protection. The point is that, when investigating a breach of data protection law, the commissioner has to decide whether a journalist acted reasonably. When making that judgment, a failure to comply with the statutory code will weigh heavily against the journalist.

[Mr Jim Cunningham (Coventry South) (Lab)]

How binding is the arbitration, and how binding is the code of practice?

[Matt Hancock]

The arbitration is binding on the newspapers, meaning that anybody who wants to get redress from a newspaper in the scheme can do so up to a limit of £60,000, and then the recourse is through the courts. The Information Commissioner’s statutory code of practice is binding with respect to data protection standards; after all, this is a Data Protection Bill, so that is what is in scope.

Taken together, the changes from IPSO and the new clauses mean that Britain will have the most robust system we have ever had of redress for press intrusion and it will be accessible to all. It will achieve that and the benefits of high-quality journalism, without the negative effect that section 40 would have.

[Joanna Cherry (Edinburgh South West) (SNP)]

I thank the Secretary of State for giving way; he is being very generous in taking interventions. Before he finishes his peroration on the new clauses, will he confirm that they are purely procedural and will give members of the public, including our constituents, absolutely no new rights whatsoever?

[Matt Hancock]

No, that is not right. The statutory code of practice for journalists must be a consideration in the Information Commissioner’s judgments, and a failure to comply with the statutory code will weigh against the journalist in law. It has precisely the impact that we are trying to bring about.

New clause 18, tabled by the former Leader of the Opposition, the right hon. Member for Doncaster North (Edward Miliband), requires the Government to, in effect, reopen the Leveson inquiry, but only in relation to data protection. I want to say something specific and technical about the new clause. Even on its own terms, it would not deliver Leveson 2 as envisaged. It focuses on data protection breaches, not the broad question of the future of the press. The new clause, therefore, is not appropriate for those who want to vote for Leveson 2.

The first Leveson inquiry lasted more than a year and heard the evidence of more than 300 people, including journalists, editors and victims. The inquiry was a diligent and thorough examination of the culture, practices and ethics of our press, in response to illegal and improper press intrusion. There were far too many cases of terrible behaviour, and having met some of the victims, I understand the impact that had. The inquiry was followed by three major police investigations, leading to more than 40 criminal convictions. More than £48 million was spent on the police investigations and the inquiry.

[Liam Byrne]

This is probably a good point for the Secretary of State to remind the House about Brian Leveson’s view of the future of the inquiry. Will he set that out for us?

[Matt Hancock]

Sir Brian was very clear in his letter to me. He stated that he wanted the inquiry to continue on a different basis. I think, having considered his view and others, that the best approach is to ensure that we do the work necessary to improve the standards of the press, but we do it based on what is needed now to improve things in the future. I will come back to that.

[Robert Neill (Bromley and Chislehurst) (Con)]

I am glad that my right hon. Friend acknowledges the diligence and hard work of Sir Brian Leveson in the inquiry. He highlighted the particular vice of corrupt police officers giving the names of persons—perhaps whose premises are being searched—to corrupt journalists who publish them before charge, and very often those people are never charged. No amount of redress can undo that damage. Will my right hon. Friend meet me and other concerned Members to consider revisions and what additional legal protection can be given to people post-charge to prevent this trade in muck and dirt, sometimes without anybody ever coming before a criminal court, which undermines the presumption in favour of innocence?

[Matt Hancock]

Yes, I will. My hon. Friend makes a very important point. We are discussing the rules around the disclosure of the names of people who are under investigation before arrest. This is a sensitive area, and we have got to get it right. I want to work with colleagues and others to explore the reporting restriction rules further, and I look forward to meeting him and any others who share those concerns.

[Anna Soubry (Broxtowe) (Con)]

I am grateful to the Secretary of State for giving way; it is very generous of him. Some years ago, I put forward a private Member’s Bill calling for anyone who was accused to keep their anonymity until they were charged. It is all there—it is effectively good to go. I too would very much like to meet the Secretary of State, because this is the right thing to do. People should not be named before they are even charged, unless a judge orders otherwise.

[Matt Hancock]

I am aware of my right hon. Friend’s proposals, and I look forward to meeting her. Getting the details of this right is incredibly important, and I am happy to take that forward.

[Mr Kenneth Clarke (Rushcliffe) (Con)]

To go back to the key question of holding an inquiry, the Secretary of State rather implies that the first Leveson inquiry is closed and we now face the possibility of starting a new one. Does he not accept that, from the moment it was set up, the Leveson inquiry was always going to be in two parts? That was the commitment of the Government in which he and I served. It was only suspended so that police operations could take place, and it was quite clearly agreed that part 2 of the inquiry would then resume. The case he has to make is: why is he cancelling a previously promised inquiry endorsed by Leveson? What on earth is the reason for stopping investigations into the kind of things we are all talking about? No one would stop investigations of this kind against any other body in this country.

[Matt Hancock]

I have a huge amount of respect for my right hon. and learned Friend. I was about to come on to precisely the reason for that. The reason is that inquiries are not costless, and not just in terms of taxpayers’ money; that is one consideration, but inquiries also take hours of official time and ministerial time. They divert energy and public attention—[Interruption.] Hold on. The question for the House is this: given all the other challenges facing the press, is this inquiry the right use of resources?

There is something in the calls to reopen the inquiry that implies that the problem is that we do not know what happened, but we do know what happened, and then we had police investigations and the convictions. It is fundamental that we get to the bottom of the challenges that the press face today. I want to divert our attention and resources to tackling and rising to the problems of today and ensuring we have a press that is both free and fair.

[Mr Iain Duncan Smith (Chingford and Woodford Green) (Con)]

In answer to the point made by my right hon. and learned Friend the Member for Rushcliffe (Mr Clarke), surely the question here is not that further issues should not be settled, such as those that have been raised, but how one should go about it. An open-ended continuation of this inquiry will not necessarily resolve those issues but could travel into all sorts of areas, which would take time. Will the Secretary of State commit to dealing with all these issues raised in a more effective way, rather than just opening a further point in the inquiry? That is the point.

[Matt Hancock]

Yes, and my right hon. Friend has pre-empted what I was about to say, which is that the choice is not between doing something and doing nothing, but between doing something and doing something better. New clause 18 calls on us to go into a backward-looking inquiry when what we need to do is ensure that we allow the press to rise to the challenges we face today.

[Paul Farrelly (Newcastle-under-Lyme) (Lab)]

I thank the Secretary of State for giving way, not least in view of what I am going to say. Is the truth not that he has broken promises to the victims, ignored the opinions of Sir Brian Leveson and ridden roughshod over the cross-party, unanimous opinion of the Digital, Culture, Media and Sport Committee? Much has happened since Leveson 1, and one thing that Leveson 2 could establish is who told Sir Brian the truth and nothing but the truth the first time round. Why is the Secretary of State afraid of establishing the truth?

[Matt Hancock]

I want to focus on the challenges we face now. That is my job as Secretary of State, and it is my judgment as to what the proposals I have put forward do, and do in a better way than re-establishing the inquiry.

14:15

[Mr Jacob Rees-Mogg (North East Somerset) (Con)]

Has this not been decided in the jewel of our legal system—that is to say, in front of a jury? Some people accused of things that would have been part of Leveson 2 have been acquitted, and a very few have been convicted, but once someone has been tried in front of a jury, it is fundamentally unfair, unjust and a question of double jeopardy if they are then brought before another tribunal and put once more on oath to repeat evidence that they have given before and then been acquitted for. It would be against British justice to proceed in that way.

[Matt Hancock]

The police inquiries and the prosecutions that followed were exhaustive, so much so that in 2015, the Director of Public Prosecutions said that the end had been reached of the need to inquire further into those criminal acts. Of course, the criminal acts were punished, and people were convicted and went to prison.

Crucially, the arrival of the internet has fundamentally changed the landscape. That was not addressed at the core of the first Leveson inquiry, but it must be addressed. Later this month we will publish our internet safety strategy, as I mentioned, in which we will set out the action we need to take to ensure that the online world is better policed. Many colleagues have raised with me huge concerns about online abuse and the inability to get redress. That is a significant challenge for the future, and we must address it.

However, the internet has also fundamentally undermined the business model of our printed press. Today’s core challenge is how to ensure a sustainable future for high-quality journalism that can hold the powerful to account. The rise of clickbait, disinformation and fake news is putting our whole democratic discourse at risk. This is an urgent problem that is shaking the foundations of democracies worldwide. Liberal democracies such as Britain cannot survive without the fourth estate, and the fourth estate is under threat like never before. These amendments would exacerbate that threat and undermine the work we are doing through the Cairncross review and elsewhere to support sustainable journalism.

The terms of reference of part 2 of the inquiry have already largely been met. Where action is needed, I do not back down from taking it. The culture that allowed phone hacking to become the norm has changed fundamentally and must stay that way. We have already seen reforms of police practices, with a new code of conduct for the College of Policing. As I said, we are discussing rules around disclosure. I can confirm that we have asked Her Majesty’s inspectorate of constabulary to undertake a new review of how police forces are adhering to new media relations guidance, as recommended by Sir Brian, and we will not hesitate to strengthen the rules further if that is needed.

[Andy Slaughter (Hammersmith) (Lab)]

The Secretary of State has talked about victims of abuse, but he seems to have forgotten that Leveson was set up because of the victims of press harassment and abuse in the first place. Many of those victims have written to Members on both sides of the House, rejecting the ridiculous IPSO scheme and asking for part 2 of Leveson to proceed. He has heard concerns from Members on both sides of the House today, so why will he not think again? What has changed his mind about those victims over the last three or four years?

[Matt Hancock]

In the period in which people have raised concerns and said that they must be looked into in Leveson 2, every one that has been raised with me was covered in Leveson 1. Leveson 1 was exhaustive, and there were then police investigations, which went further. My judgment is about what is right now, and the challenges the press face now are fundamentally different.

[Christine Jardine (Edinburgh West) (LD)]

Does the Secretary of State accept that many of the challenges that the press face now are the result of the behaviour that led to Leveson 1 and undermined public confidence? The fact that the victims are not perceived as having had justice further undermines the press, and we would be helping the future of the press in this country if we continued along the lines of Leveson 2 and looked at how best to implement the recommendations of Leveson 1.

[Matt Hancock]

I think the representations from the press themselves show that they are not looking for help of that sort. Let us, however, look at the public: there is not a great public cry for this. In response to the consultation, 79% of direct responses favoured the full repeal of section 40. It is my job to address what we face now and the needs of the country now.

[Ian Paisley (North Antrim) (DUP)]

The Secretary of State has made the very interesting point that he will try to address some of the grievances and outcomes by way of a review. Doing so specifically in relation to Northern Ireland was in effect precluded by the first part of Mr Leveson’s inquiry. Will the Secretary of State tell us how he will try to resolve this problem in Northern Ireland?

[Matt Hancock]

Through new clause 23, as I have mentioned, we will require the Information Commissioner to conduct a statutory review of media compliance with the new law over the next four years. Alongside that review, we propose to have a named person review the standards of the press in Northern Ireland, and we will take that forward as part of and alongside new clause 23.

[Ian Paisley]

I thank the Secretary of State for his generosity. Would it be fair for me to characterise that review as a Leveson for Northern Ireland?

[Matt Hancock]

I would characterise it as a review aligned with new clause 23, which we are bringing in for the whole country, specifically to look at the effects in Northern Ireland. The crucial point is that we will make sure, through the review in new clause 23, that the future of the press is both free and reasonable, that its behaviour is reasonable, and yet that it is not subject to statutory regulation. I want to see a press that is both free and fair.

[Edward Miliband (Doncaster North) (Lab)]

This is an extraordinary way to make policy. Will the Secretary of State explain to us why there can be a Leveson for Northern Ireland, but not for the rest of the United Kingdom?

[Matt Hancock]

I have explained that new clause 23, which I hope the right hon. Gentleman supports, will in the future bring in a review of behaviour following the new system that we are putting into place. That is true here, and it is true right across the country.

[Ian C. Lucas]

May I bring the Secretary of State back to the United Kingdom and to Manchester last year? The Kerslake review said:

“The panel was shocked and dismayed by the accounts of the families of their experiences with some of the media.”

That happened last year, so the Secretary of State should not represent the threats posed by press misbehaviour as being from the past; this is a real and pressing problem now. Will he keep his promise to the victims who have suffered from this in the past and are continuing to suffer from it?

[Matt Hancock]

New clause 23 is for the whole of the UK, which includes Northern Ireland. On the hon. Gentleman’s broader point, I have read the Kerslake review, and we asked to see all the evidence that fed into it, but we have not received specific allegations. The crucial point is that the low-cost IPSO arbitration is precisely to make sure that everybody has access to justice and that the press improves the way in which it behaves so that it is both free and fair, and that is what we want to achieve.

[Dr Lisa Cameron (East Kilbride, Strathaven and Lesmahagow) (SNP)]

The Secretary of State may not be aware of this, but my daughter, aged seven, was spoken to and recorded by a journalist in 2016. The incident, which was in our own garden, traumatised her greatly, as has been stated by her school and by her doctor, but it was ignored by IPSO. Will he meet me and my daughter to explain how children like her will be protected by his amendments and what he is trying to do, because she has no faith in the system?

[Matt Hancock]

Yes, I absolutely will. This is the sort of thing that I am trying to put right. It is about making sure that the system is right now: rather than going over the past—there is an enormous amount of evidence of what happened in the past—this is about making sure that we look to the future.

The hon. Member for North Antrim (Ian Paisley) mentioned Northern Ireland and the review I have committed to in Northern Ireland will take place at the same time as the review under new clause 23 for the UK that is before the House.

[Tom Watson (West Bromwich East) (Lab)]

Further to the point made by the hon. Member for North Antrim (Ian Paisley) about the special review for Northern Ireland, may I ask the Secretary of State in reference to the Hurst case—the former Army intelligence officer whose computers were hacked by newspaper journalists working for newspapers in England about his activities protecting our state in Northern Ireland—whether his review will also examine such criminal activity?

[Matt Hancock]

If there are allegations of criminal activity—the hon. Gentleman has just made such an allegation—then that is a matter for the courts.

[Tom Watson]

A newspaper group has admitted liability for criminally hacking the computers of a former Army intelligence officer.

[Matt Hancock]

In a way, the hon. Gentleman has summed up my case. My case is that we want a press that is free and that is fair. Statutes already exist to ensure that, when there are cases of wrongdoing, people can be brought to account through the courts. That already exists, and we now also have a system of compulsory, low-cost arbitration to make sure everybody can get recourse.

I am focused on ensuring that we have high-quality political discourse and a press that can survive and thrive, with high-quality journalists who can hold the powerful to account, and on ensuring that we face the challenges of today rather than those of yesterday. That is what we want to work towards, and new clauses 18, 20 and 21 would make it harder to find solutions to today’s real problems.

[Ian Paisley]

The Secretary of State will correct me if I am wrong, but new clause 23, to which he has referred at the Dispatch Box, looks at cases going forward; it is not retrospective—I hope I am correct. Therefore, it addresses some of the deficiencies in the other new clauses before the House about having just a consultation process on what has happened previously.

[Matt Hancock]

New clause 23 is about ensuring that in the future there is a review of activity from now onwards, and alongside it we will ensure that there is a named person to ensure that the issues in Northern Ireland are looked into properly.

Overall, I want to ensure that the law that applies to the press is applied fairly, and that we have a free press and one that is responsible. I therefore oppose new clauses 18, 20 and 21, which would make that more difficult, not easier, and I urge every Member of the House to do the same.

[Liam Byrne]

I rise to support in particular new clause 18, in the name of my right hon. Friend the Member for Doncaster North (Edward Miliband), and indeed our new clause 20 and the consequential amendments.

The background to this is fairly well rehearsed, but it is worth remembering the level of shock we all felt when the revelations about phone hacking first became public. It is worth remembering the shock we felt when we heard that Milly Dowler’s phone had been hacked. It does not often happen in this House that Members on both sides unite to try to construct a shared way forward through an extremely difficult problem, yet that is exactly what we managed to do with the Leveson inquiry.

That was very difficult, but it was always going to be a game of two halves. There were too many cases coming to court at the time; there was too much evidence still under wraps; and there was too much that had to be left in the dark. As the Father of the House so rightly pointed out, it was never a question of opening a new inquiry; this is about letting the existing inquiry actually finish its work.

When the previous Prime Minister, Mr Cameron, having spoken to victims, made a statement, the point he wanted to impress on Members on both sides of the House was the need for Leveson to finish the job:

“One of the things that the victims have been most concerned about is that part 2 of the investigation should go ahead—because of the concerns about that first police investigation and about improper relationships between journalists and police officers. It is right that it should go ahead, and that is fully our intention.”—[Official Report, 29 November 2012; Vol. 554, c. 458.]

The then Prime Minister was not speaking simply on his own behalf; he was speaking on behalf of Government Members, including members of today’s Government Front Bench such as the Chief Whip, the right hon. Member for Skipton and Ripon (Julian Smith), who wrote not too long ago to one of his constituents:

“The Government has been clear all along that the status quo is not an option and I, personally, am determined to see Lord Justice Leveson’s principles implemented.”

Where has that commitment gone this afternoon?

14:30

[Paul Farrelly]

May I add another voice? There is no journalist more respected on these shores than Sir Harold Evans, the former editor of The Sunday Times. He wrote to everybody today in support of the previous Government’s promises:

“Whatever your party, I and many of my associates, look to you to honour that commitment. To renege would be an affront to every citizen who suffered intrusion, but also the many independently-minded journalists of talent and integrity.”

Is it not time today for fair and independently minded MPs to vote as Sir Harry advises?

[Liam Byrne]

My hon. Friend makes an excellent point. What strengthens his argument is the way in which the Secretary of State has sought to bring forward one argument after another, all of which have been knocked down.

When we were first told that Leveson 2 could not proceed, we were told that there had been a day, sometime in about 2010, when magically, all of a sudden, all the abuse that we had ever heard about before categorically, unequivocally and without doubt ceased. We were all quite surprised about that. We were even more surprised, therefore, when John Ford presented his evidence to the Digital, Culture, Media and Sport Committee on 13 March. It is worth setting out what Mr Ford said, because not everyone luxuriates in membership of that Committee:

“I illegally accessed phone accounts, bank accounts, credit cards, and other personal data of public figures… My targets included politicians of all parties. In most cases, this was done without any legitimate public interest justification.”

Mr Ford goes on to reflect on whether the practice had magically ended, as the Secretary of State asserted, or whether it was ongoing. He was asked directly to reflect on the Secretary of State’s assertion that it was all over—nothing more to see; time to walk on by. Mr Ford writes in his letter:

“I am sorry to inform you that Mr Hancock is totally wrong”.

Who can imagine such a thing? He goes on to say that

“having spent 15 years in the business, it is no surprise…that I still know people in the illegal data theft industry, and specifically,”—

this is the nub of the argument—

“that I know individuals who are still engaged in these activities on behalf of newspapers.”

The idea that magically this bad behaviour suddenly stopped and is not ongoing is argument one that has been knocked down.

[Peter Heaton-Jones (North Devon) (Con)]

As reprehensible as those activities are, the fundamental point is that they are criminal acts. They are against the law. The right hon. Gentleman is wrong to conflate that point with the question of press regulation. Those are criminal acts to be dealt with by the courts.

[Liam Byrne]

Actually, it is not wrong to conflate press regulation with these matters, because the purpose of press regulation, in case the hon. Gentleman has not spotted it, is to try to stop such offences happening again. That is how public policy tends to be made in this country.

[Ian C. Lucas]

Is it not extremely relevant that one of the main aims of Leveson 2 was to investigate the relationship between the police and the press, because the police are the people who look into illegal acts and there has been evidence in the past of corruption involving the exchange of information between the police and the press, some of which has affected how Government Members have been presented? Independent-minded Members of the House should be looking into that, not suppressing it. Is it not right that that is looked into?

[Liam Byrne]

My hon. Friend is precisely right. We heard a couple of different arguments from the Secretary of State this afternoon, but they boil down to this: “Inquiries are expensive and time consuming, and officials have a lot of better work to do, unless you live in Northern Ireland, in which case we will crack on with the job now.”

[Hannah Bardell (Livingston) (SNP)]

Are not culture and criminality very closely linked in these matters and the changes proposed by Opposition Members fair and proportionate? I was disappointed to hear the Secretary of State’s very loose sense of history—of what is more recent and what is in the past. The families of Kirsty Maxwell and Julie Pearson, two of my constituents who were both killed abroad, were harassed by the press. In the case of Kirsty Maxwell, a particular tabloid harassed the family to the detriment of other good and decent journalists, because the family were too scared to speak to the press. Any fair-minded and decent journalist will support these changes.

[Liam Byrne]

That point is well put by the hon. Lady. If there is one ambition that we share in this House, it should be not only for a free press, but for a clean press. The idea that there is nothing to see and that we should all walk on by has collapsed.

[Simon Hoare (North Dorset) (Con)]

I am following what the right hon. Gentleman is saying with great interest. I think he is saying that he appreciates that a lot of the activities that he is talking about are illegal, but that they have still been done by journalists and others. Where I am not joining the dots, as he clearly is, is on why Leveson 2, were it to reopen, would make journalists and others more cognisant of those things that are already illegal and change their behaviours.

[Liam Byrne]

For a very simple reason: we have evidence that bad behaviour is still ongoing. When the Secretary of State originally decided to cancel Leveson 2, he said that the bad behaviour was in the past. Actually, the evidence is that it is ongoing. What is more, there was much evidence that could not be considered by Lord Leveson because of the court cases that were ongoing. Crucially, that evidence included allegations of collusion between the press and the police. I would have thought that we should scrutinise that to bits in this House, not just walk on by.

[Simon Hoare]

It is obviously me; I still do not get why the reopening of Leveson—

[Kevin Brennan (Cardiff West) (Lab)]

It is not a reopening.

[Simon Hoare]

Sorry, the reconvening. I do not get why the reconvening of Leveson would make things that are currently illegal any more illegal than they already are. The courts and the prosecution services have the power to bring those cases when illegality takes place. We do not need Leveson 2 to achieve that, surely.

[Liam Byrne]

The point of inquiries is to get to the nub of the truth. There was much that the first half of the Leveson inquiry could not consider because of the courts cases that were ongoing. As a Member of this House, I want to know whether the press regulation system that we are setting up takes account of what we have learned about the sins of the past. I do not think that those sins should be buried and forgotten, and that we should walk on by—unless, of course, people are lucky enough to live in Northern Ireland.

[Ian Paisley]

I know that the right hon. Gentleman thinks that people in Northern Ireland can be treated with the back of his hand with comments like that, but I should make it clear that the Northern Ireland press were exempt from proper scrutiny by Leveson. That is why people feel aggrieved. Many Members whose phones were hacked, like myself, were completely ignored by that process. Now, perhaps, we will have the chance of fairness. Quite frankly, there has been no fairness up until this point.

[Liam Byrne]

I am listening very jealously to the hon. Gentleman. I would like the privileges he has just secured for Northern Ireland for the rest of the country, because the victims who live in England and Wales deserve the same rights.

[Ian Paisley]

I understand that new clause 23 applies to the whole United Kingdom. I live in the United Kingdom.

[Liam Byrne]

The hon. Gentleman may be assured by the process that he has been offered by the Secretary of State this afternoon, but the Opposition are not. We want Lord Leveson to be given the right to finish the job and do the work that he was commissioned to do by the last Prime Minister.

[Mr Duncan Smith]

I am grateful to the right hon. Gentleman for being so generous in giving way. I want to follow up on the point made by my hon. Friend the Member for North Dorset (Simon Hoare). What I do not understand about the Labour new clauses is what he and those in his party who want phase 2 of Leveson, if we want to call it that, think they will learn that they have not learned and could not learn from the court cases and all the evidence that is already in the open. Is there not enough evidence for us to make the necessary changes, without going through the interminable process of opening it up? Is there some specific area of the criminal law he does not understand that Lord Leveson may be able to explain to him?

[Liam Byrne]

What I want to learn is the truth. I want to learn the truth about police-press collusion and I want to know how we improve our press regulation in the future, so that we have not just a free press but a clean press.

Let me make some progress. The Secretary of State offered us a second line of argument that has now collapsed. I am not quite sure of the exact words he used when he came to the House, but most of us walked away thinking that Lord Leveson was pretty content that the whole thing was going to be shuttered. The House can therefore imagine our surprise when Sir Brian Leveson said that he “fundamentally disagreed” with the Government’s decision to end part two of the inquiry. When Lord Leveson said that he wanted the terms to be revised, he meant that he wanted them to be expanded, not cancelled all together. The Secretary of State says that malpractice is in the past and that there is nothing more to see, officials are busy, inquiries are expensive and so we must move on. He intimated that Lord Leveson agreed with him when that was not in fact the case.

A third line of attack from the Secretary of State was that the review looked to the past and ignored the challenges for the press in the future. That was a legitimate challenge and if he studies carefully the words of the amendment tabled by my hon. Friend the Member for West Bromwich East (Tom Watson), he will see that there is a new ambition to get into some of the challenges around fake news that were looked at by Brian Leveson. That was not enough to satisfy the Secretary of State, however. In a letter to Conservative Members—I did not receive a copy—he offered some more objections, each one of which we can knock down.

The Secretary of State, in his letter to his colleagues, says that the first half of Leveson was “full and broad” when in fact it was partial and incomplete. He says that newspaper margins are under pressure, as if economic hardship is now some sort of defence against the full glare of justice. He says that the effect of the proposals will be “chilling”, when he knows that our fine broadcasters in this country operate under far more rigorous regulation than newspapers and that does not stop them pursuing the most extraordinarily brilliant investigations. He says that Sir Joe Pilling has “cleared” the IPSO scheme, but Joe Pilling was appointed by IPSO and IPSO itself says it does not comply with Leveson. He says that IPSO now has a low-cost arbitration scheme, but as the hon. Member for Wellingborough (Mr Bone) pointed out, MailOnline, Newsquest and Archant are all outside it, so it is not a universal scheme in the way the Secretary of State has tried to present it to the House this afternoon.

The final line of argument is that officials are very busy and inquiries are very expensive, and we should therefore just walk on by. I just do not think that that is good enough.

[Matt Hancock]

rose—

[Liam Byrne]

I am happy to hear from the Secretary of State why he thinks I am wrong.

[Matt Hancock]

The right hon. Gentleman is not making much progress. He is implying that broadcasters are under regulation but there is no chilling effect. The description of a chilling effect, raised by my hon. Friend the Member for Croydon South (Chris Philp), is the expected impact of section 40, under which anybody would be able to take a newspaper to court and get costs awarded against the newspaper even if they did not have anything in their case. The broadcasters do not have to deal with anything like that. On the point about things being brought to light, will he confirm that the case of Mr Ford, which he raised and was raised in an argument for Leveson 2, was in fact raised in the original Leveson inquiry and was therefore covered?

[Liam Byrne]

Mr Ford’s activity was, but not Mr Ford’s allegations that the activity is already under way.

Let me come on to the point the Secretary of State made about the future of press regulation. The scheme he voted for—it was elegantly designed, I think, by the right hon. Member for West Dorset (Sir Oliver Letwin)—was a good scheme. There have been a couple of important objections to it made by many of our constituents, but more importantly by many journalists in our local media. The first objection is that a royal charter is somehow tantamount to a state authorised, state-operated regulator, which will somehow impede free speech. Royal charters have for centuries been the basis by which we have given stature to universities and learning societies like the Royal Society. None of them confront restrictions on free speech in any way whatever. That argument, frankly, is fanciful.

14:44

There was then the argument about the dangers of cost shifting. That is why new clause 20 would create a threshold of about £100 million, along with other proposals, to ensure that good newspapers, which would not necessarily be able to withstand these kinds of risks, are protected. We have listened hard to the debate.

[Mrs Main]

On a point of clarification, does the right hon. Gentleman know of any other scenario within the civil courts where the costs have to be paid regardless?

[Liam Byrne]

The point is that this was well debated at the time and the argument presented by those on the Treasury Bench was that there was no point in setting up a new regulator and then doing nothing to create incentives to join that regulator. That was the proposal the Secretary of State voted for the first time around.

[Joanna Cherry]

I was not in the House at the time, so correct me if I am wrong. Am I right in thinking that Brian Leveson recommended that incentivisation to encourage the publishers to sign up to an independent regulator?

[Liam Byrne]

Absolutely. It was a very delicate job. The structure put in place was designed to minimise any dangers to free speech but create incentives for the press to move to a scheme that gave low-cost arbitration and access to justice for victims. That is at the core of this debate.

I want to conclude with two points. The first is, I suppose, a plea to the House. If we have learned one thing from the scandals of the past 10 to 12 years—whether the expenses scandal, Hillsborough or Orgreave—it is that it is never the right thing to look at a scandal and decide that it is too expensive or that we are too busy to get to the bottom of what happened. That is the core of the argument to let Brian Leveson finish his job.

I want to give the last word to the father of Madeleine McCann. When Gerry McCann found out that the Government were proposing to scrap the second half of the Leveson inquiry, he said:

“This Government has abandoned its commitments to the victims of press abuse to satisfy the corporate interests of large newspaper groups… This Government has lost all integrity when it comes to policy affecting the press.”

I hope that we can reflect on those harsh words this afternoon and rescue the integrity that is currently endangered by the Government’s determination to sweep aside the lessons of history.

[Several hon. Members rose—]

[Madam Deputy Speaker (Dame Rosie Winterton)]

Order. Before I call the next speaker, I remind colleagues that this debate has to end at four o’clock and I know a lot of people want to speak.

[Mr John Whittingdale (Maldon) (Con)]

Thank you, Madam Deputy Speaker. I will take heed of your reminder about the time limit.

It is now over 10 years since the Culture, Media and Sport Committee, of which I was Chair at the time, first conducted an inquiry into phone hacking. We conducted several subsequent inquiries, which helped to bring out the truth about the extent of phone hacking and other illegal practices. Without the work of the Committee, those would not have been revealed, although I pay tribute to The Guardian’s brilliant piece of investigative journalism. A lot of this debate concerns investigative journalism.

I think all of us were shocked by the revelation of phone hacking and we were determined that action should be taken to prevent anything like that happening again. In the 10 years that have passed, however, a lot has changed. The News of the World closed down as a result of the revelations. There were prosecutions, with 10 journalists convicted for illegal practices, although it is worth bearing in mind that 57 were cleared.

Obviously, we had the Leveson inquiry. Even if it did not complete all that it originally wanted to complete because of the ongoing criminal cases, it still took over a year and cost £49 million. It produced a swathe of recommendations, although the royal charter was not one of them. My right hon. Friend the Member for West Dorset (Sir Oliver Letwin) had the brainchild of the royal charter and, accompanying that, sanctions in the Crime and Courts Act 2013 for newspapers that did not sign up to a regulator recognised under the royal charter.

Since that time, two major changes have taken place. When the royal charter was designed and the recognition panel was established, I do not think anybody in Parliament ever expected that not a single newspaper—certainly no national newspaper and virtually no local newspaper—would be willing to sign up to a regulator that applied for recognition under the royal charter. It was not just the usual whipping boys; the News International papers, the Daily Mail, the Daily Mirror. The Financial Times, The Guardian, The Independent and all the local newspapers refused. I have met the publications that have agreed to join IMPRESS, but they are micro-publishers. No major publisher was willing to go along with the royal charter. We originally invented the idea of sanctions with the view that one newspaper, or perhaps two, might stand out against the rest. We never intended to bring in a sanction that would punish, in what seems an incredibly unjust way, every single publisher. Their refusal to join is on a matter of principle, and we have to respect that.

What did happen was that they created a new regulator called IPSO, which has steadily evolved. To begin with, it was deficient in some ways. I had talks with IPSO and pointed out to it the areas where I felt that it needed to make changes, particularly through the introduction of an arbitration scheme, which was one of the key requirements under Leveson and which did not exist. However, IPSO has now made a lot of changes, including, as my right hon. Friend the Secretary of State pointed out, the inclusion of an arbitration scheme, which is compulsory for members who sign up to it. Those that are outside it are the local newspapers, against which virtually no complaint has ever been made, and which face the greatest peril from the economic situation that exists for newspapers.

[Paul Farrelly]

The Select Committee, of which the right hon. Gentleman was a wonderful Chair, recently recommended unanimously, cross-party, the partial commencement of section 40 to give those publications protections—to protect investigative journalism—if they joined the approved regulator. That was one of the options in the consultation. What is wrong with that course?

[Mr Whittingdale]

The hon. Gentleman is an old friend—we sat together on the Committee for 10 years—and I have some sympathy with what he says. When I talked to the publications that had joined IMPRESS, they said that one reason they had done so was the possible protection offered if they were part of a recognised regulator, in that they would not have to pay costs even if they lost. That is a separate matter, but in this debate we are talking about the introduction of an amendment to provide not the carrot, but the stick—the punishment for newspapers that do not wish to sign up to a Government-approved regulator.

[Mr Bone]

Does my right hon. Friend think, deep in his heart, that anything has changed since IPSO was introduced?

[Mr Whittingdale]

Deep in my heart, yes I do. As I was about to say, I believe that there is a different climate. Of course, it does not mean that no newspaper ever does something that is a cause for complaint or invades people’s private lives—I have suffered at the hands of the press, but that is the price we pay in this place. However, I believe that the imposition of sanctions of the type that are proposed under the amendments would be deeply damaging to a free press.

In terms of what has changed, I challenge those who criticise IPSO to say where it now fails to meet the requirements under the royal charter. I have been through the royal charter, and there are perhaps three tiny sections where we could say that the wording of the IPSO codes is not precisely in line with the royal charter, but those are incredibly minor. They make no substantial difference whatever. IPSO has not applied for recognition under the royal charter, not because it does not comply, but because there is an objection in principle on the part of every single newspaper to a Government-imposed system, which this represents.

[Peter Heaton-Jones]

The fundamentally worrying thing is that this seeks to make a connection between local media organisations having to join the state regulator and their facing, if they do not, the awful costs that they might have to pay even if they win a court case. The right hon. Member for Birmingham, Hodge Hill (Liam Byrne) described that as an incentive, but it is not—it is coercion. It is only an incentive inasmuch as a condemned man on the gallows has an incentive not to stand on the trapdoor.

[Mr Whittingdale]

Of course, I agree entirely with my hon. Friend, and I am glad that he focused on local newspapers, because I referred to two changes. The first is the establishment of IPSO, which I believe in all serious respects is now compliant with what Lord Leveson wanted. The second is the complete change in the media landscape that has taken place in the last 10 years.

My right hon. Friend the Secretary of State mentioned the number of local newspapers that have gone out of business. We are seeing more continue to do so. There is likely to be further consolidation within the newspaper industry and the economics are steadily moving against newspapers. That is a real threat to democracy, because newspapers employ journalists who cover proceedings in courts, council chambers and, indeed, in this place. The big media giants who now have the power and influence—Google, Facebook and Twitter—do not employ a single journalist, so my right hon. Friend is absolutely right to have established the examination into the funding and future of the press. It is about looking forward, and that is where the House should be concentrating its efforts. It should not be looking backwards and going over again the events of more than 10 years ago; the world has changed almost beyond recognition.

[Damian Collins (Folkestone and Hythe) (Con)]

My Digital, Culture, Media and Sport Committee colleague, the hon. Member for Newcastle-under-Lyme (Paul Farrelly)—I call him my hon. Friend—raised the recommendations of the Committee last year. One was that for IPSO to be considered compliant in any way with the spirit of Leveson, it should have a compulsory industry-funded arbitration scheme. While IPSO might not be perfect, does my right hon. Friend the Member for Maldon (Mr Whittingdale) agree that this is one of the most significant areas where IPSO has responded to pressure to try to make itself more compliant?

[Mr Whittingdale]

I agree very much with my hon. Friend. Indeed, I would have found it far harder to make the argument that IPSO was basically now compliant with Lord Leveson had it not introduced the scheme that is now in place. That was the biggest difference between the system as designed by my right hon. Friend the Member for West Dorset in the royal charter and IPSO, and that, as my hon. Friend the Member for Folkestone and Hythe (Damian Collins) said, has rightly been removed.

What we do in this debate is being watched around the world. This country is seen as a bastion of freedom and liberty, and a free press is an absolutely essential component of that. I say to those who are proposing these amendments: do not just listen to the newspaper industry, which is, as I say, united against this—that includes The Guardian, despite the efforts of Labour Front Benchers to somehow exclude them. Listen to the Index on Censorship, Reporters Without Borders, the Committee to Protect Journalists—campaigning organisations that are fighting oppression of the press around the world. They say that if this House brings in this kind of measure, it would send a terrible signal to those who believe in a free press. I therefore hope that the amendments will be rejected.

[Edward Miliband]

I shall speak in support of new clause 18, which stands in my name and that of the right hon. and learned Member for Rushcliffe (Mr Clarke) and four Members from four other parties across the House. I have tabled the new clause for one overriding reason: to keep a promise that everyone in this House made to the victims of phone hacking and other unlawful conduct.

I well remember the day when I, David Cameron and Nick Clegg went to meet the victims—the McCanns, the Dowlers and all the others. You know what we said to them? We said, “This time it will be different. This time we won’t flinch. We promise you we’ll see this process through.” Painstakingly, with the victims, we designed a two-part Leveson process—let us be under no illusions about that. The first part was to look at the general issues around the culture and ethics of the press and the relationship with politicians, and the second part, promised back then, was to look, after the criminal trials were over, at, in the words of Sir Brian, who did what to whom and why it happened. Who covered it up? Did the police? Did politicians? Did other public servants?

15:00

Leveson was to be a two-part process, and here is what David Cameron said, when part 1 of Leveson was completed in November 2012:

“One of the things that the victims have been most concerned about is that part 2 of the investigation should go ahead…It is right that it should go ahead, and that is fully our intention.”—[Official Report, 29 November 2012; Vol. 554, c. 458.]

No ifs, no buts, no maybes—a clear promise to victims of the press. And here we come today, and we have the Government saying, “Let’s dump this promise. It’s too expensive—it’s a distraction.” How dare they? How dare they say that to the McCanns, the Dowlers and all the other victims? How can we be here? I say to Members across the House, in whatever party, that this is about our honour—this is a matter of honour, of a promise we made.

[Mr Rees-Mogg]

The right hon. Gentleman mentions what David Cameron, Nick Clegg and he did. It seems to have escaped his attention that David Cameron is no longer Prime Minister, that Nick Clegg is no longer Deputy Prime Minister, and that two former MPs and one still-existing MP cannot bind their successors. A new Parliament has the right to consider these matters afresh, and that is what is rightly being done today after countless police investigations and prosecutions, many of which ended in acquittal.

[Edward Miliband]

I give way to the hon. Gentleman’s constitutional knowledge, but I do not give way to him on morality—and this is a question of morality and of promises we made. Remember the furore about all these events? Remember how people looked at us? Remember how all of us—Labour Governments too—were too close to the press, and how we said we would learn lessons? I take my responsibility too. We should have acted earlier. All Governments should take responsibility. To break this promise would be contemptible.

[Anna Soubry]

The right hon. Gentleman is making a powerful case, and he is right about morality and the promises made, most importantly, to victims. I am struggling to support him, however, because while those are powerful arguments, I am actually more interested in the outcome. Is there a genuine purpose that can be achieved other than—and it is a strong argument—keeping a promise to victims? It will be a hollow promise if it is nothing more than a talking shop.

[Edward Miliband]

Other people have asked, “Why can’t the police just do it?” That suggests that whenever there is a police inquiry there cannot be a public inquiry. My answer is this: there is no substitute for the breadth of a public inquiry and its ability to see what happened. A lot has emerged even since Leveson 1. At that time, people said the hacking and improper behaviour were just at the News of the World. There have now been revelations at The Sun, allegations about The Sunday Times and a decade of blagging by John Ford—a whole range of allegations that we need to get to the bottom of. Crucially, we need to learn lessons for the future. The useful thing that can come out of this is to prevent there being future victims like the McCanns and the Dowlers. That is why so many victims have written to the Prime Minister, saying it is important to get to the truth—not just for them but to prevent it from ever happening again.

[Ian Paisley]

The right hon. Gentleman is making a very compelling argument—one that I am not turned off by—but when I read new clause 18 dispassionately, I see that it offers me a consultation process with parties in Northern Ireland and an Assembly that is not functioning. It offers me very little, although it promises me something. In new clause 23, the Government from the Dispatch Box today have offered me an actual inquiry. I ask him, then, to put himself in my shoes: should we take what we have or a promise of what we might get?

[Edward Miliband]

If the new clause was agreed today, the Secretary of State would within three months have to trigger an inquiry covering Northern Ireland. The point about consultation is precisely to consult with Members of the Assembly, Ministers, if they are in place, and those in Scotland as well. That is simply a point about consultation. I know the hon. Gentleman cares passionately about these issues.

I believe that the case is stronger, not weaker, than it was when a two-part inquiry was envisaged. Sir Brian says we should go ahead. When else do we put a presiding judge in charge of an inquiry and then ignore his advice? Frankly, it is extraordinary. As I said to the right hon. Member for Broxtowe (Anna Soubry), the wrongdoing turned out to be more widespread than we thought. I urge hon. Members, in the time left before the vote, to look at the Kerslake report on what happened in Manchester, because it is a shocking indictment of what a minority—I emphasise that it is a minority besmirching the good name of the whole press—did. I quote from it briefly:

“One mother, who was herself seriously injured as was her daughter, spoke of the press ringing her on her mobile whilst she was recovering in hospital…The child of one family was given condolences on the doorstep before official notification of the death of her mother.”

This is what some of the relatives of the victims said:

“By far the worst thing was the press”,

“They...are a disgrace, they don’t take no for an answer, they have a lack of standards and ethics,”

“The press were not respectful of grief.”

It is all very well people saying, “Everything’s changed”, but to my mind, I’m afraid, that report is proof that not enough has changed, because the same intrusion into the lives of innocent people is carrying on.

[Mr Bone]

I remember David Cameron, as I do the right hon. Gentleman, on this subject. It was one of David Cameron’s best moments. I have not yet heard an argument from the Government to explain why we cannot have Leveson 2. If it is money, that argument is ridiculous. Why does he think the Government do not want Leveson 2?

[Edward Miliband]

That is a very good point, and I will come to it in a moment, because it is important to answer it.

I want to make another point about the case for carrying on with Leveson 2. I do not believe, I am afraid, that the regulator we have, IPSO, is nearly good enough. It bears too much resemblance to its predecessor, the Press Complaints Commission. Just think about this regulator: it has not imposed a single fine, demanded a single equal-prominence front page correction or launched a single systematic inquiry, as it has the power to do. The Home Affairs Select Committee heard testimony in February on Islamophobia, and I think I am right in saying that under section 12 of the editors code, on discrimination, hate speech and so on, IPSO has received 8,000 complaints and upheld one. The Chair of the Committee and its members seemed rather shocked by that.

I return now to the very pertinent question from the hon. Member for Wellingborough (Mr Bone). Why might the Government not be going ahead with Leveson 2? Let us look at their issues briefly. They say it is about press freedom. I believe that a free critical press is an essential part of our society, and that includes being critical of politicians, but, as everyone agreed after Milly Dowler, that freedom does not include the ability to barge into the lives of innocent people. The press themselves said that was wrong. On press freedom and Leveson 2, the National Union of Journalists said in March that the decision not to allow Lord Leveson to complete his task was

“bad for politics, bad for journalism and bad for the public.”

The NUJ says it is not an attack on press freedom!

The Government have also said that the inquiry would go over ground already coved by the police, but as I said, it was always understood that Leveson 2 could only start after the police inquiries had been completed, and that there was no substitute for a broad public inquiry. It is claimed that it misses the big important issues of Facebook and fake news, but those are in the terms of reference as recommended by Sir Brian Leveson. It is said that local papers will be affected, but we have specifically written the terms of reference to exclude local papers, so that there can be no question of their being affected. It is said that this is all backward- looking, but in any other area of public life, would the press really be saying that the truth is time-limited, and that we do not need to get to the truth because it was all a few years ago? Lastly, there is the argument about cost, which I think is a terrible argument. Leveson 1 cost £5 million. That is a substantial sum, but I have to say that, given decades of abuse and broken promises in relation to the press, I think that it is worth spending such a sum to get to the truth.

Now I will answer the question asked by the hon. Member for Wellingborough. I set out the reasons adduced by the press and, indeed, the Government for the cancellation of this inquiry, but let us be absolutely honest: there is one overriding reason for the Government’s decision to abandon it, and that needs to be discussed. It is quite simple. It is fear: fear about the wrath of the press. That is why the Government have made this decision. The press do not want the inquiry to go ahead, and the Government fear attacks on them by the press. That is why the last Labour Government did not take action against the press: they too feared the consequences. But what did we also say after 2011? We said, “Never again will we succumb to fear and make the wrong decisions, which are not in the public interest.”

Fear of the powerful is not a good reason to allow them to trample on the powerless when we have it in our hands to do something about it. It goes against everything that we promised in 2011. It goes against everything that we said to the victims and everything that we told the public. We should remember the words of the current Prime Minister—the current Prime Minister—who said on the steps of Downing Street:

“When we take the big calls, we’ll think not of the powerful, but you.”

I say, “Think of the public, not the powerful, today.” There is still a chance that this time it will be different. We can learn the lessons of failed reform and no change. We can keep our promises to the victims and make change happen, and the way to do that is by voting for new clause 18.

[Mr Kenneth Clarke]

I rise to support new clause 18, and I shall try to do so as briefly as possible as we are running out of time. I have also put my name to amendment 14, which I hope the hon. Member for Sunderland Central (Julie Elliott) will press to a Division if she catches your eye, Madam Deputy Speaker. However, new clause 18 and Leveson 2 are my main concern because, as the then Justice Secretary, I was personally involved in setting up the Leveson inquiry.

I have the highest regard for Sir Brian Leveson, and I share his indignation that the House is going back on previous commitments about the completion of that inquiry. Sir Brian is now the president of the Queen’s Bench division. He is the head of criminal justice in this country. He does not think that his inquiry completed its work or inquired into all the matters into which it was supposed to be inquiring. He said in his public letter that he “fundamentally” disagreed with the proposal to cancel the inquiry now and prevent it from going any further. I share his views, and I do not think that the House should lightly set them aside.

It was always clear when the inquiry was established that there would have to be a second part. In his statement when the inquiry was first announced, the then Prime Minister said:

“The second part of the inquiry will examine the extent of unlawful or improper conduct at the News of the World and other newspapers, and the way in which management failures may have allowed it to happen. That part of the inquiry will also look into the original police investigation and the issue of corrupt payments to police officers, and will consider the implications for the relationships between newspapers and the police.”—[Official Report, 13 July 2011; Vol. 531, c. 312.]

Those are the things that we are saying that we perhaps do not want to inquire into any further, for what seem to me—with great respect to my right hon. Friend the Secretary of State, who made a valiant effort to put forward the case on behalf of the Government— to be quite inadequate reasons.

When the first part of Leveson was completed, the then Government recommitted to holding the second part. I cannot recall anyone in the House objecting to the idea that we were waiting for the inquiry to be completed once the police inquiries were over. On 29 November 2012, the then Prime Minister said:

“When I set up the inquiry, I also said that there would be a second part to investigate wrongdoing in the press and the police, including the conduct of the first police investigation. That second stage cannot go ahead until the current criminal proceedings have concluded, but we remain committed to the inquiry as it was first established.”

That was the commitment of the Government of which I was a member, of which my right hon. Friend was a member, and of which half the present Government were members. No one objected to that in the House. Indeed, I think that my right hon. Friend took pride in rebutting what was eloquently described by the right hon. Member for Doncaster North (Edward Miliband) as the fear—the craven fear—that most Governments have felt of Her Majesty’s press during much of the time that I have been in Parliament.

15:15

When the Prime Minister announced that there was to be a second inquiry, he quoted Lord Leveson as saying:

“over the last 30-35 years and probably much longer, the political parties of UK national Government and of UK official Opposition, have had or developed too close a relationship with the press in a way which has not been in the public interest.”—[Official Report, 29 November 2012; Vol. 554, c. 446.]

He rejected that, and I do not think the House should put aside that rejection too lightly.

In the present mad climate of political debate, I think that quite a lot of people—for one reason or another, as has always been the case in politics—are currying favour with the proprietors and editors of newspapers, or are fearful of those proprietors and editors. It is difficult to deny that that may have played a part in the sudden decision that we do not want to know any more about matters such as relationships between the police and the press.

[Mr Bone]

Will my right hon. and learned Friend give way?

[Mr Clarke]

I do not want to take too long, but I will give way.

[Mr Bone]

What my right hon. and learned Friend has said was the crux of David Cameron’s point. Political parties have got too close to the press. The only reason I can see for abandoning Leveson 2 would be if that had stopped. Does my right hon. and learned Friend think that it has stopped?

[Mr Clarke]

I fear that my hon. Friend is probably right, although I should give some credit to my right hon. and hon. Friends in government. I would like to give them the benefit of the doubt, but my suspicions are as strong as those of my hon. Friend.

[Paul Farrelly]

The Government also asked the public what they thought. When they announced the results of the consultation, it quickly became clear that the Secretary of State had set aside two petitions signed by more than 200,000 people who were in favour of Leveson 2, but counted 62,000 pro forma newspaper coupons that were against it, just because they had been returned in envelopes. Does the right hon. and learned Gentleman think that that is a rather odd way in which to judge the outcome of a consultation, and perhaps a little biased?

[Mr Clarke]

I personally will give my right hon. and hon. Friends the benefit of the doubt—I am sure that every representation was considered extremely carefully—but, in the end, it is for the House to decide what goes on.

The first argument that seems to be raised is about the lapse of time and the fact that we are talking about such a long time ago—2012; 2011—that we cannot spend public money on reopening former issues. It has already been said that quite a lot has happened since then. At the time of Leveson 1, I do not think that anyone knew that The Sun was involved in hacking. I do not think that anyone realised that Trinity Mirror was as mired in criminality as News International, and that it had gone in for hacking. They have tried to cover up the details since then by settling every civil claim that has been brought against them because they do not wish to give any evidence in public, or to have any evidence heard in public against them.

The other issue that has not gone away, about which the right hon. Member for Doncaster North, the former Leader of the Opposition, spoke very eloquently, is the treatment of the victims. There have been other incidents since that time. The Manchester bombing is a plain and obvious example. Victims of tragic occasions such as terrorist outrages still find, far too often, that their gardens fill with photographers. Weeping relatives find that their doors are being knocked on so that they can be asked for comment. They are interviewed when they are plainly still badly shaken up, and probably not yet able to cope with the pressures.

I think that quite a lot has happened, but it has taken some time. It is not actually that long, in my aged recollection, since 2012. This consideration has never been applied to any other public inquiry, and we have lots of public inquiries. When trying to refute the moves against them, the press go back to 1961 in order to attack Mr Mosley and resurrect his activities as a student—they were fairly startling—with his notorious father.

The sexual offences inquiry—a very important inquiry—is making very slow progress. It is inquiring into allegations against public figures now dead, going back for decades. In any other context, shock would be expressed about a scandal of the scale we had in the case of the behaviour of the press. To say, “Oh, that’s too late now; it’s all gone by and we do not wish to know any more about it,” would be greeted with outrage and treated as a ridiculous argument, and I really do not think that we should accept it.

The Independent Press Standards Organisation is a big improvement on what we had before, but it is plainly not an independent regulator. If we had a group of people with the authority of those involved in part one of the Leveson inquiry recommending a new independent regulator, no other public body—none of the utilities, for instance—would be allowed to turn around and say, “We refuse to comply. We will be regulated, but only by a regulator whom we appoint and can change at any stage.” That would be dismissed.

The Government can address all the unworthy suspicions we have that their decision is motivated by a combination of fear and desire to curry favour. They should recover their courage and let the process go ahead, and we will see whether the press really have anything much to fear. I do not think that legitimate journalism and the very many honest journalists have anything to fear. As has been said—I am sure this is true in the House of Commons—everybody in public life in this country thinks that a free and fearless press is a key part of our liberties, and it is a joke to start presenting any moves to investigate as a threat to the freedom of the press.

The final argument that has been used against the proposal is that as the press are under great commercial pressures and face lots of challenges, we should not allow this to go ahead. I cannot think of any other body of organisations of such public importance that could claim, “We are under a bit of pressure, and there is a lot of competition; it is worse than it was a few years ago.” We should certainly tackle the digital market. I think it is quite obvious that Facebook and others are publishers. We should get away from the fiction that they are not publishers, and they should be subject to the same regulation as publishers, but that is another issue.

I supported Leveson when it was set up and I believe it should be completed. Leveson should not be cancelled. There are probably policemen still serving who are hoping that their corrupt relationship with the media will not be investigated further because they have got away with it so far. There are probably journalists still working—editors, even, still in post—who knew perfectly well that they were acting illegally in sourcing private information about public figures not just in politics, but in sport and theatre—anybody who achieves B-list celebrity status in this country. It is still the case that nothing sells newspapers like celebrity sex and scandal—no doubt long may that continue—but we must have a look at the ethical standards that should be applied to every possible sort of story.

This is not just about the law; it is also about ethics. We want more respect for our free press, and a proper Leveson 2 could eventually lead to that being achieved.

[Julie Elliott (Sunderland Central) (Lab)]

It is a real pleasure to follow the right hon. and learned Member for Rushcliffe (Mr Clarke) and my right hon. Friend the Member for Doncaster North (Edward Miliband), with whom I agree entirely on Leveson 2. I shall address my remarks to amendment 14, which stands in my name and those of colleagues.

First, let us consider the situation now. We have two self-regulatory bodies for the British press and news publishers: IPSO and IMPRESS. These regulators each have standards codes that apply to their members in the news publishing industry. One of the standards codes is listed in the Bill. The Government are happy to give publishers following that code a qualified exemption from the laws that apply to most other professions and industries. Those publishers are, in short, more free to process people’s personal data. That is right, and it allows for, and supports, investigative journalism in the public interest. The other code is not in the Bill, and publishers following that code are less free to process personal data, to conduct investigations and to hold the powerful to account.

People might be surprised to learn which regulator has that statutory recognition. It is not IMPRESS, the new regulator that meets all the requirements of the royal charter on press regulation in the way that this Parliament hoped for after Leveson. The regulator to which the Government are giving these privileges is IPSO, the regulator that has set its face against Parliament and will have nothing to do with statutes or charters.

The cross-party amendment 14 has been tabled in the spirit of the consensus in the House five years ago. It simply says that there must be fair and equal rights for members of IMPRESS. As the first and only regulator approved under the framework that Parliament supported, IMPRESS has worked hard to meet the standards that Leveson set. It has an independently appointed board. It wrote its own code, after extensive public consultation, and it receives funding from a charity, the Independent Press Regulation Trust. IPSO’s arrangements have been subject to no such scrutiny.

IMPRESS is open to the world. Its funding arrangements, appointments, code and regulatory scheme have been published and pored over. In October 2016, the Press Recognition Panel, an arm’s length public body established by royal charter, confirmed that IMPRESS does indeed meet the Leveson standards. That decision was challenged in the courts by the News Media Association, and every single objection that it made was thrown out. That was not widely reported, because most national newspapers choose only to publish bad news, smears and innuendoes about IMPRESS. I believe that the Government have been influenced by those news reports and have chosen to adopt a non-co-operation attitude to IMPRESS.

[Chris Philp]

Will the hon. Lady give way?

[Julie Elliott]

No; there is not enough time.

It is because of the Government’s intransigence that we are debating the amendment. I wish that we did not need to take up parliamentary time with this issue. I wish that the Government had dealt with it long before now. However, as the Secretary of State says, we are where we are: the odd situation in which IPSO, the regulator that turns its back on Parliament and the public, is listed in the Data Protection Bill, but IMPRESS, the regulator that is publicly accountable, is not. The Government have stonewalled every attempt by IMPRESS for inclusion in the list of journalism codes in schedule 2 or existing legislation since 2016. For a long time, they refused even to consider the issue. Last September, they finally accepted IMPRESS’s application. Since then, they have simply said that the issue is “under consideration”. I now ask the Government to give the case that has been made in this debate proper consideration. I will not press amendment 14 to a Division, but I would be grateful for a full response from the Minister.

[Mr Andrew Mitchell (Sutton Coldfield) (Con)]

I draw the House’s attention to my entry in the Register of Members’ Financial Interests. I want to make a few general comments, particularly on new clause 18, where the House faces a fine judgment on which way to proceed.

The arguments in favour of new clause 18 are strong. David Cameron promised what it proposes. I was in the Cabinet at the time and remember him making that promise and it was unequivocal, which is reflected in the new clause. Brian Leveson has confirmed his belief that another inquiry should go ahead. In the House of Lords, Lady Hollins set out persuasively the three reasons why the inquiry should proceed. There was also Lord Kerslake’s powerful testimony following the Manchester tragedy that lessons have still not been learned about press intrusion. While Lord Kerslake appears to have found a new role adjacent to the Labour Front-Bench team, he remains one of Britain’s most senior and distinguished former civil servants and his views cannot be idly dismissed. In addition, as has been alluded to by several Members, the victims affected by what we are trying to address today may find it, frankly, rather distasteful that a bunch of politicians appear to be rushing to ingratiate ourselves with the media for fear that they will persistently trawl through our dustbins.

15:31

Those arguments seem to be valid reasons in support of new clause 18, but there are other points that have not yet been adequately weighed up by some of those who so eloquently proposed the new clause. We need to consider whether another all-singing, all-dancing inquiry, with the enormous public expense of teams of lawyers, will tell us much that we do not already know. We must also disaggregate issues affecting the police from those affecting the press. They are different things, and in some ways they are mutually contradictory.

First, the written media is already facing serious financial challenges, and I am not only talking about the national newspapers. My right hon. and learned Friend the Member for Rushcliffe (Mr Clarke) made too light of that point. On the “Today” programme this morning, we heard from Marc Reeves, the editor of the Birmingham Mail. Sutton Coldfield used to have two excellent local newspapers. Our constituents trust the veracity of the local media far more than the national media, but they do not buy local newspapers. The Royal town of Sutton Coldfield lost its second newspaper some time ago, and the Royal Sutton Coldfield Observer, which is owned by Trinity Mirror, has been seriously cut. This week, the paper sees the departure of the distinguished, award-winning editor, Mr Gary Phelps, who has been in post for 16 years, and I genuinely fear for the paper’s future. The question is whether the media has learned its lessons, whether there is anything seriously new to be learned and whether yet further digging up of issues by the roots holds real public benefit.

Secondly, it is worth bearing in mind the importance to all citizens of the preservation of the right to a free press, and I do not think that the House has adequately reflected on that. In all the time that I have been involved in international development, in government and in opposition, I have learned that the key ingredient for development, good governance, stability and accountability is transparency. Last week, the House agreed that the overseas territories must accept open registers of ownership, and the information that was critical to convincing many of us came through British investigative journalism exposing corruption and dishonesty through the Panama and Paradise papers. Across the developing world, Britain has championed and strongly supported, with taxpayers’ money, the development of a free media, but it matters here in Britain, too. I think it was a US President who said that if he had to choose between democracy and a free press, he would go for the latter. I conclude that a disrespectful, raucous, cynical, irreverent, suspicious media is the ineluctable price that we pay for our freedoms and rights and also the way in which we hold the rich and the powerful to account.

There is a final point that cuts across new clause 18: a powerful press is all too often itself the way in which we hold the police to account. In Britain, we give the police great power and great trust. We also—unwisely in my view—leave them largely to police themselves. All too often it is the media that exposes police corruption, rather than the organs of the state, and there are numerous examples of that. We should remember the role of the media in exposing the truth behind the shooting of Jean Charles de Menezes, the appalling events at Hillsborough and the heartbreaking way in which the Lawrence family were treated by the police. The Times played a role in exposing the Rotherham child abuse scandal, and The Guardian revealed sexual predators in the police both in 2012 and more recently. Journalists and, indeed, Members of this House played a role in exposing the appalling police corruption in the fitting up of the Birmingham Six, an event which is still to achieve closure in Birmingham as the families strive to achieve justice through the ongoing coroner’s inquiry.

It is the role of the free media fearlessly to expose wrongdoing, and we would not be serving the interests of our constituents if, by our action today, we took steps that could diminish their ability to do that. Members of the House will make up their own minds on the new clause. This seems to be the nub of the issue, but it is a very fine judgment as to which way our votes should fall.

[Christine Jardine]

I rise to speak in support of new clause 18, which my friend the right hon. Member for Doncaster North (Edward Miliband) has so eloquently described. I would like to bring three words to the House’s attention: fairness, justice and honour. I say this not as a politician—although I hope that we would all hold those things in high regard—but because they were the things that originally attracted me to a career in journalism. That career involved challenging the establishment, questioning power and holding politicians, big business and powerful vested interests in the media to account. Standing here today, I do not believe that any good ethical journalist or publication in this country has anything to fear from revisiting the Leveson 2 inquiry. Indeed, I feel that they have much to gain.

The right hon. Member for Doncaster North talked about going with David Cameron and Nick Clegg to speak to the victims of hacking, and about the promise that was made to them. I respect the fact that this Parliament should not be held by promises made by another Parliament, but it would say a lot about this House if we were to hold to that promise. It would disappoint the public who are watching us today, hoping that we will live up to those standards of fairness, justice and honour, if we did not do so. That promise was about redressing the balance of power between the vested interests of the press and the ordinary public in this country. The ordinary public deserve the right of redress, and they deserve to have the confidence that everything has been done to safeguard their rights.

We have heard from the Secretary of State that time has moved on and that we live in a different culture, but the fact that we have moved on should not prevent us from learning the lessons of the past. If history teaches us nothing else, it teaches us that if we do not learn the lessons of the past, we will repeat our mistakes in the future. Today, we have an opportunity to ensure that we do not repeat the mistakes that led to the hacking of phones, to the intrusion into the lives of innocent members of the public and to the hounding of people who were already suffering, such as the family of Madeleine McCann.

More than that, this is an opportunity to reassure members of the public who, as we have heard time and again over the past few years, feel detached from politics. They feel that we have somehow let them down and that we are not listening to them, but this is an opportunity to tell them that we are listening and that we hear their outrage at the way in which members of the public have been treated by the press—not all the press, but certain elements of it. I also understand the pressures on the press, as a former journalist and the wife of a journalist. I lived through my late husband’s employer announcing redundancies five years in a row, every year at Christmas. That is the reality of life in the modern media, but that is an economic pressure. It is not a pressure brought about by any ethical standard. It is the modern reality of the changes in technology that the industry is learning to deal with.

The Secretary of State said that we had moved on and that the culture had changed, but I would like to remind him of the Kerslake inquiry, and of the behaviour in Manchester that we have heard about. Unfortunately, the truth is that there are unethical individuals in every walk of life and in every profession. However, every other profession in this country—dentistry, medicine, the law—has a regulatory body that is underpinned by statute and that holds its members to a standard. Why should newspapers be exempt? I say that not as somebody who wants any restriction on freedom of the press; I believe that the fourth estate is a fundamental pillar of a free and democratic society. But it also has to be answerable, because freedom of the press should not mean freedom to intrude, to harass or to manufacture stories about individuals; it should mean freedom to be responsible and to be held to account, by the law and by the politicians who make the law.

Friends, the victims of the hacking scandal will be watching today to see whether we live up to the promise that was made to them by the right hon. Member for Doncaster North, by David Cameron and by Nick Clegg. I appeal to Members, please do not be found wanting.

[Bill Wiggin (North Herefordshire) (Con)]

May I say what a sad day this is? I pay tribute to the Government Chief Whip, who has worked exceptionally hard to try to protect the Government, which is particularly difficult, given that in 2013, 530 MPs voted for section 40 and only 13 voted against it. That vote was for the Courts and Crime Act 2013, which enshrined in law the low-cost access to justice that Lord Justice Leveson had agreed was necessary. That was first suggested by Lord Justice Leveson and then agreed to almost unanimously by all parties in Parliament. However, it was never commenced. Successive Secretaries of State have refused to commence the cost-shifting provisions that are so necessary for access to justice.

Section 40 is not about punishing newspapers that do not sign up to IMPRESS; it is about ensuring low-cost access to justice for vulnerable victims of press abuse. The first part of the Leveson inquiry uncovered the horrific scale of abuse, which was endemic in the press, and there have been many court cases and convictions since. Section 40 ensures that publishers that are members of an independently approved regulator that provides low-cost arbitration do not face expensive court costs. It also ensures that victims of press abuse who have been attacked by publications that are not members of an independently approved regulator can access justice via the courts without having to be extremely wealthy.

There are myths about section 40. The first myth is that it would damage the freedom of the press. That is not true. The press recognition panel is independent and was created by royal charter. The charter enshrines press freedom in law. Criterion 8 states that any regulator

“must take into account the importance of freedom of speech, the interests of the public… the need for journalists to protect confidential sources of information, and the rights of individuals.”

Criterion 17 states that such a regulator’s board

“should not have the power to prevent publication of any material, by anyone, or at any time”.

The only way to change the charter would be by a 66% super-majority in both Houses, plus the unanimous agreement of the press recognition panel’s board. This is not state regulation of the press, or even state regulation of the press regulators; it is the creation of an independent body that will apply Leveson’s criteria for a press regulator to potential self-funded press regulators.

The second myth is that it would threaten the existence of local newspapers. Again, that is not true. New clause 20 would protect all local newspapers that have a turnover of less than £100 million and exempt them from section 40. Local newspapers were generally omitted from the criticisms of Leveson 1, and they are rightly protected from costs shifting, which they might be unable to afford.

[Mike Wood (Dudley South) (Con)]

Does my hon. Friend recognise that condition B would still leave 85% of local newspapers covered by the cost-shifting provisions, directly threatening their ability to conduct the investigative journalism that so many of them do so well?

[Bill Wiggin]

I am grateful to my hon. Friend for that intervention. What he is saying is that businesses with a turnover of over £100 million should be protected, which I think is probably not quite right.

[Richard Drax (South Dorset) (Con)]

Does my hon. Friend find it odd that the lesser-off papers, as I think he phrased it, get away with some things and the better-off papers do not? Is that not discriminatory and completely against British justice?

15:44

[Bill Wiggin]

No, it is not, because it is designed to ensure that victims get access to justice. My hon. Friend will find the local papers that may come under section 40 are owned by large companies. The exemption is designed for the charitable sector, which I will come to in just a moment.

One myth is that The Guardian would not be covered. The Daily Mail claimed that The Guardian would be exempt from the section 40 provisions, which is not true. The Guardian would not be covered by condition A, which is necessary to protect the not-for-profit publications that cannot afford cost-shifting—that is the sector my hon. Friend is interested in protecting. The Guardian would be covered because it declares dividends to its members, so it would not be exempted as the Daily Mail suggested.

The next myth about section 40 is that newspapers would have to sign up to IMPRESS, which again is simply not true. The press are at liberty to create their own regulator, which would simply have to fulfil all 29 of Leveson’s criteria in order to become approved. Becoming approved does not require any sort of Government or political approval. It is entirely independent, and there is nothing to stop IPSO applying to become an approved regulator, except that it does not want to provide the low-cost access to justice that is so necessary. IPSO is a press protector, not a press regulator. I say that because it has introduced what it calls a compulsory low-cost arbitration scheme, but that is not right. IPSO’s scheme is voluntary, and the Financial Times, MailOnline and other newspapers not regulated by IPSO have not signed up. Newspapers may leave the scheme whenever they choose. Although I am delighted that IPSO has admitted that low-cost arbitration is necessary, to add to the express view of both Houses and the recommendation of Lord Leveson, this version of it is not right.

If we choose not to vote for section 40 today, we will once again be trusting the newspapers to reform themselves. They say we should trust them and that IPSO is reforming, coincidentally at exactly the same time as we vote on this important new clause. The newspapers have shown again and again that they cannot be trusted, and we must vote to ensure that all victims have access to low-cost justice, which is so necessary. Lord Leveson, both Houses of Parliament and, now, IPSO have all agreed this is necessary. Section 40 has been on the statute book for five years, and it is now time it was commenced.

[Brendan O'Hara (Argyll and Bute) (SNP)]

Time is tight, so I will be brief. I rise to speak in support of new clause 18 because the Scottish National party has been clear throughout that all individuals should be able to seek redress when they feel they have been the victim of press malpractice. It benefits each and every one of us to have a media that is both transparent and accountable.

The Scottish National party is committed to ensuring that the practices that led to the Leveson inquiry never happen again. We have been equally clear, however, that if there is to be a second part of the Leveson inquiry, the distinct Scottish legal context must be taken into account and the Scottish Government must be consulted on the scope and scale of any future inquiry.

Both my hon. Friend the Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) and I raised that on Second Reading and again in Committee, and we put on record our dismay at the wholly inappropriate, indeed lazy, amendments made in the other place that sought to impose a blanket, one-size-fits-all, Truro-to-Thurso policy without any cognisance of the devolution settlement or of the fact that matters of press regulation and criminal justice are wholly devolved to the Parliament in Holyrood. I do not think it unreasonable to expect the House of Lords to know that both criminal justice and press regulation, and all the associated issues of the culture, practice and ethics of the press, fall under devolved competence, and that any blanket UK-wide proposal could only negatively impact on devolution.

Scottish National party Members have said repeatedly that, as long as the Scottish Government are consulted and the Scottish legal system is taken into account, we would be happy to support a Leveson inquiry.

[Liam Byrne]

I am following the hon. Gentleman’s argument closely. He is right to say that we need to ensure the sins of the past are not repeated, which is why we need new clause 20. Can he confirm whether his party’s position is to support new clause 20 today or, as I have heard, to abstain on it?

[Brendan O'Hara]

The right hon. Gentleman may push that to the vote, but new clause 20 seeks to impose on Scotland a system of press regulation from Westminster, even though this is wholly devolved. I appreciate the work that he and others in Hacked Off have tried to do to square that circle, but it has not been squared. Therefore, we cannot support a system of press regulation that will be imposed from Westminster on Holyrood. That is why I am so pleased that new clause 18 is presented in such a way that it takes on board all of our concerns. I am extremely grateful for the efforts made by the right hon. Member for Doncaster North (Edward Miliband) in fashioning the new clause in a way that allows the second part of the Leveson inquiry to take place while recognising the devolution settlement and the distinct position in Scotland. I commend the passion with which he put across his argument this afternoon.

There will be some who will say that part 2 of Leveson is now out of date—indeed, the Secretary of State said as much when he announced his plans to scrap it. People are right to say that much has changed since 2011, which was before Brexit or the fake news agenda dominated the newspapers, but we need to ask ourselves how much has really changed since the height of the phone hacking scandal. The Government are convinced that a step change has taken place, but I question whether it really has. The Secretary of State has pointed out that the world has changed, but these concerns are as relevant now as they were then.

We have seen how social media is now part and parcel of everyday life. Surely the time is right, with this second part of Leveson, to investigate the role of social media companies—Facebook, Twitter and others—in spreading fake news and disinformation. I would like to think that this inquiry would look to build on the outstanding work being done by the hon. Member for Folkestone and Hythe (Damian Collins) and his Select Committee in pursuing fake news and the spread of disinformation.

On behalf of the Scottish National party, I am delighted to have added my name to new clause 18 because I believe any reasonable person would agree that the terms of reference for this part of the Leveson inquiry have not yet been met.

[Mr Rees-Mogg]

The freedom of the press is so overwhelmingly precious that we should preserve it even if sometimes the press upsets us. It is amazing how many people who have had run-ins with the press have suddenly found that they think it should be more tightly regulated. Fascinatingly, the Daily Mail carried out a survey of their lordships House and discovered that more than a third of those who voted to shackle the press had been embarrassed by the press. May I therefore pay all the greater tribute to my right hon. Friend the Member for Sutton Coldfield (Mr Mitchell) for his impressive speech? He has suffered at the hands of the press, yet he recognises that the value of the free press is one of the great jewels in the crown of our constitutional settlement. But it is a jewel that has become tarnished because of actions taken by us; in four years, we have fallen in the rank of free nations from 30th to 40th, so that now we are behind Trinidad and Tobago, and, perhaps most insultingly, even below the French in freedom of the press. The clauses before us today should fill us with shame because they go to the heart of what we should believe in, in terms of our liberties, our freedoms and the rule of law.

New clause 18 seeks to have double jeopardy. Why did Leveson 2 not go ahead in the first place? It was because of a fear that trials could be made unfair by an inquiry going ahead at the same time. But those trials have now gone ahead and juries have returned verdicts. Interestingly, what verdicts did they return? It was not the ones the establishment expected. By and large, the journalists were found not guilty—not guilty of misusing any public office—but the police who gave them information were found guilty.

Was that not proper justice at work? The receiving of information as a journalist is your job, but the giving of information as a policeman is against the law. They have had justice, they have had the inquiry and they have been through the process, but now people want to put those found innocent through it again. They want to call them in front of a tribunal, to put them on oath, to put them in the stocks, and to let them be quizzed, questioned and interrogated so that the freedom of the press can be undermined and pressurised by those who have sometimes had the sharp lash of the press’s tongue against them. It reeks of self-interest.

[Richard Drax]

Will my hon. Friend give way?

[Mr Rees-Mogg]

I will not because time is so short.

Let me move on to new clause 20, the Max Mosley amendment. A man more cynical than I am might think that £540,000 donated to a certain political party might have had some influence on the desire to support IMPRESS—on the desire to support the creation of a known racist, a man who went on anti-Semitic rallies with his father. A party suffering from accusations of anti-Semitism wishes to be in bed with a man who gave it £540,000 to pursue his cause, which is to make IMPRESS the regulator of our free press, in the pocket of one of the most disreputable figures in this nation. IPSO has made leaps and bounds to ensure that it is a proper self-regulator. It is a self-regulator free from the taint of state approval, state authorisation and state regulation—

[Bill Wiggin]

And from responsibility.

[Mr Rees-Mogg]

The freedoms and liberties that we hold so dear should be preserved, even when they are inconvenient to us. The House may not have heard what my hon. Friend next to me just said. Baldwin’s line was that the press had the “prerogative of the harlot”—power without responsibility. That was his line, but I would rather have a free press in that condition than a Government-approved, propagandised press that took away all our ancient liberties. These new clauses must be wiped out and cut from the legislative book. We must preserve our freedoms.

[Ian C. Lucas]

This has been an excellent debate. I wish to tell the House about a victim of press intrusion. Twenty-one years ago, I represented the bodyguard who survived the crash that killed the Princess of Wales. I made it clear to the press at the time that neither he nor his family wished to be pressured, followed or traced by journalists. They completely disregarded my advice and treated someone who was gravely ill, and his family, appallingly.

When I saw the statements in the Kerslake inquiry last year, I saw that, contrary to what the Secretary of State has said, the situation has not changed. Individuals who were the victims of grave crimes were abused, their privacy invaded and their lives turned around by press intrusion. That was after Sir Brian Leveson had conducted his inquiry, and after he, a greatly respected judge, had told the Government that he fundamentally disagreed with their decision not to proceed with the second part of the Leveson inquiry.

Earlier, I intervened on the Secretary of State and asked him why the Conservative party previously supported the terms of section 40 of the Crime and Courts Act 2013, which it now opposes. For all the eloquence we have just heard, the position is that the Conservative party is breaking a promise that was made to victims of crime by a Prime Minister of this great country, the United Kingdom. Anyone who supports the Government today should be ashamed of themselves, because those victims of crime are the powerless who need protection from the powerful. The powerful are the people who are too close to those who have governmental power.

As my right hon. Friend the Member for Doncaster North (Edward Miliband) said, we know why this decision is being made—why the Conservative party is backing away from the promise made by a Conservative Prime Minister: it is frightened of the press and its influence. It is a shameful step that it is taking. I appeal to all individual and independent Members of this House to stand up for the powerless against the powerful and to support new clause 18. I implore the Secretary of State to be straightforward with the House.

Question agreed to.

New clause 19 accordingly read a Second time, and added to the Bill.

16:00

Proceedings interrupted (Programme Order, this day).

The Deputy Speaker put forthwith the Questions necessary for the disposal of business to be concluded at that time (Standing Order No. 83E).

New Clause 22

Review of processing of personal data for the purposes of journalism

“(1) The Commissioner must—

(a) review the extent to which the processing of personal data for the purposes of journalism complied with the data protection legislation during the review period,

(b) prepare a report of the review, and

(c) submit the report to the Secretary of State.

(2) “The review period” means the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force.

(3) The Commissioner must—

(a) start the review within the period of 6 months beginning when the review period ends, and

(b) submit the report to the Secretary of State before the end of the period of 18 months beginning when the Commissioner started the review.

(4) The report must include consideration of the extent of compliance (as described in subsection (1)(a)) in each part of the United Kingdom.

(5) The Secretary of State must—

(a) lay the report before Parliament, and

(b) send a copy of the report to—

(i) the Scottish Ministers,

(ii) the Welsh Ministers, and

(iii) the Executive Office in Northern Ireland.” ).—(Matt Hancock.)

This new clause would be inserted after Clause 172. It requires the Information Commissioner to carry out a review of, and report on, the extent to which the processing of personal data for the purposes of journalism complied with the data protection legislation during the first 4 years of its operation. The Secretary of State must lay the report before Parliament and send a copy of the report to the Scottish Ministers, the Welsh Ministers and the Executive Office in Northern Ireland (formerly the office of the First Minister and deputy First Minister in Northern Ireland.

Brought up, and added to the Bill.

New Clause 23

Data protection and journalism code

“(1) The Commissioner must prepare a code of practice which contains—

(a) practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation, and

(b) such other guidance as the Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.

(2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(3) Before preparing a code or amendments under this section, the Commissioner must consult such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(c) persons who appear to the Commissioner to represent the interests of data subjects.

(4) A code under this section may include transitional provision or savings.

(5) In this section—

“good practice in the processing of personal data for the purposes of journalism” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—

(a) the interests of data subjects and others, including compliance with the requirements of the data protection legislation, and

(b) the special importance of the public interest in the freedom of expression and information;

‘trade association’ includes a body representing controllers or processors.” ).—(Matt Hancock.)

This new Clause would be inserted after Clause 123. It requires the Commissioner to prepare a code of practice giving guidance about the processing of personal data for the purposes of journalism. Clauses 124 to 126 (approval, publication and effect) would apply to the code (see amendments 146, 147, 148, 149 and 150).

Brought up, and added to the Bill.

New Clause 18

Data protection breaches by national news publishers

“(1) The Secretary of State must, within the period of three months beginning with the day on which this Act is passed, establish an inquiry under the Inquiries Act 2005 into allegations of data protection breaches committed by or on behalf of national news publishers and other media organisations.

(2) Before setting the terms of reference of and other arrangements for the inquiry the Secretary of State must—

(a) consult the Scottish Ministers with a view to ensuring, in particular, that the inquiry will consider the separate legal context and other circumstances of Scotland;

(b) consult Northern Ireland Ministers and members of the Northern Ireland Assembly with a view to ensuring, in particular, that the inquiry will consider the separate legal context and other circumstances of Northern Ireland;

(c) consult persons appearing to the Secretary of State to represent the interests of victims of data protection breaches committed by, on behalf of or in relation to, national news publishers and other media organisations; and

(d) consult persons appearing to the Secretary of State to represent the interests of news publishers and other media organisations (having regard in particular to organisations representing journalists).

(3) The terms of reference for the inquiry must include requirements—

(a) to inquire into the extent of unlawful or improper conduct by or on behalf of national news publishers and other organisations within the media in respect of personal data;

(b) to inquire into the extent of corporate governance and management failures and the role, if any, of politicians, public servants and others in relation to failures to investigate wrongdoing at media organisations within the scope of the inquiry;

(c) to review the protections and provisions around media coverage of individuals subject to police inquiries, including the policy and practice of naming suspects of crime prior to any relevant charge or conviction;

(d) to investigate the dissemination of information and news, including false news stories, by social media organisations using personal data;

(e) to consider the adequacy of the current regulatory arrangements and the resources, powers and approach of the Information Commissioner and any other relevant authorities in relation to—

(i) the news publishing industry (except in relation to entities regulated by Ofcom) across all platforms and in the light of experience since 2012;

(ii) social media companies;

(f) to make such recommendations as appear to the inquiry to be appropriate for the purpose of ensuring that the privacy rights of individuals are balanced with the right to freedom of expression.

(4) In setting the terms of reference for the inquiry the Secretary of State must—

(a) have regard to the current context of the news, publishing and general media industry;

(b) must set appropriate parameters for determining which allegations are to be considered;

(c) determine the meaning and scope of references to national news publishers and other media organisations for the purposes of the inquiry.

(5) Before complying with subsection (4) the Secretary of State must consult the judge or other person who is likely to be invited to chair the inquiry.

(6) The inquiry may, so far as it considers appropriate—

(a) consider evidence given to previous public inquiries; and

(b) take account of the findings of and evidence given to previous public inquiries (and the inquiry must consider using this power for the purpose of avoiding the waste of public resources).

(7) This section comes into force on Royal Assent.” .—(Edward Miliband.)

This new clause would require the establishment of an inquiry under the Inquiries Act 2005 as recommended by Lord Justice Leveson for Part two of his Inquiry.

Brought up.

Question put, That the clause be added to the Bill.

16:01

Division 152

Ayes: 295

---

Labour: 237
Scottish National Party: 32
Liberal Democrat: 11
Conservative: 5
Plaid Cymru: 4
Independent: 4
Green Party: 1

Noes: 304

---

Conservative: 293
Democratic Unionist Party: 9
Independent: 1
Labour: 1

Clause 124

Approval of data-sharing, direct marketing and age-appropriate design codes

Amendments made: 146, page 69, line 21, leave out “or 123” and insert

“,123 or (Data protection and journalism code)”.

See the explanatory statement for NC23.

Amendment 147, page 69, line 32, leave out “or 123” and insert

“,123 or (Data protection and journalism code)”.

See the explanatory statement for NC23.

Amendment 148, page 69, line 39, leave out “or 123” and insert

“,123 or (Data protection and journalism code)”.

See the explanatory statement for NC23.

Amendment 149, page 70, line 5, leave out “and 123” and insert

“,123 and (Data protection and journalism code)”.—(Matt Hancock.)

See the explanatory statement for NC23.

Clause 125

Publication and review of data-sharing, direct marketing and age-appropriate design codes

Amendment made: 150, page 70, line 18, leave out “or 123(2)” and insert—

“,123(2) or (Data protection and journalism code)(2)”.—(Matt Hancock.)

See the explanatory statement NC23.

Clause 196

General interpretation

Amendment made: 145, page 115, line 42, at end insert—

“( ) section (Review of processing of personal data for the purposes of journalism)(2);”.—(Matt Hancock.)

This amendment provides that EU Regulation No. 1182/71 determining the rules applicable to periods, dates and time limits does not apply for the purposes of the 4 year period described in subsection (2) of NC22.

New Clause 13

Information Orders

‘(1) This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice.

(2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—

(a) information referred to in the information notice;

(b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section141(2)(b).

(3) The order—

(a) may specify the form in which the information must be provided,

(b) must specify the time at which, or the period within which, the information must be provided, and

(c) may specify the place where the information must be provided.’—(Margot James.)

This new clause would be inserted after Clause 143. It provides that, where a person has failed to comply with an information notice (given under Clause 141), the Information Commissioner may seek a court order requiring the person to provide the information referred to in the notice or other information which the Commissioner requires for a reason specified in the notice. See also Amendments 57, 58 and 60.

Brought up, and read the First time.

[The Minister for Digital and the Creative Industries (Margot James)]

I beg to move, That the clause be read a Second time.

[Madam Deputy Speaker (Mrs Eleanor Laing)]

With this it will be convenient to discuss the following:

Government new clause 14—Destroying or falsifying information and documents etc.

Government new clause 15—Applications in respect of urgent notices.

Government new clause 16—Post-review powers to make provision about representation of data subjects.

Government new clause 17—Reserve forces: data-sharing by HMRC.

New clause 3—Bill of Data Rights in the Digital Environment—

‘Schedule [Bill of Data Rights in the Digital Environment] shall have effect.’

This new clause would introduce a Schedule containing a Bill of Data Rights in the Digital Environment.

New clause 4—Bill of Data Rights in the Digital Environment (No. 2)—

‘(1) The Secretary of State shall, by regulations, establish a Bill of Data Rights in the Digital Environment.

(2) Before making regulations under this section, the Secretary of State shall—

(a) consult—

(i) the Commissioner,

(ii) trade associations,

(iii) data subjects, and

(iv) persons who appear to the Commissioner or the Secretary of State to represent the interests of data subjects; and

(b) publish a draft of the Bill of Data Rights.

(3) The Bill of Data Rights in the Digital Environment shall enshrine—

(a) a right for a data subject to have privacy from commercial or personal intrusion,

(b) a right for a data subject to own, curate, move, revise or review their identity as founded upon personal data (whether directly or as a result of processing of that data),

(c) a right for a data subject to have their access to their data profiles or personal data protected, and

(d) a right for a data subject to object to any decision made solely on automated decision-making, including a decision relating to education and employment of the data subject.

(4) Regulations under this section are subject to the affirmative resolution procedure.’

This new clause would empower the Secretary of State to introduce a Bill of Data Rights in the Digital Environment.

New clause 6—Targeted dissemination disclosure notice for third parties and others (No. 2)—

‘In Schedule 19B of the Political Parties, Elections and Referendums Act 2000 (Power to require disclosure), after paragraph 10 (documents in electronic form) insert—

‘10A (1) This paragraph applies to the following organisations and individuals—

(a) a recognised third party (within the meaning of Part 6);

(b) a permitted participant (within the meaning of Part 7);

(c) a regulated donee (within the meaning of Schedule 7);

(d) a regulated participant (within the meaning of Schedule 7A);

(e) a candidate at an election (other than a local government election in Scotland);

(f) the election agent for such a candidate;

(g) an organisation or individual formerly falling within any of paragraphs (a) to (f); or

(h) the treasurer, director, or another officer of an organisation to which this paragraph applies, or has been at any time in the period of five years ending with the day on which the notice is given.

(2) The Commission may under this paragraph issue at any time a targeted dissemination disclosure notice, requiring disclosure of any settings used to disseminate material which it believes were intended to have the effect, or were likely to have the effect, of influencing public opinion in any part of the United Kingdom, ahead of a specific election or referendum, where the platform for dissemination allows for targeting based on demographic or other information about individuals, including information gathered by information society services.

(3) This power shall not be available in respect of registered parties or their officers, save where they separately and independently fall into one or more of categories (a) to (h) of sub-paragraph (1).

(4) A person or organisation to whom such a targeted dissemination disclosure notice is given shall comply with it within such time as is specified in the notice.’’

This new clause would amend the Political Parties, Elections and Referendums Act 2000 to allow the Electoral Commission to require disclosure of settings used to disseminate material where the platform for dissemination allows for targeting based on demographic or other information about individuals.

New clause 10—Automated decision-making concerning a child—

‘(1) Where a data controller expects to take a significant decision based solely on automated processing which may concern a child, the controller must, before such processing is undertaken—

(a) deposit a data protection impact assessment with the Commissioner, and

(b) consult the Commissioner (within the meaning of Article 36 of the GDPR), regardless of measures taken by the controller to mitigate any risk.

(2) Where, following prior consultation, the Commissioner does not choose to prevent processing on the basis of Article 58(2)(f) of the GDPR, the Commissioner must publish the part or parts of the data protection impact assessment provided under subsection (1), relevant to the reaching of that decision.

(3) The Commissioner must produce and publish a list of safeguards to be applied by data controllers where any significant decision based solely on automated processing may concern a child.

(4) For the purposes of this section, the meaning of “child” is determined by the age of lawful processing under Article 8 of the GDPR and section 9 of this Act.’

New clause 11—Education: safe use of personal data—

‘(1) The Children and Social Work Act 2017 is amended as follows.

(2) In section 35 (other personal, social, health and economic education), after subsection (1)(b) insert—

‘(1A) In this section, “personal, social, health and economic education” shall include education relating to the safe use of personal data.’’

This new clause would enable the Secretary of State to require that personal information safety be taught as a mandatory part of the national PSHE curriculum.

New clause 12—Health bodies: disclosure of personal data—

‘(1) In section 261 of the Health and Social Care Act 2012 (Health and Social Care Information Centre: dissemination of information) after subsection (5) insert—

‘(5A) A disclosure of personal data may be made under subsection (5)(e) only if it is made—

(a) to and at the request of a member of a police force, and

(b) for the purpose of investigating a serious offence.

(5B) In subsection (5A)—

“personal data” has the meaning given by section 3 of the Data Protection Act 2018;

“police force” means—

(a) a police force within the meaning of section 101 of the Police Act 1996, and

(b) an equivalent force operating under the law of any Part of the United Kingdom or of another country; and

“serious offence” means—

(a) a serious offence within the meaning of Part 1 of Schedule 1 to the Serious Crime Act 2007,

(b) an offence under the Offences Against the Person Act 1861, the Sexual Offences Act 2003, the Explosive Substances Act 1883, the Terrorism Act 2000 or the Terrorism Act 2006, and

(c) the equivalent of any of those offences under the law of any Part of the United Kingdom or of another country.’

(2) In section 13Z3 of the National Health Service Act 2006 () at the end insert—

‘(3) A disclosure of personal data may be made under subsection (1)(g) only if it is made—

(a) to and at the request of a member of a police force, and

(b) for the purpose of investigating a serious offence.

(4) In subsection (3)—

“personal data” has the meaning given by section 3 of the Data Protection Act 2018;

“police force” means—

(a) a police force within the meaning of section 101 of the Police Act 1996, and

(b) an equivalent force operating under the law of any Part of the United Kingdom or of another country; and

“serious offence” means—

(a) a serious offence within the meaning of Part 1 of Schedule 1 to the Serious Crime Act 2007,

(b) an offence under the Offences against the Person Act 1861, the Sexual Offences Act 2003, the Explosive Substances Act 1883, the Terrorism Act 2000 or the Terrorism Act 2006, and

(c) the equivalent of any of those offences under the law of any Part of the United Kingdom or of another country.’

(3) In section 14Z23 of the National Health Service Act 2006 (clinical commissioning groups: permitted disclosure of information) at the end insert—

‘(3) A disclosure of personal data may be made under subsection (1)(g) only if it is made—

(a) to and at the request of a member of a police force, and

(b) for the purpose of investigating a serious offence.

(4) In subsection (3)—

“personal data” has the meaning given by section 3 of the Data Protection Act 2018;

“police force” means—

(a) a police force within the meaning of section 101 of the Police Act 1996, and

(b) an equivalent force operating under the law of any Part of the United Kingdom or of another country; and

“serious offence” means—

(a) a serious offence within the meaning of Part 1 of Schedule 1 to the Serious Crime Act 2007,

(b) an offence under the Offences against the Person Act 1861, the Sexual Offences Act 2003, the Explosive Substances Act 1883, the Terrorism Act 2000 or the Terrorism Act 2006, and

(c) the equivalent of any of those offences under the law of any Part of the United Kingdom or of another country.’

(4) In section 79 of the Health and Social Care Act 2008 (Care Quality Commission: permitted disclosures) after subsection (3) insert—

‘(3A) A disclosure of personal data may be made under subsection (3)(g) only if it is made—

(a) to and at the request of a member of a police force, and

(b) for the purpose of investigating a serious offence.

(3B) In subsection (3A)—

“personal data” has the meaning given by section 3 of the Data Protection Act 2018;

“police force” means—

(a) a police force within the meaning of section 101 of the Police Act 1996, and

(b) an equivalent force operating under the law of any Part of the United Kingdom or of another country; and

“serious offence” means—

(a) a serious offence within the meaning of Part 1 of Schedule 1 to the Serious Crime Act 2007,

(b) an offence under the Offences against the Person Act 1861, the Sexual Offences Act 2003, the Explosive Substances Act 1883, the Terrorism Act 2000 or the Terrorism Act 2006, and

(c) the equivalent of any of those offences under the law of any Part of the United Kingdom or of another country.’’

This new clause would prevent personal data held by the NHS from being disclosed for the purpose of the investigation of a criminal offence unless the offence concerned is serious, which is consistent with the NHS Code of Confidentiality and GMC guidance on confidentiality. It would also mean that any such disclosure could only be made to the police, and not, for example, to Home Office immigration enforcement officials.

New clause 24—Safeguards on the transfer of data for lethal force operations overseas—

‘(1) A transferring controller may not make any transfer of personal data outside the United Kingdom under Part 4 of this Act where—

(a) the transferring controller knows, or should know, that the data will be used in an operation or activity that may involve the use of lethal force, and

(b) there is a real risk that the transfer would amount to a breach of domestic law or an internationally wrongful act under international law.

(2) Where the transferring controller determines that there is no real risk under subsection (1)(b), the transfer is not lawful unless—

(a) the transferring controller documents the determination, providing reasons, and

(b) the Secretary of State has approved the transfer in writing.

(3) Any documentation created under subsection (2) shall be provided to the Information Commissioner and the Investigatory Powers Commissioner within 90 days of the transfer.

(4) A “transferring controller” is a controller who makes a transfer of personal data outside the United Kingdom under Part 4 of this Act.

(5) For the purposes of subsection (1)(b),

(c) “domestic law” includes, but is not limited to,

(i) soliciting, encouraging, persuading or proposing a murder contrary to section 4 of the Offences Against the Person Act 1861,

(ii) conspiracy to commit murder contrary to section 1 or 1A of the Criminal Law Act 1977,

(iii) aiding, abetting, counselling, or procuring murder contrary to section 8 of the Accessories and Abettors Act 1861,

(iv) offences contrary to section 44, 45 and 46 of the Serious Crime Act 2007,

(v) offences under the International Criminal Court Act 2001.

(d) “International law” includes, but is not limited to, Article 16 of the 2001 Draft Articles on the Responsibility of States for Internationally Wrongful Acts.

(6) The Secretary of State must lay before Parliament, within six months of the coming into force of this Act, guidance for intelligence officers on subsections (1) and (2).

(7) The Secretary of State must lay before Parliament any subsequent changes made to the guidance reported under subsection (6) within 90 days of any changes being made.’

Amendment 18, in clause 7, page 5, line 24, after “subsections” insert “(1A),”.

Government amendment 22.

Amendment 19, page 5, line 24, at end insert—

‘(1A) A primary care service provider is not a “public authority” or “public body” for the purposes of the GDPR merely by virtue of the fact that it is defined as a public authority by either—

(a) any of paragraphs 43A to 45A or paragraph 51 of Schedule 1 to the Freedom of Information Act 2000, or

(b) any of paragraphs 33 to 35 of Schedule 1 to the Freedom of Information (Scotland) Act 2002 (asp 13).’

Government amendments 23 and 24.

Amendment 4, in clause 10, page 6, line 37, leave out subsections (6) and (7).

This amendment would remove delegated powers that would allow the Secretary of State to vary the conditions and safeguards governing the general processing of sensitive personal data.

Amendment 5, in clause 14, page 8, line 11, at end insert—

‘(2A) A decision that engages an individual’s rights under the Human Rights Act 1998 does not fall within Article 22(2)(b) of the GDPR (exception from prohibition on taking significant decisions based solely on automated processing for decisions that are authorised by law and subject to safeguards for the data subject’s rights, freedoms and legitimate interests).

(2B) A decision is “based solely on automated processing” for the purposes of this section if, in relation to a data subject, there is no meaningful input by a natural person in the decision-making process.’

This amendment would ensure that where human rights are engaged by automated decisions these are human decisions and provides clarification that purely administrative human approval of an automated decision does make an automated decision a ‘human’ one.

Amendment 6, page 9, line 36, leave out clause 16.

This amendment would remove delegated powers that would allow the Secretary of State to add further exemptions.

Government amendment 143.

Amendment 7, in clause 35, page 22, line 14, leave out subsections (6) and (7).

This amendment would remove delegated powers that would allow the Secretary of State to vary the conditions and safeguards governing the general processing of sensitive personal data.

Amendment 151, in clause 49, page 30, line 19, at end insert—

‘(1A) A controller may not take a significant decision based solely on automated processing if that decision affects the rights of the data subject under the Human Rights Act 1998.’

Amendment 2, in clause 50, page 30, line 28, at end insert—‘and

(c) it does not engage the rights of the data subject under the Human Rights Act 1998.’

This amendment would ensure that automated decisions should not be authorised by law if they engage an individual’s human rights.

Amendment 8, in clause 86, page 51, line 21, leave out subsections (3) and (4).

This amendment would remove delegated powers that would allow the Secretary of State to vary the conditions and safeguards governing the general processing of sensitive personal data.

Amendment 3, in clause 96, page 56, line 38, after “law” insert—

‘unless the decision engages an individual’s rights under the Human Rights Act 1998.’

This amendment would ensure that automated decisions should not be authorised by law if they engage an individual’s human rights.

Amendment 9, page 63, line 27, leave out clause 113.

This amendment would remove delegated powers that would allow the Secretary of State to create new exemptions to Part 4 of the Bill.

Government amendments 25 to 37.

Amendment 20, in clause 144, page 81, line 11, leave out “7 days” and insert “24 hours”.

This amendment would reduce from 7 days to 24 hours the minimum period which must elapse before a controller or processor has to comply with an assessment notice which has been issued by the Commissioner and which the Commissioner has stated should be complied with urgently.

Government amendments 38 to 71.

Government new schedule 3—Transitional provision etc.

New schedule 1—Bill of Data Rights in the Digital Environment—

‘The UK recognises the following Data Rights:

Article 1—Equality of Treatment

Every data subject has the right to fair and equal treatment in the processing of his or her personal data.

Article 2—Security

Every data subject has the right to security and protection of their personal data and information systems.

Access requests by government must be for the purpose of combating serious crime and subject to independent authorisation.

Article 3—Free Expression

Every data subject has the right to deploy his or her personal data in pursuit of their fundamental rights to freedom of expression, thought and conscience.

Article 4—Equality of Access

Every data subject has the right to access and participate in the digital environment on equal terms.

Internet access should be open.

Article 5—Privacy

Every data subject has the right to respect for their personal data and information systems and as part of his or her fundamental right to private and family life, home and communications.

Article 6—Ownership

Every data subject has the right to own and control his or her personal data.

Every data subject is entitled to proportionate share of income or other benefit derived from his or her personal data as part of the right to own.

Article 7—Control

Every data subject is entitled to know the purpose for which personal data is being processed. Data controllers should not deliberately extend the gathering of personal data solely for their own purposes. Government, corporations, public authorities and other data controllers must obtain meaningful consent for the use of people’s personal data. Every data subject has the right to own curate, move, revise or review their personal data.

Article 8—Algorithms

Every data subject has the right to transparent and equal treatment in the processing of his or her personal data by an algorithm or automated system.

Every data subject is entitled to meaningful human control in making significant decisions – algorithms and automated systems must not be deployed to make significant decisions.

Article 9—Participation

Every data subject has the right to deploy his or her personal data and information systems to communicate in pursuit of the fundamental right to freedom of association.

Article 10—Protection

Every data subject has the right to safety and protection from harassment and other targeting through use of personal data whether sexual, social or commercial.

Article 11—Removal

Every data subject is entitled to revise and remove their personal data.

Compensation

Breach of any right in this Bill will entitle the data subject to fair and equitable compensation under existing enforcement provisions. If none apply, the Centre for Data Ethics will establish and administer a compensation scheme to ensure just remedy for any breaches.

Application to Children

The application of these rights to a person less than 18 years of age must be read in conjunction with the rights set out in the United Nations Convention on the Rights of the Child. Where an information society service processes data of persons less than 18 years of age it must do so under the age appropriate design code set out in section 123 of this Act.’

Government amendments 72 and 73.

Amendment 16, in schedule 2, page 140, line 15, at end insert—

‘(1A) The exemption in sub-paragraph (1) may not be invoked in relation to offences under—

(a) sections 24, 24A, 24B or 24C of the Immigration Act 1971,

(b) section 21 of the Immigration, Asylum and Nationality Act 2006, or

(c) sections 33A and 33B of the Immigration Act 2014.’

Amendment 15, page 141, line 17, leave out paragraph 4.

Government amendments 141 and 142.

Amendment 10, page 152, line 24, leave out paragraph 19 and insert—

‘19 The listed GDPR provisions do not apply to personal data that consists of information which is protected by legal professional privilege or the duty of confidentiality.’

This amendment would ensure that both legal professional privilege and confidentiality are recognised within the legislation.

Government amendments 139, 74 and 75.

Amendment 11, in schedule 11, page 196, line 39, leave out paragraph 9 and insert—

‘9 The listed provisions do not apply to personal data that consists of information which is protected by legal professional privilege or the duty of confidentiality.’

This amendment would ensure that both legal professional privilege and confidentiality are recognised within the legislation.

Government amendments 140 and 76 to 80.

Amendment 21, in schedule 15, page 206, line 11, at end insert—

‘(1A) A warrant issued under subparagraph (1)(b) or (1)(c) of this paragraph does not require any notice to be given to the controller or processor, or to the occupier of the premises.’

This amendment would make it clear that a judge can issue a warrant to enter premises under subparagraphs 4(1)(b) or 4(1)(c) without the Commissioner having given prior notice to the data controller, data processor or occupier of premises.

Government amendments 81 to 85.

Amendment 12, page 208, line 13, leave out

“with respect to obligations, liabilities or rights under the data protection legislation”.

This amendment would ensure that both legal professional privilege and confidentiality are recognised within the legislation.

Amendment 13, page 208, line 21, leave out from “proceedings” to the end of line 23.

This amendment would ensure that both legal professional privilege and confidentiality are recognised within the legislation.

Government amendments 86 to 138.

[Margot James]

I shall start by addressing the Government amendments—[Interruption.]

[Madam Deputy Speaker (Mrs Eleanor Laing)]

Order. Will people who are leaving the Chamber please do so quietly? The Minister is making an important speech and people want to hear it. It is just rude to make a noise—unless you happen to be in the Chair.

[Margot James]

I propose to start my remarks by addressing the Government amendments to strengthen the powers of the Information Commissioner.

The investigation of the Information Commissioner’s Office into Cambridge Analytica is unprecedented in its scale and complexity. It has, necessarily, pushed the boundaries of what the drafters of the Data Protection Act 1998 and the parliamentarians who scrutinised it could have envisaged. Although we recognise that the Bill already expands and enhances the commissioner’s ability to enforce the requirements of the data protection legislation in such circumstances, the Government undertook to consider whether further provision was desirable in the light of the commissioner’s experience. Following extensive discussions with the commissioner and in Committee, we concluded that such provision is desirable. Our amendments will strengthen the commissioner’s ability to enforce the law, while ensuring that she operates within a clear and accountable structure. I will give a few examples.

First, amendments 27 and 28 will allow the commissioner to require any person who might have knowledge about suspected breaches of the data protection legislation to provide information. Previously, information could be sought only from a data controller or a data processor. That might be important where, for example, a former employee has information about the organisation’s processing activities.

Secondly, new clause 13 will allow the commissioner to apply to the court for an order to force compliance when a person fails to comply with a requirement to provide information. Organisations that might previously have been tempted to pay a fine for non-compliance instead of handing over the information will find themselves at risk of being in contempt of court if they do not comply.

Thirdly, amendments 30 and 45 will allow the commissioner to require controllers to comply with information or enforcement notices within 24 hours in some very urgent cases, rather than the seven days provided for in the existing law. Amendment 38 will allow the commissioner, in certain circumstances, to issue an assessment notice that can have immediate effect. Those amendments will allow the commissioner to obtain information about a suspected breach or put a stop to high-risk processing activities in a prompt and effective way. They will also allow her to carry out no-notice inspections without a warrant in certain circumstances.

Fourthly, new clause 14 will criminalise the behaviour of any person who seeks to frustrate an information or assessment notice by deliberately destroying, falsifying, blocking or concealing evidence that has been identified as relevant to the commissioner’s investigation.

Finally, we have taken this opportunity to modernise the commissioner’s powers. Storing files on an office server is rapidly becoming a thing of the past. Amendment 79 will enable the commissioner to apply for a warrant to access material that can be viewed via computers on the premises but that is held in the cloud.

When strengthening the commissioner’s enforcement powers, we have been mindful of the need to provide appropriate safeguards and remedies for those who find themselves under investigation. For example, when an information, assessment or enforcement notice containing an urgency statement is served on a person, new clause 15 will allow them to apply to the court to disapply the urgency statement. In effect, they will have a right to apply to the court to vary the timetable for compliance with the order. A court considering an application from the commissioner for an information order will be able to take into account all the relevant circumstances at the time, including whether an application has been brought by the person concerned under new clause 15 and whether the person has brought an appeal against the notice itself in the tribunal. These amendments have been developed in close liaison with the Information Commissioner. We are confident that they will give her the powers she needs to ensure that those who flout the law in our increasingly digital age are held to account for their actions.

I now turn to the representation of data subjects. I am very grateful to Baroness Kidron for her continued engagement on this subject. In particular, we agree that children merit special protection in relation to their personal data and that the review the Government will undertake shall look accordingly at the specific barriers young people and children face in enforcing their rights. Government new clause 16, as well as amendments 61, 62, 63, 70 and 75, ensures that they will.

 Government new clause 17 concerns maintaining contact with ex-regular reserve forces. This will allow Her Majesty’s Revenue and Customs to share contact detail information with the Ministry of Defence to ensure that the MOD is better able to locate and contact members of the ex-regular reserve.

New clause 12, on data sharing by health bodies, is in the name of my hon. Friend the Member for Totnes (Dr Wollaston), who chairs the Health and Social Care Committee. I know she and the Committee have significant and legitimate concerns about the operation of the memorandum of understanding between NHS Digital and the Home Office, which currently allows the sharing of non-clinical information, principally address information, for immigration purposes. The Select Committee has argued for the suspension of the MOU pending the outcome of a review of its impact by Public Health England. New clause 12 seeks to adopt a more long-term approach by narrowing the ability of NHS Digital to disclose information in connection with the investigation of criminal offences. The aim is to narrow the MOU’s scope, so that it only facilitates the exchange of personal data in cases involving serious criminality.

The Government have reflected further on the concerns put forward by my hon. Friend and her Committee. As a result, and with immediate effect, the data sharing arrangements between the Home Office and the NHS have been amended. This is a new step and it supersedes the position set out in previous correspondence between the Home Office, the Department for Health and Social Care and the Select Committee.

I know my hon. Friend and her colleagues have been particularly exercised by the contents of a letter dated 23 February from both the above-mentioned Departments to her Select Committee, in which it is stated that

“a person using the NHS can have a reasonable expectation when using this taxpayer-funded service that their non-medical data, which lies at the lower end of the privacy spectrum, will not be shared securely between other officers within government in exercise of their lawful powers”.

The bar for sharing data will now be set significantly higher. By sharing, I mean sharing between the Department of Health and Social Care, the Home Office and, in future, possibly other Departments. No longer will the names of overstayers and illegal entrants be sought against health service records to find current address details. The data sharing, relying on powers under the Health and Social Care Act 2012, the National Health Service Act 2006 and the Health and Social Care Act 2008, will only be used to trace an individual who is being considered for deportation action having been investigated for, or convicted of, a serious criminal offence that results in a minimum sentence of at least 12 months in prison.

The Government have a long-held policy on what level of serious criminality is deserving of deportation, given statutory force by the UK Borders Act 2007. When a custodial sentence of more than 12 months has been given, consideration for deportation must therefore follow. Henceforth, the Home Office will only be able to use the memorandum of understanding to trace an individual who is being considered for deportation action having been convicted of a serious criminal offence, or when their presence is considered non-conducive to the public good—for example, when they present a risk to public security but have yet to be convicted of a criminal offence.

16:30

[Alison Thewliss (Glasgow Central) (SNP)]

Can the Minister give me more reassurance about the Home Office and its activity in this regard? At the moment, I have constituents who, under paragraph 322(5) of the immigration rules, face being deported for making legitimate changes to their tax return through HMRC data being accessed. Will she reassure me about what the Home Office can do to make sure that this is not abused and misused for the purposes of meeting immigration targets?

[Margot James]

I will write to the hon. Lady and I hope to give her reassurance. This new higher bar concerns NHS data and that would obviously not catch within it errors on a tax return.

As now, the memorandum of understanding would also continue to operate when there are concerns about the welfare and safety of a missing individual—for example, vulnerable children and adults. That has always been the case. Personal information will only be disclosed to the Home Office or agencies under the purview of the Home Office. This is a significant restriction on the Home Office’s ability to use data held by the NHS. It is estimated that the change will exclude over 90% of the requests that have been satisfied to date.

[Sir Edward Davey (Kingston and Surbiton) (LD)]

The Minister talks about a memorandum of understanding giving reassurance to the House. I refer her to part 2 of schedule 2, which talks about exemptions from the general data protection regulation in respect of crime and taxation. Surely, the rights of individuals to have their data protected under that provision would address all these issues, and it would potentially supersede the memorandum of understanding.

[Margot James]

I will come on to the exemptions in terms of criminal activity and immigration in a wider context than NHS information in due course.

My right hon. Friend the Minister for Immigration is committed to sending a copy of an updated MOU to the Health and Social Care Committee shortly, but as I have indicated, the significant narrowing of the MOU will have immediate effect. This commitment is consistent with the intention underpinning new clause 12. I trust that on that basis, my hon. Friend the Member for Totnes and her colleagues will not press new clause 12. I am sure that if she has any questions, she will intervene on me, or that when she makes her remarks later, I might be invited to intervene on her. I thank my hon. Friend and all her Committee members for their work to establish higher principles in this area.

I turn to Opposition amendments 16 and 15 and Government amendments 141 and 142, on immigration. Amendment 15 would remove the provisions relating to effective immigration control in schedule 2. In responding to the amendment, I want to address some of the continued misunderstandings that have arisen around the purpose and scope of the provision, and I hope to persuade the House that this is a necessary and proportionate measure to protect the integrity of our immigration system. It has been suggested that the provisions have no basis in the GDPR, but article 23 expressly allows member states to restrict certain specified rights for the purpose of safeguarding

“other important objectives of general public interest of a…Member State”.

The maintenance of effective immigration control is one such objective.

[Sir Edward Davey]

Will the Minister confirm that article 23 of the GDPR does not specify immigration?

[Margot James]

It does not rule out immigration and it does allow the restriction of certain specified rights—not wholesale restrictions—for the purpose of safeguarding

“other important objectives of general public interest”.

The purpose is to provide a derogation for member states wide enough that they can pursue an overall Government policy in the general public interest. I would conclude that immigration is one such example. It has been suggested that the provisions represent a blanket carve-out of all a data subject’s rights. That is certainly not the case. I would like to reassure the right hon. Gentleman that we are being very selective about the rights that could be disapplied. The exemption will be applied only on a case-by-case basis and only where it is necessary and proportionate.

[Liam Byrne]

Has the Minister learnt nothing from the Windrush scandal? Here we have a Department of State that is not fantastic at keeping records. The idea of selectively carving out particular rights of particular people who need this information to fight tribunal cases strikes me as lunacy, given what we have learnt about the dysfunction at the Home Office.

[Margot James]

Perhaps if I continue my remarks, I can reassure the right hon. Gentleman that of course lessons have been learnt, not least by the Home Office itself, as both the former Home Secretary and the current Home Secretary have made abundantly clear to the House.

The exemption in the amendment is to be applied only on a case-by-case basis and only where it is necessary and proportionate. It cannot and will not be used to target any group of people. Nor does the application of the exemption set aside all a data subject’s rights; it sets aside only those expressly listed. A further limitation is that it can be applied only where compliance with the relevant rights would be likely to prejudice the maintenance of effective immigration control.

[Liam Byrne]

Effective safeguards for crime prevention are already written into the Bill, which gives the Minister the power she is seeking to fulfil the purpose she is setting out for the House. If we selectively discard rights for selected people, we come pretty close to arbitrary decision making, and it is practically impossible to do that consistently and in way make it defendable in a judicial review. These provisions will result in injustice and cases that the Home Office loses, so just dump them now!

[Margot James]

The right hon. Gentleman should know that different structures govern crime and immigration. I reiterate that we are disapplying these rights selectively—the data subjects will hang on to the majority of their rights—but it cannot be right for the Home Office to have to furnish someone who is in contravention of immigration law with information it has been given.

[Yvette Cooper (Normanton, Pontefract and Castleford) (Lab)]

I am shocked by what the Minister is saying. These provisions were drafted before the Windrush scandal broke, and she is not learning the lessons at all. She says she wants these decisions made on an individual basis and in a way that is necessary and proportionate, but necessary and proportionate to achieve what? None of us knows what her definition of immigration control is. Does it mean meeting the net migration target, which is what we normally hear Ministers say? Necessary and proportionate to meet the net migration target could mean anything.

[Margot James]

I understand that it is a matter of interpretation. I also understand that the Home Office is considering these matters in the fallout from the Windrush case. I am sure that, as Chair of the Home Affairs Committee, the right hon. Lady will have ample opportunity to question the new Home Secretary on exactly what he might mean by “necessary and proportionate”. When someone is seeking access to data from the Home Office to prove their immigration history, such as in the Windrush cases, there will be no basis for invoking the immigration exemption in the Bill. I trust that that provides the right hon. Lady with some comfort.

[Yvette Cooper]

rose—

[Margot James]

Apparently not.

[Sir Edward Davey]

rose—

[Margot James]

I will give way for the last time to the right hon. Lady, if the right hon. Gentleman does not mind.

[Yvette Cooper]

That is not what the Bill says. That may be what the Minister intends, but if that is what she intends, she should change the Bill.

[Margot James]

I shall have to write to the right hon. Lady once I have communicated with Home Office Ministers. According to my understanding, the Bill says that the exemption applies—

[Liam Byrne]

On a point of order, Madam Deputy Speaker. We are being invited to pass an important piece of legislation which hands important new powers to Her Majesty’s Home Office, yet there is not a Home Office Minister on the Front Bench to respond to the points that we are making about the details of that legislation. What steps can we take to summon a Home Office Minister this afternoon, so that our questions can be answered?

[Madam Deputy Speaker (Mrs Eleanor Laing)]

I understand the right hon. Gentleman’s point of order, but the fact is that the Minister, who is a very capable Minister, speaks for the Government, who are seamless. The Minister who is currently at the Dispatch Box is in a position to speak for all Ministers on this matter, which is why she has this responsibility and is responding to the questions that are currently being asked of her.

[Margot James]

Thank you, Madam Deputy Speaker. I might as well give way to the right hon. Member for Kingston and Surbiton (Sir Edward Davey) now.

[Sir Edward Davey]

I am grateful to the Minister. To help other Members consider amendment 15, let me point out that one of the data protection provisions that are being exempted for immigration purposes is the right to make subject access requests. It is critical to the rule of law for people and their representatives to know on the basis of what information the Home Office has made its decisions. The Bill provides no safeguards, no balance, and no restrictions to the use of that law by Home Office officials. As we heard from the right hon. Member for Normanton, Pontefract and Castleford (Yvette Cooper), those are simply not in the Bill. It is entirely wrong for the House to be asked to pass a Bill that does not contain real safeguards for the people involved, given what happened in the Windrush cases.

[Margot James]

I will continue to make some progress, as I feel that those points have already been made.

The application of the exemption does not set aside all data subjects’ rights, but only those expressly listed. A further limitation is that exemptions can be applied only where compliance with the relevant rights would be likely to prejudice the maintenance of effective immigration control.

[Sir Edward Davey]

What does that mean?

[Margot James]

It is an established term. It is used in the Immigration Act 2014 and the Freedom of Information Act 2000 uses a similar term, namely “operation of immigration controls”.

[Mr Ranil Jayawardena (North East Hampshire) (Con)]

Without this immigration exemption, might not the Home Office have to disclose sources of tip-offs, which would not be conducive to ensuring that illegal immigration is properly controlled?

[Margot James]

I think it highly likely that if, for example, someone were to undertake a full data subject review of whatever information the Home Office held about them—as was posited earlier by the right hon. Member for Kingston and Surbiton—the review would contain sources of information as well as the information itself. A further limitation is that exemptions can be applied only where compliance with the relevant rights would be likely to prejudice the maintenance of immigration control. This “prejudice” test must be applied first, and as a result the situations in which the exemption can be used are limited. The Government recognise the concerns that have been expressed in this debate.

16:45

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

Can the Minister give us a couple of examples to illustrate why these additional powers are necessary, and where the other powers in the Bill—in relation to criminal offences and investigations, for example—would not already suffice to do everything that the Home Office wishes?

[Margot James]

We are permitted under GDPR to make these exemptions and are doing so in a very selective way and on a case-by-case basis, so it will not result in a widespread denial of people’s data rights.

The exemption should be as limited as possible, which is why we have brought forward amendments 141 and 142. These amendments will ensure that migrants enjoy the rights afforded under all of the data protection principles, except where a restriction on those principles is a consequence of restricting one of the other rights coming within the scope of the exemption.

I now turn to Opposition amendments 18 and 19 on primary care providers, and Government amendments 22 to 24 on parish councils. Parish and community councils are not exempt from the new law. None the less, by describing parish and community councils as “public authorities” the Bill gives these councils additional obligations above and beyond those placed on other small organisations, including that they must appoint a data protection officer. We have been working to minimise the impact of this requirement, and have concluded that as parish and community councils process very little personal data, the burden they would face would be disproportionate. Amendments 22, 23 and 24 therefore take these councils out of the definition of “public authorities” for data protection purposes.

[Mr Jayawardena]

I commend my hon. Friend the Minister on amendment 24, which recognises that councils are often so tiny—indeed, some are not even parish councils, and some do not employ any staff—that it would be wholly disproportionate to treat them in the way originally intended. I commend the Minister for listening to so many Members who made these points and recognising that parish councils must be treated separately.

[Margot James]

I thank my hon. Friend for his comments. He and other colleagues across the House made these arguments, and given that such organisations are often very small and process only small amounts of personal data, we have decided to take parish councils out of the definition of “public authorities” for data protection purposes. Their status in respect of other legislation, including the Freedom of Information Act, is unaffected, however.

Similar arguments have been advanced in respect of primary care providers, but although I have sympathy with amendments 18 and 19, primary care providers are different from parish councils in that they process sizeable quantities of sensitive health data, whether that be an individual’s mental health status, the fact that they are pregnant, or details of their prescription for a terminal illness. All of these matters are highly personal, and in the world of health, data protection is rightly paramount.

The Dean Street Express case in 2015 illustrates the potential harm that even a single data breach can cause. In that incident, the names and email addresses of almost 800 people, many living with HIV, were disclosed to other recipients. It does not seem unreasonable that bodies who process that kind of data should have a single point of contact on data protection matters.

Government amendments 139 and 140 relate to legal professional privilege. We recognise the importance of protecting legal professional privilege and that is why in the Bill we have replicated the existing measures and exemptions for legal professional privilege found in the Data Protection Act 1998, which have worked well for many years.

Amendments 10 and 11 seek to widen the legal professional privilege exemptions found in schedules 2 and 11. They offer some thoughtful changes that are intended to recognise the broader range of material covered by a lawyer’s ethical duty of confidentiality. We agree that the Bill could be clearer, and have tabled amendments 139 and 140 in response.

[Sir Mike Penning (Hemel Hempstead) (Con)]

It is interesting that we are making lots of exemptions for the Government, parish councils, lawyers and so on. I spoke to some lawyers this morning, and they were not convinced by the measures either. However, small businesses seem to be disproportionately affected, and there is real confusion out there. As I say, a lot of work has been done to protect the Government, parish councils and lawyers, but what about the little people—the people who make this country grow? There is even confusion in the Information Commissioner’s Office, which gave the wrong advice in briefings here to MPs’ staff only the other week. What are we going to do to protect the small people? They think that they are doing the right thing, but they have probably been ill advised. They are spending a lot of money trying to get things right, but there is real confusion out there.

[Margot James]

My right hon. Friend raises several important points. As for the effect on small businesses, he will be reassured to learn that the issues with the processing of highly personal data that I was discussing do not apply to the majority of SMEs. They will not have to appoint a data protection officer, so that is one comfort.

As for training and guidance, I am sorry that colleagues and their research staff attended courses that were put together before the Bill was even in Committee, and thus did not take numerous amendments into account—not least the amendment clarifying the rights of Members of Parliament and other elected individuals. I apologise for that confusion.

I draw businesses’ attention to the excellent ICO website, which contains good sources of guidance for SMEs, including frequently asked questions. The ICO also provides an advice line for any follow-up questions on subjects that businesses might not be clear about. Ultimately, there is a need for better data protection, and that is not just what is set out in the GDPR. Dreadful examples, such as the case of Facebook and Cambridge Analytica, have demonstrated the need for more rigorous data rights and for greater security of data.

[Sir Mike Penning]

The Minister is being ever so generous in giving way not just to me, but to Members from across the House, and I thank her. Returning to the parliamentary stuff—we are only a small part of all this—some of the staff present at the briefing I mentioned left in tears, and I know that for a fact, because a member of my staff was there. Believe it or not, even though the ICO knew that the briefing was completely flawed, it has today issued certificates of attendance saying that it was the right thing for staff to have done.

More important, however, are the SMEs. Small businesses have approached me today to tell me that they have been told to delete all their data unless they get permission from the relevant people. Companies that did work for people three, four or five years ago—even last year—must get permission to hold their addresses so that they can fulfil, for example, warranty agreements. Other companies are getting completely different advice, and the lawyers are getting different advice. There seems to be a rush to protect Government agencies, local government, parish councils and lawyers, but not enough is being done to protect the small people of this country—the people who account for so much of our money.

[Margot James]

I thank my right hon. Friend for his points. I want to reassure the small businesses that he mentions. I sympathise with businesses that are getting conflicting advice, and with those that are approached by firms of consultants who appear to be exaggerating the scale of the task of complying with the legislation. I am afraid that that always happens when there is change; people think that they can exaggerate the impact and the implications of a change and—who knows?—perhaps they will be remunerated for helping businesses to comply.

I also want to reassure my right hon. Friend about the specific case that he mentioned, in which companies were being advised that they needed to delete all the data for which they did not have consent. I want to reassure him that the vast majority of businesses will not have to delete the personal data that they hold. If they have gained the personal data lawfully, there are five, if not six, lawful bases on which they can process that personal data, of which consent is only one. I draw his attention particularly to legitimate interests, which is a lawful basis for processing data. For example, if a small firm has been supplying a much-needed service to people for a number of years, it is in the pursuit of its legitimate interests to communicate with its database of customers or new prospects, and it does not need to have consent. I would advise people not to delete their data without very careful consideration, or without consultation with the ICO website in particular.

[Anna Soubry]

Will the Minister give way?

[Margot James]

I will give way to my right hon. Friend in a second. I want to respond to my right hon. Friend the Member for Hemel Hempstead (Sir Mike Penning) on the alleged discrimination involved in our taking steps to protect lawyers, parliamentarians, local councillors and so on but not to protect small businesses. The reason is that small businesses are less affected, in the sense that most of them do not process huge quantities of personal data. They therefore come under the purview of the ICO to a lesser extent, and enforcement is less likely to focus on organisations that do not process highly personal data. Those organisations do not need to appoint a data protection officer. I hope that I have gone some way towards allaying my right hon. Friend’s—

[Sir Mike Penning]

rose—

[Margot James]

I will come back to my right hon. Friend in a moment, but I did say that I would give way to my right hon. Friend the Member for Broxtowe (Anna Soubry).

[Anna Soubry]

I thank my hon. Friend for that information, but it was mainly complete news to me, as I suspect it was to my right hon. Friend the Member for Hemel Hempstead too. We have a really serious problem here. I just cannot overestimate the amount of concern among small businesses. Medium-sized businesses with more than 250 employees have the benefit of a team of people, but this is a real crisis for small businesses and I am afraid that the lack of information is truly troubling. There are solutions, and perhaps we should discuss them in a different debate, but as a Government we have an absolute duty to get this right. There are devices available—HMRC sends out tax returns, for example—and there are many opportunities to get this information out there. At the moment, however, there is a lot of disinformation, and as my right hon. Friend the Member for Hemel Hempstead says, these businesses are the lifeblood of our economy. They do not know what is happening, and they are worried.

[Margot James]

I sympathise with the points that my right hon. Friend has raised. In fact, we have secured almost £500,000 to launch an information campaign to bolster what the Information Commissioner’s Office is already doing for small businesses. I also draw her attention to the need for this legislation, and to the need for businesses and all of us in public life to respect people’s data rights. The landscape has changed. We now live in a digital world, and there is so much abuse of people’s privacy and data that I must bring her attention back to the need for the Bill. Of course she is right, however, to say that people need to be properly informed, and that is what the ICO is doing and what the Government campaign that we are about to launch will also do.

[Sir Mike Penning]

What the Minister said at the Dispatch Box a moment ago was also news to me. I have been campaigning and pushing on this for months—I spoke to the Secretary of State over the bank holiday weekend—and I was going to vote against the Bill this evening. Yes, we need data protection, but we do not want to destroy or frighten our businesses in the process. However, I take my hon. Friend at her word, and I will vote for the legislation this evening.

[Margot James]

I quite agree. In fact, both the Secretary of State and I were small business owners before entering this place, so I feel what my right hon. Friend says very deeply. I must commend my hon. Friend the Member for Mid Worcestershire (Nigel Huddleston) on the excellent advice that his office has put together on what it will be doing in this respect. For the benefit of my staff, I have set out exactly what my office will be doing to comply with the legislation. If my right hon. Friend has any concerns about his own situation—

[Sir Mike Penning]

I am not worried about us; I am worried about small businesses.

[Margot James]

In that case, I will proceed no further down that path. I am glad that I have been able to reassure my right hon. Friend and thank him for raising those important points.

17:04

[Chi Onwurah (Newcastle upon Tyne Central) (Lab)]

I thank the Minister for that clarification, but I am not sure that it is clear enough. She will undoubtedly be aware that the Windrush documents were supposedly destroyed as a result of data protection requirements. There remains a significant possibility that there will be a wholesale destruction of data, some of which might be important, useful and legitimately kept, unless the Government take further action.

[Margot James]

I commend the hon. Lady for that observation, because she has a fair point. I will raise her concern with the Information Commissioner. My right hon. Friend the Member for Hemel Hempstead said that some businesses have been advised that they should delete their data, so I can see where the hon. Lady is going on that. It raises the prospect that some organisations might use this as an excuse to delete data that it would be in the data subject’s interests to preserve.

I have not been able to address every amendment in the time available, but I am mindful of the number of colleagues who wish to contribute, and we have less than 60 minutes remaining. I have addressed most of the matters that came up in the Public Bill Committee, and the Government’s position will remain the same on many of them.

In short, we have enhanced the ICO’s enforcement powers, we have changed the way we share data, we have reached out to parish councils, we have narrowed the immigration exemption and we have responded to calls to better protect lawyer-client confidentiality. We have also dealt—effectively, I hope—with the concern expressed by my hon. Friend the Member for Totnes about the sharing of data between the Department of Health and Social Care and the Home Office.

[Liam Byrne]

May I start by welcoming the new powers for the Information Commissioner, which we called for in Committee? Nobody who observed the debacle of the investigation into Cambridge Analytica will have needed persuading that that those powers are necessary—it took the court five or six days to issue the requisite search warrants, and that time might well have been used by Cambridge Analytica to destroy evidence—so I am glad that the Minister has heeded our calls and introduced the proposals this afternoon. We are happy to give them our support.

I will speak to a number of new clauses and amendments in the group, particularly new clause 4, which is our enabling clause for creating a bold and imaginative Bill of data rights for the 21st century. I want to make the case for universal application of those rights, including their application to newcomers, who need rights in order to challenge bad decisions made by Governments, which is why our amendment 15 would strike out the immigration provisions that have so unwisely been put into the Bill. I will also say a few words about new measures that are needed in the Bill to defend the integrity of our democracy in the digital age.

The Minister took the time to make a comprehensive speech, which included an excellent explanation of the Government amendments, so I will be brief. Let me start with the argument for a Bill of data rights. Every so often we have to try to democratise both progress and protections. In this country we are the great writers of rights—we have been doing it since Magna Carta. Over the years, the universal declaration of human rights, the UN convention on the rights of the child, the charter of fundamental rights, the Human Rights Act 1998, the Equality Act 2010 and, indeed, the original Data Protection Act have all been good examples of how good and wise people in this country have enshrined into charters and other legal instruments a set of rights that we can all enjoy, that give us all a set of protections, and that help us to democratise progress.

[Chi Onwurah]

My right hon. Friend makes an excellent point. Does he share my astonishment that the Government are not taking the opportunity to update our rights for the digital age? Does he think that that is because they are too captured by the tech giants, because they are too confused by Brexit to invest in change, or because they are too ideologically constipated regarding the free market that they can do nothing about it?

[Liam Byrne]

My hon. Friend hits the nail on the head. The answer, of course, is that it is for all three of those reasons that we do not have before us an imaginative bill of digital rights, but the times do call for it.

In the early days, when we were writing great charters such as Magna Carta, the threats to ordinary citizens were from bad monarchs. We needed provisions such as Magna Carta and the Bill of Rights and the Glorious Revolution to protect the citizens of this country and their wealth from bad monarchs who would seek to steal things that were not theirs.

What we now confront is not a bad monarch—we have a fantastic monarch—but the risk of bad big tech. The big five companies now have a combined market capitalisation of some $2.5 trillion, and they are up to all sorts of things. They are often protected by the first amendment in the United States, but their business—their bad business—often hurts the data rights of citizens in this country.

That is why we need this new bill of rights. We have to accept that we are on the cusp of radical and rapid changes in legislation and regulation. I often make the point that over the course of the 19th century there was not one Factory Act but 17 Factory Acts. We had to legislate and re-legislate as technology, economics and methods of production changed, and that is the point we are at now. We will have to regulate and re-regulate, and legislate and re-legislate, again and again over the decades to come. Therefore, if we are to give people any certainty about what the new laws will look like, it would be a sensible precaution if we were to write down now the principles that will form the north star that guides us as we seek to keep legislation up to date.

[Mr Jim Cunningham]

I am sure that my right hon. Friend has received correspondence from constituents who are worried about the use of personal data. My constituents have a lot of sympathy with the views of the hon. Member for Totnes (Dr Wollaston) about this. Does my right hon. Friend the Member for Birmingham, Hodge Hill (Liam Byrne) agree?

[Liam Byrne]

My hon. Friend is right. We have been on the receiving end of a huge number of data breaches in this country—really serious infringements of basic 21st-century rights—which is why we need a bold declaration of those rights so that the citizens of this country know what they are entitled to. Unless we get this right, we will not be able to build the environment of trust that is the basis of trade in the digital economy. At the moment, trust in the online world is extremely weak—that trust is going down, not up—so we need to put in place measures now, as legislators, to fix this, turn it around and put in place preparations for the future.

The Government’s proposal of a digital charter is a bit like the cones hotline approach to public service reform. The contents of the charter are not really rights but guidelines. There are no good methods of redress or transparency. Frankly, if we try to introduce rights and redress mechanisms in that way, they will basically fail and will not lead to any kind of change. That is why we urge the Government to follow the approach that we are setting out.

I put on record my profound thanks to Baroness Kidron and the 5Rights movement. Her work forms the basis of the bill of rights we are proposing to the House: the right to remove data, as enshrined in the GDPR—that right is very important to children—the right to know; the right to safety and support; the right to informed and conscious use; and the right to digital literacy. Those are the kinds of rights we should now be talking about as the rights of every child and every citizen.

[Margot James]

The right hon. Gentleman makes some good points. I agree with the rights he is talking about, but those rights exist under the GDPR and are intrinsic to the Bill, so I see no need for his amendment.

[Liam Byrne]

There is no right to digital literacy under the Bill, which is why we propose the five rights as the core of new schedule 1 in which, as the Minister knows, we go much further. The provision sets out rights to equality of treatment, security, free expression, access, privacy, ownership and control, the right not to be discriminated against as a result of automated decision making, and rights on participation, protection and removal.

Rights are sometimes scattered through thousands and thousands of pages of legislation, which is where we are on data protection today. That is why from time to time, as a country, we decide to make bold declaratory statements of what principles should guide us. These are methods of simplification and consolidation, and we are pretty good at that in this country. When we press our proposal to enable the creation of such a bill of rights to a Division a little later, we hope that it will be the call that the Government need to begin the process of consultation, thought, argument and debate about the digital rights that we need in this century and what they need to look like. Rights should not be imposed from the top down; they should come from the grassroots up, and the process of conversation and consultation is long overdue. To help the Government, we will accelerate that debate during this year.

The second point I wish to make is about amendment 15, which would ensure that the rights set out in the GDPR would stretch to everyone in this country. It would mean that the Government would not be permitted to knock out selective rights for certain people who just happen to be newcomers to this country. The proposal to withhold data rights from migrants and newcomers is a disgrace and does not deserve to be in the Bill. In Committee, Ministers were unable to tell us why the Bill’s crime prevention provisions could not be stretched to accommodate their ambitions for immigration control. The Minister has not been able to give us a succinct definition of “immigration control” today, and we have not been able to hear about the lessons learned from Windrush. Frankly, the debate has been left poorly informed, and we have had promises that letters will be sent to hon. Members long after tonight’s vote.

[Sir Edward Davey]

I totally agree with the right hon. Gentleman’s point. He says that this is about newcomers and immigrants, and I am sure he will agree that it also applies to British citizens’ ability to get their immigration file. Can he confirm that that is the case?

[Liam Byrne]

I am not sure that that is the case. British citizens have confirmed rights under the GDPR—that is safeguarded under EU legislation—but the risks I am worried about are the same ones as the right hon. Gentleman. I spent two and a half years in the Home Office. I recognised many of the errors that were made by the former Home Secretary in the situation that we inherited back in 2006, so I do not think that lessons have been learnt from Windrush, or that many lessons have been learnt from errors over the past eight to 10 years. The Home Office is a great Department of State, with tremendous strengths. It has fantastic civil servants who do an amazing job, without the resources to do it properly and very often without the level of support they need from their Ministers, but it is a human institution and such institutions make mistakes. To correct those, we have tribunals and courts through which people can test decisions made by officials without the disinfectant of sunlight. Unless we equip those individuals with everything they need to make their case effectively, we risk injustice. After our debates over the past month, we must do everything we can so that we never run that risk again.

[Mr Jim Cunningham]

To pursue those rights, people also need legal aid, and in some circumstances, they are denied legal aid. The state should not have the right to give private information about its citizens to anybody, or even to sell it to organisations.

[Liam Byrne]

Correct. In my first months at the Home Office, I spent a lot of time in immigration tribunals. I used to go to the courts up in Islington to sit, watch and listen so that I could learn the basic mechanisms of justice in this country. The thing that struck me was the inequality of arms that comes to bear in these tribunals. On the one side, there is a Home Office lawyer, who is sometimes there, sometimes not. Home Office lawyers are backed by teams and have well-constructed cases and all the information they need. On the other side of the argument are people without money or access to lawyers, but now the Government propose to deny some of them the information that they need to argue and win their cases. It is a recipe for injustice.

17:15

[Caroline Lucas (Brighton, Pavilion) (Green)]

I very much agree with the points that the right hon. Gentleman is making. Does he agree that we ought to consider the way in which the crime exemption in the Bill will be invoked in respect of low-level offences under immigration law? Is it really acceptable for data rights to be suspended in relation to normal activities such as driving—just being here—that are currently criminalised under immigration law?

[Liam Byrne]

Those are real risks, which is why amendment 15 would delete such an important chunk of the Bill and therefore improve it.

I know that when I was a Home Office Minister, I took decisions that sometimes were wrong, and those decisions were corrected through the tribunal system. Tribunal cases were often successfully prosecuted by those who had rights that we were seeking to deny because subject access requests had been used to get the information necessary to win the argument. If we switch off that access, injustice will follow, so I urge the Government to think again and I urge Members from all parties to support amendment 15.

The last measure to which I shall speak is new clause 6, which is our proposal for a UK version of the Honest Ads Act that is currently being debated in the United States Congress. I do not want to rehearse the background to the debate for long, because for six months now a hardy group of us has been seeking to raise and unpack the new risks that we confront from countries such as Russia that are aiming at us a new panoply of active measures, including all kinds of bad behaviour online. Right now, we do not have good measures to defend the integrity of our democracy. Indeed, the most recent edition of the national security strategy did not even include the defence of the integrity of democracy among its core strategic aims.

We have to bring our election law into the 21st century as it is hopelessly out of date. We have an Electoral Commission that is unable effectively to investigate donations and money coming from abroad. The Information Commissioner has only this afternoon been given the powers that it needs. Ofcom will not investigate videos on social media and the Advertising Standards Authority does not investigate political advertising. We have a massive lacuna in which there should be good, robust legislation to police elections in the 21st century.

If we look at what is going on throughout the west, we see that we have to wake up to this risk. Giving the Electoral Commission new powers to require information about money that is used to run campaigns that try to influence votes is now a de minimis provision for a modern democracy in the digital age. We hope that the Minister will listen to us and take our ideas on board.

[Several hon. Members rose—]

[Madam Deputy Speaker (Mrs Eleanor Laing)]

Order. We have only 40 minutes left to debate this group and around 10 Members wish to speak. If everybody speaks for four to five minutes, everybody will get in; if not, some people will not get to speak at all.

[Dr Sarah Wollaston (Totnes) (Con)]

I rise to speak to new clause 12, which was tabled in my name, that of my colleague, the hon. Member for Stockton South (Dr Williams), and those of other members of the Health and Social Care Committee and Members from all parties.

I wish to speak about the importance of medical confidentiality, because it lies at the heart of the trust between clinicians and their patients, and we mess with that at our peril. If people do not have that trust, they are less likely to come forward and seek the care that they need. There were many unintended consequences as a result of the decision enshrined in a memorandum of understanding between the Home Office, the Department of Health and NHS Digital, which allowed the sharing of addresses at a much lower crime threshold than serious crime. That was permitted under the terms of the Health and Social Care Act 2012, but patients were always protected, in effect, because the terms of the NHS constitution, the guidance from the General Medical Council and a raft of guidance from across the NHS and voluntary agencies protected the sharing of data in practice.

This shift was therefore particularly worrying. There were many unintended consequences for the individuals concerned. The Health and Social Care Committee was also deeply concerned about the wider implications that this might represent a shift to data sharing much more widely across Government Departments. There was a risk, for example, that the Department for Work and Pensions might take an interest in patients’ addresses to see whether people were co-habiting for the purpose of investigating benefit fraud. There was a really serious risk of that.

I am afraid that the letter that we received from the Department of Health and Social Care and the Home Office declining to withdraw from the memorandum of understanding made the risk quite explicit. I would just like to quote from the letter, because it is very important. I also seek further clarification from the Minister on this. The letter states that

“it is also important to consider the expectations of anybody using the NHS—a state provided national resource. We do not consider that a person using the NHS can have a reasonable expectation when using this taxpayer-funded service that their non-medical data, which lies at the lower end of the privacy spectrum, will not be shared securely between other officers within government in the exercise of their lawful powers in cases such as these.”

I profoundly object to that statement. There was no such contract in the founding principles of the NHS. As I have said, it is vital that we preserve that fundamental principle of confidentiality, including for address data. I was delighted to hear the Minister’s words at the Dispatch Box, but can she just confirm for me absolutely that that statement has now been superseded?

[Margot James]

Yes, I can confirm absolutely that the statement that my hon. Friend quoted from the letter of 23 February has been superseded by today’s announcements.

[Dr Wollaston]

I thank the Minister for that reassurance. There is much more that I could say, but I know that there are very many other colleagues who wish to speak. With that reassurance, I am happy not to press my amendment to a vote.

I would like to make one further comment on protecting patients. At a time when confidence in data sharing is so important, especially around issues such as research, we all rely on the role of NHS Digital. Set up under the Health and Social Care Act 2012 as a non-departmental public body at arm’s length from Government, NHS Digital has the specific duty robustly to stand up for the interests of patients and for the principles of confidentiality. As a Committee, we were deeply disappointed that, despite the clear concern set out from a range of bodies, including Public Health England, all the medical royal colleges, very many voluntary agencies, the National Data Guardian and others, the organisation seemed to have just the dimmest grasp of the principles of underpinning confidentiality. I wish to put it on the record that we expect the leadership of NHS Digital to take its responsibilities seriously, to understand the ethical underpinnings and to stand up for patients. With that, I will close my remarks. I thank the Minister for the time that she has taken to listen to our concerns and for her response.

[Yvette Cooper]

I wish to speak briefly to amendment 15 and to say to those on the Front Bench that this is their opportunity to actually do something as Ministers. I urge them to make a late change and not just to drift on with legislation that was drawn up before the Windrush scandal. They can go and talk to the Secretary of State—have a discussion with him—and decide now to accept amendment 15. I really urge Ministers to do that, because what the Bill is doing is immensely serious. The Bill is incredibly widely drawn. This exemption allows the Home Office to refuse subject access requests in immigration cases and to put in place data sharing without proper accountability in any case where it meets the maintenance of effective immigration control or the investigation or detection of activities that would undermine the maintenance of effective control, and yet, repeatedly, we have had no explanation from Ministers as to what effective immigration control means. That is because, in truth, it is immensely broad. It could mean meeting the net migration target, sustaining the hostile environment and enabling a deportation that the Home Office thinks is justified, even if in practice it has made a mistake. It could mean decisions being taken by immigration removal centres, G4S, Serco or any of the many private companies contracted by the Home Office to deliver its so-called effective immigration control.

The Home Office has made an objective of reducing the number of appeals and removing the right to appeal in immigration cases. If a subject access request makes an appeal more likely, why does preventing that SAR in order to prevent a potential appeal not count as immigration control under the Home Office’s definition? That would be unjustified and wrong, but it is made possible by the Bill. If the Government do not want that to be the case, they should change their proposed legislation and accept amendment 15.

Ministers do not have to go ahead with this right now. An immigration Bill is going to come down the track at some future point and it will give them and the Home Secretary the opportunity to reflect on the Windrush scandal. The Immigration Minister told the Home Affairs Committee yesterday that the culture of the Home Office, including that of casework and decision making, needs to change. The Home Secretary and the former Home Secretary recognise that substantial changes need to be made. We are told that huge lessons have been learned and we have been promised inquiries that will report back and have independent oversight. None of them have yet taken place, but the Windrush scandal has had shocking and devastating consequences for individual lives, as so many Members on both sides of the House acknowledge. I therefore ask Ministers to not make future Windrush scandals more likely and to not deny people the information they need about their case in order to prove their circumstances and ensure that a Home Office mistake or error can be overturned.

Michael Braithwaite came here from Barbados in 1961. He is a special needs teacher who has lived here for more than 50 years, and yet he was sacked from his job because the Home Office got it wrong. His lawyer’s application for a subject access request formed part of the process for clearing up and sorting out his case, but the Bill will make it much more difficult to make such a request. Subject access requests are already often resisted by the Home Office. Whether inadvertently or intentionally, the Home Office has a bad record in complying swiftly and fully with subject access requests, so why on earth does this Bill make that more likely and further allow the Home Office to simply not give people the information they need to make sure that justice is done?

There are huge concerns about the way in which targets have operated. The Home Secretary and other Ministers will have to look into that in depth. In the meantime, however, they should not allow a situation to develop whereby the operation of those targets could end up with subject access requests being denied because meeting those targets is seen as part of effective immigration control.

The Home Office does get things wrong. There are huge strengths and skills within the Home Office. There are people who work immensely hard to try to get things right, but we know that a Department that size gets things wrong and we have seen the evidence, to terrible effect, in the Windrush cases. There have been 60 cases of unlawful detention in the past few years, even before the Windrush cases. Nearly half of the cases that go to appeal go against the Home Office because it got those decisions wrong. Sampling by the immigration inspectorate found that 10% of the data that the Home Office gave to banks, telling them to close people’s accounts because they were here illegally, was in fact wrong and that those people should not have had their bank accounts closed. Given that level of errors and mistakes, why on earth would we prevent the kind of transparency that subject access requests deliver? Some 39,000 people were wrongly sent texts telling them that they were here unlawfully. The Home Office makes mistakes, and we need transparency and subject access requests to be able to challenge those mistakes.

17:30

I say to Ministers: take this exemption out of the Bill. We do not need it. We did not have this kind of exemption from previous data protection Acts, so we do not need it from this one. They can revisit it in the immigration Bill once they have had time to do a proper consultation and consider all the options, but they should not do this now.

Let me give the House one final reason why amendment 15 is so important. We are storing up further problems that could prevent us from fighting crime and injustice through international security co-operation. After Brexit, we need a co-operation agreement—a data adequacy agreement—with the EU, so that our police and law enforcement agencies can continue to legally share the data they need to solve crimes, stop criminals and prevent terror attacks. However, this whopping great exemption to the GDPR lying at the heart of the Bill will, as the Home Affairs Committee has warned, make it harder for us to get the data adequacy agreement that we need.

I am immensely worried about what will happen if that data adequacy agreement is delayed, and the Government should be much more worried than they appear to be about the consequences for our security and crime fighting if that data adequacy agreement is not secured. So I say to them: do not make it harder. Do not keep this exemption in the Bill. Remove it, not just for the sake of future security and crime co-operation, but for the sake of preventing more injustices like Windrush.

[Damian Collins]

The significance of the Bill and the importance of data and data protection to the economy and the whole of society is reflected in this debate. The fact that amendments have been tabled on Report through the work of three different departmental Select Committees shows how wide-ranging this issue is.

I principally want to talk about amendments 20 and 21, which stand in my name and those of other members of the Digital, Culture, Media and Sport Committee and which are addressed by Government amendments, too. Before I do so, I want to add that the Chair of the Home Affairs Committee, the right hon. Member for Normanton, Pontefract and Castleford (Yvette Cooper), made a very important point about the fact that some people—particularly those involved in immigration cases—may not have full access to the data rights enjoyed by others. If the Minister can provide any further clarification, I will be happy to give way before I move on.

[Margot James]

After the exchange I had with the hon. Member for Newcastle upon Tyne Central (Chi Onwurah), I wanted to confirm that the Home Office will certainly not destroy any data for which there is still a legitimate and ongoing need not just for the Home Office but for data subjects.

[Damian Collins]

I am grateful to the Minister for that further clarification.

Amendments 20 and 21 get to the heart of an issue that has been raised by a number of Members, which is the power of the Information Commissioner to act in data investigations. The Minister, the right hon. Member for Birmingham, Hodge Hill (Liam Byrne) and others have referenced the Cambridge Analytica data breach scandal, which is a very good example of why these additional powers are needed. We raised that in the Select Committee with the Secretary of State. The Information Commissioner raised it with us and it was raised on the Floor of the House on Second Reading.

The ability to fine companies for being in breach of data rules is important, but what is most significant is that we get hold of the data needed by investigators, so that we understand who is doing what, how they are doing it and how wide-ranging this is. It is crucial that the Information Commissioner has the enforcement powers she needs to complete those investigations.

In the case of Cambridge Analytica, an information notice was issued by the Information Commissioner to that company to comply with requests for data and information. Not only did Cambridge Analytica not comply, but Cambridge Analytica and Facebook knew that. That information notice expired at 5 o’clock on the evening of the day when that deadline was set; it was the beginning of the week. Before the notice had expired and a warrant could even be applied for, Facebook had sent in its own lawyers and data experts to try to recover data that was relevant to the Information Commissioner’s request.

The Information Commissioner found out about that live on “Channel 4 News” and then effectively sent a cease and desist note to Facebook, telling it to withdraw its people. She might very well not have been made aware of what Facebook was doing that evening, and data vital for her investigation could have been taken out of her grasp by parties to the investigation, which would have been completely wrong. Not only did that happen—thankfully, Facebook stood down—but a further five days expired before a warrant could be issued—before the right judge in the right court had the time to grant the warrant to enable her to complete her work. We live in a fast-moving world, and data is the fuel of that fast-moving world, so we cannot have 19th or even 20th-century legal responses. We must give our investigatory authorities the powers they need to be effective, which means seizing data on demand, without notice, as part of an investigation, and having the ability to see how data is used in the workplace or wider environment.

The Government are bringing forward amendments, which I think have the support of the House, that will give us one of the most effective enforcement regimes in the world. They will give us the power to do something we have not been able to do before, which is to go behind the curtain to see what tech companies, even major tech companies, are doing and make sure they comply with our data rules and regulations. Without that or an effective power to inspect, we would largely be in the position of having to take their word for it when they said they were complying with the GDPR. Particularly with companies such as Facebook that run closed systems—they have closed algorithms and their data is not open in any way—there are very good commercial reasons for doing so, but there are also consumer safety reasons. We must have the power to go in and check what they are doing, so the amendments are absolutely vital.

There are further concerns. The shadow Minister, the right hon. Member for Birmingham, Hodge Hill, was right to raise concerns about honesty and transparency in political advertising. Both the Information Commissioner and the Electoral Commission are examining the use of data in politics, as well as looking at who places the ads. It is already a breach of the law in the UK, as it is in other countries, for people outside our jurisdiction to run political advertising during election campaigns in this country.

In the case of Facebook, it is unacceptable that its ad check teams have not spotted such advertising and stopped it happening when someone is breaking the law. If this were about the financial services sector, we would not let a company say, “Well, we thought someone was breaking the law, but we weren’t told to do anything about it, so we didn’t”. We would expect such a company to spot it and to take effective action. We need to see a lot more progress on this, particularly in relation to the placement of micro-targeting ads and dark ads. The Institute of Practitioners in Advertising has called for a moratorium on the micro-targeting of political ads, which may be seen only by the person who receives an ad and the person who places it.

When the chief technology officer of Facebook, Mike Schroepfer, gave evidence to the Select Committee, I asked him whether, if someone set up a Facebook page to run ads during a campaign and micro-targeted individual voters before taking down the page at the end of the campaign and destroying the adverts, Facebook would have any record that that advertising had ever run, he said that he did not know. We have written to him and Mark Zuckerberg saying that we need to know, because unless we know, a bad actor could run ads in huge volumes, investing a huge amount of money in breach of electoral law, and if they did not declare it, there would be no record of that advertising ever having been placed.

[Liam Byrne]

The Chair of the Select Committee is doing a brilliant job with his investigation, but the argument must stretch further than simply political advertising. For example, when Voter Consultancy Ltd ran attack ads against Conservative Members, accusing some of them of being Brexit mutineers, it was running an imprint for a company that was actually filing dormant accounts at Companies House. There are real questions not just about political ads in the narrow traditional sense, but about how to get to the bottom of who is literally writing the cheques.

[Damian Collins]

The right hon. Gentleman is absolutely right and that throws up two really important points.

The first point is that the Information Commissioner is also currently investigating this, which links to the right hon. Gentleman’s point about where the money comes from and who the data controllers are in these campaigns. Although Facebook is saying that it will in future change its guidelines so that people running political ads must have their identity and location verified, we know that it is very easy for bad actors to fake those things. It would be pretty easy for anyone in the House to set up a Facebook page or account using a dummy email address they have created that is not linked to a real person, but is a fake account. This is not necessarily as robust as it seems, so we need to know who is running these ads and what their motivation is for doing so.

Secondly, the Information Commissioner is also looking at the holding of political data. It is already an offence for people to harvest and collect data about people’s political opinions or to target them using it without their consent, and it is an offence for organisations that are not registered political parties even to hold such data. If political consultancies are scraping data off social media sites such as Facebook, combining it with other data that helps them to target voters and micro-targeting them with messaging during a political campaign or at any time, there is a question as to whether that is legal now, let alone under the protection of GDPR.

As a country and a society, we have been on a journey over the past few months and we now understand much more readily how much data is collected about us, how that data is used and how vulnerable that data can be to bad actors. Many Facebook users would not have understood that Facebook not only keeps information about what they do on Facebook, but gathers evidence about what non-Facebook users do on the internet and about what Facebook users do on other sites around the internet. It cannot even tell us what proportion of internet sites around the world it gathers such data from. Developers who create games and tools that people use on Facebook harvest data about those users, and it is then largely outside the control of Facebook and there is little it can do to monitor what happens to it. It can end up in the hands of a discredited and disgraced company like Cambridge Analytica.

These are serious issues. The Bill goes a long way towards providing the sort of enforcement powers we need to act against the bad actors, but they will not stop and neither will we. No doubt there will be further challenges in the future that will require a response from this House.

[Brendan O'Hara]

I will be very brief, Madam Deputy Speaker, because we are incredibly tight for time.

There is so much in the Bill that I would like to talk about, such as effective immigration control, delegated powers and collective redress, not to mention the achievement of adequacy, but I will concentrate on amendment 5, which appears in my name and those of my hon. Friend the Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) and the hon. Member for Brighton, Pavilion (Caroline Lucas).

The amendment seeks to provide protection for individuals where automated decision making could have an adverse impact on their fundamental rights. It would require that, where human rights are or could be impacted by automated decisions, ultimately, there will always be a human decision maker at the end of the process. It would instil that vital protection of human rights in respect of the general processing of personal data. We believe strongly that automated decision making without human intervention should be subject to strict limitations to promote fairness, transparency and accountability, and to prevent discrimination. As it stands, the Bill provides insufficient safeguards.

I am talking about decisions that are made without human oversight, but that can have long-term, serious consequences for an individual’s health or financial, employment, residential or legal status. As it stands, the Bill will allow law enforcement agencies to make purely automated decisions. That is fraught with danger and we believe it to be at odds not just with the Data Protection Act 1998, but with article 22 of the GDPR, which gives individuals the right not to be subject to a purely automated decision. We understand that there is provision within the GDPR for states to opt out, but that opt-out does not apply if the data subject’s rights, freedoms or legitimate interests are undermined.

I urge the House to support amendment 5 and to make it explicit in the Bill that, where automated processing that could have long-term consequences for an individual’s health or financial, employment or legal status is carried out, a human being will have to decide whether it is reasonable and appropriate to continue. Not only will that human intervention provide transparency and accountability; it will ensure that the state does not infringe an individual’s fundamental rights and privacy—issues that are often subjective and are beyond the scope of an algorithm. We shall press the amendment to the vote this evening.

[Margot James]

rose—

[Brendan O'Hara]

I would give way, Minister, but I am very pushed for time.

I would like to voice my support and that of the SNP for amendment 15 on effective immigration control. We believe that the exemption is fundamentally wrong, disproportionate and grossly unfair, and we call on the Government to stop it.

[Colin Clark (Gordon) (Con)]

I am conscious of the time, Madam Deputy Speaker, so I will not take too long.

This country is committed to remaining a global leader on data protection. The fundamental principle behind the Bill is to bring our data protection and information laws up to speed in the digital age. If we are to keep pace with technology and restore accountability in this area, we need a strong Information Commissioner’s Office. I am therefore pleased that the Government have brought forward new clauses 13 and 14. Remarkably, 11.5% of global data flows through the UK. It is vital that the UK plays a key role in ensuring compliance.

17:44

The Bill strikes a balance between individuals’ protection and organisations. It creates a bespoke framework for law enforcement, which is vital to our security services. I welcome the Minister’s comments giving comfort to businesses. In my constituency, they were deeply concerned about some of the claims made by organisations.

New clause 13 ensures that the Information Commissioner can seek a court order to enforce an information notice, given under clause 141 of the Bill, should someone fail to comply. New clause 14 makes it an offence, as the Minister said, for someone to destroy, dispose of, conceal, block or falsify information required by the Information Commissioner. The new clauses will ensure that companies and individuals subject to an Information Commissioner’s Office assessment notice are truly accountable.

The recent scandals involving Cambridge Analytica and Facebook, mentioned by several hon. Members, shone a spotlight on this area of the law. Cambridge Analytica has been repeatedly accused of holding back data. The story is so concerning because it reached the very corridors of power in which we work. Political parties and campaigns from various countries, and even in this country, sought out Cambridge Analytica’s help. The UK Government’s new clauses and amendments will ensure that the Bill does exactly what they intend it to do.

[Sir Edward Davey]

The right hon. Member for Normanton, Pontefract and Castleford (Yvette Cooper) made a very powerful speech in favour of amendment 15, and I would like to associate myself and my party with all the comments she made. In particular, I underline the point she made that the Home Office powers in the Bill have no limit and are completely subjective.

The Under-Secretary of State for the Home Department, the hon. Member for Louth and Horncastle (Victoria Atkins), is sitting on the Government Back Benches, talking to a colleague. She is a respected lawyer who has practised law. Imagine if she had a client who was being denied reunification with their family, was not allowed to work, was being deported from this country and was not able to have access to the information on which that decision was made. That would go against all the principles of the rule of law of which this country is proud and which this House has upheld century after century, yet she, as a Home Office Minister, is allowing that to happen.

I urge the hon. Lady to think about that and, as the right hon. Member for Normanton, Pontefract and Castleford said, go to the new Home Secretary, who said he would take a new approach and sweep away some of the past, and ask him to think again and allow amendment 15 to proceed tonight. As the right hon. Lady said, there will be another opportunity with another immigration Bill coming up soon. The Home Office Minister and the Home Secretary can rest assured that the powers under paragraph 2 in schedule 2 relating to criminal actions would cover all the examples that Ministers in Committee, on Second Reading and in the other place have given for why they think this proposed legislation is required.

[Yvette Cooper]

The Secretary of State for the Department for Digital, Culture, Media and Sport is now back in his place. Does the right hon. Gentleman agree that it would simply take a phone call between him and the Home Secretary to agree that this measure could be suspended? The whole issue could be revisited in the immigration Bill coming down the track in due course. It could be removed from this Bill now for the sake of the Windrush generation.

[Sir Edward Davey]

The right hon. Lady is absolutely right, and it is the Windrush generation who should be in our minds above all.

The right hon. Lady mentioned the need—this will be dependent on the EU negotiations—to ensure that we have access to data for national security and for fighting crime. That is in the Government’s interests as they negotiate Brexit, in particular with respect to the rights of EU citizens. I am fairly convinced that when the Commission really wakes up to the implications of paragraph 4 in schedule 2, it will say that this is acting in bad faith. The Government have agreed a settlement for the 3 million EU citizens in this country and the EU citizens who may wish to come to this country in the years ahead. The Bill will take away the rights they thought they would have. I therefore say to Ministers on the Front Bench and those on the Back Benches that they have just a few minutes or so to think again before it is too late.

[Daniel Zeichner (Cambridge) (Lab)]

I want to endorse new clause 4, which was so ably set out my right hon. Friend the Member for Birmingham, Hodge Hill (Liam Byrne) from the Opposition Front Bench. I went on the Bill Committee with a sense of optimism and excitement, perhaps naively, because it seemed that so much needed to be done at the moment. Almost every day new issues arise—I hardly need to say that for me, “Cambridge” and “analytics” is an unfortunate combination. In the past few days, there have been facial recognition issues in the Welsh police and Amnesty International has raised the issue of gang lists. I hoped that we could rise to the challenge. However, I fear that although the Bill is hundreds and hundreds of pages long—in the pre-digital age, it would probably have been described as being the size of a telephone book—as Members have observed, does anyone really know what it means? That is why we needed a simple set of rights that people could understand. The sad thing is that people in the wider world are doing such good work and we should be looking at it. Look at what Tim Berners-Lee and Nigel Shadbolt are doing to try to transfer the data away from the big tech companies to make it our data. That is key, and it is the underlying principle of the GDPR, but I am not sure that we have been able to translate it into legislation.

I make two final observations. First, the golden thread running through much of this is data adequacy, which was referred to by the Chair of the Home Affairs Committee, my right hon. Friend the Member for Normanton, Pontefract and Castleford. In too many places there are genuine concerns, not just from Opposition Members but from Members in the other place, about our being tripped up on data adequacy, which is so important.

Finally, on the Information Commissioner’s role, a huge amount is being passed to her. We can have every confidence in her, but does she really have the resources, power and expertise? Most importantly, we are outsourcing some huge, really important judgments to the Information Commissioner, but I think it should be the role of this place to make those judgements in future, and I fear that we will come back to those points later in the day.

[Dr Paul Williams (Stockton South) (Lab)]

It is a pleasure to follow my hon. Friend the Member for Cambridge (Daniel Zeichner). I also pay tribute to the hon. Member for Totnes (Dr Wollaston), who is an extremely capable Chair of the Health and Social Care Committee and has shown real resolution and persistence on new clause 12.

In the sanctity of the consulting room, patients tell doctors, nurses and NHS staff all kinds of things. I have had all kinds of private and confidential issues disclosed to me in the 22 years that I have worked as a doctor, but the protection that the NHS gives to this information is absolutely fundamental. For years, the NHS has, on request from the Home Office, been sharing the address details of some patients that have ultimately been used to deport an unknown number of people over many years.

I recently visited a clinic run by the excellent charity, Doctors of the World, in Bethnal Green. I heard stories there of vulnerable people being afraid to approach NHS services because they cannot be certain that the information that they are asked to give will be treated confidentially. I heard about pregnant women not going for antenatal care, people with HIV not getting treatment and people who are afraid to take their children to the GP. The bond of trust between the NHS and its patients relies on the truth being told in both directions. Sadly, people have been avoiding the NHS because they do not trust it. That is bad for the reputation of the NHS, bad for the health of individual patients and bad for public health.

Doctors, nurses and other health professionals do not want information that is given to the NHS by patients to be shared except in the most extreme cases, when there is a significant risk to individuals or to the public. I am pleased that the Government have found a way to assure the House this evening that NHS information will be shared only in the event of a conviction or an investigation for a serious crime. This is the only way to preserve the integrity of the NHS and the immeasurable, vital and precious bond of trust between NHS staff and their patients.

[Caroline Lucas]

Like others, I would like to associate myself with the very powerful arguments that have been made in favour of amendment 15, but I want to speak briefly to amendment 16 to extend the debate about the conditions under which someone’s rights can be breached. It would prevent the crime exemption in the Bill being invoked in relation to low-level offences under immigration law.

Few of us would dispute the overall principle that data might be shared in some circumstances—for example, to prevent a serious crime or to apprehend an offender—but when the crimes in question are not serious and arise simply because of someone’s immigration status, we have to question whether the grounds for suspending data protection rights really do stack up. It is clear that the majority of offences under immigration law are not serious crimes. Most result only in a custodial sentence of two years or less, or a fine. Rather, they are the mundane activities of people doing what they must to survive. The effect is already forcing undocumented migrants to avoid sending their children to school, visiting the GP, presenting to homelessness services and seeking social support, for fear they might risk detention and removal by doing so.

Last year, a woman who was five months pregnant went to report being repeatedly raped to the police but was subsequently arrested at a rape crisis centre on immigration grounds. My amendment 16 seeks to better protect her and all others like her whose data protection rights are routinely being breached just because they are undocumented migrants and who are therefore being automatically criminalised just for leading their lives. There must be a firewall between Home Office immigration control and other Departments if we are serious about ending the current hostile immigration environment.

[Stuart C. McDonald]

I echo the criticisms of the outrageous immigration exemption in the Bill and am pleased to add my name to amendment 15.

Little has been said today about international transfers of personal data by intelligence services, despite the serious concerns raised in Committee. I will therefore speak briefly to new clause 24, which it is all the more important we debate, given the moves by the Trump Administration in the USA to roll back on safeguards on the targeting of drone strikes and the significant increase in their use of lethal force outside armed conflict zones. These developments mean an increased risk of strikes being in breach of international human rights law, and we know that UK intelligence personnel are involved in the transfer of data that could be used in such drone strikes, so it is all the more important that there be safeguards and accountability on when and how information can be transferred and that legal certainty be provided for our personnel.

As the Joint Committee on Human Rights said in its 2016 report,

“we owe it to all those involved in the chain of command for such uses of lethal force…to provide them with absolute clarity about the circumstances in which they will have a defence against any possible future criminal prosecution, including those which might originate from outside the UK.”

The Bill fails to provide those safeguards and clarity. Clause 109 places no realistic restriction on such transfers, referring simply to necessity and proportionality in pursuit of statutory goals. The new clause would provide a clear bar on transfers for use in unlawful operations and introduce accountability and transparency by requiring that written reasons be provided for any transfer thought to be lawful, that there be ministerial sign-off, that certain information be provided to the Information Commissioner and the Investigatory Powers Commissioner and that guidance on transfers be laid before Parliament. The new clause would not hinder but help our personnel working in this area and ensure that the UK is seen as complying with the rule of law and its international obligations. This is an important debate to which we will have to return in the future.

Question put and agreed to.

New clause 13 accordingly read a Second time, and added to the Bill.

New Clause 14

Destroying or falsifying information and documents etc

“(1) This section applies where a person—

(a) has been given an information notice requiring the person to provide the Commissioner with information, or

(b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.

(2) It is an offence for the person—

(a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or

“(b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,

with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.

(3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.”—(Margot James.)

This new clause would be inserted after Clause 145. It provides that, where the Information Commissioner has given an information notice (see Clause 141) or an assessment notice (see Clause 144) requiring access to information, a document, equipment or material, it is an offence to destroy or otherwise dispose of, conceal, block or (where relevant) falsify it.

Brought up, read the First and Second time, and added to the Bill.

New Clause 15

Applications in respect of urgent notices

“(1) This section applies where an information notice, an assessment notice or an enforcement notice given to a person contains an urgency statement.

(2) The person may apply to the court for either or both of the following—

(a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;

(b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.

(3) On an application under subsection (2), the court may do any of the following—

(a) direct that the notice is to have effect as if it did not contain the urgency statement;

(b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;

(c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;

(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).

(4) The decision of the court on an application under this section is final.

(5) In this section, “urgency statement” means—

(a) in relation to an information notice, a statement under section141(7)(a),

(b) in relation to an assessment notice, a statement under section144(8)(a) or (8A)(d), and

(c) in relation to an enforcement notice, a statement under section147(8)(a).”—(Margot James.)

This new clause would be inserted after Clause 160. It enables a person who is given an information notice, assessment notice or enforcement which requires the person to comply with it urgently to apply to the court for variation of the timetable for compliance. It replaces the provision in Clauses 159(2) and 160(5) for appeals to the Tribunal. See also Amendments 54, 56 and 60.

Brought up, read the First and Second time, and added to the Bill.

New Clause 16

Post-review powers to make provision about representation of data subjects

“(1) After the report under section 182(1) is laid before Parliament, the Secretary of State may by regulations—

(a) exercise the powers under Article 80(2) of the GDPR in relation to England and Wales and Northern Ireland,

(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise a data subject’s rights under Article 82 of the GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and

(c) make provision described in section182(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

(2) The powers under subsection (1) include power—

(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject’s rights;

(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject’s rights;

(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;

(d) to confer functions on a person, including functions involving the exercise of a discretion;

(e) to amend sections162 to164,173,180,194,196 and197;

(f) to insert new sections and Schedules into Part 6 or 7;

(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(c) the assessment of the amount of compensation;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the affirmative resolution procedure.”—(Margot James.)

This new clause would be inserted after Clause 182. It contains the provisions currently in subsections (4) to (7) of Clause 182, modified to take account of the changes made to that Clause by Amendments 61 and 62 (see subsections (1)(c) and (3) of this new Clause).

Brought up, read the First and Second time, and added to the Bill.

New Clause 17

Reserve forces: data-sharing by HMRC

“(1) The Reserve Forces Act 1996 is amended as follows.

(2) After section 125 insert—

“125A Supply of contact details by HMRC

(1) This subsection applies to contact details for—

(a) a member of an ex-regular reserve force, or

(b) a person to whom section 66 (officers and former servicemen liable to recall) applies,

which are held by HMRC in connection with a function of HMRC.

(2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State—

(a) to contact a member of an ex-regular reserve force in connection with the person’s liability, or potential liability, to be called out for service under Part 6;

(b) to contact a person to whom section 66 applies in connection with the person’s liability, or potential liability, to be recalled for service under Part 7.

(3) Where a person’s contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person’s service (whether past, present or future) in the reserve forces or regular services.

(4) In this section, “HMRC” means Her Majesty’s Revenue and Customs.

125B Prohibition on disclosure of contact details supplied under section 125A

‘(1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty’s Revenue and Customs (which may be general or specific).

(2) A person who contravenes subsection (1) is guilty of an offence.

(3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already lawfully been made available to the public.

(4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section.

(5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section.

125C Data protection

‘(1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation.

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”—(Margot James.)

This new clause would be inserted after Clause 186. It provides for HMRC to supply the Secretary of State with the contact details of members of the ex-regular reserve force and former members of the armed forces so that they may be contacted regarding their liability to be called out or recalled for service under the Reserved Forces Act 1996. The details supplied may also be used for defence purposes connected with their service in the forces (whether past, present or future). It is an offence for the details supplied to be disclosed without the consent of the Commissioners for Revenue and Customs.

Brought up, read the First and Second time, and added to the Bill.

18:00

Proceedings interrupted (Programme Order, this day).

The Deputy Speaker put forthwith the Questions necessary for the disposal of the business to be concluded at that time (Standing Order No. 83E).

New Clause 4

Bill of Data Rights in the Digital Environment (No. 2)

“(1) The Secretary of State shall, by regulations, establish a Bill of Data Rights in the Digital Environment.

(2) Before making regulations under this section, the Secretary of State shall—

(a) consult—

(i) the Commissioner,

(ii) trade associations,

(iii) data subjects, and

(iv) persons who appear to the Commissioner or the Secretary of State to represent the interests of data subjects; and

(b) publish a draft of the Bill of Data Rights.

(3) The Bill of Data Rights in the Digital Environment shall enshrine—

(a) a right for a data subject to have privacy from commercial or personal intrusion,

(b) a right for a data subject to own, curate, move, revise or review their identity as founded upon personal data (whether directly or as a result of processing of that data),

(c) a right for a data subject to have their access to their data profiles or personal data protected, and

(d) a right for a data subject to object to any decision made solely on automated decision-making, including a decision relating to education and employment of the data subject.

(4) Regulations under this section are subject to the affirmative resolution procedure.”—(Tom Watson.)

This new clause would empower the Secretary of State to introduce a Bill of Data Rights in the Digital Environment.

Brought up.

Question put, That the clause be added to the Bill:—

18:01

Division 153

Ayes: 283

---

Labour: 231
Scottish National Party: 32
Liberal Democrat: 10
Plaid Cymru: 4
Independent: 4
Green Party: 1

Noes: 309

---

Conservative: 298
Democratic Unionist Party: 10
Independent: 1

Clause 7

Meaning of “public authority” and “public body”

Amendments made: 22, page 5, line 24, after “(2)” insert “, (2A)”.

This amendment is consequential on Amendment 24.

Amendment 23, page 5, line 26, after “body’” insert—

“for the purposes of the GDPR”.

Subsection (2) of Clause 7 provides that an authority or body is only a “public authority” or a “public body” if it meets the conditions in that subsection. This amendment makes it clear that subsection (2) only affects a body or authority’s status for the purposes of the GDPR.

Amendment 24, page 5, line 27, at end insert—

“(2A) The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the following that fall within those definitions—

(a) a parish council in England;

(b) a community council in Wales;

(c) a community council in Scotland;

(d) a parish meeting constituted under section 13 of the Local Government Act 1972;

(e) a community meeting constituted under section 27 of that Act;

(f) charter trustees constituted—

(i) under section 246 of that Act,

(ii) under Part 1 of the Local Government and Public Involvement in Health Act 2007, or

(iii) by the Charter Trustees Regulations 1996 (S.I. 1996/263).”—(Margot James.)

This amendment provides that the authorities listed in new subsection (2A) are not “public authorities” or “public bodies” for the purposes of the GDPR by virtue of being public authorities or Scottish public authorities as defined in the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002.

Clause 14

Amendment proposed: 5, page 8, line 11, at end insert—

“(2A) A decision that engages an individual’s rights under the Human Rights Act 1998 does not fall within Article 22(2)(b) of the GDPR (exception from prohibition on taking significant decisions based solely on automated processing for decisions that are authorised by law and subject to safeguards for the data subject’s rights, freedoms and legitimate interests).

(2B) A decision is ‘based solely on automated processing’ for the purposes of this section if, in relation to a data subject, there is no meaningful input by a natural person in the decision-making process.”—(Brendan O’Hara.)

This amendment would ensure that where human rights are engaged by automated decisions these are human decisions and provides clarification that purely administrative human approval of an automated decision does make an automated decision a ‘human’ one.

Question put, That the amendment be made.

18:13

Division 154

Ayes: 282

---

Labour: 231
Scottish National Party: 30
Liberal Democrat: 10
Plaid Cymru: 4
Independent: 4
Green Party: 1

Noes: 310

---

Conservative: 299
Democratic Unionist Party: 10
Independent: 1

Clause 21

Processing to which this Chapter applies

Amendment made: 143, page 13, line 10, leave out

“to which Part 3 (law enforcement processing) or”

and insert

“by a competent authority for any of the law enforcement purposes (as defined in Part 3) or processing to which”.—(Margot James.)

This amendment clarifies the description of the types of processing excluded from Chapter 3 of Part 2 (other general processing).

Clause 119

Inspection of personal data in accordance with international obligations

Amendment made: 25, page 66, line 12, at end insert—

‘( ) Paragraphs (c) and (d) of section 3(14) do not apply to references in this section to personal data, the processing of personal data, a controller or a processor.”—(Margot James.)

This amendment secures that the references to personal data, the processing of personal data, a controller or a processor in Clause 119 include all types of personal data etc. It disapplies Clause 3(14)(c) and (d), which provide that references to personal data etc in Parts 5 to 7 of the Bill are usually to personal data etc to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.

Clause 120

Further international role

Amendment made: 26, page 67, line 4, at end insert—

‘( ) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.”—(Margot James.)

This amendment secures that the references to personal data and the processing of personal data in Clause 120 include all types of personal data and the processing of personal data. It disapplies Clause 3(14)(c), which provides that references to personal data etc in Parts 5 to 7 of the Bill are usually to personal data etc to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.

Clause 141

Information notices

Amendments made: 27, page 78, line 2, after “of” insert “—

(i) investigating a suspected failure of a type described in section 146(2) or a suspected offence under this Act, or

(ii) ”.

This amendment enables the Information Commissioner to obtain information from any person for the purposes of investigating failures to comply with the data protection legislation that are listed in Clause 146(2) or suspected offences under the Bill.

Amendment 28, page 78, line 5, after “state” insert “—

(a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

(b) ”.

This amendment requires information notices given by the Information Commissioner to state whether they are given under Clause 141(1)(a), (b)(i) or (b)(ii). See also Amendment 27.

Amendment 29, page 78, line 15, leave out

“the rights of appeal under section 159”

and insert “—

(a) the consequences of failure to comply with it, and

(b) the rights under sections 159 and (Applications in respect of urgent notices) (appeals etc).”

This amendment adds a requirement for information notices to include information about the consequences of failure to comply. The reference in paragraph (b) to applications in respect of urgent notices is consequential on NC15.

Amendment 30, page 78, line 26, leave out “7 days” and insert “24 hours”.—(Margot James.)

This amendment provides that, in urgent cases, the Information Commissioner must allow a minimum of 24 hours, rather than 7 days, for a person to provide information requested in an information notice.

Clause 144

Assessment notices

Amendments made: 31, page 80, line 19, after “for” insert

“a copy (in such form as may be requested) of”.

This amendment and Amendments 32 and 33 tidy up Clause 144(2)(d) and make clear that the Commissioner may ask for copies of documents, as well as information viewed, to be provided in a particular form.

Amendment 32, page 80, line 20, leave out “a copy of”.

See the explanatory statement for Amendment 31.

Amendment 33, page 80, line 21, leave out

“a copy (in such form as may be requested) of”.

See the explanatory statement for Amendment 31.

Amendment 34, page 80, line 27, at end insert—

“( ) provide the Commissioner with an explanation of such documents, information, equipment or material;”.

This amendment enables an assessment notice given by the Information Commissioner to require a person to provide an explanation of documents, information, equipment or material.

Amendment 35, page 80, line 39, leave out “(8)” and insert “(8A)”.

See the explanatory statement for Amendment 38.

Amendment 36, page 80, line 40, leave out

“the rights of appeal under section 159”

and insert “—

(a) the consequences of failure to comply with it, and

(b) the rights under sections 159 and (Applications in respect of urgent notices) (appeals etc).”

This amendment adds a requirement for assessment notices to include information about the consequences of failure to comply. The reference in paragraph (b) to applications in respect of urgent notices is consequential on NC15.

Amendment 37, page 81, line 8, at end insert “, and

( ) does not meet the conditions in subsection (8A)(a) to (d),”.

This amendment makes clear that, where an assessment notice is given under Clause 144 and compliance is required urgently, the notice cannot fall within both subsection (8) and new subsection (8A) (see Amendment 38).

Amendment 38, page 81, line 11, at end insert—

‘(8A) If an assessment notice—

(a) states that, in the Commissioner’s opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 146(2) or that an offence under this Act has been or is being committed,

(b) indicates the nature of the suspected failure or offence,

(c) does not specify domestic premises,

(d) states that, in the Commissioner’s opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and

(e) gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) do not apply.”

This amendment and Amendments 35 and 39 provide that, in the circumstances described in the new subsection (8A), the Commissioner may require a person to comply with an assessment notice with immediate effect.

Amendment 39, page 81, line 17, after “section” insert “—

“domestic premises” means premises, or a part of premises, used as a dwelling;”.—(Margot James.)

See the explanatory statement for Amendment 38.

Clause 146

Enforcement notices

Amendments made: 40, page 82, line 22, after “GDPR” insert

“or section 64 or 65 of this Act”.

This amendment enables the Information Commissioner to give an enforcement notice or a penalty notice (see Clause 152(1)(a)) in respect of a failure to comply with Clause 64 or 65 of the Bill (law enforcement processing: data protection impact assessments and prior consultation with the Commissioner).

Amendment 41, page 83, line 8, leave out “enforcement notices” and insert “an enforcement notice”.

This amendment is made for drafting consistency with the provision inserted by Amendment 43.

Amendment 42, page 83, line 9, at end insert

“, including by amending this section and sections 147 to 149,”.

This amendment is consequential on Amendment 43.

Amendment 43, page 83, line 10, leave out paragraph (b) and insert—

“( ) may make provision about the giving of an information notice, an assessment notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 141, 142, 144, 145 and 152 to 154 and Schedules 15 and 16, and”.—(Margot James.)

This amendment enables the Secretary of State, when making regulations enabling the Information Commissioner to give enforcement notices in respect of further failures, to make provision about the exercise of the Information Commissioner’s other enforcement powers in connection with the failure.

Clause 147

Enforcement notices: supplementary

Amendments made: 44, page 83, line 31, leave out

“the rights of appeal under section 159”

and insert “—

(a) the consequences of failure to comply with it, and

(b) the rights under sections 159 and (Applications in respect of urgent notices) (appeals etc).”

This amendment adds a requirement for enforcement notices to include information about the consequences of failure to comply. The reference in paragraph (b) to applications in respect of urgent notices is consequential on new Clause NC15.

Amendment 45, page 83, line 44, leave out “7 days” and insert “24 hours”.—(Margot James.)

This amendment provides that, in urgent cases, the Information Commissioner must allow a minimum of 24 hours, rather than 7 days, for a person to comply with an enforcement notice.

Clause 155

Fixed penalties for non-compliance with charges regulations

Amendment made: 46, page 88, line 36, leave out “Secretary of State” and insert “Commissioner”.—(Margot James.)

This amendment provides that the persons to be consulted before the Commissioner produces a document specifying the penalties for non-compliance with charges regulations are the persons that the Commissioner, rather than the Secretary of State, considers appropriate.

Clause 157

Guidance about regulatory action

Amendments made: 47, page 89, line 12, at end insert—

“( ) information notices,”.

This amendment requires the guidance produced under Clause 157 to include guidance about how the Information Commissioner proposes to exercise her functions in connection with information notices.

Amendment 48, page 89, line 18, at end insert—

‘( ) In relation to information notices, the guidance must include—

(a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 141(7) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an information notice.”

This amendment specifies what the guidance under Clause 157 in relation to information notices must include.

Amendment 49, page 89, line 21, at end insert—

“( ) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 144(8) or (8A) (urgent cases);”.

This amendment provides that the guidance under Clause 157 in relation to assessment notices must include provision about when the Information Commissioner would consider it appropriate to give an assessment notice requiring a person to comply with it urgently.

Amendment 50, page 89, line 33, at end insert—

“( ) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice.”

This amendment provides that the guidance under Clause 157 in relation to assessment notices must include provision about how the Information Commissioner will determine how to proceed if a person does not comply with such a notice.

Amendment 51, page 89, line 39, at end insert—

‘( ) In relation to enforcement notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 147(8) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.”

This amendment specifies what the guidance under Clause 157 in relation to enforcement notices must include.

Amendment 52, page 90, line 2, at end insert—

“( ) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.”

This amendment provides that the guidance under Clause 157 in relation to penalty notices must include provision about how the Information Commissioner will determine how to proceed if a person does not comply with such a notice.

Amendment 53, page 90, line 9, leave out “Secretary of State” and insert “Commissioner”.—(Margot James.)

This amendment provides that the persons to be consulted before the Commissioner produces guidance about regulatory action are the persons that the Commissioner, rather than the Secretary of State, considers appropriate.

Clause 159

Rights of appeal

Amendments made: 54, page 91, line 10, leave out subsection (2).

See the explanatory statement for NC15.

Amendment 55, page 91, line 20, after “appeal” insert “to the Tribunal”.—(Margot James.)

This amendment adds a reference to the Tribunal in Clause 159(4) for consistency with Clause 159(3) and (5).

Clause 160

Determination of appeals

Amendment made: 56, page 91, line 39, leave out subsection (5).—(Margot James.)

See the explanatory statement for NC15.

Clause 173

Jurisdiction

Amendments made: 57, page 100, line 38, for “subsection (3)” substitute “subsections (3) and (4)”.

See the explanatory statement for Amendment 58.

Amendment 58, page 100, line 39, at end insert—

“( ) section (Information orders) (information orders);”.

This amendment and Amendments 57 and 60 provide that information orders under new Clause NC13 can normally be made by the High Court or county court or, in Scotland, by the Court of Session or the sheriff. There is an exception for cases in which the information notice contains an urgency statement, when only the High Court or, in Scotland, the Court of Session can make an information order.

Amendment 59, page 101, line 2, after “jurisdiction” insert

“conferred by the provisions listed in subsection (2)”.

This amendment adds words to make clear that the jurisdiction referred to in Clause 173(3) is the jurisdiction conferred on a court by the provisions listed in subsection (2) of that clause.

Amendment 60, page 101, line 3, at end insert—

‘(4) In relation to an information notice which contains a statement under section 141(7), the jurisdiction conferred on a court by section (Information orders) is exercisable only by the High Court or, in Scotland, the Court of Session.

(5) The jurisdiction conferred on a court by section (Applications in respect of urgent notices) (applications in respect of urgent notices) is exercisable only by the High Court or, in Scotland, the Court of Session.”—(Margot James.)

See the explanatory statement for Amendment 58. This amendment also provides that applications under NC15 are to be dealt with by the High Court or, in Scotland, by the Court of Session.

Clause 182

Duty to review provision for representation of data subjects

Amendments made: 61, page 106, line 34, at end insert “, and

(e) the merits of making provision for a children’s rights organisation to exercise some or all of a data subject’s rights under Articles 77, 78, 79 and 82 of the GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.”

This amendment requires the Secretary of State’s review under Clause 182 to include a review of the merits of making provision for children’s rights organisations (defined in Amendment 62) to act on behalf of children in respect of their rights to complain to the Information Commissioner, to a judicial remedy and to compensation under the GDPR.

Amendment 62, page 106, line 36, at end insert—

‘( ) In carrying out the review, the Secretary of State must—

(a) consider the particular needs of children separately from the needs of adults,

(b) have regard to the fact that children have different needs at different stages of development,

(c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the GDPR or section 180,

(d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the GDPR by another person on their behalf and the merits of making available other support or advice, and

(e) have regard to the United Kingdom’s obligations under the United Nations Convention on the Rights of the Child.

( ) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—

(a) persons active in the field of protection of data subjects’ rights and freedoms with regard to the protection of their personal data,

(b) children and parents,

(c) children’s rights organisations and other persons who appear to the Secretary of State to represent the interests of children,

(d) child development experts, and

(e) trade associations.

( ) In this section—

“children’s rights organisation” means a body or other organisation which—

(a) is active in representing the interests of children, and

(b) has objectives which are in the public interest;

“trade association” includes a body representing controllers or processors;

“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.”

This amendment requires the Secretary of State to consider and analyse specified matters relating to children when carrying out the review under Clause 182. It also imposes an obligation on the Secretary of State to consult specified persons before preparing the report under that clause.

Amendment 63, page 106, line 37, leave out subsections (4) to (7).—(Margot James.)

This amendment is consequential on NC16, which reproduces subsections (4) to (7) of Clause 182 with modifications.

Clause 187

Penalties for offences

Amendment made: 64, page 109, line 24, after “143” insert “, (Destroying or falsifying information and documents etc)”.—(Margot James.)

This amendment provides for a person who commits an offence under NC14 to be liable to a fine, on summary conviction or on conviction on indictment.

Clause 190

Recordable offences

Amendment made: 65, page 111, line 12, at end insert—

“( ) section (Destroying or falsifying information and documents etc);”.—(Margot James.)

This amendment provides for convictions for the offence under NC14 to be recorded on the Police National Computer. People who are arrested for a recordable offence may have their fingerprints and DNA samples taken.

Clause 198

Territorial application of this Act

Amendment made: 66, page 118, line 36, after “provision” insert “in or”.—(Margot James.)

Subsections (1) to (3) of Clause 198 (territorial application) set out when the Bill applies to the processing of personal data. Subsection (4) provides that subsections (1) to (3) have effect subject to provision made “under” Clause 120. This amendment amends subsection (4) so that it also refers to provision made “in” Clause 120 (see Clause 120(4)).

Clause 203

Commencement

Amendment made: 67, page 121, line 36, for “204” substitute “204(2)”.—(Margot James.)

This amendment is consequential on Amendment 68.

Clause 204

Transitional provision

Amendments made: 68, page 122, line 1, at end insert—

‘(1) Schedule (Transitional provision etc) contains transitional, transitory and saving provision.

(2) ”.

This amendment is consequential on NS3.

Amendment 69, page 122, line 4, at end insert

“or with the GDPR beginning to apply, including provision amending or repealing a provision of Schedule (Transitional provision etc).

‘( ) Regulations under this section that amend or repeal a provision of Schedule (Transitional provision etc) are subject to the negative resolution procedure.”—(Margot James.)

This amendment enables the Secretary of State, by regulations, to make transitional, transitory or saving provision in connection with the GDPR beginning to apply. It also enables regulations, subject to the negative resolution procedure, to amend NS3.

Clause 205

Extent

Amendments made: 70, page 122, line 11, leave out “and 182” insert

“,182 and (Post-review powers to make provision about representation of data subjects)”.

This amendment is consequential on NC16. It provides that the new Clause extends to England and Wales and Northern Ireland only.

Amendment 71, page 122, line 16, for “204” substitute “204(2)”.—(Margot James.)

This amendment is consequential on Amendment 68.

New Schedule 3

Transitional provision etc

Part 1

General

Interpretation

1 (1) In this Schedule—

“the 1984 Act” means the Data Protection Act 1984;

“the 1998 Act” means the Data Protection Act 1998;

“the 2014 Regulations” means the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141);

“data controller” has the same meaning as in the 1998 Act (see section 1 of that Act);

“the old data protection principles” means the principles set out in—

(a) Part 1 of Schedule 1 to the 1998 Act, and

(b) regulation 30 of the 2014 Regulations.

(2) A provision of the 1998 Act that has effect by virtue of this Schedule is not, by virtue of that, part of the data protection legislation (as defined in section 3).

Part 2

Rights of data subjects

Right of access to personal data under the 1998 Act

2 (1) The repeal of sections 7 to 9A of the 1998 Act (right of access to personal data) does not affect the application of those sections after the relevant time in a case in which a data controller received a request under section 7 of that Act (right of access to personal data) before the relevant time.

(2) The repeal of sections 7 and 8 of the 1998 Act and the revocation of regulation 44 of the 2014 Regulations (which applies those sections with modifications) do not affect the application of those sections and that regulation after the relevant time in a case in which a UK competent authority received a request under section 7 of the 1998 Act (as applied by that regulation) before the relevant time.

(3) The revocation of the relevant regulations, or their amendment by Schedule 18 to this Act, and the repeals and revocation mentioned in sub-paragraphs (1) and (2), do not affect the application of the relevant regulations after the relevant time in a case described in those sub-paragraphs.

(4) In this paragraph—

“the relevant regulations” means—

(a) the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191);

(b) regulation 4 of, and Schedule 1 to, the Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290);

(c) regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244);

“the relevant time” means the time when the repeal of section 7 of the 1998 Act comes into force;

“UK competent authority” has the same meaning as in Part 4 of the 2014 Regulations (see regulation 27 of those Regulations).

Right to prevent processing likely to cause damage or distress under the 1998 Act

3 (1) The repeal of section 10 of the 1998 Act (right to prevent processing likely to cause damage or distress) does not affect the application of that section after the relevant time in a case in which an individual gave notice in writing to a data controller under that section before the relevant time.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 10 of the 1998 Act comes into force.

Right to prevent processing for purposes of direct marketing under the 1998 Act

4 (1) The repeal of section 11 of the 1998 Act (right to prevent processing for purposes of direct marketing) does not affect the application of that section after the relevant time in a case in which an individual gave notice in writing to a data controller under that section before the relevant time.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 11 of the 1998 Act comes into force.

Automated processing under the 1998 Act

5 (1) The repeal of section 12 of the 1998 Act (rights in relation to automated decision-taking) does not affect the application of that section after the relevant time in relation to a decision taken by a person before that time if—

(a) in taking the decision the person failed to comply with section 12(1) of the 1998 Act, or

(b) at the relevant time—

(i) the person had not taken all of the steps required under section 12(2) or (3) of the 1998 Act, or

(ii) the period specified in section 12(2)(b) of the 1998 Act (for an individual to require a person to reconsider a decision) had not expired.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 12 of the 1998 Act comes into force.

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

6 (1) The repeal of section 13 of the 1998 Act (compensation for failure to comply with certain requirements) does not affect the application of that section after the relevant time in relation to damage or distress suffered at any time by reason of an act or omission before the relevant time.

(2) The revocation of regulation 45 of the 2014 Regulations (right to compensation) does not affect the application of that regulation after the relevant time in relation to damage or distress suffered at any time by reason of an act or omission before the relevant time.

(3) “The relevant time” means—

(a) in sub-paragraph (1), the time when the repeal of section 13 of the 1998 Act comes into force;

(b) in sub-paragraph (2), the time when the revocation of regulation 45 of the 2014 Regulation comes into force.

Rectification, blocking, erasure and destruction under the 1998 Act

7 (1) The repeal of section 14(1) to (3) and (6) of the 1998 Act (rectification, blocking, erasure and destruction of inaccurate personal data) does not affect the application of those provisions after the relevant time in a case in which an application was made under subsection (1) of that section before the relevant time.

(2) The repeal of section 14(4) to (6) of the 1998 Act (rectification, blocking, erasure and destruction: risk of further contravention in circumstances entitling data subject to compensation under section 13 of the 1998 Act) does not affect the application of those provisions after the relevant time in a case in which an application was made under subsection (4) of that section before the relevant time.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 14 of the 1998 Act comes into force.

Jurisdiction and procedure under the 1998 Act

8 The repeal of section 15 of the 1998 Act (jurisdiction and procedure) does not affect the application of that section in connection with sections 7 to 14 of the 1998 Act as they have effect by virtue of this Schedule.

Exemptions under the 1998 Act

9 (1) The repeal of Part 4 of the 1998 Act (exemptions) does not affect the application of that Part after the relevant time in connection with a provision of Part 2 of the 1998 Act as it has effect after that time by virtue of paragraphs 2 to 7 of this Schedule.

(2) The revocation of the relevant Orders, and the repeal mentioned in sub-paragraph (1), do not affect the application of the relevant Orders after the relevant time in connection with a provision of Part 2 of the 1998 Act as it has effect as described in sub-paragraph (1).

(3) In this paragraph—

“the relevant Orders” means—

(a) the Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184);

(b) the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413);

(c) the Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414);

(d) the Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415);

(e) the Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416);

(f) Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419);

(g) Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864);

“the relevant time” means the time when the repeal of the provision of Part 2 of the 1998 Act in question comes into force.

(4) As regards certificates issued under section 28(2) of the 1998 Act, see Part 5 of this Schedule.

Prohibition by this Act of requirement to produce relevant records

10 (1) In Schedule 17 to this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.

(2) In section 177 of this Act, references to a “relevant record” include a record which does not fall within the definition in Schedule 17 to this Act (read with sub-paragraph (1)) but which, immediately before the relevant time, was a “relevant record” for the purposes of section 56 of the 1998 Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 56 of the 1998 Act comes into force.

Avoidance under this Act of certain contractual terms relating to health records

11 In section 178 of this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.

Part 3

The GDPR and Part 2 of this Act

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

12 In paragraph 20(2) of Schedule 2 to this Act (self-incrimination), the reference to an offence under this Act includes an offence under the 1998 Act or the 1984 Act.

Manual unstructured data held by FOI public authorities

13 Until the first regulations under section 24(8) of this Act come into force, “the appropriate maximum” for the purposes of that section is—

(a) where the controller is a public authority listed in Part 1 of Schedule 1 to the Freedom of Information Act 2000, £600, and

(b) otherwise, £450.

Part 4

Law enforcement and intelligence services processing

Logging

14 (1) In relation to an automated processing system set up before 6 May 2016, subsections (1) to (3) of section 62 of this Act do not apply if and to the extent that compliance with them would involve disproportionate effort.

(2) Sub-paragraph (1) ceases to have effect at the beginning of 6 May 2023.

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

15 Nothing in this Schedule, read with the revocation of regulation 50 of the 2014 Regulations, has the effect of applying a provision of the 1998 Act to the processing of personal data to which Part 4 of the 2014 Regulations applies in a case in which that provision did not apply before the revocation of that regulation.

Maximum fee for data subject access requests to intelligence services

16 Until the first regulations under section 94(4)(b) of this Act come into force, the maximum amount of a fee that may be required by a controller under that section is £10.

Part 5

National security certificates

National security certificates: processing of personal data under the 1998 Act

17 (1) The repeal of section 28(2) to (12) of the 1998 Act does not affect the application of those provisions after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies.

(2) A certificate issued under section 28(2) of the 1998 Act continues to have effect after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies.

(3) Where a certificate continues to have effect under sub-paragraph (2) after the relevant time, it may be revoked or quashed in accordance with section 28 of the 1998 Act after the relevant time.

(4) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

National security certificates: processing of personal data under the 2018 Act

18 (1) This paragraph applies to a certificate issued under section 28(2) of the 1998 Act (an “old certificate”) which has effect immediately before the relevant time.

(2) If and to the extent that the old certificate provides protection with respect to personal data which corresponds to protection that could be provided by a certificate issued under section 27, 79 or 111 of this Act, the old certificate also has effect to that extent after the relevant time as if—

(a) it were a certificate issued under one or more of sections 27, 79 and 111 (as the case may be),

(b) it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the applied GDPR, and

(c) where it has effect as a certificate issued under section 79, it certified that each restriction in question is a necessary and proportionate measure to protect national security.

(3) Where an old certificate also has effect as if it were a certificate issued under one or more of sections 27, 79 and 111, that section has, or those sections have, effect accordingly in relation to the certificate.

(4) Where an old certificate has an extended effect because of sub-paragraph (2), section 129 of this Act does not apply in relation to it.

(5) An old certificate that has an extended effect because of sub-paragraph (2) provides protection only with respect to the processing of personal data that occurs during the period of 1 year beginning with the relevant time (and a Minister of the Crown may curtail that protection by wholly or partly revoking the old certificate).

(6) For the purposes of this paragraph—

(a) a reference to the protection provided by a certificate issued under—

(i) section 28(2) of the 1998 Act, or

(ii) section 27, 79 or 111 of this Act,

is a reference to the effect of the evidence that is provided by the certificate;

(b) protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the applied GDPR to which a certificate under section 27, 79 or 111 could relate.

(7) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

Part 6

The Information Commissioner

Appointment etc

19 (1) On and after the relevant day, the individual who was the Commissioner immediately before that day—

(a) continues to be the Commissioner,

(b) is to be treated as having been appointed under Schedule 12 to this Act, and

(c) holds office for the period—

(i) beginning with the relevant day, and

(ii) lasting for 7 years less a period equal to the individual’s pre-commencement term.

(2) On and after the relevant day, a resolution passed by the House of Commons for the purposes of paragraph 3 of Schedule 5 to the 1998 Act (salary and pension of Commissioner), and not superseded before that day, is to be treated as having been passed for the purposes of paragraph 4 of Schedule 12 to this Act.

(3) In this paragraph—

“pre-commencement term”, in relation to an individual, means the period during which the individual was the Commissioner before the relevant day;

“the relevant day” means the day on which Schedule 12 to this Act comes into force.

Accounts

20 (1) The repeal of paragraph 10 of Schedule 5 to the 1998 Act does not affect the duties of the Commissioner and the Comptroller and Auditor General under that paragraph in respect of the Commissioner’s statement of account for the financial year beginning with 1 April 2017.

(2) The Commissioner’s duty under paragraph 11 of Schedule 12 to this Act to prepare a statement of account for each financial year includes a duty to do so for the financial year beginning with 1 April 2018.

Annual report

21 (1) The repeal of section 52(1) of the 1998 Act (annual report) does not affect the Commissioner’s duty under that subsection to produce a general report on the exercise of the Commissioner’s functions under the 1998 Act during the period of 1 year beginning with 1 April 2017 and to lay it before Parliament.

(2) The repeal of section 49 of the Freedom of Information Act 2000 (annual report) does not affect the Commissioner’s duty under that section to produce a general report on the exercise of the Commissioner’s functions under that Act during the period of 1 year beginning with 1 April 2017 and to lay it before Parliament.

(3) The first report produced by the Commissioner under section 138 of this Act must relate to the period of 1 year beginning with 1 April 2018.

Fees etc received by the Commissioner

22 (1) The repeal of Schedule 5 to the 1998 Act (Information Commissioner) does not affect the application of paragraph 9 of that Schedule after the relevant time to amounts received by the Commissioner before the relevant time.

(2) In this paragraph, “the relevant time” means the time when the repeal of Schedule 5 to the 1998 Act comes into force.

23 Paragraph 10 of Schedule 12 to this Act applies only to amounts received by the Commissioner after the time when that Schedule comes into force.

Functions in connection with the Data Protection Convention

24 (1) The repeal of section 54(2) of the 1998 Act (functions to be discharged by the Commissioner for the purposes of Article 13 of the Data Protection Convention), and the revocation of the Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186), do not affect the application of articles 1 to 5 of that Order after the relevant time in relation to a request described in those articles which was made before that time.

(2) The references in paragraph 9 of Schedule 13 to this Act (Data Protection Convention: restrictions on use of information) to requests made or received by the Commissioner under paragraph 6 or 7 of that Schedule include a request made or received by the Commissioner under article 3 or 4 of the Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186).

(3) The repeal of section 54(7) of the 1998 Act (duty to notify the European Commission of certain approvals and authorisations) does not affect the application of that provision after the relevant time in relation to an approval or authorisation granted before the relevant time.

(4) In this paragraph, “the relevant time” means the time when the repeal of section 54 of the 1998 Act comes into force.

Co-operation with the European Commission: transfers of personal data outside the EEA

25 (1) The repeal of section 54(3) of the 1998 Act (co-operation by the Commissioner with the European Commission etc), and the revocation of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190), do not affect the application of articles 1 to 4 of that Order after the relevant time in relation to transfers that took place before the relevant time.

(2) In this paragraph—

“the relevant time” means the time when the repeal of section 54 of the 1998 Act comes into force;

“transfer” has the meaning given in article 2 of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190).

Charges payable to the Commissioner by controllers

26 (1) The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) have effect after the relevant time (until revoked) as if they were made under section 136 of this Act.

(2) In this paragraph, “the relevant time” means the time when section 136 of this Act comes into force.

Requests for assessment

27 (1) The repeal of section 42 of the 1998 Act (requests for assessment) does not affect the application of that section after the relevant time in a case in which the Commissioner received a request under that section before the relevant time, subject to sub-paragraph (2).

(2) The Commissioner is only required to make an assessment of acts and omissions that took place before the relevant time.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 42 of the 1998 Act comes into force.

Codes of practice

28 (1) The repeal of section 52E of the 1998 Act (effect of codes of practice) does not affect the application of that section after the relevant time in relation to legal proceedings or to the exercise of the Commissioner’s functions under the 1998 Act as it has effect by virtue of this Schedule.

(2) In section 52E of the 1998 Act, as it has effect by virtue of this paragraph, the references to the 1998 Act include that Act as it has effect by virtue of this Schedule.

(3) For the purposes of subsection (3) of that section, as it has effect by virtue of this paragraph, the data-sharing code and direct marketing code in force immediately before the relevant time are to be treated as having continued in force after that time.

(4) In this paragraph—

“the data-sharing code” and “the direct marketing code” mean the codes respectively prepared under sections 52A and 52AA of the 1998 Act and issued under section 52B(5) of that Act;

“the relevant time” means the time when the repeal of section 52E of the 1998 Act comes into force.

Part 7

Enforcement etc under the 1998 Act

Interpretation of this Part

29 (1) In this Part of this Schedule, references to contravention of the sixth data protection principle sections are to relevant contravention of any of sections 7, 10, 11 or 12 of the 1998 Act, as they continue to have effect by virtue of this Schedule after their repeal (and references to compliance with the sixth data protection principle sections are to be read accordingly).

(2) In sub-paragraph (1), “relevant contravention” means contravention in a manner described in paragraph 8 of Part 2 of Schedule 1 to the 1998 Act (sixth data protection principle).

Information notices

30 (1) The repeal of section 43 of the 1998 Act (information notices) does not affect the application of that section after the relevant time in a case in which—

(a) the Commissioner served a notice under that section before the relevant time (and did not cancel it before that time), or

(b) the Commissioner requires information after the relevant time for the purposes of—

(i) responding to a request made under section 42 of the 1998 Act before that time,

(ii) determining whether a data controller complied with the old data protection principles before that time, or

(iii) determining whether a data controller complied with the sixth data protection principle sections after that time.

(2) In section 43 of the 1998 Act, as it has effect by virtue of this paragraph—

(a) the reference to an offence under section 47 of the 1998 Act includes an offence under section 143 of this Act, and

(b) the references to an offence under the 1998 Act include an offence under this Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 43 of the 1998 Act comes into force.

Special information notices

31 (1) The repeal of section 44 of the 1998 Act (special information notices) does not affect the application of that section after the relevant time in a case in which—

(a) the Commissioner served a notice under that section before the relevant time (and did not cancel it before that time), or

(b) the Commissioner requires information after the relevant time for the purposes of—

(i) responding to a request made under section 42 of the 1998 Act before that time, or

(ii) ascertaining whether section 44(2)(a) or (b) of the 1998 Act was satisfied before that time.

(2) In section 44 of the 1998 Act, as it has effect by virtue of this paragraph—

(a) the reference to an offence under section 47 of the 1998 Act includes an offence under section 143 of this Act, and

(b) the references to an offence under the 1998 Act include an offence under this Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 44 of the 1998 Act comes into force.

Assessment notices

32 (1) The repeal of sections 41A and 41B of the 1998 Act (assessment notices) does not affect the application of those sections after the relevant time in a case in which—

(a) the Commissioner served a notice under section 41A of the 1998 Act before the relevant time (and did not cancel it before that time), or

(b) the Commissioner considers it appropriate, after the relevant time, to investigate—

(i) whether a data controller complied with the old data protection principles before that time, or

(ii) whether a data controller complied with the sixth data protection principle sections after that time.

(2) The revocation of the Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282), and the repeals mentioned in sub-paragraph (1), do not affect the application of that Order in a case described in sub-paragraph (1).

(3) Sub-paragraph (1) does not enable the Secretary of State, after the relevant time, to make an order under section 41A(2)(b) or (c) of the 1998 Act (data controllers on whom an assessment notice may be served) designating a public authority or person for the purposes of that section.

(4) Section 41A of the 1998 Act, as it has effect by virtue of sub-paragraph (1), has effect as if subsections (8) and (11) (duty to review designation orders) were omitted.

(5) The repeal of section 41C of the 1998 Act (code of practice about assessment notice) does not affect the application, after the relevant time, of the code issued under that section and in force immediately before the relevant time in relation to the exercise of the Commissioner’s functions under and in connection with section 41A of the 1998 Act, as it has effect by virtue of sub-paragraph (1).

(6) In this paragraph, “the relevant time” means the time when the repeal of section 41A of the 1998 Act comes into force.

Enforcement notices

33 (1) The repeal of sections 40 and 41 of the 1998 Act (enforcement notices) does not affect the application of those sections after the relevant time in a case in which—

(a) the Commissioner served a notice under section 40 of the 1998 Act before the relevant time (and did not cancel it before that time), or

(b) the Commissioner is satisfied, after that time, that a data controller —

(i) contravened the old data protection principles before that time, or

(ii) contravened the sixth data protection principle sections after that time.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 40 of the 1998 Act comes into force.

Determination by Commissioner as to the special purposes

34 (1) The repeal of section 45 of the 1998 Act (determination by Commissioner as to the special purposes) does not affect the application of that section after the relevant time in a case in which—

(a) the Commissioner made a determination under that section before the relevant time, or

(b) the Commissioner considers it appropriate, after the relevant time, to make a determination under that section.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 45 of the 1998 Act comes into force.

Restriction on enforcement in case of processing for the special purposes

35 (1) The repeal of section 46 of the 1998 Act (restriction on enforcement in case of processing for the special purposes) does not affect the application of that section after the relevant time in relation to an enforcement notice or information notice served under the 1998 Act—

(a) before the relevant time, or

(b) after the relevant time in reliance on this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 46 of the 1998 Act comes into force.

Offences

36 (1) The repeal of sections 47, 60 and 61 of the 1998 Act (offences of failing to comply with certain notices and of providing false information etc in response to a notice) does not affect the application of those sections after the relevant time in connection with an information notice, special information notice or enforcement notice served under Part 5 of the 1998 Act—

(a) before the relevant time, or

(b) after that time in reliance on this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 47 of the 1998 Act comes into force.

Powers of entry

37 (1) The repeal of sections 50, 60 and 61 of, and Schedule 9 to, the 1998 Act (powers of entry) does not affect the application of those provisions after the relevant time in a case in which—

(a) a warrant issued under that Schedule was in force immediately before the relevant time,

(b) before the relevant time, the Commissioner supplied information on oath for the purposes of obtaining a warrant under that Schedule but that had not been considered by a circuit judge or a District Judge (Magistrates’ Courts), or

(c) after the relevant time, the Commissioner supplies information on oath to a circuit judge or a District Judge (Magistrates’ Courts) in respect of—

(i) a contravention of the old data protection principles before the relevant time;

(ii) a contravention of the sixth data protection principle sections after the relevant time;

(iii) the commission of an offence under a provision of the 1998 Act (including as the provision has effect by virtue of this Schedule);

(iv) a failure to comply with a requirement imposed by an assessment notice issued under section 41A the 1998 Act (including as it has effect by virtue of this Schedule).

(2) In paragraph 16 of Schedule 9 to the 1998 Act, as it has effect by virtue of this paragraph, the reference to an offence under paragraph 12 of that Schedule includes an offence under paragraph 15 of Schedule 15 to this Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of Schedule 9 to the 1998 Act comes into force.

(4) Paragraphs 14 and 15 of Schedule 9 to the 1998 Act (application of that Schedule to Scotland and Northern Ireland) apply for the purposes of this paragraph as they apply for the purposes of that Schedule.

Monetary penalties

38 (1) The repeal of sections 55A, 55B, 55D and 55E of the 1998 Act (monetary penalties) does not affect the application of those provisions after the relevant time in a case in which—

(a) the Commissioner served a monetary penalty notice under section 55A of the 1998 Act before the relevant time,

(b) the Commissioner served a notice of intent under section 55B of the 1998 Act before the relevant time, or

(c) the Commissioner considers it appropriate, after the relevant time, to serve a notice mentioned in paragraph (a) or (b) in respect of—

(i) a contravention of section 4(4) of the 1998 Act before the relevant time, or

(ii) a contravention of the sixth data protection principle sections after the relevant time.

(2) The revocation of the relevant subordinate legislation, and the repeals mentioned in sub-paragraph (1), do not affect the application of the relevant subordinate legislation (or of provisions of the 1998 Act applied by them) after the relevant time in a case described in sub-paragraph (1).

(3) Guidance issued under section 55C of the 1998 Act (guidance about monetary penalty notices) which is in force immediately before the relevant time continues in force after that time for the purposes of the Commissioner’s exercise of functions under sections 55A and 55B of the 1998 Act as they have effect by virtue of this paragraph.

(4) In this paragraph—

“the relevant subordinate legislation” means—

(a) the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31);

(b) the Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910);

“the relevant time” means the time when the repeal of section 55A of the 1998 Act comes into force.

Appeals

39 (1) The repeal of sections 48 and 49 of the 1998 Act (appeals) does not affect the application of those sections after the relevant time in relation to a notice served under the 1998 Act or a determination made under section 45 of that Act—

(a) before the relevant time, or

(b) after that time in reliance on this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 48 of the 1998 Act comes into force.

Exemptions

40 (1) The repeal of section 28 of the 1998 Act (national security) does not affect the application of that section after the relevant time for the purposes of a provision of Part 5 of the 1998 Act as it has effect after that time by virtue of the preceding paragraphs of this Part of this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of the provision of Part 5 of the 1998 Act in question comes into force.

(3) As regards certificates issued under section 28(2) of the 1998 Act, see Part 5 of this Schedule.

Tribunal Procedure Rules

41 (1) The repeal of paragraph 7 of Schedule 6 to the 1998 Act (Tribunal Procedure Rules) does not affect the application of that paragraph, or of rules made under that paragraph, after the relevant time in relation to the exercise of rights of appeal conferred by section 28 or 48 of the 1998 Act, as they have effect by virtue of this Schedule.

(2) Part 3 of Schedule 18 to this Act does not apply for the purposes of Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act as they apply, after the relevant time, in relation to the exercise of rights of appeal described in sub-paragraph (1).

(3) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7 of Schedule 6 to the 1998 Act comes into force.

Obstruction etc

42 (1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that paragraph after the relevant time in relation to an act or omission in relation to proceedings under the 1998 Act (including as it has effect by virtue of this Schedule).

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force.

Enforcement etc under the 2014 Regulations

43 (1) The references in the preceding paragraphs of this Part of this Schedule to provisions of the 1998 Act include those provisions as applied, with modifications, by regulation 51 of the 2014 Regulations (other functions of the Commissioner).

(2) The revocation of regulation 51 of the 2014 Regulations does not affect the application of those provisions of the 1998 Act (as so applied) as described in those paragraphs.

Part 8

Enforcement etc under this Act

Information notices

44 In section 142 of this Act—

(a) the reference to an offence under section 143 of this Act includes an offence under section 47 of the 1998 Act (including as it has effect by virtue of this Schedule), and

(b) the references to an offence under this Act include an offence under the 1998 Act (including as it has effect by virtue of this Schedule) or the 1984 Act.

Powers of entry

45 In paragraph 16 of Schedule 15 to this Act (powers of entry: self-incrimination), the reference to an offence under paragraph 15 of that Schedule includes an offence under paragraph 12 of Schedule 9 to the 1998 Act (including as it has effect by virtue of this Schedule).

Tribunal Procedure Rules

46 (1) Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act (appeal rights under the 1998 Act) and in force immediately before the relevant time have effect after that time as if they were also made under section 194 of this Act.

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7(1)(a) of Schedule 6 to the 1998 Act comes into force.

Part 9

Other enactments

Powers to disclose information to the Commissioner

47 (1) The following provisions (as amended by Schedule 18 to this Act) have effect after the relevant time as if the matters they refer to included a matter in respect of which the Commissioner could exercise a power conferred by a provision of Part 5 of the 1998 Act, as it has effect by virtue of this Schedule—

(a) section 11AA(1)(a) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner);

(b) sections 33A(1)(a) and 34O(1)(a) of the Local Government Act 1974 (disclosure of information by Local Commissioner);

(c) section 18A(1)(a) of the Health Service Commissioners Act 1993 (disclosure of information by Health Service Commissioner);

(d) paragraph 1 of the entry for the Information Commissioner in Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp 11) (disclosure of information by the Ombudsman);

(e) section 34X(3)(a) of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information by the Ombudsman);

(f) section 18(6)(a) of the Commissioner for Older People (Wales) Act 2006 (disclosure of information by the Commissioner);

(g) section 22(3)(a) of the Welsh Language (Wales) Measure 2011 (nawm 1) (disclosure of information by the Welsh Language Commissioner);

(h) section 49(3)(a) of the Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.)) (disclosure of information by the Ombudsman);

(i) section 44(3)(a) of the Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)) (disclosure of information by the Prison Ombudsman for Northern Ireland).

(2) The following provisions (as amended by Schedule 18 to this Act) have effect after the relevant time as if the offences they refer to included an offence under any provision of the 1998 Act other than paragraph 12 of Schedule 9 to that Act (obstruction of execution of warrant)—

(a) section 11AA(1)(b) of the Parliamentary Commissioner Act 1967;

(b) sections 33A(1)(b) and 34O(1)(b) of the Local Government Act 1974;

(c) section 18A(1)(b) of the Health Service Commissioners Act 1993;

(d) paragraph 2 of the entry for the Information Commissioner in Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp 11);

(e) section 34X(5) of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information by the Ombudsman);

(f) section 18(8) of the Commissioner for Older People (Wales) Act 2006;

(g) section 22(5) of the Welsh Language (Wales) Measure 2011 (nawm 1);

(h) section 49(5) of the Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.));

(i) section 44(3)(b) of the Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)).

(3) In this paragraph, “the relevant time”, in relation to a provision of a section or Schedule listed in sub-paragraph (1) or (2), means the time when the amendment of the section or Schedule by Schedule 18 to this Act comes into force.

Codes etc required to be consistent with the Commissioner’s data-sharing code

48 (1) This paragraph applies in relation to the code of practice issued under each of the following provisions—

(a) section 19AC of the Registration Service Act 1953 (code of practice about disclosure of information by civil registration officials);

(b) section 43 of the Digital Economy Act 2017 (code of practice about disclosure of information to improve public service delivery);

(c) section 52 of that Act (code of practice about disclosure of information to reduce debt owed to the public sector);

(d) section 60 of that Act (code of practice about disclosure of information to combat fraud against the public sector);

(e) section 70 of that Act (code of practice about disclosure of information for research purposes).

(2) During the relevant period, the code of practice does not have effect to the extent that it is inconsistent with the code of practice prepared under section 121 of this Act (data-sharing code) and issued under section 124(4) of this Act (as altered or replaced from time to time).

(3) In this paragraph, “the relevant period”, in relation to a code issued under a section mentioned in sub-paragraph (1), means the period—

(a) beginning when the amendments of that section in Schedule 18 to this Act come into force, and

(b) ending when the code is first reissued under that section.

49 (1) This paragraph applies in relation to the original statement published under section 45E of the Statistics and Registration Service Act 2007 (statement of principles and procedures in connection with access to information by the Statistics Board).

(2) During the relevant period, the statement does not have effect to the extent that it is inconsistent with the code of practice prepared under section 121 of this Act (data-sharing code) and issued under section 124(4) of this Act (as altered or replaced from time to time).

(3) In this paragraph, “the relevant period” means the period—

(a) beginning when the amendments of section 45E of the Statistics and Registration Service Act 2007 in Schedule 18 to this Act come into force, and

(b) ending when the first revised statement is published under that section.

Consumer Credit Act 1974

50 In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong information) (as amended by Schedule 18 to this Act), the reference to information given under Article 15(1) to (3) of the GDPR includes information given at any time under section 7 of the 1998 Act.

Freedom of Information Act 2000

51 Paragraphs 52 to 55 make provision about the Freedom of Information Act 2000 (“the 2000 Act”).

52 (1) This paragraph applies where a request for information was made to a public authority under the 2000 Act before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of sections 2 and 40 of the 2000 Act in Schedule 18 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2000 Act.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of sections 2 and 40 of the 2000 Act in Schedule 18 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Part 1 of the 2000 Act, but

(b) the powers of the Commissioner and the Tribunal, on an application or appeal under the 2000 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2000 Act as amended by Schedule 18 to this Act.

(4) In this paragraph—

“public authority” has the same meaning as in the 2000 Act;

“the relevant time” means the time when the amendments of sections 2 and 40 of the 2000 Act in Schedule 18 to this Act come into force.

53 (1) Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule 6 to the 1998 Act (appeal rights under the 2000 Act) and in force immediately before the relevant time have effect after that time as if they were also made under section 61 of the 2000 Act (as inserted by Schedule 18 to this Act).

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7(1)(b) of Schedule 6 to the 1998 Act comes into force.

54 (1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that paragraph after the relevant time in relation to an act or omission before that time in relation to an appeal under the 2000 Act.

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force.

55 (1) The amendment of section 77 of the 2000 Act in Schedule 18 to this Act (offence of altering etc record with intent to prevent disclosure: omission of reference to section 7 of the 1998 Act) does not affect the application of that section after the relevant time in relation to a case in which—

(a) the request for information mentioned in section 77(1) of the 2000 Act was made before the relevant time, and

(b) when the request was made, section 77(1)(b) of the 2000 Act was satisfied by virtue of section 7 of the 1998 Act.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 7 of the 1998 Act comes into force.

Freedom of Information (Scotland) Act 2002

56 (1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 (“the 2002 Act”) before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 18 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of the 2002 Act in Schedule 18 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Part 1 of the 2002 Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 18 to this Act.

(4) In this paragraph—

“Scottish public authority” has the same meaning as in the 2002 Act;

“the relevant time” means the time when the amendments of the 2002 Act in Schedule 18 to this Act come into force.

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

57 Until the first regulations under Article 5(4)(a) of the Access to Health Records (Northern Ireland) Order 1993 (as amended by Schedule 18 to this Act) come into force, the maximum amount of a fee that may be required for giving access under that Article is £10.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)

58 (1) The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“the PECR 2003”) (see regulations 2, 31 and 31B of, and Schedule 1 to, those Regulations).

(2) Where subordinate legislation made under a provision of the 1998 Act is in force immediately before the repeal of that provision, neither the revocation of the subordinate legislation nor the repeal of the provision of the 1998 Act affect the application of the subordinate legislation for the purposes of the PECR 2003 after that time.

(3) Part 3 of Schedule 18 to this Act (modifications) does not have effect in relation to the PECR 2003.

(4) Part 7 of this Schedule does not have effect in relation to the provisions of the 1998 Act as applied by the PECR 2003.

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

59 Part 3 of Schedule 18 to this Act (modifications) does not have effect in relation to the reference to an accessible record within the meaning of section 68 of the 1998 Act in regulation 43 of the Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003.

Environmental Information Regulations 2004 (S.I. 2004/3391)

60 (1) This paragraph applies where a request for information was made to a public authority under the Environmental Information Regulations 2004 (“the 2004 Regulations”) before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 18 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Parts 2 and 3 of those Regulations.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of the 2004 Regulations in Schedule 18 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Parts 2 and 3 of those Regulations, but

(b) the powers of the Commissioner and the Tribunal, on an application or appeal under the 2000 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with Parts 2 and 3 of those Regulations as amended by Schedule 18 to this Act.

(4) In this paragraph—

“public authority” has the same meaning as in the 2004 Regulations;

“the relevant time” means the time when the amendments of the 2004 Regulations in Schedule 18 to this Act come into force.

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

61 (1) This paragraph applies where a request for information was made to a Scottish public authority under the Environmental Information (Scotland) Regulations 2004 (“the 2004 Regulations”) before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 18 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with those Regulations.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of the 2004 Regulations in Schedule 18 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with those Regulations, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with those Regulations as amended by Schedule 18 to this Act.

(4) In this paragraph—

“Scottish public authority” has the same meaning as in the 2004 Regulations;

“the relevant time” means the time when the amendments of the 2004 Regulations in Schedule 18 to this Act come into force.”—(Margot James.)

This amendment inserts a Schedule making transitional, transitory and saving provision in connection with the coming into force of the Bill, including provision about subject access requests (see Part 2 of the Schedule) and about the Information Commissioner’s enforcement powers (see Parts 7 and 8 of the Schedule).

Brought up, and added to the Bill.

Schedule 1

Special categories of personal data and criminal convictions etc data

Amendments made: 72, page 134, line 11, at end insert —

( ) a mayor for the area of a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009;”.

This amendment adds mayors of combined authorities in England to the list of elected representatives for the purposes of paragraphs 23 and 24 of Schedule 1, which authorise certain processing of special categories of personal data by such representatives.

Amendment 73, page 134, line 19, at end insert —

( ) a police and crime commissioner.”—(Margot James.)

This amendment adds police and crime commissioners established under section 1 of the Police Reform and Social Responsibility Act 2011 to the list of elected representatives for the purposes of paragraphs 23 and 24 of Schedule 1, which authorise certain processing of special categories of personal data by such representatives.

Schedule 2

Exemptions etc from the GDPR

Amendment proposed: 15, page 141, line 17, leave out paragraph 4.—(Tom Watson.)

18:27

Division 155

Ayes: 282

---

Labour: 230
Scottish National Party: 32
Liberal Democrat: 10
Plaid Cymru: 4
Independent: 4
Green Party: 1

Noes: 310

---

Conservative: 299
Democratic Unionist Party: 10
Independent: 1

Amendments made: 141, page 141, line 39, leave out from “(vi)” to end of line 44.

Paragraph 4(2) of Schedule 2 lists provisions of the GDPR which do not apply to the extent that their application would be likely to prejudice certain matters relating to immigration. This amendment removes Articles 5(1)(a) and (b) from the list (except so far as they correspond to rights and obligations provided for in provisions mentioned in paragraph 4(2)(i) to (vi), see paragraph 4(2)(vii)).

Amendment 142, page 141, line 48, at end insert—

“and, subject to sub-paragraph (2)(vii) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)”

This amendment is consequential on Amendment 141.

Amendment 139, page 152, line 27, at end insert “, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.” .—(Margot James.)

This amendment extends the legal professional privilege exemption in Part 4 of Schedule 2 to include information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser. See also Amendment 140.

Schedule 6

The applied GDPR and the applied Chapter 2

Amendments made: 74, page 177, line 31, leave out from beginning to end of line 3 on page 178 and insert—

“(none) ‘Subsections (1), (2) and (7) of section 198 of the 2018 Act have effect for the purposes of this Regulation as they have effect for the purposes of that Act but as if the following were omitted—

(a) in subsection (1), the reference to subsection (3), and

(b) in subsection (7), the words following paragraph (d).’”

This amendment amends paragraph 8 of Schedule 6 which makes provision about the territorial application of the applied GDPR. This amendment is consequential on amendments made to Clause 198 (territorial application) in Public Bill Committee.

Amendment 75, page 185, line 43, leave out “182” and insert—

“(Post-review powers to make provision about representation of data subjects)”. .—(Margot James.)

This amendment is consequential on Amendment 63 and NC16.

Schedule 11

Other exemptions under Part 4

Amendment made: 140, page 197, line 2, at end insert “, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.” .—(Margot James.)

This amendment extends the legal professional privilege exemption in Schedule 11 to include information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser. See also Amendment 139.

Schedule 12

The Information Commissioner

Amendment made: 76, page 200, line 32, after “fees” insert “, charges, penalties” .—(Margot James.)

This amendment makes clear that the sums that the Commissioner is required to pay to the Secretary of State include charges (such as charges imposed by regulations made under Clause 136) and penalties.

Schedule 13

Other general functions of the Commissioner

Amendment made: 77, page 202, line 12, at end insert—

“(2) Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).” .—(Margot James.)

This amendment secures that the reference to personal data in paragraph 1(1)(h) includes all types of personal data. It disapplies Clause 3(14)(c), which provides that references to personal data in Parts 5 to 7 of the bill are usually to personal data to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.

Schedule 15

Powers of entry and inspection

Amendments made: 78, page 205, line 19, , after “if” insert—

“a judge of the High Court,”

This amendment and Amendments 80 and 86 enable a judge of the High Court or, in Scotland, a judge of the Court of Session to deal with an application for a warrant made by the Information Commissioner under Schedule 15.

Amendment 79, page 205, line 28, at end insert—

“or is capable of being viewed using equipment on such premises”.

This amendment enables a warrant to be granted in respect of premises where evidence of a failure or offence can be viewed using equipment on the premises, not just where such evidence is to be found on the premises.

Amendment 80, page 205, line 31, after “if” insert—

“a judge of the High Court,”

See the explanatory statement for Amendment 78.

Amendment 81, page 206, line 41, at end insert—

“( ) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may be evidence of that failure or offence,”

This amendment and Amendments 83 and 85 require a warrant in respect of premises to authorise the Commissioner to require a person to provide a copy of information capable of being viewed using equipment on the premises.

Amendment 82, page 206, line 43, after “premises” insert—

“and of any information capable of being viewed using equipment on the premises”.

This amendment and Amendment 84 require a warrant in respect of premises to authorise the Commissioner to require a person to provide an explanation of information capable of being viewed using equipment on the premises.

Amendment 83, page 207, line 8, at end insert—

“( ) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may enable the Commissioner to make such a determination,”

See the explanatory statement for Amendment 81.

Amendment 84, page 207, line 10, after “premises” insert—

“and of any information capable of being viewed using equipment on the premises”.

See the explanatory statement for Amendment 82.

Amendment 85, page 207, line 18, at end insert—

“( ) For the purposes of this paragraph, a copy of information is in an “appropriate form” if —

(a) it can be taken away, and

(b) it is visible and legible or it can readily be made visible and legible.”

See the explanatory statement for Amendment 81.

Amendment 86, page 210, line 13, at end insert—

“( ) references to a judge of the High Court have effect as if they were references to a judge of the Court of Session,” .—(Margot James.)

See the explanatory statement for Amendment 78.

Schedule 17

Relevant records

Amendments made: 87, page 214, line 22, at end insert—

“( ) the Department of Justice in Northern Ireland;”

See the explanatory statement for Amendment 89.

Amendment 88, page 214, line 42, at end insert—

“Part 5 of the Police Act 1997,”

(i) Part 5 of the Police Act 1997,”

This amendment provides that the Secretary of State’s functions under Part 5 of the Police Act 1997 are “relevant functions” for the purposes of paragraph 4 of Schedule 17 (relevant records relating to statutory functions).

Amendment 89, page 215, line 6, at end insert—

“( ) In relation to the Department of Justice in Northern Ireland, the ‘relevant functions’ are its functions under Part 5 of the Police Act 1997.”

This amendment and Amendment 87 provide that the Department of Justice in Northern Ireland’s functions under Part 5 of the Police Act 1997 are “relevant functions” for the purposes of paragraph 4 of Schedule 17 (relevant records relating to statutory functions).

Amendment 90, page 215, line 8, after “under” insert “—

(a) Part 5 of the Police Act 1997, or

(b) ”

This amendment provides that the Scottish Ministers’ functions under Part 5 of the Police Act 1997 are “relevant functions” for the purposes of paragraph 4 of Schedule 17 (relevant records relating to statutory functions).

Amendment 91, page 215, line 11, at end insert—

“( ) Part 5 of the Police Act 1997,” ).—(Margot James.)

This amendment provides that the Disclosure and Barring Service’s functions under Part 5 of the Police Act 1997 are “relevant functions” for the purposes of paragraph 4 of Schedule 17 (relevant records relating to statutory functions).

Schedule 18

Minor and consequential amendments

Amendments made: 92, page 216, line 1, leave out sub-paragraph (2) and insert—

“( ) In subsection (2), for ‘issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 124(4) of that Act’.”

This amendment replaces a consequential amendment of section 19AC of the Registration Service Act 1953. The new wording makes clear that the code referred to is the data-sharing code prepared under Clause 121 and issued under Clause 124(4).

Amendment 93, page 216, line 29, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Parliamentary Commissioner Act 1967 and is consequential on NC15.

Amendment 94, page 217, line 2, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Local Government Act 1974 and is consequential on NC15.

Amendment 95, page 217, line 17, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Local Government Act 1974 and is consequential on NC15.

Amendment 96, page 223, line 38, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Health Service Commissioners Act 1993 and is consequential on NC15.

Amendment 97, page 224, line 12, at end insert—

“, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments)”.

This amendment provides that certain provisions of the Data Protection Act 1998, which amend other enactments, are not to be repealed.

Amendment 98, page 231, line 19, , leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Scottish Public Services Ombudsman Act 2002 and is consequential on NC15.

Amendment 99, page 236, line 2, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Public Services Ombudsman (Wales) Act 2005 and is consequential on NC15.

Amendment 100, page 236, line 36, , leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Commissioner for Older People (Wales) Act 2006 and is consequential on NC15.

Amendment 101, page 239, line 34, leave out sub-paragraph (2) and insert —

“( ) In subsection (6), for ‘issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 124(4) of that Act’.”

This amendment replaces a consequential amendment of section 45E of the Statistics and Registration Service Act 2007. The new wording makes clear that the code referred to is the data-sharing code prepared under Clause 121 and issued under Clause 124(4).

Amendment 102, page 245, line 2, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the English language text of the Welsh Language (Wales) Measure 2011 and is consequential on NC15.

Amendment 103, page 245, line 6, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Welsh language text of the Welsh Language (Wales) Measure 2011 and is consequential on NC15.

Amendment 104, page 252, line 9, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Public Services Ombudsman Act (Northern Ireland) 2016 and is consequential on NC15.

Amendment 105, page 253, line 9, leave out “160” and insert—

“(Applications in respect of urgent notices)”

This amendment amends a consequential amendment to the Justice Act (Northern Ireland) 2016 and is consequential on NC15.

Amendment 106, page 254, line 23, leave out sub-paragraph (2) and insert—

“( ) In subsection (2), for ‘issued under section 52B (data-sharing code) of the Data Protection Act 1998’ substitute ‘prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 124(4) of that Act’.”

This amendment replaces a consequential amendment of section 43 of the Digital Economy Act 2017. The new wording makes clear that the code referred to is the data-sharing code prepared under Clause 121 and issued under Clause 124(4).

Amendment 107, page 254, line 37, leave out sub-paragraph (2) and insert—

“( ) In subsection (2), for ‘issued under section 52B (data-sharing code) of the Data Protection Act 1998’ substitute ‘prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 124(4) of that Act’.”

This amendment replaces a consequential amendment of section 52 of the Digital Economy Act 2017. The new wording makes clear that the code referred to is the data-sharing code prepared under Clause 121 and issued under Clause 124(4).

Amendment 108, page 255, line 13, leave out sub-paragraph (2) and insert—

“( ) In subsection (2), for ‘issued under section 52B (data-sharing code) of the Data Protection Act 1998’ substitute ‘prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 124(4) of that Act’.”

This amendment replaces a consequential amendment of section 60 of the Digital Economy Act 2017. The new wording makes clear that the code referred to is the data-sharing code prepared under Clause 121 and issued under Clause 124(4).

Amendment 109, page 255, line 28, leave out sub-paragraph (2) and insert—

“( ) In subsection (2), for ‘issued under section 52B (data-sharing code) of the Data Protection Act 1998’ substitute ‘prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 124(4) of that Act’.”

This amendment replaces a consequential amendment of section 70 of the Digital Economy Act 2017. The new wording makes clear that the code referred to is the data-sharing code prepared under Clause 121 and issued under Clause 124(4).

Amendment 110, page 257, line 12, at end insert—

“Section (Destroying or falsifying information and documents etc)

Destroying or falsifying information and documents etc”

This amendment amends a consequential amendment to the Estate Agents (Specified Offences) (No. 2) Order 1991 to include a reference to the offence in NC14.

Amendment 111, page 260, line 8, at end insert —

“Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)

238A The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.

Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)

238B The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.

Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)

238C The Data Protection (Functions of Designated Authority) Order 2000 is revoked.

Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)

238D The Data Protection (International Co-operation) Order 2000 is revoked.

Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)

238E The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.

Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)

238F In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data Protection Act 1998) are revoked.

Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)

238G The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.

Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)

238H The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.

Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)

238I The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.

Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)

238J The Data Protection (Crown Appointments) Order 2000 is revoked.

Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)

238K The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.

Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)

238L The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.

Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)

238M The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.”

This amendment revokes a number of Orders and regulations made under Parts 1, 2, 4 and 6 of the Data Protection Act 1998.

Amendment 112, page 264, line 15, at end insert—

“Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)

276A The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)

276B The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.

276C In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act 1998” substitute “the Data Protection Act 2018”.

276D (1) Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, for “the Data Protection Act 1998” substitute “the data protection legislation”.

(4) After that sub-paragraph insert—

“(2) In this regulation—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section3 of that Act);

“personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section3(2), (4) and (14) of that Act).”

(3) Regulation 2(2) and (3) (meaning of certain expressions) do not apply for the purposes of this regulation.”

(5) In the heading of that regulation, for “the Data Protection Act 1998” substitute “the data protection legislation”.”

This amendment revokes an Order made under paragraph 10 of Schedule 3 to the Data Protection Act 1998. It also makes consequential amendments of the Privacy and Electronic Communications (EC Directive) Regulations 2003. See also the transitional provision in NS3.

Amendment 113, page 265, line 45, at end insert—

“Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)

286A In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in section 9A(3) and (4) of the 1998 Act and”.”

This amendment amends provision about the appropriate limit for the purposes of section 9A of the Data Protection Act 1998 and section 12 of the Freedom of Information Act 2000 in consequence of the repeal of the Data Protection Act 1998.

Amendment 114, page 273, line 19, at end insert—

“Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)

302A The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.”

This amendment revokes an Order made under paragraph 10 of Schedule 3 to the Data Protection Act 1998.

Amendment 115, page 279, line 20, at end insert—

“or section (Destroying or falsifying information and documents etc) of that Act (destroying or falsifying information and documents etc);”

This amendment amends a consequential amendment to the Companies (Disclosure of Address) Regulations 2009 to include a reference to the offence in NC14.

Amendment 116, page 280, line 10, at end insert—

“or section (Destroying or falsifying information and documents etc) of that Act (destroying or falsifying information and documents etc);”

This amendment amends a consequential amendment to the Overseas Companies Regulations 2009 to include a reference to the offence in NC14.

Amendment 117, page 280, line 31, at end insert—

“Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)

321A The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.”

This amendment revokes an Order made under paragraph 10 of Schedule 3 to the Data Protection Act 1998.

Amendment 118, page 283, line 7, at end insert—

“Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)

329A The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 are revoked.”

This amendment revokes an Order made under sections 55A and 55B of the Data Protection Act 1998.

Amendment 119, page 284, line 43, at end insert—

“Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)

338A The Data Protection (Monetary Penalties) Order 2010 is revoked.”

This amendment revokes an Order made under section 55E of the Data Protection Act 1998.

Amendment 120, page 287, line 39, at end insert—

“Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)

347A The Data Protection (Processing of Sensitive Personal Data) Order 2012 is revoked.”

This amendment revokes an Order made under paragraph 10 of Schedule 3 to the Data Protection Act 1998.

Amendment 121, page 289, line 20, at end insert—

“Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)

357A The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.”

This amendment revokes an Order made under section 41A of the Data Protection Act 1998.

Amendment 122, page 290, line 9, at end insert—

“or section (Destroying or falsifying information and documents etc) of that Act (destroying or falsifying information and documents etc);”

This amendment amends a consequential amendment to the Companies (Disclosure of Date of Birth Information) Regulations 2015 to include a reference to the offence in NC14.

Amendment 123, page 293, line 11, leave out “; or”

See the explanatory statement for Amendment 124.

Amendment 124, page 293, line 14, after “notice);” insert—

“or section (Destroying or falsifying information and documents etc) of that Act (destroying or falsifying information and documents etc);””

(i) section (Destroying or falsifying information and documents etc) of that Act (destroying or falsifying information and documents etc);””

This amendment makes a further consequential amendment to the Register of People with Significant Control Regulations 2016 to include a reference to the offence in NC14.

Amendment 125, page 294, line 16, at end insert—

“(ea) section (Information orders) (information orders);”

This amendment and Amendment 131 apply new Clause NC13, with a modification, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 126, page 294, line 18, at end insert—

“(ga) section (Destroying or falsifying information and documents etc) (destroying or falsifying information and documents etc);”

This amendment applies new Clause NC14 for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 127, page 294, line 34, at end insert—

“(ta) section (Applications in respect of urgent notices) (applications in respect of urgent notices);

(tb) section 173 (jurisdiction);”

This amendment and Amendment 135 apply new Clause NC15 and Clause 173, with modifications, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 128, page 295, line 16, at end insert—

“(3) In that section, subsection (2) has effect as if paragraph (a) were omitted.”

This amendment is consequential on Amendment 28. It amends consequential provision applying Clause 141 of the Bill, with modifications, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 129, page 295, line 24, after “143” insert—

“or (Destroying or falsifying information and documents etc)”

This amendment is consequential on NC14 and Amendment 126. It amends consequential provision applying Clause 142(7) of the Bill, with modifications, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 130, page 295, line 27, at beginning insert—

“section (Destroying or falsifying information and documents etc) or”

This amendment is consequential on NC14 and Amendment 126. It amends consequential provision applying Clause 142(8) of the Bill, with modifications, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 131, page 295, line 27, at end insert—

“Modification of section (Information orders) (information orders)

4A Section (Information orders)(2)(b) has effect as if for “section141(2)(b)” there were substituted “section141(2)”.”

See the explanatory statement for Amendment 125.

Amendment 132, page 295, line 38, after “(8)” insert “, (8A)”.

This amendment is consequential on Amendment 38. It amends consequential provision applying Clause 144 of the Bill, with modifications, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 133, page 295, line 40, at end insert—

“(d) subsection (8A)(a) has effect as if for “as described in section146(2) or that an offence under this Act” there were substituted “to comply with the eIDAS requirements or that an offence under section 143 or (Destroying or falsifying information and documents etc) or paragraph 15 of Schedule15”.”

This amendment is consequential on Amendment 38. It amends consequential provision applying Clause 144 of the Bill for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 134, page 297, line 18, after “143” insert—

“or (Destroying or falsifying information and documents etc)”

This amendment is consequential on NC14 and Amendment 126. It amends consequential provision applying paragraph 1 of Schedule 15 to the Bill, with modifications, for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and the eIDAS Regulation (defined in the 2016 Regulations).

Amendment 135, page 298, line 38, at end insert—

“Modification of section173 (jurisdiction)

18A (1) Section 173 has effect as if subsections (2)(c) and (d) and (3) were omitted.

(2) Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “subsection (4)”.”

See the explanatory statement for Amendment 127.

Amendment 136, page 299, line 9, after “143,” insert—

“(Destroying or falsifying information and documents etc),”

See the explanatory statement for Amendment 126.

Amendment 137, page 299, line 10, after “143” insert—

“or (Destroying or falsifying information and documents etc)”

See the explanatory statement for Amendment 126.

Amendment 138, page 302, line 39, at end insert—

“Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)

396A In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert—

““data controller” means a person who is a controller for the purposes of Parts 5 to 7 of the Data Protection Act 2018 (see section3(6) and (14) of that Act);”;

““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section3(2) and (14) of that Act);”.” .—(Margot James.)

This amendment makes consequential amendments to the Data Protection (Charges and Information) Regulations 2018.

[Madam Deputy Speaker (Dame Rosie Winterton)]

I will now suspend the House for no more than five minutes in order to make a decision about certification. The Division bells will be rung two minutes before the House resumes. Following certification, a Minister will move the appropriate consent motion, copies of which will be available in the Vote Office and will be distributed by Doorkeepers.

18:41

Sitting suspended.

18:43

On resuming—

[Madam Deputy Speaker (Dame Rosie Winterton)]

I can now inform the House that I have completed certification of the Bill, as required by the Standing Order. I have confirmed the view expressed in the Speaker’s provisional certificate issued on 8 May. Copies of the final certificate will be made available in the Vote Office and on the parliamentary website.

Under Standing Order No. 83M, a consent motion is therefore required for the Bill to proceed. Copies of the motion are available in the Vote Office and on the parliamentary website, and have been made available to Members in the Chamber. Does the Minister intend to move the consent motion?

[Margot James]

indicated assent.

The House forthwith resolved itself into the Legislative Grand Committee (England and Wales) (Standing Order No. 83M).

[Dame Rosie Winterton in the Chair]

18:44

[The Second Deputy Chairman of Ways and Means (Dame Rosie Winterton)]

I remind hon. Members that if there is a Division, only Members representing constituencies in England and Wales may vote. As the knife has fallen, there can be no debate.

Motion made, and Question put forthwith (Standing Order No. 83M(5)),

That the Committee consents to the following certified clauses of the Data Protection Bill [Lords]

Clauses certified under SO No. 83L(2) as relating exclusively to England and Wales and being within devolved legislative competence

Clause 190 of the Bill, as amended in Public Bill Committee (Bill 190).—(Margot James.)

Question agreed to.

The occupant of the Chair left the Chair to report the decision of the Committee (Standing Order No. 83M(6)).

The Deputy Speaker resumed the Chair; decision reported.

[Pete Wishart (Perth and North Perthshire) (SNP)]

On a point of order, Madam Deputy Speaker. I hope the House takes the time to consider very seriously the fact that once again English Members have not had the opportunity to debate the critical issues in clause 190, which has been certified. What can you do, Madam Deputy Speaker, to ensure that English Members in the English Parliament get the opportunity to debate those critical English-only issues?

[Madam Deputy Speaker (Dame Rosie Winterton)]

That is not a point of order.

Third Reading

Queen’s and Prince of Wales’s consent signified.

18:46

[Matt Hancock]

I beg to move, That the Bill be now read the Third time.

What a great pleasure this is. The Bill gives people more power and control over their lives online while supporting innovation and entrepreneurship in the digital age. It will deliver real benefits across the country and help our businesses to compete and trade abroad. Strong data protection laws give customers confidence in the products and services that they buy, and that is good for business. The Bill provides a full data protection framework as we leave the EU, consistent with the general data protection regulation.

We have heard many things during our debates in the Chamber and in Committee, including concerns about small businesses. I reassure colleagues that the Information Commissioner’s Office has produced specific advice for them, as well as detailed advice for charities and local government.

The Bill provides a bespoke tech framework that is tailored to the needs of our criminal justice agencies and the intelligence services. That will protect the rights of victims, witnesses and suspects while making sure that we can tackle the changing nature of the global threats that the UK faces.

The Bill has received coverage from around the world, including Australia, the Philippines and, indeed, Suffolk. Let me be clear: the Bill is about preparing Britain for the future. As we leave the EU, the Bill sets out full spectrum data protection legislation, and I hope that the House will give it its Third Reading.

I am very grateful for the way in which the House has engaged with the Bill. I want to put on record my thanks to many people: my hon. Friend the Minister for Digital and the Creative Industries, in particular, for her sterling work day in, day out; my predecessor, who is now Northern Ireland Secretary, who worked hard with me on the Bill before her promotion; the Under-Secretary of State for the Home Department, my hon. Friend the Member for Louth and Horncastle (Victoria Atkins), for grappling with the Bill in a brand new brief; the Digital, Culture, Media and Sport Committee, whose members made many contributions; the Public Bill Committee; the Information Commissioner herself, with whom we have worked very closely on the Bill and who is a great star; and the Whips, Clerks, Committee Chairs, Mr Speaker and the Deputy Speakers. They have all been of great assistance. I also thank the Front-Bench teams of Her Majesty’s loyal Opposition, the Scottish National party and other parties for, on the whole, their highly constructive attitude to this important legislation.

The Bill that we send back to the other place has been improved in three key respects. First, we have made good on the promises made by Lord Ashton in the other place. For instance, we have delivered certainty for patient support groups—a cause passionately championed by my noble Friend Baroness Neville-Jones. We have provided reassurance for those on the frontline, safeguarding the emotional, physical and mental health of some of our most vulnerable citizens. We have legislated for a statutory review of the private enforcement provisions of the Bill, which will ensure that we leave no stone unturned in our search for strong and effective oversight of data controllers, particularly where children are concerned.

Secondly, the House has ensured that we have learned the lessons from the Cambridge Analytica scandal, which exploded during the passage of the Bill. The ongoing investigation into that is unprecedented in its scale and importance. We have increased the powers of the Information Commissioner to ensure she has enough resources. Some say that that scandal put data protection at the top of the news. Some even say it made data protection sexy. With the Bill, we can be assured that the Information Commissioner will have the powers that she needs to ensure that those who flout the law are held to account for their actions. I want particularly to thank the Digital, Culture, Media and Sport Committee for its proposals, which we took on board to strengthen the Bill in response to that scandal. Finally, we have ensured that when it comes to the freedom of the press, we are prepared for the future, not stuck in the past.

The Bill will give people more control over their data, support businesses in their use of data and prepare Britain for Brexit. Over a generation, the Data Protection Act 1998, which this Bill replaces, has commanded broad public consensus and cross-party support. That has been one of its strengths. I hope that this Bill will gain cross-party support on Third Reading so that no matter the debate on some of the points of detail, we will have a broad consensus behind our data protection approach here in the UK for the years to come, because that is one of the strengths of our digital economy—a digital economy that is powering ahead. I hope that the Bill can add to the fundamental underpinnings of the strength of our economy and our society for the future. I commend it to the House.

18:52

[Tom Watson]

I refer hon. Members to my entry in the Register of Members’ Financial Interests. I want to thank all the individuals and organisations that submitted evidence and participated in the discussions about what we all know to be a fiendishly complicated Bill. I am grateful to the Clerks, the Hansard reporters and the Doorkeepers for making the passage of the Bill possible.

Given that this is a fiendishly complicated Bill, we put forward our best team on the Public Bill Committee. I particularly thank my Labour Front-Bench colleagues—my right hon. Friend the Member for Birmingham, Hodge Hill (Liam Byrne) and my hon. Friend the Member for Sheffield, Heeley (Louise Haigh)—who are both the brightest of their generation. I would also like to thank my hon. Friends the Members for Ogmore (Chris Elmore), for Bristol North West (Darren Jones) and for Cambridge (Daniel Zeichner), and Members of other Opposition parties, who made great contributions to the Bill. The contributions in today’s debate from my right hon. Friend the Member for Doncaster North (Edward Miliband), the right hon. and learned Member for Rushcliffe (Mr Clarke) and the hon. Member for Edinburgh West (Christine Jardine) were intelligent, wise and moving.

Our position has always been that we do not oppose the Bill. We recognise that it contains a number of measures that need to be passed into law by the end of this month, and we have never had any interest in standing in the way of the broad thrust of the Bill or most of its contents. However, we have had a number of specific concerns, and we have sought to improve some parts of the Bill. We have little time to dwell on those issues, but I would like to mention a couple.

We believe that the proposals for a data bill of rights were strong and had merit. They would have created a statutory code of enforceable rights, including the right of the individual to access all their data held or controlled by organisations and large social media companies. With our SNP colleagues, we have also debated how the Home Office will receive a wide exemption when processing the data of newcomers to this country. Given its recent record, the Home Office is not a Department to which we want to give new sweeping powers over personal data. Keeping this exemption is a continuation of the hostile environment, and we should be ashamed that it remains in the Bill.

Our biggest disappointment, however, is that we did not convince enough Members to commence part 2 of the Leveson inquiry. The victims were solemnly promised that this inquiry would be completed, and today this House has let them down. However, we consider this unfinished business, and I have to say to the Secretary of State that when he is in the twilight of his political career—careers in this place always end in such a way—he will come to regret his decision to side so stridently with the press barons against the victims.

To conclude, the Bill is necessary, but there have been missed opportunities. There has been a missed opportunity to correct the sins of the past on Leveson, and also a failure to look at how we should begin to deal with the future of data capitalism and its impact on people in the new digital age. I hope that the Government will continue to engage on these issues in the coming weeks and months, and we will continue to press them on the subject of citizens’ data rights.

18:55

[Peter Heaton-Jones]

It is a pleasure to be able to speak briefly at the conclusion of our proceedings on the Bill. I have followed it with interest throughout all its stages, and I had the pleasure of sitting on the Public Bill Committee. I echo what has been said about the fine contributions made by Members on both sides of the House at all stages, and I thought that the Committee was extraordinarily well conducted. I particular enjoyed my light-hearted sparring with the right hon. Member for Birmingham, Hodge Hill (Liam Byrne), and the people at BBC Radio Essex will have been delighted that they got a disproportionate amount of airtime as a result.

This is a good Bill. Data protection is incredibly important—and increasingly so. The Bill has successfully navigated the choppy waters that are coming towards us, created by the need for the GDPR to be implemented in only about 14 days’ time. If I may say so, the Secretary of State and his entire team have navigated those waters with skill and elegance to ensure that we in the UK now have legislation that does what it needs to do as far as the GDPR is concerned, on which I congratulate them. The Government, the House and the other place have looked into this matter very carefully and rigorously, and they have arrived at what I think is a good package of measures that will do what it needs to do as far as data protection is concerned.

My interest has been in the amendments concerning press regulation, as Members on both sides of the House will remember. I believe that the House has reached the right decision on what started off as an amendment in the other place and what was set out in new clause 18 today. Not to go ahead with Leveson 2 is the right decision. However, I agree with the sentiment that we must keep the victims of what will undoubtedly still be a difficult press environment at the centre of our thinking. It is important that we have not lost the opportunity to do that, and I know the Secretary of State and his team will continue to do so, but I think we have got the balance right today.

I congratulate the whole ministerial team and all those who have taken part in these deliberations. I have followed with interest the arguments made by Members on both sides.

[Matt Hancock]

My hon. Friend mentioned some people he wanted to thank, and there is one other person I want to thank: my hon. Friend the Member for Chelmsford (Vicky Ford). She was involved with the development of the GDPR in the European Parliament right from the start, and I want to put on the record our thanks, and my personal thanks, for her guidance. She has lived with the Bill for far longer than anybody else in the Chamber.

[Peter Heaton-Jones]

Yet another mention for Essex, where people will be absolutely delighted.

This is the Government getting on with business. We promised that we would do this in our manifesto, on which we were elected, and we have got on with and delivered it. I will be delighted to see the Bill reaching the statute book. This is the Government delivering what they need to deliver, and doing it in a very rigorous, elegant and clever way. This is a digital Bill for the digital age, and I am pleased to support it.

Question put and agreed to.

Bill accordingly read the Third time and passed, with amendments.

Deferred Divisions

Motion made, and Question put forthwith (Standing Order No. 41A(3)),

That, at this day’s sitting, Standing Order No. 41A (Deferred divisions) shall not apply to the Motion in the name of Jeremy Corbyn relating to Education (Student Support).—(Jo Churchill.)

Question agreed to.