Data Protection (Charges and Information) (Amendment) Regulations 2019
(5 years, 10 months ago)
Lords ChamberRead Hansard Text Read Debate Ministerial Extracts
Lord Ashton of Hyde
That the draft Regulations laid before the House on 17 December 2018 be approved.
The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde)
My Lords, I declare an interest which every Member of this House who speaks will have to declare so perhaps I can save them the bother. I will benefit from the fact that I will not have to pay the £40 charge if the regulations are approved. Secondly, my wife is a parish councillor and will also benefit.
The original regulations were debated and approved in this House on 20 March 2018. Noble Lords may recall that those regulations introduced a new charging structure to fund the Information Commissioner’s Office. The authority for doing so derived at the time from the Digital Economy Act 2017, now superseded by the powers set out in Section 137 of the Data Protection Act 2018. As we promised during those debates, we are now looking to implement a new exemption from the annual data protection charge for elected representatives, candidates for election and Members of the House of Lords for processing that they undertake in the course of fulfilling their democratic duties.
The new data protection framework is about protecting personal data—that is, information that can identify individuals. Some of us in this House will be data controllers—we may hold personal data—and are responsible for how that information is processed. There may be a number of reasons why we hold that personal data—for example, we may have been entrusted with it by members of the public for particular aspects of parliamentary work—but, as data controllers, we have various obligations under the Data Protection Act, including how we look after that information.
While we have previously debated the importance of having an adequately funded regulator, there will be some situations where it would be unreasonable for some data controllers to pay the charge or where the charge would give rise to unintended negative consequences. For that reason, Schedule 1 to the funding regulations details a number of exemptions to the payment of the charge. For example, any data controller who processes personal data only for staff administration purposes, or purely for advertising, marketing and public relations reasons, is not required to pay.
During the parliamentary debate of the original funding regulations on 20 March last year, the Government undertook to review these exemptions. A public consultation took place last summer and has been available online since June 2018. The consultation sought views on whether each of the exemptions was still appropriate; a proposed new exemption for elected representatives, prospective candidates for election and Members of the House of Lords; and whether any other new exemptions should be introduced. Respondents were broadly supportive of the current exemptions regime. However, there was also support for one new exemption for elected representatives, candidates, including prospective candidates for election, and Members of the House of Lords.
The Government’s view is that activity deriving from elected representatives’ public offices and functions should not be liable to a charge. Charges of this nature potentially represent a perceived or actual barrier to democratic engagement. A number of respondents supported this view. In light of this support, we have decided to take this amendment forward for implementation, so I now come to the details of the instrument.
The amendment introduces an exemption for: Members of the House of Lords who are entitled to receive a Writ of Summons to attend this House specifically for the purposes of related functions; elected representatives, as defined in paragraph 23(3) of Schedule 1 to the Data Protection Act 2018 in connection with the discharge of their respective functions; and relevant processing undertaken by candidates, prospective and nominated, seeking to become elected representatives. These exemptions cover those who are acting on instructions or on behalf of such Members and elected or prospective representatives. Importantly, that is not to say that all processing of data conducted by those listed in the amendment, including all Members of this House, is automatically exempt from paying a charge. The instrument makes it clear that the exemption relates solely to processing carried out by these parties in connection with their democratic functions.
In the case of prospective candidates, the exemption would apply only to processing in connection with those activities related to election or re-election in a post. It is important to extend the exemption to anyone seeking to become an elected representative, not just to nominated candidates. This is because formal nomination, the stage at which candidates are defined in electoral legislation, occurs only in the immediate lead-up to an election. Activity to support re-election is likely to predate this stage. Excluding prospective candidates from this exemption would place them at a financial disadvantage compared with their incumbent counterparts. We have restricted the application of the exemption to data processing associated with the functions of our respective roles. This provides a safeguard against misuse, for example by individuals falsely claiming to be prospective candidates.
I want to be clear that the exemption relates only to the payment of the annual data protection charge. It is not an exemption from data controllers’ important data protection responsibilities. Anyone who does not adhere to those responsibilities and principles will face enforcement action by the ICO.
I hope noble Lords will agree that this amendment is important to encourage wider participation in the democratic engagement process. The removal of a requirement to pay the annual data protection charge to the ICO will ensure that all prospective candidates will start their electoral campaigns on a footing equal to that of elected representatives already in post. It also reflects the high regard the Government place upon those undertaking public functions. I beg to move.
Lord McNally (LD)
My Lords, we welcome this statutory instrument and the exemptions provided for. Like the Minister and, I think, everybody in this House, we do not want a tax on democracy, but people should be assured that the legal responsibilities remain the same and can be quite onerous. The Minister’s last remark was that we must not allow people to use the candidate or even the MP or Peer as cover for activities that would be outside the narrow exemption of this House.
This reminds me of debates we had some 20 or even 30 years ago—in the early 1990s—when we brought in legislation about the financing of political parties. I remember that those of us who had experience of working for political parties were very conscious that they are all made up of volunteers, often amateurs. There was a danger in that legislation—and I think there still is—of putting on to enthusiastic volunteer amateurs, who make our democracy work, very onerous financial responsibilities in terms of election spending and, in this case, very onerous data protection responsibilities. There might be a case for giving political parties some funding for advice, training and support to make sure that these responsibilities are understood and work well.
What the Minister has had to say is very welcome, and we are all involved in this, but it appears that the initial advice was a little confusing and caused concern. Once these regulations are approved, as I am sure they will be, I wonder whether the House authorities can issue some clear and definitive advice that will be of benefit to Members of this House. We look forward to this SI being passed.
Baroness Ludford (LD)
My Lords, I just want to add to what my noble friend Lord McNally has said. I am glad that this matter is being cleared up, because we had very confusing advice a few months ago. I also want to note, as one of the people who was involved in the European Parliament’s proceedings on the GDPR, that it is a UK decision to impose a fee on data controllers. The mandatory requirement was removed from the GDPR, and it is a unilateral UK decision to fund the ICO in this way so that, in effect, data controllers in the UK will not feel the change which perhaps will be felt by data controllers in other EEA states, where Governments make a decision to fund their data protection authorities from, for instance, general taxation. I realise that that decision was made in the Digital Economy Act rather than in last year’s Data Protection Act, but it is imposed not by Brussels but by Whitehall and Westminster.
Baroness O'Neill of Bengarve (CB)
My Lords, these amendments represent a little island of calm in a turbulent ocean. For once, I am referring not to Brexit or the backstop but, rather, to the fact that we are in the middle of some very turbulent changes in our regimes for the protection of data and privacy and many other aspects of communication. This morning, we saw the publication of the report of the Digital, Culture, Media and Sport Committee of the other place on disinformation and “fake news”. In so far as I have got into the report—which is not very far—it is very welcome in that it represents a much broader view of the threats to democracy from the present regime for controlling the use of data. There is much more to be said, and I hope that the Minister will be able to say something about the ways in which the broader picture will be taken into account. These amendments do not need changing because of the broader picture, but it is curious to fiddle with the small stuff when such major and serious issues are happening in this domain.
Lord Griffiths of Burry Port (Lab)
My Lords, this seems a sensible measure and the issues have been well rehearsed. There was one area where there was some confusion in my mind, and I hope that noble Lords will not mind my bringing it to their attention now. I, too, am looking forward to not having to pay £40—that is good news, but in exempting Members from both Houses, candidates and so on from the need to pay that charge, we recognise that many of us have other duties and obligations not related to our being Members of this House. We are in employment, we run things and so on, and we handle people’s data other than in the sense that has been described. I guess they will have to pay their £40 or whatever it is, but my confusion lies in the hinterland between those two modes of operation: information gained in respect of activities of one kind can without too much imagination become useful in respect of those of another kind. I wonder whether some thought has been given to handling that kind of confusion and, if so, how. It would be helpful if the Minister could say something about that; otherwise, this seems like common sense and we would have no hesitation in wanting it to go forward.
Lord Ashton of Hyde
My Lords, I am grateful to all noble Lords who have responded. This statutory instrument is unique among those I have dealt with recently in having gained a speedy and generally favourable response; I am grateful for that.
I am grateful to the noble Lord, Lord McNally, for his welcome. He spoke about financing political parties and the need to give advice—as indeed did the noble Baroness, Lady Ludford. I can say that the House authorities will take that on board and provide some clear advice, taking into account the new requirements if this statutory instrument is passed; I am very pleased about that.
I acknowledge—the noble Baroness, Lady Ludford, was right about this—that the approach to funding the ICO was originally set by the Digital Economy Act, which was superseded by the Data Protection Act. The method of funding the ICO, and the question of whether it is adequate, have been occupying us for several years. I am pleased that we have finally resolved it. The noble Baroness is right that we decided to do it this way and not as part of the GDPR. Supervisory authorities can be funded in a number of ways. The reason for doing it this way was that it did not involve much practical change from the ICO funding arrangements under the Data Protection Act 1998 and a register is not necessary.
The noble Baroness, Lady O’Neill, talked about an ocean of calm within a broader picture that is possibly not so calming. I agree with her that it is a small but important issue. It is right to deal with an issue that promotes—or at least does not prevent—demographic engagement; and a commitment was made when the regulations were debated last year that we would look at this and take it forward. It is important to carry forward what we said; I take on board her points about the issues alluded to in the DCMS Committee’s report, as outlined this morning. Generally speaking, we have not yet had time to analyse it in great detail but, together with the Cabinet Office, we will be taking forward a lot of these issues around disinformation and its effect on elections, particularly through the online harms White Paper, which will be coming out soon.
The noble Lord, Lord Griffiths, mentioned that Peers have other duties; he asked about the way this exemption would apply in relation to their duties in the House of Lords and elsewhere. He is quite right that, if they are a data controller and have other duties that are not subject to an exemption, they would be required to pay the charge. I will mention this to the House authorities when they issue their advice and hopefully they can be clear. Ultimately, the Data Protection Act says that you must have lawful authority to handle personal data and it is up to you to make sure that is the case; if you handle personal data—other than data that has some limited exemptions provided in the Act—then you will have to pay the charge.
Lord Griffiths of Burry Port
I wonder if I could ask for a little more resolution on the matter. My mind is filled with pictures of activities that I myself have engaged in where, by doing work for which I am remunerated, I gain some kind of control of people’s data or the use of it, and at the same time I can be involved in an area where I am exempt from all that. Because of the homogeneity of the activities, one paid and one not, it is not difficult to see that the dividing line between what qualifies and what does not might be difficult to establish, even with the good will of the authorities of the House who write the best guidance that has ever been written.
Lord Ashton of Hyde
If the guidance does not produce clarity in the noble Lord’s mind, then I think the answer is to avail himself of the ICO’s telephone hotline, which is there specifically to answer questions such as the ones that he has asked. He will be able to give them the specific examples of where he is unable to be clear. That applies generally to people in public office such as him but also, importantly, to other small businesses; there is a specific small-business hotline that is there exactly to answer questions like his. I hope that has covered most of the issues.