Data Protection Bill [HL]

Baroness Chisholm of Owlpen Excerpts

Report: 1st sitting: House of Lords
Monday 11th December 2017 Lords Chamber

Moved by

[Baroness Chisholm of Owlpen]

3: Clause 6, page 4, leave out line 34

[Baroness Chisholm of Owlpen (Con)]

My Lords, I am pleased to be moving the Government’s technical amendments this evening, and, in particular, Amendments 3, 4 and 5 which respond to the concerns raised by the noble Baroness, Lady Royall, and others on behalf of the UK’s universities, schools and colleges. They were worried that the Bill would restrict their ability to process the data of alumni for fundraising purposes. As the noble Baroness explained in Committee, universities, schools and colleges were concerned that being badged as public authorities by Clause 6 would mean they could not rely on the legitimate interests processing condition in article 6(1)(f). This is because the final sentence of article 6(1) states:

“Point (f) … shall not apply to processing carried out by public authorities in the performance of their tasks”.


Universities also doubted whether, in the context of alumni relations, they could rely on article 6(1)(e) of the GDPR, which relates to processing necessary for the performance of a task carried out in the public interest. Although there is a good argument that any fundraising or similar activity which allows universities to improve facilities for students would be considered a “public interest” task, the Government can see why universities might doubt whether all their fundraising work would fall into that category. If universities could not rely on article 6(1)(e) or (f), they say they would be left without an obvious processing condition in situations where obtaining the data subject’s consent, at least in the GDPR sense of that term, was not a realistic option.

Government Amendments 3, 4 and 5 address these concerns by making it clear that public authorities will be treated as public authorities for data protection purposes only when they are carrying out their public tasks. To the extent that they carry out non-public tasks, they would not be defined as a public authority for the purposes of the GDPR and would not be prevented from relying on the legitimate interests processing condition.

We recognise that the amendment does not refer to universities, schools or colleges by name. This is deliberate, meaning that any public authority which is processing data for non-public functions will be able to rely on this provision. The education sector is not the only one to have these worries. I know, for example, that our museums and galleries would welcome the same degree of flexibility, and this amendment will ensure they have it. I am grateful to the noble Baroness for raising this matter and I hope these amendments will provide universities and other similar organisations with the reassurance they need.

I will not go through the remaining amendments in the group one by one, but instead pick out a few which I think may be of broader interest—for example, Amendments 145 and 146. In Committee, my noble friend Lord Hunt of Wirral was among those to express concerns about the inclusion of the term “other adverse effects” in the definition of damage in Clause 159. He asked whether this was broader than the definition in the GDPR. As I set out then, the Government’s intention in including a definition of damage in Clause 159 was to provide clarity, specifically in relation to the inclusion of distress. Clause 159 does not seek to provide a wider definition of damage than is currently provided in the GDPR; nor indeed could it.

None the less, in light of the concerns expressed by my noble friend, the Government have reconsidered this issue and decided to amend the definition to ensure that it is as clear as possible and to minimise the risk of any uncertainty such as that which concerned noble Lords. The amended definition now simply states that the reference to “non-material damage” in the GDPR includes distress. The definition of damage for the purposes of the law enforcement and intelligence services regimes is set out separately in Clause 160. Amendment 146 makes a similar change to that definition so that it is as clear as possible and no longer refers to “other adverse effects”. I beg to move.

[Lord Patel (CB)]

My Lords, I will comment on Amendments 3, 4 and 5. The Minister and the noble Baroness may well feel that I do not give up, and I agree: I do not. I of course understand clearly what the Government are trying to do with the amendment from the noble Baroness, Lady Royall of Blaisdon—that they have agreed to get that into the Bill. It is helpful to know that public bodies need to be defined as such when they are processing data for tasks that are not defined as tasks in the public interest. This opens up the possibility of their instead using legitimate interests as a legal basis under some circumstances: for example, as has already been mentioned, for universities contacting alumni for fundraising purposes.

My point is different: universities and their research activities and how that is recognised, which we discussed. Here, it is more pressing to be clear on what counts as a task in the public interest, since public bodies will need to determine which legal basis is appropriate to the processing they are undertaking in different circumstances. For example, is research conducted in universities a task in the public interest, in which case the university would be considered as a public body for the purposes of the Bill, or is it not? In the latter case the university is not a public body for research purposes, and the research is therefore conducted on the legal basis of legitimate interest.

These differences matter, particularly as the GDPR requires data controllers to be clear on the legal basis they are using. How are public bodies such as universities to make this determination? The clearest answer would be, as I indicated in Committee, that the ICO gives guidance. I understand that the Government cannot direct the ICO to give guidance, so a way needs to be found to clarify which tasks fall under the public interest basis, specifically using the example of university research to provide that clarity. I would be grateful if the Minister commented on that.

--- Later in debate ---

[Lord Kennedy of Southwark (Lab Co-op)]

My Lords, I thank the noble Baroness, Lady Chisholm of Owlpen, for her explanation of the government amendments in this group, which are largely in response to issues raised in Committee. I do not intend to speak for long on this group, because the amendments are largely to be welcomed. I want to pay particular tribute to my noble friend Lady Royall of Blaisdon, who raised the concern of the university sector during Committee that, under the Bill, universities could find themselves in difficulty over fundraising activities with alumni. We were pleased to see today that the Government have listened and addressed that. My noble friend cannot be with us today because of the weather making it difficult for her to travel to London. Generally, the higher education sector and others are grateful for what is proposed, although a couple of noble Lords have raised particular concerns, so it would be useful if the Minister could address those in her response. There may be one area that has not quite been resolved.

There are a couple of issues to mention. We are happy to support the amendment on police sharing of information for law enforcement purposes, as I am the amendment in respect of the Prisoner Ombudsman for Northern Ireland and the technical amendments on tribunals and courts to ensure consistency of language.

I shall not go on any further, because I am conscious that we have two Statements today and one will take at least an hour and the other 40 minutes, and the dinner break business for an hour, which will eat in to our time for Report today. I shall leave it here and say well done to the Government: thank you very much for that. It is better that we spend our day looking at issues that we have not quite resolved.

[Baroness Chisholm of Owlpen]

My Lords, I thank all noble Lords for the points they made. In answer to the noble Lord, Lord Patel, as my noble friend Lord Ashton explained in previous debates, Clause 7 was never intended to provide an exhaustive list of public interest tasks but, rather, to ensure continuity with respect to those processing activities that cover paragraph 5 of Schedule 2 to the 1968 Act. However, I am happy to reiterate that medical research—and other types of research carried out by universities for the benefit of society—will almost always be seen as a public interest task. I appreciate the sector’s desire to have greater guidance from the Information Commissioner on the issue, and I shall certainly pass that on, but the noble Lord will appreciate that it is not for me to dictate the Information Commissioner’s precise programme of work from the Dispatch Box.

I thank the noble Lords, Lord Smith and Lord Macdonald, for their kind words. I think we have put universities on a safe footing in this regard. I reiterate my thanks to them for coming to see us and helping us with that amendment.

The noble Lord, Lord Clement-Jones, asked: is alumni fundraising always in the public interest, and what about medical research?

[Lord Clement-Jones]

No, can it sometimes be in the public interest?

[Baroness Chisholm of Owlpen]

I think that gets more rather than less muddling, but I think I see where the noble Lord is coming from.

The amendment should relate to and rely either on article 6(1)(e) or (f). That should solve any possibility raised by the noble Lord.

Amendment 3 agreed.

Moved by

[Baroness Chisholm of Owlpen]

4: Clause 6, page 4, line 36, leave out “, subject to subsection (2)”

--- Later in debate ---

Moved by

[Baroness Chisholm of Owlpen]

6: Clause 7, page 5, line 11, after “enactment” insert “or rule of law”

Amendment 6 agreed.

[Baroness Chisholm of Owlpen]

My Lords, as it is 4.25 pm and the Statement is due sometime after 4.30 pm, it would be unwise to start on another amendment now, particularly a very long amendment, so I need to adjourn the House during pleasure for four minutes until 4.30 pm.