Data Protection Bill [HL]

Baroness Jones of Moulsecoomb Excerpts

Monday 13th November 2017 Lords Chamber

These are all consequences of the overall approach we are taking. I look forward to further debates and the Minister’s response.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, I speak to Amendment 75 in particular, but the whole issue of automated decision-making is extremely worrying.

As we have gone through this Bill, I have been desperately hoping that some of the most repressive bits are a negotiating tactic on the Government’s part, and that before Report they will say, “We’ll take out this really nasty bit if you let us leave in this not really quite so nasty bit”. I feel that this issue is one of the really nasty bits.

I thank Liberty, which has worked incredibly hard on this Bill and drawn out the really nasty bits. Under the Data Protection Act 1998, individuals have a qualified right not to be subject to purely automated decision-making and, to the extent that automated decision-making is permitted, they have a right to access information relating to such decisions made about them. The GDPR clarifies and extends these rights to the point that automated decisions that engage a person’s human rights are not permissible.

This could include being subjected to unfair discrimination. The noble Lord, Lord Clement-Jones, used the phrase, “unintended discrimination”—for example, detecting sexuality or diagnosing depression. The rapidly growing field of machine learning and algorithmic decision-making presents some new and very serious risks to our right to a private life and to freedom of expression and assembly. Such automated decision-making is deeply worrying when done by law enforcement agencies or the intelligence services because the decisions could have adverse legal effects. Such processing should inform rather than determine officers’ decisions.

We must have the vital safeguard for human rights of the requirement of human involvement. After the automated decision-making result has come out, there has to be a human who says whether or not it is reasonable.

[Baroness Hamwee]

My Lords, I too want to say a word about Amendment 75. The Human Rights Act trumps everything. To put it another way, the fundamental rights it deals with are incorporated into UK law, and they trump everything.

Like the noble Baroness, I believe that it is quite right that those who are responsible—humans—stop and think whether fundamental human rights are engaged. The right not to be subject to unfair discrimination has been referred to. Both the Bill and the GDPR recognised that as an issue in the provisions on profiling, but we need this overarching provision. Like other noble Lords, I find it so unsettling to be faced with what are clearly algorithmic decisions.

When I was on holiday I went to a restaurant in France called L’Algorithme, which was very worrying but I was allowed to choose my own meal. If this work continues in the industry, perhaps I will not be allowed to do so next year. I wondered about the practicalities of this, and whether through this amendment we are seeking something difficult to implement—but I do not think so. Law enforcement agencies under a later part of the Bill may not make significant decisions adversely affecting a data subject. Judgments of this sort must be practicable. That was a concern in my mind, and I thought that I would articulate my dismissal of that concern.

Data Protection Bill [HL]

Baroness Jones of Moulsecoomb Excerpts

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 13th November 2017 Lords Chamber

[Baroness Hamwee]

My Lords, the Committee may realise that there are sometimes occasions when none of us quite prepare for amendments and others where more than one of us does, but, as my noble friend knows, I rarely pass over an opportunity to say how offensive the phrase “hostile environment” is. Data protection should be a force for good in dealing with the way our society is going.

My noble friend has reminded the Committee of the provisions of paragraph 4. Over the last few years the state has extended the mechanisms for immigration control very significantly to letting of property, employment, bank accounts, driving and so on. We may be told that the various departments have memoranda of understanding between themselves with the Home Office to deal with all this, but that is an inadequate way of dealing with them. I do not think I will be the only one in the Chamber to think that. Home Office errors are reported embarrassingly frequently. The exemption covers so many rights: rights held by data subjects to access rectification and erasure, and the right to know who is processing data and why, including when data is obtained from a third party.

Liberty, with its usual energy, has provided us with 13 pages of briefing on this amendment. I do not propose to read them all to the Committee. No doubt the Government have read them and are prepared to respond, but I reserve the right to do so on Report if necessary. It reminds us of the work, if we needed reminding, of Lord Avebury, who said that the equivalent, very similar provision with which he was dealing was,

“in danger of being oppressive, deeply worrying to the immigrant community living among us, and one which is in grave danger of infringing the provisions”—[Official Report, 21/7/1983; cols. 1274-75]—

of the European Convention on Human Rights. The Minister will be relieved that I have not yet succeeded in emulating my late, much-missed noble friend to the extent I would like—I never will, but I will continue to try. His words are even more pertinent now, extending beyond the immigrant community to families and employers, to give two examples.

Like my noble friend, I would be interested to know examples and justifications for how the exemption might be applied. Presumably it would facilitate sharing between public services used by an individual, government departments and the Home Office to check the individual’s entitlement. The Government have said that they want to make the immigration system as “digital, flexible and frictionless” as possible. Initially that seems admirable, until one delves into issues such as this. Liberty asks whether the provision extends to activities such as running a night shelter or a food bank, which might well benefit undocumented migrants. Providing shelter and providing food could be construed as activities which undermine “effective immigration control”—to quote the Bill. Would a school have to provide a person’s address without their knowledge and without their even having committed an immigration offence? Underlying all this, what effect could such a provision have on migrants’ willingness to engage with public services?

Other noble Lords will probably have received a briefing from the Migrants’ Rights Network. It is about a legal challenge which it is starting against the NHS’s data sharing, but it is relevant here. The director of Migrants’ Rights Network said:

“We are gravely concerned that immigration enforcement is creeping into our public services, especially the NHS. And therefore, it is important to challenge this data-sharing agreement which violates patient confidentiality, and discriminates against those who are non-British”.


The lawyer acting for Migrants’ Rights Network says in the press release what I have heard from many workers in the field: that the data-sharing arrangement,

“is leaving migrants too scared to access healthcare services they are entitled to, for fear their address and other public information may be passed onto the Home Office. This could have a particularly negative effect on children, pregnant women, people with disabilities and victims of trafficking and abuse”.

It could have a severe effect on public health as well—we will debate all this when we deal with NHS charges in the regret Motion on Thursday.

The data subject will not know that data are transferred to the Home Office for immigration control purposes. The exemption seems to apply to immigrants and those connected with them, and those suspected of having an immigration offence in contemplation, thus turning them into an inferior class of citizen. It allows, or perhaps requires, data controllers, including the Home Office and its various arms, processing information for immigration purposes to ignore the principles on which the use of data is founded under the GDPR and the Bill and protection is applied.

I think that your Lordships might gather that we are very unhappy with this provision. It needs more justification than I think is capable of being provided, although we will of course wait and see.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, the Minister, who is not in his place at the moment, said earlier that he could not understand what I meant by repressive measures, but paragraph 4 of the schedule is exactly what I meant and it is why this amendment would remove it.

The inclusion of an immigration control exemption in the Bill is a brazen violation of the data protection and privacy rights of migrants—both documented and undocumented—and of their families and communities in the name of immigration control. In effect, it removes all the Home Office’s data protection obligations as they relate to its activities to control immigration, as well as those of any other agency processing personal data for the same purpose or sharing data with another agency processing it for that purpose.

As the noble Baroness, Lady Hamwee, mentioned, it is not the first time that the Government have tried to limit data protection rights on immigration control grounds. In 1983, Clause 28 of the then Data Protection Bill had an identical aim, setting out broad exemptions to data subjects’ rights on grounds of crime, national security and immigration control. The Data Protection Committee, then chaired by Sir Norman Lindop, said that the clause would be,

“a palpable fraud upon the public if … allowed to become law”,

because it allowed data acquired for one purpose to be processed for another; and here is another power grab by this Government.

Clause 28 was rightly removed from the 1983 Bill, but today we see it resurrected with even more breadth and even less definition of its objectives. No attempt whatever has been made to define the new objective: nowhere in the Bill or its Explanatory Notes are the notions of effective immigration control or the activities requiring its maintenance defined. I simply do not understand the colossal cheek this Government have to put something such as this into a Bill and then present it in this House—I can understand it going through the other place but certainly not here. It is virtually impossible to come up with an exhaustive list of all the activities that might be included under this, or of individuals who might be affected. The potential list, as, again, the noble Baroness, Lady Hamwee, pointed out, could go far beyond the immigrants themselves and could apply to almost anybody, including some in your Lordships’ House—at least, I hope that some in your Lordships’ House might be involved in shelters and food banks.

I urge the Government to think again. This is probably one of the really nasty bits that the Government have an option to take out, so I hope that they will listen to us.

[Lord Lucas]

My Lords, I thoroughly support this amendment. I really hope that the Home Office has noticed that the Bill is starting in this House and that therefore this is a paragraph we can kill—and should, as we did in 1983. If the Home Office needs something more, it should make a case for it and we should listen, but to have a blanket provision such as this is very destructive of data collection as a whole. To take again the example of the NPD, the fact that data is passed from the NPD to the Home Office has made the bits of data that are being passed totally corrupt: one can no longer rely on that data because so many schools, not unnaturally, are unwilling to shop their parents and drop their parents into what can be extremely difficult circumstances. You destroy the purpose of the data that you pollute in this way; you make it unreliable. I suspect that you also undermine the research exemption: if data is actually being collected to give to the Home Office, how can you claim that it is for research? You start to undermine the Bill in all sorts of insidious ways by having such a broad and unjustified paragraph— unjustified in the sense that no one has made a justification for it. I really hope that the Home Office will think again.

Data Protection Bill [HL]

Baroness Jones of Moulsecoomb Excerpts

Monday 6th November 2017 Lords Chamber

[The Deputy Chairman of Committees (Lord Faulkner of Worcester) (Lab)]

I remind the Committee that if this amendment were to be agreed, I would be unable to call Amendment 22A for reason of pre-emption.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, I regret I was not able to speak to the Bill at Second Reading, but I take great delight in speaking to it this evening, on Amendments 22, 23, 107, 138 and Clauses 15 and 111. I am well aware that the Bill is extremely important. The digital age brings all sorts of opportunities for us but also lots of challenges, and it is absolutely right to keep up to date and make sure that we have legislation in place for the big questions of privacy in such rapidly changing times. When the current data protection legislation came in, most people were still getting to grips with email, and sending a text message on your mobile phone was a really fancy way of communicating. It is time that the legislation was updated.

The sheer volume and depth of personal data that are now floating around online would have been unimaginable then. We share the deepest and most personal details of ourselves quite freely these days, or at least some of us do. The Bill seeks to set important new standards for the protection of people’s data and give them more rights over how their data are used. So far, so good—for example it would allow some of us to ask the social media companies to delete any stupid comments we made a decade or so ago, which might help some MPs currently.

Digital Understanding

Baroness Jones of Moulsecoomb Excerpts

Thursday 7th September 2017 Lords Chamber

[Baroness Jones of Moulsecoomb (GP)]

I too congratulate the noble Baroness, Lady Lane-Fox, on introducing this debate. She has already forced somebody with few digital skills into a little bit of digital understanding, and I thank her very much for that. It is a pleasure to follow the noble Lord, Lord Berkeley. He put this issue into the context of music and I shall put it into the context of policing. It was a delight that the noble Baroness mentioned climate change, but I am going to avoid that topic today and talk about policing.

A high level of digital understanding is obviously important for the police. It will be essential in fighting crime. The problem is that the rapid pace of technological advancement leaves many unknown unknowns—for example, the policing issues that might arise with driverless cars or quantum computers. As new crimes come forward, such as cyberbullying and phishing, the police need technology skills and support to face these 21st-century crimes. At the same time as we navigate these challenges, we also have to maintain a constant focus on protecting civil liberties while encouraging and facilitating innovation.

Digital crime differs greatly from traditional crimes, because most digital crime can be committed from the comfort of the perpetrator’s own home, and the actions of a computer-savvy criminal can rapidly affect thousands of people. The ransomware attack on the NHS in May showed the devastating effect that cybercrime can have on core public services. To meet these challenges, all police officers and police staff need the knowledge and skills to use digital technology and be aware of emerging trends. Police leaders must have a deep understanding of the developing issues, and have the vision for a new strategy to seize the initiative on these new crimes.

I want to talk about big data, which the police use a lot. That means drawing huge amounts of data from diverse sources, assessing their accuracy and reliability, and then making critical analyses—and sometimes difficult decisions based on what has been learned. This is an important issue, as it has wide-ranging implications for civil liberties and discrimination within society. It offers opportunities for the police to add data-driven insights to their traditional policing expertise. Complex algorithms can make useful predictions from a range of data as diverse as historical crime data, location of cashpoints, census data, football results, weather patterns and temperature changes.

The opportunity is that big data models can give deeper insight into the trends that affect crime and allow police to direct scarce resources better. Often this can make policing easier but sometimes IT goes badly wrong, and I shall give your Lordships an example of that. Last month, London’s Met police used what is actually a controversial, inaccurate and largely unregulated automated facial recognition technology to spot troublemakers at the Notting Hill Carnival. This is the second year running that it has trialled it, and once again it did more harm than good. Last year it actually proved useless, so that was okay, but this year it proved worse than useless, with 35 false matches and one wrongful arrest of someone erroneously tagged as being wanted on warrant for a rioting offence. Silkie Carlo, the technology policy officer for civil rights group Liberty, saw the technology in action and, in a blog post, described the system as showing,

“all the hallmarks of the very basic pitfalls technologists have warned of for years—policing led by low-quality data and low-quality algorithms”.

Yet, in spite of its lack of success, the Met’s project leads viewed the weekend not as a failure but as a resounding success. It had come up with one solitary successful match, and even that was skewered by sloppy record-keeping that got an individual wrongly arrested. The automated facial recognition was accurate but the person had already been processed by the justice system and was erroneously included on a suspect database. It so often comes back to basic record-keeping, not to technology that can make things easier.

I see two particular problems for the police force: understanding what there is in terms of digital products, and having the judgment to know what is appropriate to use.