Data Protection Bill [HL]

Debate between Baroness Jones of Moulsecoomb and Lord Clement-Jones

Monday 14th May 2018 Lords Chamber

[Baroness Jones of Moulsecoomb (GP)]

My Lords, I support Amendments 53A and 53B, tabled by the noble Lord, Lord Mitchell.

I must express my general frustration at the Bill. There is so much information, so much data of national significance that, it is clear, will be abused by the Government, whether or not they know that they are doing so. The Windrush scandal showed just how badly the Home Office gets things wrong, and the Bill’s provisions allow the sharing of people’s data which would further the “hostile environment” policy. I am very disappointed that the Government have not tabled amendments to curtail the broad powers in the Bill that will allow for such abuse.

There are so many cases of people who are victims of serious crime—of rape, violence and people trafficking—who are being reported by the police to the Home Office and then being arrested, detained and deported. At least 27 police forces have admitted that they do this. Ministers cannot possibly claim to be learning from those instances, just as they appear not to have learned from Windrush, while they continue to include such cruel and intrusive powers in the Bill. The fact that the Government can get things so horribly wrong is why the amendment should be included.

We have heard that data is more valuable than oil. It is more valuable than oil or gold. It is the boom industry of our times, and the temptation for government to allow its exploitation by the commercial sector—the predatory big tech organisations to which the noble Lord, Lord Mitchell, referred—will be overwhelming, especially in this age of austerity when money appears to be so short.

This is not just an issue of exploitation in a negative sense: there are lots of opportunities for government data to be used to empower communities. We can do things such as monitor air pollution and hold the Government to account by using this data. I am excited by those opportunities, but they need proper regulatory oversight to ensure that data is used for good. The control and processing of nationally important data must be properly overseen by the Information Commissioner and the National Audit Office. The Government recognised this in the Bill as drafted, and I do not understand why that has been removed—perhaps the Minister could explain.

I really hope that the Minister will support the amendments, but I rather suspect he will not.

[Lord Clement-Jones (LD)]

My Lords, on these Benches, we are very sympathetic to Amendments 53A and 53B. Like the noble Lord, Lord Mitchell, we find it difficult to understand why it has been impossible to come to some sort of agreement. I hear what the Minister said: that he is sympathetic, but not so sympathetic that he agrees with the amendments. This disagreement about whether a statutory code, guidance or whatever is the right way forward seems to be dancing on the head of a pin.

I pray in aid the intervening report of the AI Select Committee on precisely this matter, which supports the contentions of the noble Lord, Lord Mitchell. In our report, we stated:

“Increasingly, public sector data has value. It is important that public organisations are aware of the commercial potential of such data. We recommend that the Information Commissioner’s Office work closely with the Centre for Data Ethics and Innovation in the establishment of data trusts, and help to prepare advice and guidance for data controllers in the public sector to enable them to estimate the value of the data they hold, in order to make best use of it and negotiate fair and evidence-based agreements with private-sector partners”.


That seems fair and square along the lines proposed by the noble Lord, Lord Mitchell.

In the course of our inquiry, we also looked carefully at the sorts of arrangements made by DeepMind—not only the benefits, which he very fairly outlined, but the issues with how sharing that data was organised, which of course led to an investigation by the Information Commissioner’s Office. Of course, NHS data is particularly important in this context. In our report, we stated:

“The data held by the NHS could be considered a unique source of value for the nation. It should not be shared lightly, but when it is, it should be done in a manner which allows for that value to be recouped”.


So, fair and square, we are with the noble Lord, Lord Mitchell.

It would be somewhat ironic if the Secretary of State, in his response to our Select Committee in three or four weeks, said, “Yes, we agree: there should be something along these lines”, but we had missed the opportunity in this Bill.

Data Protection Bill [HL]

Debate between Baroness Jones of Moulsecoomb and Lord Clement-Jones

Committee: 6th sitting (Hansard): House of Lords
Wednesday 22nd November 2017 Lords Chamber

[Lord Clement-Jones]

My Lords, I strongly support Amendment 184. The Minister will have noticed that Amendment 185 would simply import the same provisions into applied GDPR for this purpose. The rationale, which has been very well put forward by the noble Lord, Lord Stevenson, is precisely the same.

I do not know whether the Minister was choking over his breakfast this morning, but if he was reading the Daily Telegraph—he shakes his head. I am encouraged that he was not reading the Daily Telegraph, but he would have seen that a letter was written to his right honourable friend Matt Hancock, the Digital Minister, demanding that the legislation can and should contain the second limb that is contained in the GDPR but is not brought into the Bill. The letter was signed by Which?, Age UK, Privacy International and the Open Rights Group for all the reasons that the noble Lord, Lord Stevenson, put forward. The noble Lord mentioned a number of data breach cases, but the Uber breach came to light only last night. It was particularly egregious because Uber did not tell anybody about it for months and, as far as one can make out from the press reports, it was a pay-off. There is a very important role for such organisations to play on behalf of vulnerable consumers.

The Which? survey was particularly important in that respect because it showed that consumers have little understanding of the kind of redress that they may have following a data breach. A recent survey shows that almost one in five consumers say that they would not know how to claim redress for a data breach, and the same proportion do not know who would be responsible for helping them when data is lost. Therefore the equivalent of a super-complaint in these circumstances is very important. To add to that point, young people are often the target of advertising and analysis using their personal data. I think they would benefit particularly from having this kind of super-complaint process for a data breach.

I hope very much that the Government, who I believe are conducting some kind of review, although it is not entirely clear, will think about this again because it is definitely something we will need to bring back on Report.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, I support Amendment 184. As the noble Lord, Lord Stevenson, said, the GDPR does allow not-for-profit organisations to lodge complaints about suspected breaches of data protection without needing the authorisation of the individuals concerned. I really do not understand why this has been taken out; it is such an important piece of legislation that gives teeth to data protection. Most people do not have the time or the inclination to lodge complaints against data controllers. So many organisations are now holding data about us that it is ridiculous to suggest that individuals can become data detectives responsible for finding out who holds data on them and trying to work out whether that data is being processed in accordance with data protection rules.

I went through the hassle of getting my own subject access request from the Met police. It took a lot of form filling and cost me £10, which was absolutely not money well spent because the file, when I got it, was so redacted. I did ask for my money back but was not given it. That shows me that most of us will not know that data about us is being held—so the amendment is extremely valid.

Despite my opposition to some provisions in the Bill, I accept that it is very important. However, it is equally important that we get it right and that we do not have all these derogations which mean that it has less authority and power. Personally, I think that the amendment strengthens the data protection regime without any hassle for consumers. I hope that the Government will include it in the next iteration of the Bill.