Victims and Prisoners Bill

Baroness Morgan of Cotes Excerpts

3rd reading
Thursday 23rd May 2024 Lords Chamber

[Lord Bellamy (Con)]

I think this is not a very useful debate to pursue at this stage of the proceedings. Without going any further, I am under the impression that it is not only the question of agreeing on a lawyer, but whether a standing public advocate should be appointed in the first place. I suggest that is something we should leave aside for today’s purposes.

My second duty is to speak to Amendment 1 in my name on the Marshalled List. I thank the noble Baroness, Lady Morgan of Cotes, and Stella Creasy, a Member of Parliament in the other place, for the amendments they have tabled on this issue, and their engagement with myself and officials in this area. The amendment concerns what to do when there is a malicious complaint to social services and the procedure for removing that complaint, following the conviction of the complainant and the finding that the complaint was malicious.

Amendment 1 will insert into Article 17(1) of the GDPR—in fact, it inserts it into the relevant European directive so we have an unusual example of the UK Government directly amending European legislation—a new Part 2 ground which creates the right for certain victims who are data subjects to request deletion of personal data when the following two circumstances occur: first, when an allegation has been made by a person who has been convicted of relevant criminal offence against the data subject, or the person is subject to a stalking protection order made to protect the data subject from a risk associated with stalking; secondly, following an investigation by the data controller, it has been decided that no further action has to be taken in relation to the allegation.

The relevant criminal offences listed in the amendment are the offences of stalking and harassment against a victim. A power is also taken to update this list by regulations made using the affirmative procedure, should further offences be required to be included in the future. This amendment will provide a specific new ground for victims of stalking and harassment for the deletion of false allegations made about them, and support them to prevent the further distress that retaining this information may cause.

To ensure that the data controller has an important reason to retain the data, the exemptions under Article 17(3) of the UK GDPR will apply. This allows the data controller to refuse the re quest for a limited list of reasons, including whether processing is necessary for compliance with a legal obligation or the performance of a task carried out in the public interest, which could capture refusal for safeguarding reasons. However, data controllers must provide reasons for any refusal and inform data subjects of their right to complain to the Information Commissioner’s Office. We will ensure that guidance, including on child safeguarding, is updated so data controllers understand how the new ground is intended to work. We will also update the victims’ code so that victims are aware of their rights around data erasure.

I therefore commend this amendment to the House, and I hope that what I have said will permit the noble Baroness, Lady Morgan, not to press her Amendment 2 on the marshalled list.

[Baroness Morgan of Cotes (Con)]

My Lords, it is a pleasure to speak on this very important Bill. I am delighted that it covers so many vital issues and will proceed, we hope, to Royal Assent before Parliament is prorogued.

I shall speak to Amendments 1 and 2. I thank my noble friends the Minister and Lady Barran, and their officials, for their engagement on this matter at some speed. I am delighted that Stella Creasy is here to listen to the debate. I thank the noble Baroness, Lady Brinton, my noble friend Lady Finn and the noble Lord, Lord Russell, for their support, as well as the Opposition Front Bench.

Politics is the “art of the possible”, as the important quote goes. The Government have now accepted, after resisting for many months, the principle behind Amendment 2, which we repeatedly tabled in this House at various stages of the Bill. As we have heard, the law should be updated to recognise that, in cases of stalking and harassment, one of the things that the stalker or harasser can do to prolong their victim’s agony is to make a false and malicious allegation which stays on the record, and data controllers hide behind their rights in not deleting it even when the allegation has been found to be both false and malicious.

I recognise the progress that has been made in the tabling of Amendment 1. As ever, of course, the devil is in the detail. As my noble and learned friend Lord Bellamy has said, there are still grounds under Article 17(3) of the GDPR on which a data controller could refuse to delete the data. I really welcome his clear commitment that there needs to be strong guidance to the ICO and data controllers in the Explanatory Notes to the Bill, and also provisions in the victims’ code. The danger with all this is that we still leave the burden on victims to argue for the data to be erased, and the power remains with the data controller. That is what worries me about those exemptions in Article 17(3).

In that guidance, the data controller must be told that they need to set out substantive grounds for refusing any request for erasure of the data. We also hope that the Government will set out scenarios in which those exemptions in Article 17(3), provided for in law, cannot be used in cases where data records have been created as a result of malicious conduct.

Having said all that, I recognise where we are at this time in this Parliament. I will be interested to hear what other noble Lords might say in this short debate and what the Minister might say in summing up. I recognise and thank my noble and learned friend for the progress that he has made on this issue.

[Lord Russell of Liverpool (CB)]

My Lords, I will speak very briefly. I pay tribute to the noble Baroness, Lady Morgan, for her persistence and skills in negotiating with her own party, which is possibly easier than doing it from outside the party.

I stress the absolute importance of giving crystal clear guidance. The occupation of data controller is not necessarily high on the list of most of us as a potential career. I suspect that it is not the most exciting part of many bureaucracies. I also suspect that it is an area where one follows the rulebook, or what one perceives to be the rulebook, particularly closely. I suspect that the ability of individuals to feel that they have the power to exercise their own judgment is somewhat limited and probably not encouraged. It is incredibly important that there is absolutely no doubt in the mind of even the least curious or the most obdurate data controller as to what is and is not acceptable in terms of erasure.

Other than that, I thank the Government for having thought about this carefully, and for having responded. I hope that as a result of this, the data controller in Waltham Forest who is making Stella Creasy’s life rather difficult will at least read this debate or be told of it and will rethink his or her decision to not erase the data.