Electronic Communications and Wireless Telegraphy (Amendment etc.) (EU Exit) Regulations 2019

Baroness Neville-Rolfe Excerpts

Thursday 7th February 2019 Lords Chamber

[Lord Griffiths of Burry Port (Lab)]

My Lords, I rise to wish the Minister well. We had a good debate in Grand Committee. We shared very frankly a number of views. There were questions relating to what kind of consultation had taken place; others were raised persistently and clearly by the noble Lord, Lord Foster of Bath, and he has continued to pose them this morning. I was reassured by the letter that we received, which took up and dealt with a number of the questions that we had been struggling with.

Once again, as I said from the Dispatch Box yesterday, I am trying to make a clear distinction between what needs to happen to the statutory instrument laid before us—I am sure the matters arising from it have now been adequately aired—and the questions that will go on worrying us after this instrument has been passed; as we move into the next phase, we will be debating substantive issues that certainly have not been answered in a debate of this kind. For the purpose of dealing with the piece of business directly before us, I am happy to give our accord from these Benches, but not if that should be supposed to cancel, diminish or sideline the issues that have been raised from the other Benches.

[Baroness Neville-Rolfe (Con)]

Unfortunately we do not have a satisfactory or agreed Brexit deal and we need a no-deal SI here and indeed in a number of other areas, so I support the Government on that. However, I would like to pick up a point made by the noble Lord, Lord Foster, on roaming, which I understand is broader than this SI. If this is to be a commercial decision in future for the mobile operators in the event of no deal, as we heard earlier, can the Government seek voluntary assurances from them that they will continue to incorporate overseas calls and internet access into their contracts? I have that facility from Three and it includes the EU and indeed the US, and I do not think the company is planning to change that. However, in addition to the consumer triggers that are being introduced and the very good provision on inadvertent Republic of Ireland roaming, I think Ofcom could require the operators to make a clear statement of their intentions in this area on such calls in the EU, and I think it should look at the ability of consumers to switch from deals that turn out to be bad as a result of the change.

[Lord Pannick (CB)]

My Lords, I support the noble Lord, Lord Foster, in the concerns that he has raised. It is not just the Minister in the other place who says it is important for Ofcom to benefit from the continuing exchange of best regulatory practice; it is in paragraph 7.35 of the Explanatory Memorandum:

“However, the Government recognises that Ofcom would benefit from the continued exchange of regulatory best practice with other national regulatory authorities and the exchange of information about electronic communications matters more generally”.


The memorandum goes on at paragraph 7.36 to note that,

“the BEREC Regulation presently allows BEREC to invite observers to attend its meetings, and that the new BEREC Regulation is expected to provide that the Board of Regulators, the working groups and the Management Board should be open to the participation of regulatory authorities of third countries”—

which of course would include us in the event of no deal—

“where those countries have entered into agreements with the EU to that effect”.

My question is therefore about whether it is the intention of the Government that, in the event of no deal, Ofcom should urgently seek from other EU states an agreement that will allow Ofcom to have such observer status so that Ofcom can benefit from the continuing exchange of best regulatory practice, and indeed the regulators at BEREC can benefit from Ofcom’s expertise.

Broadcasting (Amendment) (EU Exit) Regulations 2019

Baroness Neville-Rolfe Excerpts

Wednesday 6th February 2019 Lords Chamber

[Lord Adonis (Lab)]

My Lords, I have a very short question for the Minister again on this issue of consultation. The broader issues were raised in the excellent speech made by the noble Lord, Lord Foster. On consultation, in paragraph 10.1, it says:

“Ofcom, as the audiovisual regulator, were consulted in drafting this instrument”.


Was Ofcom the sole body consulted in the preparation of this instrument? In light of the speeches that have been made in the House, I find that extraordinary, given the range of interests, companies and organisations affected. Will the Minister say why Ofcom was the only body consulted, given the broader themes that have come out? It is extraordinary in light of the speech made by the noble Lord, Lord Foster, to read paragraphs 7.2 and 7.3 in the Explanatory Memorandum. You would think that you were talking about two entirely separate sets of proposals. Paragraphs 7.2 and 7.3 make it sound as if these changes from country of origin to country of destination are the purely technical and unavoidable dotting of commas and crossing of “t”s as a result of leaving the European Union. Only as the speech made by the noble Lord, Lord Foster, unfolded did we realise that these are fundamental changes to the whole broadcasting regime in Europe that could have extensive consequences. In that case, why was Ofcom alone consulted?

[Baroness Neville-Rolfe (Con)]

I rise briefly to support my noble friend the Minister. It is a difficult situation in broadcasting, and I think it is sensible and creative of DCMS to make use of the Council of Europe treaty. Whatever your views on Brexit, we need to be ready for exit day. This ensures that 50 or 60 channels that will continue to come in from the EU can be regulated against Ofcom standards from 29 March, or at the end of the transition period. Along with the noble Lord, Lord Adonis, I would be interested to hear who has been consulted about the detail of this. There will be scope in the future to look at the longer-term arrangement. As an ex-Minister and ITV director, I look forward to that, including looking at the future of new broadcasting methods, video on demand, the effect of social media, and so on.

Mobile Networks: Resilience

Baroness Neville-Rolfe Excerpts

Tuesday 11th December 2018 Lords Chamber

[Lord Ashton of Hyde]

As the noble Lord knows perfectly well, the universal service directive, which is the basis for the universal service obligation, only includes fixed-line service. Therefore, it would be impossible under European law to include mobile.

[Baroness Neville-Rolfe (Con)]

My Lords, digital connectivity, whether through broadband or mobile, is a new utility and those who do not have it are socially and financially excluded. Can my noble friend tell me when 100% of homes in this country will have such connectivity?

[Lord Ashton of Hyde]

As the noble Lord, Lord Stevenson, alluded to, by 2020 the universal service obligation will give every household in this country a legal right to be connected at a speed of not less than 10 megabits a second.

Public Sector Television Content

Baroness Neville-Rolfe Excerpts

Thursday 25th October 2018 Lords Chamber

[Lord Ashton of Hyde]

That is likely to be the case, but we are obviously waiting for Ofcom’s report. However, I understand the point, and I think it will have suitable prominence.

[Baroness Neville-Rolfe (Con)]

I refer to the register of interests. Is the Minster aware that the concerns reflected in the noble Baroness’s Question are shared by many on these Benches as well? Can he send a strong message to Ofcom about the need for speed, given the pace of technological change, which is overtaking us every day? When does he think the Government will be able to announce concrete progress on this road?

[Lord Ashton of Hyde]

I have outlined that things are moving fast. The consultation finishes on 5 October. Ofcom has said it will report at the beginning of 2019. Then, as the noble Lord, Lord Griffiths, alluded to, it is up to the business managers—if Ofcom decides that legislation is necessary; you will have to look at the report. This is a complex area. The new technologies do not make it simple. It is not just like an old, linear EPG. But we understand the urgency and we know that the commercial interests do make it difficult for public service broadcasters. The key is that we support public service broadcasting.

Data Protection Bill [HL]

Baroness Neville-Rolfe Excerpts

Monday 14th May 2018 Lords Chamber

[Lord Ashton of Hyde]

They should have hired a lawyer. The point is that it is a perfectly valid point. We have sought to replicate in the Bill, as far as possible, the existing provisions relating to legal professional privilege. We had several discussions about that in the 1998 Act, including the relevant exemptions to rights and obligations for personal data. I cannot help but notice that the Arbitration and Mediation Service, given that we are trying to replicate as far as possible existing provisions, appears to have been operating without undue burden for the last 20 years, but I am certainly prepared to undertake to the noble Lord, Lord Pannick, that we will look at that with a view to making sure that this is not a serious problem. We certainly have not been able to do it in time. I can confirm to him that, if there is a problem, the Bill contains regulation-making powers to address this concern. The only thing I can say on that is that, quite rightly, those regulations would have to come before both Houses of Parliament. If there is a concern he will be able to address it later.

The noble Lord, Lord Stevenson, is quite correct that we talked about me making a statement or addressing concerns about the individual application of the GDPR and the Bill to Peers. I assumed I would do so if it was necessary and if the subject came up, which, luckily, it has not. Just to be clear, it is not just that Peers and other citizens of this country are suffering under the GDPR, although they might have obligations that they were not aware of before and, I agree, certain extra ones because the GDPR has direct effect; it also greatly increases individual subject rights. It makes sure that individuals’ personal data, in particular sensitive personal data, is better protected in law and by a regulator, who, thanks to your Lordships’ agreement, has real power to make sure that the data regime is obeyed. I believe that the House authorities have issued a statement to all Peers. Of course, my department is there to address this. The first avenue that Peers should use for the individual circumstances is the House authorities.

[Baroness Neville-Rolfe (Con)]

Can I press my noble friend a little further on the issue of what individual Peers and Members of Parliament should do? There was an earlier discussion on whether some arrangements might be made so that data protection rules can be followed but the burden would not be unreasonable. I also take this opportunity to thank my noble friend for these many amendments which are grouped together, on diversity through to financial services. It has been a model of good working.

[Lord Ashton of Hyde]

I am grateful for that. When my noble friend spoke of pushing me further, I am not completely clear what she wants me to do. It is not right for me to opine on individual cases. I think we are talking about Peers in their roles as Peers. Each individual Peer has to discuss that in the light of their individual circumstances. All I would say is that if noble Lords are dealing with special categories of data and personal data, they will have to be aware of the obligations put on them by the Bill and the GDPR. The House authorities are there to advise, as is the Information Commissioner. They will have to do so. In my case, for example, I do not anticipate that in what I do as a Peer, as opposed to a Minister, I would have to pay a fee as a controller, if that helps.

Brexit: Digital Single Market

Baroness Neville-Rolfe Excerpts

Tuesday 8th May 2018 Lords Chamber

[Lord Ashton of Hyde]

The noble Lord is right that roaming charges are one of the main areas that we have to look at as part of the negotiations that particularly affect DCMS. That is absolutely on our radar and we understand the implications both ways. We understand that it is a fairly recent innovation not to have roaming charges within the EU: we completely understand that and it will form part of the negotiations.

[Baroness Neville-Rolfe (Con)]

My Lords, I agree about the importance of the creative industries and I am sure they will continue to be creative as we go forward beyond Brexit, but I want to ask my noble friend a question about portability. This is the ability to take your television programmes abroad digitally when, for example, you go on holiday in the Mediterranean, so that you are able to watch “Coronation Street”, “EastEnders” or whatever is your particular delight. Can my noble friend give me an update on whether that will still be possible?

[Lord Ashton of Hyde]

I am not absolutely clear whether that will still be possible. I do not think it is the highest on our list of priorities. However, I will certainly take it back to my department and get my noble friend a clear and concise answer.

Volunteering

Baroness Neville-Rolfe Excerpts

Wednesday 21st February 2018 Lords Chamber

[Baroness Neville-Rolfe (Con)]

I am delighted that the noble Baroness, Lady Armstrong, has secured this fascinating debate on volunteering, which has been part of my life from an early age. My mother worked for many years as a mental health volunteer. I remember helping her in the charity’s shop in Salisbury and, best of all, painting and decorating halfway houses for mental patients coming out of care, freeing up beds for others. I still give my clothes to the successor shop and I recollect that one of her biggest problems was with the Charity Commission, which was slow at approving the purchase of these halfway houses. I used to walk for Shelter at school and, as part of my charitable work at Tesco, ran—or tried to run—for 11 years in Cancer Research UK’s Race for Life, as part of an effort that raised more than £400 million.

These examples show, first, the value to the individual of charitable engagement. We learn new competences or, as my noble friend Lord Hodgson said, get back into work. Secondly, they show the substantial sums of money that can be raised, especially with the backing of a big corporate. Companies can also move very fast. I remember being the first donor to the Thailand tsunami, allowing the Red Cross to fly out immediate supplies. Thirdly, volunteering is good for us morally: it is good to think of others and often good physically as well.

Finally, I want to talk about the Trussell Trust, based in Salisbury. It provides food banks, and I first came across the trust in Liverpool in the wake of the financial crisis. It relies heavily on volunteers and I have seen moving testimony of the positive effect that volunteering has had on them. What the trust does, in a no-nonsense, modest way, is provide support for those who suddenly fall into real difficulty, such that they and their dependants cannot see where to go or where the next meal will come from. It has branched out, but that is its fundamental purpose.

We should admire the extensive efforts made by many people in volunteering to help others. We need more engagement in volunteering and in charity work by more people. They will enjoy it and bring in valuable funds. But practical enthusiasm from individuals is the single most important thing we need.

Data Protection Bill [HL]

Baroness Neville-Rolfe Excerpts

Report: 3rd sitting Hansard: House of Lords
Wednesday 10th January 2018 Lords Chamber

Moved by

[Baroness Neville-Rolfe]

106: After Clause 114, insert the following new Clause—
“Duty to support small organisations
(1) The Commissioner is to provide additional support to—(a) small businesses,(b) small charities, and(c) parish councils,in meeting their obligations under the GDPR and this Act.(2) The additional support in subsection (1) may include, but is not limited to—(a) advice on how to comply with the provisions of the GDPR and this Act;(b) access to pro formas to demonstrate compliance with the GDPR and this Act; and(c) in relation to fees to be paid to the Commissioner, discounted charges or no charges.(3) In this Act, “small businesses” has the same meaning as in section 2 of the Enterprise Act 2016.”

[Baroness Neville-Rolfe (Con)]

My Lords, we have had something of a break, so perhaps I should remind the House what lies behind my Amendments 106, 125 and 127. It is the wish to reduce, as far as possible, the burden that the GDPR and the Bill will place especially on small entities—notably, small businesses, small charities and parish councils. I might add that it behoves us to stand back from time to time and recognise the burdens we all too often impose on people and businesses. This is very often for good reasons, but it can seem overwhelming for those at the receiving end, and it is important to minimise the burden where we can legitimately do so.

I also place on record my thanks to the Minister for a helpful meeting about my concerns. Against this background, Amendment 106 would place a duty on the Information Commissioner to support such small entities in meeting their obligations under the GDPR and the Bill. It gives examples of how this should be done, including compliance advice and zero or discounted fees. This is important both practically and as a manifestation of how the state expects the commissioner to approach her duties. We should always remember that data protection will sound forbidding to some small organisations.

Furthermore, parish councils are fearful that they could face new costs of up to £20 million in total on one reasonable interpretation of the present text. They have been advised that an existing officer of a council could not act as a DPO because they are not independent. My noble friend Lord Marlesford mentioned this issue at Questions in December but, happily, I believe the Government take a different view, and it would be helpful to hear that on the record from my noble friend.

On the same lines, Amendment 125 would require the Secretary of State to consider fixing charges levied on small entities by the commissioner at a discounted or zero level. We need to find a way to avoid the imposition of significant costs for small entities into the future as cost recovery escalates in the administration of data protection.

Amendment 127 goes a little further. It would require the commissioner to have regard to economic factors in conducting her business. This is a fundamental point. The commissioner’s remit contains elements which are similar to those of a judge and focuses predominantly on individual rights and protections. But the analogy is imperfect. Judges must go where justice takes them. The commissioner’s role is different in important respects, and economic factors ought to hold a high place in her consideration. This is important for UK competitiveness and for continued growth and innovation, which is also of benefit to business, citizens and data science—and, indeed, UK plc.

The amendment seeks to ensure that the commissioner concentrates on this economic angle by reference to the commissioner’s annual report. The noble Lord, Lord Stevenson, may remember that we introduced a special reporting requirement into intellectual property legislation which helped to ensure the right culture in that increasingly important area.

I should add that I am grateful to my noble friend Lord Arbuthnot and to the noble Lord, Lord Stevenson, for their involvement, and I am hopeful that the Minister will be able to meet the concerns I have outlined in my three amendments in a sympathetic and practical way.

[Lord Clement-Jones (LD)]

My Lords, I rise briefly to support the noble Baroness, Lady Neville-Rolfe, in her amendment. She made a very good case. Current fee proposals really are very flawed. Clause 132, “Charges payable to the Commissioner by controllers”, states:

“The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commissioner”.


That, compared to the existing regime of registration, seems far more arbitrary and far less certain in the way it will provide the resources that the Minister, in a very welcome fashion, pledged to the noble Lord, Lord Puttnam. It is far from clear on what basis those fees will be payable. Registration is a much sounder basis on which to levy fees by the Information Commissioner, as it was from the 1998 Act onwards.

I wish to be very brief; this has already been brought up. The Minister prayed in aid the fact that there are already some 400,000 data controllers and it was already getting out of hand. If the department—indeed, if the ICO—is going to be in contact with all those it believes to hold data as data controllers, it will have to have some kind of records. If that is not registration, I do not know what is. The department has not really thought through what the future will be, or how the Information Commissioner will secure the resources she needs. I hope that there is still time for the Minister to rethink the approach to the levying of future tariffs.

--- Later in debate ---

[Lord Ashton of Hyde]

Exactly, so my point, which I was coming to but which the noble Lord has very carefully made for me, is that, in doing this, the Information Commissioner will obviously keep a list of the names and addresses of those people who have paid the charge. The noble Lord may even want to call that a register. The difference is, unlike the previous register, it will not have all the details included in the previous one. That was fine in 1998, and had some benefit, but the Information Commissioner finds it extremely time-consuming to maintain this. In addition, as regards the information required in the existing register, under the GDPR that now has to be notified to the data subjects anyway. Therefore, if the noble Lord wants to think of this list of people who have paid the charge as a register, he may feel happier.

I have talked about the penalty sanction. When the noble Lord interrupted me, I was just about to say—I will repeat it—that the commissioner will maintain a database of those who have paid the new charge, and will use the charge income to fund her operation. So what has changed? The main change is that the same benefits of the old scheme are achieved with less burden on business and less unnecessary administration for the commissioner. The current scheme is cumbersome, demanding lots of information from the data processors and controllers, and for the commissioner, and it demands regular updates. It had a place in 1998 and was introduced then to support the proper implementation of data protection law in the UK. However, in the past two decades, the use of data in our society has changed dramatically. In our digital age, in which an ever-increasing amount of data is being processed, data controllers find this process unwieldy. It takes longer and longer to complete the forms and updates are needed more and more often, and the commissioner herself tells us that she has limited use for this information.

My hope is that Amendment 107A is born out of a feeling shared by many, which is to a certain extent one of confusion. I hope that with this explanation the situation is now clearer. When we lay the charges regulations shortly, it will, I hope, become clearer still. The amendment would simply create unnecessary red tape and may even be incompatible with the GDPR as it would institute a register which is not required by the GDPR. I am sure that cannot be the noble Lord’s intention. For all those reasons, I hope he will withdraw the amendment.

[Baroness Neville-Rolfe]

I thank the Minister for going into the issues in such detail, and for the support that is now being offered by the ICO through the transition. We have heard about the helpline, the websites, and new guidance—not only for parish councils, which I regard as a major breakthrough, but for small business and schools. That is all very good news. There will be a charge but it will be modulated, as I understand it, in a way to be decided and brought before the House in an order. I think the Minister understands the wish of this House not to load lots of costs on smaller businesses as a result of this important legislation, which we all know is necessary for a post-Brexit world.

My only concern related to the Minister’s comments on what we might put into the report, because he rightly said that the Information Commissioner had to be independent, which I totally agree with. Equally, I thought that without undermining her independence, it was possible to ask her to report on economic matters and, for example, on how business learns about data protection and how that is going. I do not know whether he is able to confirm that today, but he made a point about independence and it was not clear whether it would be possible to put something into the reporting system.

[Lord Ashton of Hyde]

We are keen that the Information Commissioner be independent and is seen to be independent, and I know that the commissioner herself is aware of that. I cannot commit to anything today, but I will certainly take back my noble friend’s question and see what can be done while maintaining the Information Commissioner’s independence.

[Baroness Neville-Rolfe]

On that basis, I am happy to beg leave to withdraw my amendment.

Amendment 106 withdrawn.

Data Protection Bill [HL]

Baroness Neville-Rolfe Excerpts

Committee: 6th sitting (Hansard): House of Lords
Wednesday 22nd November 2017 Lords Chamber

[Lord Griffiths of Burry Port (Lab)]

My Lords, I thank the noble Lord for his eloquent disquisition, which made me much more aware of the issues than I was before. I have no problem in aligning myself with the two points of view that have just been expressed. I had come to the conclusion partly myself, but to be told that the wording is not in the equivalent article in the European GDPR just adds to my simple conclusion that the words “other adverse effects” add precisely nothing but open a potential cave of dark possibilities. The rain of the noble Lord’s eloquence has found a crack in my roof, and I am very happy to align myself with his remarks.

[Baroness Neville-Rolfe (Con)]

I also share the concerns expressed by my noble friend Lord Hunt, based on my experience, both in government and in a number of different businesses. We have the experience not only of the motor sector, which has been talked about, but obviously of PPI, where there was compensation that needed to be paid, but the whole business took years and generated not only claims management companies but also nuisance calls and lots of other harms. This is an area that one has to be very careful about, and I support looking at the drafting carefully to see what can be done, and at my noble friend’s idea of trying to estimate the economic impact—the costs—in terms of those affected. That would help one to come to a sensible conclusion on what is appropriate in this important Bill.

[Baroness Chisholm of Owlpen (Con)]

My Lords, I thank my noble friend Lord Hunt for explaining Amendment 170A and other noble Lords who have spoken. The amendment seeks to clarify the definition of “damage” provided by Clause 159 and its relationship to the language used in article 82 of the GDPR. This is important because article 82 of the GDPR provides a right to compensation when a person has suffered damage as the result of an infringement of the rights during the processing of their personal data.

Currently, the type of damage that can be claimed is broader under article 82 than Section 13 of the 1998 Act, as article 82 expressly extends to “non-material” damage. As a result, in drafting the Bill, the Government considered that some definition of “damage” was necessary, including specifying that it extends to distress, to provide clarity and certainty for data subjects and others as to their rights under article 82.

I stress that Clause 159 does not seek to provide a wider definition of “damage” than is currently provided in the GDPR, and nor indeed could it. The intention is simply to clarify the GDPR’s meaning. My noble friend Lord Hunt asked what estimates have been made of the financial consequences of the increase in litigation, but as Clause 159 does not provide a wider definition of damage there will be no financial consequence.

The concept of “damage” included in the GDPR reflects developments in case law over a period of some years. As such, I cannot agree with my noble friend’s suggestion that the Bill or the GDPR will suddenly unleash a free-for-all of claims. However, I am happy to reflect on my noble friend’s point that the Bill’s use of the term “other adverse effects” may unintentionally provide uncertainty rather than clarity. With the reassurance that I will go away and look at that, I hope my noble friend feels able to withdraw his amendment.

--- Later in debate ---

[Lord Clement-Jones (LD)]

We are in the thickets here at the interface between technology, techno-speak and legality. Picking our way through Clause 162 is going to be rather important.

There are two schools of thought. The first is that we can amend this clause in fairly radical ways—and I support many of the amendments proposed by the noble Lord, Lord Stevenson. Of course, I am speaking to Amendment 170E as well, which tries to simplify the language and make it much more straightforward in terms of retroactive approval for actions taken in this respect, and I very much hope that parliamentary draftsmen will approve of our efforts to simplify the language. However, another more drastic school of thought is represented by many researchers—and the noble Lord, Lord Stevenson, has put the case very well that they have put to us, that the cause of security research will be considerably hampered. But it is not just the research community that is concerned, although it is extremely concerned by the lack of definition, the sanctions and the restrictions that the provisions appear to place on their activities. Business is also concerned, as numerous industry practices might be considered illegal and a criminal offence, including browser fingerprinting, data linkage in medicine, what they call device reconciliation or offline purchases tracking. So there is a lot of uncertainty for business as well as for the academic research community.

This is where we get into the techno-language. We are advised that modern, privacy-enhancing technologies such as differential privacy, homomorphic encryption—I am sure that the Minister is highly familiar with that—and question and answer systems are being used and further developed. There is nothing worse than putting a chill on the kind of research that we want to see by not acknowledging that there is the technology to make sure that we can do what we need to do and can keep our consumers safe in the circumstances. The fact is that quite often anonymisation, as we are advised, can never be complete. It is only by using this new technology that we can do that. I very much hope that the Minister is taking the very best legal and technology advice in the drafting and purposes of this clause. I am sure that he is fully aware that there is a great deal of concern about it.

[Baroness Neville-Rolfe]

I rise to support the noble Lords, Lord Stevenson and Lord Clement-Jones, and some of the amendments in this group on this, the final day in Committee. I congratulate my noble friends Lord Ashton and Lady Chisholm of Owlpen as well as the indefatigable Bill team for taking this gargantuan Bill through so rapidly.

The problem caused by criminalising re-identification was brought to my attention by one of our most distinguished universities and research bodies, Imperial College London. I thought that this was a research issue, which troubled me but which I thought might be easy to deal with. However, talking to the professor in the computational privacy group today, I found, as the noble Lord, Lord Clement-Jones, said, that it goes wider and could cause problems for companies as well. That leads me to think that I should probably draw attention to my relevant interests in the House of Lords register of interests.

The computational privacy group explained that the curious addition of Clause 162—which is different in character and language from other parts of the Bill, as the noble Lord, Lord Stevenson, said—draws on Australian experience, but risks halving the work of the privacy group, which is an academic body, and possibly creating costs and problems for other organisations and companies. I am not yet convinced that we should proceed with this clause at all, for two reasons. First, it will not address the real risk of unethical practice by people outside the UK. As the provision is not in the GDPR or equivalent frameworks in most other countries, only UK and Australian bodies or companies will be affected, which could lead to the migration of research teams and data entrepreneurs to Harvard, Paris and other sunny and sultry climes. Secondly, because it will become criminal in the UK to re-identify de-identified data—it is like saying “seashells on the seashore”—the clause could perversely increase the risk of data being re-identified and misused. It will limit the ability of researchers to show up the vulnerability of published datasets, which will make life easier for hackers and fraudsters—another perversity. For that reason, it may be wise to recognise the scope and value of modern privacy-enhancing technologies in ensuring the anonymous use of data somewhere in the Bill, which could perhaps be looked at.

I acknowledge that there are defences in Clause 162 —so, if a person faces prosecution, they have a defence. However, in my experience, responsible organisations do not much like to rely on defences when they are criminal prohibitions, as they can be open to dispute. I am also grateful to the noble Lord, Lord Stevenson— I am so sorry about his voice, although it seems to be getting a bit better—for proposing an exemption in cases where re-identification relates to demonstrating how personal data can be re-identified or is vulnerable to attack. However, I am not sure that the clause and its wider ramifications have been thought through. I am a strong supporter of regulation to deal with proven harm, especially in the data and digital area, where we are still learning about the externalities. But it needs to be reasonable, balanced, costed, careful and thought through—and time needs to be taken for that purpose.

I very much hope that my noble friend the Minister can find a way through these problems but, if that is not possible, I believe that the Government should consider withdrawing the clause.

[Lord Lucas (Con)]

I very much support what my noble friend has just said. The noble Lord, Lord Stevenson, has tried to give an exemption for researchers, but a lot of these things will happen in the course of other research. You are not spending your time solely trying to break some system; you are trying to understand what you can get from it, and suddenly you see someone you know, or you can see a single person there. It is something that you can discover as a result of using the data; you can get to the point where you understand that this is a single person, and you could find out more about them if you wanted to. If it is a criminal offence, of course, you will then tell nobody, which rather defeats the point. You ought to be going back to the data controller and saying that it is not quite right.

There are enormous uses in learning how to make a city work better by following people around with mobile phone data, for instance, but how do you anonymise it? Given greater computational power and more datasets becoming available, what can you show and use which does not have the danger of identifying people? This is ongoing technology—there will be new ways of breaking it and of maintaining privacy, and we have to have that as an active area of research and conversation. To my mind, this clause as it presently is just gets in the way.

--- Later in debate ---

Debate on whether Clause 162 should stand part of the Bill.

[Baroness Neville-Rolfe]

My Lords, I simply wish to associate myself with the comments of the noble Lord, Lord Stevenson, and say that a meeting on this would be helpful. As I said, I hope that we can find a solution. If we cannot, I have reservations about this measure being part of the Bill.

[Lord Ashton of Hyde]

I make it plain to my noble friend—my predecessor in this position—that I will arrange a meeting.

Data Protection Bill [HL]

Baroness Neville-Rolfe Excerpts

Monday 30th October 2017 Lords Chamber

Moved by

[Baroness Neville-Rolfe]

7: Clause 3, page 3, line 32, at end insert—
“(4) This Act does not apply to any organisation employing five employees or fewer.(5) Organisations covered by subsection (4) include, but are not limited to—(a) small businesses,(b) charities,(c) parish councils.”

[Baroness Neville-Rolfe (Con)]

My Lords, in moving Amendment 7 I shall speak also to Amendments 152 and 169, which have been grouped together. They all stand in my name and that of my noble friend Lord Arbuthnot of Edrom, who spoke so eloquently at Second Reading.

Amendment 7 explores an exemption for small organisations in the business and charity sectors and for parish councils, all of whom have expressed concerns to me about the burdens of the Bill. At Second Reading, I, like others, supported the Bill because it brings us up to date for the digital age, encourages good data practice to minimise scams and cyberattacks, and prevents abuse. It gets us up to the standards we need to get a good deal on data protection in the Brexit talks, and it provides citizens with easier access to their data. However, as presently drafted, I fear it imposes disproportionate burdens, especially on small businesses, charities and other small organisations. Luckily we have my noble friend Lord Ashton to guide us through this part of the Bill, and I congratulate him on his response to the first group of amendments today.

I come to this matter because sometimes I feel like a voice in the wilderness, fighting over-regulation and complexity. Our recent record on productivity is bad, partly because of poorly constructed and complex regulation and, in some cases, overbearing regulators. I would add that the fashion for intervention on all sides of the House could actually make things worse.

Instead of questioning regulation as we used to do, the Government are now seeking to match every EU rule as part of the Brexit project. Detailed consideration of how to ameliorate the impact on small businesses and charities, for example, seems to have gone out of the window and conversations on how to improve things once Brexit has given us greater freedom are regrettably not encouraged. In short, economics gets less attention in this House than it ought to. Those of us who have worked in business and the charitable sector know that well-meaning measures can adversely affect business by reducing competitiveness and growth, and indeed the tax take we need to build schools and pay for welfare. We are regulating more and not thinking about how we can do less. I was struck by what the noble Lord, Lord McNally, said earlier about the good but light touch that he sought in Brussels when he was dealing with data protection legislation.

Research by the Federation of Small Businesses shows that data protection regulation is one of the most salient regulations for 59% of small businesses. The federation provided me with some estimates which suggest that small businesses in the ICT sector alone, representing 6% of the business sector according to the ONS, will spend £700 million in man hours on implementing the new requirements—and that is not allowing for the cost of materials and ongoing compliance. Nor does it allow for the opportunity cost, another economic concept that is widely ignored in government. What we sorely need is a proper impact assessment, not the one provided so far, which does not address the cost to business and, oddly, suggests that there is no need to consult the Regulatory Policy Committee. If it is not needed for this sort of burden, I am not sure what it is needed for.

This House rightly always supports proper costing, as I know from some of the Bills I have been involved in. Before the Committee stage ends, we need to know the updated cost impact for business of what is coming in: first, under the GDPR, which will take direct effect and, as I understand it, continue after Brexit under the terms of the withdrawal Bill; and secondly, under what is planned in this Bill through the regulations to be made using its powers. I hope the Minister can help us with that.

It is against this background that Amendment 7 proposes an exemption from the Bill’s provisions—not, of course, from the GDPR, which has direct effect. Inevitably, the amendment is exploratory in nature. However, I trust that it will give the Minister, DCMS and the Information Commissioner the opportunity to think carefully about what we might do to reduce the burden on small businesses, charities and parish councils, which the National Association of Local Councils says are very concerned about the panoply of new rules. I cannot believe that we would see these in Greece.

The argument I have heard from the Government is that the changes are good for these organisations because they are under-compliant at present: they would deter the cyberattacks and data leaks that can harm them. I accept that responsible bodies know that good data practices are business critical, but what they do not need is the full panoply of controls, fees and penalties being introduced by this Bill. There is a risk of fines for breaches of up €20 million or 4% of worldwide turnover. My fear is that the controls are so burdensome, open-ended and threatening that at the margin, businesses will either give up or be deterred from operating overseas—at a time when we need them to export more. We need to find a way of bringing in de minimis rules and reducing the powers of the commissioner to what is reasonable. Another look at the compensation provisions with an eye to small operators could also be useful. I note that the Delegated Powers and Regulatory Reform Committee shares some of my concerns about the powers being given to the commissioner, as well as the extraordinarily wide powers being delegated to Ministers, which we will discuss later.

One practical countermeasure would be to introduce a greater emphasis in the Bill on the economic and other consequences of the commissioner’s work and to make this transparent, so that it can be considered properly by all those affected and publicly debated before she takes measures in relation to the protection of individuals’ rights and the processing of personal data.

That is the purpose of Amendment 152, which adds a third duty after subsection (1)(b). Perhaps I may give an example of why this is of practical importance. I spoke to representatives from CACI, a leading firm in mapping and data analytics, which is the sort of business we want to encourage if we are to be world-leading here in the UK. They are concerned about the technical aspects of ICO draft statutory guidance on consent. The fear is that the ICO may be adopting a needlessly restrictive interpretation of the GDPR which will benefit the large social media multinationals at the expense of British operators in retail and marketing, as well as charities. This would threaten the way that they and others run their businesses. I urge Ministers to meet representatives of the business community most at risk, not just the trade associations, as soon as possible and before the ICO finalises its vital guidance.

I believe strongly that regulators with powers as wide as those of the Information Commissioner need to engage properly on the content of draft regulations and draft guidance, which is often equally important. They must be required and of course resourced to do so; otherwise—going back to my first point—the burdens and risks will be disproportionate.

--- Later in debate ---

[Lord Knight of Weymouth]

Certainly if the amendment were to have any legs in terms of using the number of employees as a parameter then that would have to be defined. However you chose to define the size of an organisation, you would need to explore how to work that out.

[Baroness Neville-Rolfe]

I chose five employees because it often denotes a small organisation or a small business. I can see that some of the businesses in that category might be fairly large. I would of course have no objection to adding an extra criterion, such as turnover, if there was a mood to write exemptions into the Bill. Other legislation has exemptions for smaller bodies. The overall objectives of the data protection legislation clearly have to be achieved but I am concerned that, in particular, some of the subsidiary provisions, such as fines and fees, which I mentioned, are demanding and worrying for smaller entities.

[Lord Knight of Weymouth]

I am grateful for the noble Baroness’s comments. Something certainly can be done to think more about turnover than the number of employees, otherwise there would be a big loophole, particularly around marketing and being able to set up a company to harvest data, for which the Act would not apply. It could then sell the data on. It would not need very many people at all to pursue that opportunity.

The other thing these amendments allow us to do is ask the Minister to enlighten us a little on his thinking about how the Information Commissioner’s role will develop. In particular, if it is to pursue the sorts of education activities set out in these amendments, how will it be resourced to do so? I know there are some career-limiting aspects for Ministers who promise resources from the Dispatch Box, but the more he can set out how that might work, the more welcome that would be.

--- Later in debate ---

[Lord Ashton of Hyde]

I agree with the noble Lord that, if nothing did arrive, it would not be good enough.

[Baroness Neville-Rolfe]

My Lords, I was slightly disappointed when all my amendments were grouped, but bringing them together has led to an extremely useful and productive debate. I am very grateful to noble Lords right across the Committee for their support. I am also grateful to the Minister for saying that he will let us have a compliance cost assessment, which I will read with the detail and vigour that it merits, and for some of the other points he made.

I am a little disappointed about how we achieve some de minimis relief for the smaller organisations in these various sectors, including the ones mentioned by the noble Lord, Lord Kennedy, as well as on guidance—I am not sure we are quite there. We need to think a little further. I gave the Minister an example of the difficulties that the data analytics sector had had on consent. It would be good if he could look at that point and perhaps arrange for a meeting so that we could talk further. I will look in Hansard at the progress we have made in this very constructive discussion and possibly come back on Report on one or two points. I beg leave to withdraw the amendment.

Amendment 7 withdrawn.