Data Protection Bill [HL]

Baroness Neville-Rolfe Excerpts

Committee: 6th sitting (Hansard): House of Lords
Wednesday 22nd November 2017 Lords Chamber

[Lord Griffiths of Burry Port (Lab)]

My Lords, I thank the noble Lord for his eloquent disquisition, which made me much more aware of the issues than I was before. I have no problem in aligning myself with the two points of view that have just been expressed. I had come to the conclusion partly myself, but to be told that the wording is not in the equivalent article in the European GDPR just adds to my simple conclusion that the words “other adverse effects” add precisely nothing but open a potential cave of dark possibilities. The rain of the noble Lord’s eloquence has found a crack in my roof, and I am very happy to align myself with his remarks.

[Baroness Neville-Rolfe (Con)]

I also share the concerns expressed by my noble friend Lord Hunt, based on my experience, both in government and in a number of different businesses. We have the experience not only of the motor sector, which has been talked about, but obviously of PPI, where there was compensation that needed to be paid, but the whole business took years and generated not only claims management companies but also nuisance calls and lots of other harms. This is an area that one has to be very careful about, and I support looking at the drafting carefully to see what can be done, and at my noble friend’s idea of trying to estimate the economic impact—the costs—in terms of those affected. That would help one to come to a sensible conclusion on what is appropriate in this important Bill.

[Baroness Chisholm of Owlpen (Con)]

My Lords, I thank my noble friend Lord Hunt for explaining Amendment 170A and other noble Lords who have spoken. The amendment seeks to clarify the definition of “damage” provided by Clause 159 and its relationship to the language used in article 82 of the GDPR. This is important because article 82 of the GDPR provides a right to compensation when a person has suffered damage as the result of an infringement of the rights during the processing of their personal data.

Currently, the type of damage that can be claimed is broader under article 82 than Section 13 of the 1998 Act, as article 82 expressly extends to “non-material” damage. As a result, in drafting the Bill, the Government considered that some definition of “damage” was necessary, including specifying that it extends to distress, to provide clarity and certainty for data subjects and others as to their rights under article 82.

I stress that Clause 159 does not seek to provide a wider definition of “damage” than is currently provided in the GDPR, and nor indeed could it. The intention is simply to clarify the GDPR’s meaning. My noble friend Lord Hunt asked what estimates have been made of the financial consequences of the increase in litigation, but as Clause 159 does not provide a wider definition of damage there will be no financial consequence.

The concept of “damage” included in the GDPR reflects developments in case law over a period of some years. As such, I cannot agree with my noble friend’s suggestion that the Bill or the GDPR will suddenly unleash a free-for-all of claims. However, I am happy to reflect on my noble friend’s point that the Bill’s use of the term “other adverse effects” may unintentionally provide uncertainty rather than clarity. With the reassurance that I will go away and look at that, I hope my noble friend feels able to withdraw his amendment.

--- Later in debate ---

[Lord Clement-Jones (LD)]

We are in the thickets here at the interface between technology, techno-speak and legality. Picking our way through Clause 162 is going to be rather important.

There are two schools of thought. The first is that we can amend this clause in fairly radical ways—and I support many of the amendments proposed by the noble Lord, Lord Stevenson. Of course, I am speaking to Amendment 170E as well, which tries to simplify the language and make it much more straightforward in terms of retroactive approval for actions taken in this respect, and I very much hope that parliamentary draftsmen will approve of our efforts to simplify the language. However, another more drastic school of thought is represented by many researchers—and the noble Lord, Lord Stevenson, has put the case very well that they have put to us, that the cause of security research will be considerably hampered. But it is not just the research community that is concerned, although it is extremely concerned by the lack of definition, the sanctions and the restrictions that the provisions appear to place on their activities. Business is also concerned, as numerous industry practices might be considered illegal and a criminal offence, including browser fingerprinting, data linkage in medicine, what they call device reconciliation or offline purchases tracking. So there is a lot of uncertainty for business as well as for the academic research community.

This is where we get into the techno-language. We are advised that modern, privacy-enhancing technologies such as differential privacy, homomorphic encryption—I am sure that the Minister is highly familiar with that—and question and answer systems are being used and further developed. There is nothing worse than putting a chill on the kind of research that we want to see by not acknowledging that there is the technology to make sure that we can do what we need to do and can keep our consumers safe in the circumstances. The fact is that quite often anonymisation, as we are advised, can never be complete. It is only by using this new technology that we can do that. I very much hope that the Minister is taking the very best legal and technology advice in the drafting and purposes of this clause. I am sure that he is fully aware that there is a great deal of concern about it.

[Baroness Neville-Rolfe]

I rise to support the noble Lords, Lord Stevenson and Lord Clement-Jones, and some of the amendments in this group on this, the final day in Committee. I congratulate my noble friends Lord Ashton and Lady Chisholm of Owlpen as well as the indefatigable Bill team for taking this gargantuan Bill through so rapidly.

The problem caused by criminalising re-identification was brought to my attention by one of our most distinguished universities and research bodies, Imperial College London. I thought that this was a research issue, which troubled me but which I thought might be easy to deal with. However, talking to the professor in the computational privacy group today, I found, as the noble Lord, Lord Clement-Jones, said, that it goes wider and could cause problems for companies as well. That leads me to think that I should probably draw attention to my relevant interests in the House of Lords register of interests.

The computational privacy group explained that the curious addition of Clause 162—which is different in character and language from other parts of the Bill, as the noble Lord, Lord Stevenson, said—draws on Australian experience, but risks halving the work of the privacy group, which is an academic body, and possibly creating costs and problems for other organisations and companies. I am not yet convinced that we should proceed with this clause at all, for two reasons. First, it will not address the real risk of unethical practice by people outside the UK. As the provision is not in the GDPR or equivalent frameworks in most other countries, only UK and Australian bodies or companies will be affected, which could lead to the migration of research teams and data entrepreneurs to Harvard, Paris and other sunny and sultry climes. Secondly, because it will become criminal in the UK to re-identify de-identified data—it is like saying “seashells on the seashore”—the clause could perversely increase the risk of data being re-identified and misused. It will limit the ability of researchers to show up the vulnerability of published datasets, which will make life easier for hackers and fraudsters—another perversity. For that reason, it may be wise to recognise the scope and value of modern privacy-enhancing technologies in ensuring the anonymous use of data somewhere in the Bill, which could perhaps be looked at.

I acknowledge that there are defences in Clause 162 —so, if a person faces prosecution, they have a defence. However, in my experience, responsible organisations do not much like to rely on defences when they are criminal prohibitions, as they can be open to dispute. I am also grateful to the noble Lord, Lord Stevenson— I am so sorry about his voice, although it seems to be getting a bit better—for proposing an exemption in cases where re-identification relates to demonstrating how personal data can be re-identified or is vulnerable to attack. However, I am not sure that the clause and its wider ramifications have been thought through. I am a strong supporter of regulation to deal with proven harm, especially in the data and digital area, where we are still learning about the externalities. But it needs to be reasonable, balanced, costed, careful and thought through—and time needs to be taken for that purpose.

I very much hope that my noble friend the Minister can find a way through these problems but, if that is not possible, I believe that the Government should consider withdrawing the clause.

[Lord Lucas (Con)]

I very much support what my noble friend has just said. The noble Lord, Lord Stevenson, has tried to give an exemption for researchers, but a lot of these things will happen in the course of other research. You are not spending your time solely trying to break some system; you are trying to understand what you can get from it, and suddenly you see someone you know, or you can see a single person there. It is something that you can discover as a result of using the data; you can get to the point where you understand that this is a single person, and you could find out more about them if you wanted to. If it is a criminal offence, of course, you will then tell nobody, which rather defeats the point. You ought to be going back to the data controller and saying that it is not quite right.

There are enormous uses in learning how to make a city work better by following people around with mobile phone data, for instance, but how do you anonymise it? Given greater computational power and more datasets becoming available, what can you show and use which does not have the danger of identifying people? This is ongoing technology—there will be new ways of breaking it and of maintaining privacy, and we have to have that as an active area of research and conversation. To my mind, this clause as it presently is just gets in the way.

--- Later in debate ---

Debate on whether Clause 162 should stand part of the Bill.

[Baroness Neville-Rolfe]

My Lords, I simply wish to associate myself with the comments of the noble Lord, Lord Stevenson, and say that a meeting on this would be helpful. As I said, I hope that we can find a solution. If we cannot, I have reservations about this measure being part of the Bill.

[Lord Ashton of Hyde]

I make it plain to my noble friend—my predecessor in this position—that I will arrange a meeting.

Data Protection Bill [HL]

Baroness Neville-Rolfe Excerpts

Monday 30th October 2017 Lords Chamber

Moved by

[Baroness Neville-Rolfe]

7: Clause 3, page 3, line 32, at end insert—
“(4) This Act does not apply to any organisation employing five employees or fewer.(5) Organisations covered by subsection (4) include, but are not limited to—(a) small businesses,(b) charities,(c) parish councils.”

[Baroness Neville-Rolfe (Con)]

My Lords, in moving Amendment 7 I shall speak also to Amendments 152 and 169, which have been grouped together. They all stand in my name and that of my noble friend Lord Arbuthnot of Edrom, who spoke so eloquently at Second Reading.

Amendment 7 explores an exemption for small organisations in the business and charity sectors and for parish councils, all of whom have expressed concerns to me about the burdens of the Bill. At Second Reading, I, like others, supported the Bill because it brings us up to date for the digital age, encourages good data practice to minimise scams and cyberattacks, and prevents abuse. It gets us up to the standards we need to get a good deal on data protection in the Brexit talks, and it provides citizens with easier access to their data. However, as presently drafted, I fear it imposes disproportionate burdens, especially on small businesses, charities and other small organisations. Luckily we have my noble friend Lord Ashton to guide us through this part of the Bill, and I congratulate him on his response to the first group of amendments today.

I come to this matter because sometimes I feel like a voice in the wilderness, fighting over-regulation and complexity. Our recent record on productivity is bad, partly because of poorly constructed and complex regulation and, in some cases, overbearing regulators. I would add that the fashion for intervention on all sides of the House could actually make things worse.

Instead of questioning regulation as we used to do, the Government are now seeking to match every EU rule as part of the Brexit project. Detailed consideration of how to ameliorate the impact on small businesses and charities, for example, seems to have gone out of the window and conversations on how to improve things once Brexit has given us greater freedom are regrettably not encouraged. In short, economics gets less attention in this House than it ought to. Those of us who have worked in business and the charitable sector know that well-meaning measures can adversely affect business by reducing competitiveness and growth, and indeed the tax take we need to build schools and pay for welfare. We are regulating more and not thinking about how we can do less. I was struck by what the noble Lord, Lord McNally, said earlier about the good but light touch that he sought in Brussels when he was dealing with data protection legislation.

Research by the Federation of Small Businesses shows that data protection regulation is one of the most salient regulations for 59% of small businesses. The federation provided me with some estimates which suggest that small businesses in the ICT sector alone, representing 6% of the business sector according to the ONS, will spend £700 million in man hours on implementing the new requirements—and that is not allowing for the cost of materials and ongoing compliance. Nor does it allow for the opportunity cost, another economic concept that is widely ignored in government. What we sorely need is a proper impact assessment, not the one provided so far, which does not address the cost to business and, oddly, suggests that there is no need to consult the Regulatory Policy Committee. If it is not needed for this sort of burden, I am not sure what it is needed for.

This House rightly always supports proper costing, as I know from some of the Bills I have been involved in. Before the Committee stage ends, we need to know the updated cost impact for business of what is coming in: first, under the GDPR, which will take direct effect and, as I understand it, continue after Brexit under the terms of the withdrawal Bill; and secondly, under what is planned in this Bill through the regulations to be made using its powers. I hope the Minister can help us with that.

It is against this background that Amendment 7 proposes an exemption from the Bill’s provisions—not, of course, from the GDPR, which has direct effect. Inevitably, the amendment is exploratory in nature. However, I trust that it will give the Minister, DCMS and the Information Commissioner the opportunity to think carefully about what we might do to reduce the burden on small businesses, charities and parish councils, which the National Association of Local Councils says are very concerned about the panoply of new rules. I cannot believe that we would see these in Greece.

The argument I have heard from the Government is that the changes are good for these organisations because they are under-compliant at present: they would deter the cyberattacks and data leaks that can harm them. I accept that responsible bodies know that good data practices are business critical, but what they do not need is the full panoply of controls, fees and penalties being introduced by this Bill. There is a risk of fines for breaches of up €20 million or 4% of worldwide turnover. My fear is that the controls are so burdensome, open-ended and threatening that at the margin, businesses will either give up or be deterred from operating overseas—at a time when we need them to export more. We need to find a way of bringing in de minimis rules and reducing the powers of the commissioner to what is reasonable. Another look at the compensation provisions with an eye to small operators could also be useful. I note that the Delegated Powers and Regulatory Reform Committee shares some of my concerns about the powers being given to the commissioner, as well as the extraordinarily wide powers being delegated to Ministers, which we will discuss later.

One practical countermeasure would be to introduce a greater emphasis in the Bill on the economic and other consequences of the commissioner’s work and to make this transparent, so that it can be considered properly by all those affected and publicly debated before she takes measures in relation to the protection of individuals’ rights and the processing of personal data.

That is the purpose of Amendment 152, which adds a third duty after subsection (1)(b). Perhaps I may give an example of why this is of practical importance. I spoke to representatives from CACI, a leading firm in mapping and data analytics, which is the sort of business we want to encourage if we are to be world-leading here in the UK. They are concerned about the technical aspects of ICO draft statutory guidance on consent. The fear is that the ICO may be adopting a needlessly restrictive interpretation of the GDPR which will benefit the large social media multinationals at the expense of British operators in retail and marketing, as well as charities. This would threaten the way that they and others run their businesses. I urge Ministers to meet representatives of the business community most at risk, not just the trade associations, as soon as possible and before the ICO finalises its vital guidance.

I believe strongly that regulators with powers as wide as those of the Information Commissioner need to engage properly on the content of draft regulations and draft guidance, which is often equally important. They must be required and of course resourced to do so; otherwise—going back to my first point—the burdens and risks will be disproportionate.

--- Later in debate ---

[Lord Knight of Weymouth]

Certainly if the amendment were to have any legs in terms of using the number of employees as a parameter then that would have to be defined. However you chose to define the size of an organisation, you would need to explore how to work that out.

[Baroness Neville-Rolfe]

I chose five employees because it often denotes a small organisation or a small business. I can see that some of the businesses in that category might be fairly large. I would of course have no objection to adding an extra criterion, such as turnover, if there was a mood to write exemptions into the Bill. Other legislation has exemptions for smaller bodies. The overall objectives of the data protection legislation clearly have to be achieved but I am concerned that, in particular, some of the subsidiary provisions, such as fines and fees, which I mentioned, are demanding and worrying for smaller entities.

[Lord Knight of Weymouth]

I am grateful for the noble Baroness’s comments. Something certainly can be done to think more about turnover than the number of employees, otherwise there would be a big loophole, particularly around marketing and being able to set up a company to harvest data, for which the Act would not apply. It could then sell the data on. It would not need very many people at all to pursue that opportunity.

The other thing these amendments allow us to do is ask the Minister to enlighten us a little on his thinking about how the Information Commissioner’s role will develop. In particular, if it is to pursue the sorts of education activities set out in these amendments, how will it be resourced to do so? I know there are some career-limiting aspects for Ministers who promise resources from the Dispatch Box, but the more he can set out how that might work, the more welcome that would be.

--- Later in debate ---

[Lord Ashton of Hyde]

I agree with the noble Lord that, if nothing did arrive, it would not be good enough.

[Baroness Neville-Rolfe]

My Lords, I was slightly disappointed when all my amendments were grouped, but bringing them together has led to an extremely useful and productive debate. I am very grateful to noble Lords right across the Committee for their support. I am also grateful to the Minister for saying that he will let us have a compliance cost assessment, which I will read with the detail and vigour that it merits, and for some of the other points he made.

I am a little disappointed about how we achieve some de minimis relief for the smaller organisations in these various sectors, including the ones mentioned by the noble Lord, Lord Kennedy, as well as on guidance—I am not sure we are quite there. We need to think a little further. I gave the Minister an example of the difficulties that the data analytics sector had had on consent. It would be good if he could look at that point and perhaps arrange for a meeting so that we could talk further. I will look in Hansard at the progress we have made in this very constructive discussion and possibly come back on Report on one or two points. I beg leave to withdraw the amendment.

Amendment 7 withdrawn.

Digital Understanding

Baroness Neville-Rolfe Excerpts

Thursday 7th September 2017 Lords Chamber

[Baroness Neville-Rolfe (Con)]

My Lords, like others, I congratulate the noble Baroness, Lady Lane-Fox. She has been a role model for us all. She has created a successful digital business; she helped the Government to get ahead on technology when we served together on the coalition’s Efficiency Board; and now she is beating the drum for digital skills, awareness and understanding.

I know that she feels that public policy on this matter has developed rather too slowly. I share that sentiment, but it is rarely in the nature of government to be quick. Nevertheless, as a nation we benefit from very strong technology and creative industries. So some things are going well, and we benefit from the support of groups such as techUK, which briefed us for this debate.

When I came to Parliament, I used to wax lyrical on the awfulness of internet and mobile coverage, as well as the problems of exclusion, described again today by the right reverend Prelate the Bishop of St Albans and my noble friend Lord Cathcart. This made me very unpopular with Ed Vaizey, who, to do him justice, worked hard to extend coverage with less help from industry than he deserved. Only last week he was on the “Today” programme, still cheering us up on this very subject. We made money available for digital infrastructure when I was at the Treasury, and it is clear to me that a combination of wi-fi and 4G and 5G mobile providing digital access right across the UK is essential to our success now that digital affects most—indeed, perhaps all—of our endeavours.

Today, I want to make two further points. First, the noble Baroness is right to worry about digital understanding, as well as about skills. I was cheered by the figures in the Library note showing that, according to Lloyds Bank, only 11.5 million people lack digital skills and, according to the ONS, only 9% have never used the internet. If you look back only 10 years, that is an extraordinary improvement and a tribute to free-market transformation. My noble friend Lord Baker will be glad to know that my granddaughter learned coding in her first year at primary school in Wandsworth.

However, as with everything in life, there are drawbacks to internet penetration. It poses a major challenge to government and society. There are worrying externalities to balance the wonderful convenience, pleasure and efficiency that digital brings. I am referring to scams, especially the millions of financial scams every week, with data and identities constantly at risk from cyberattacks. Which? has produced very good reports on this scourge. I am also referring to access to the compulsive dangers of gambling and drugs, and to bullying online, child abuse, pornography and Islamist extremism. There is also biased, unregulated and annoying advertising, putting the offline advertisers at a commercial disadvantage and undermining the print media. Close to my heart, there is also the theft of intellectual property, affecting books and other networks. In addition, there is fake news online and its huge impact on society, public sentiment and elections.

Finally, regarding Brexit, as the Minister responsible for the digital single market, I spent many hours with other member states, including Estonia, debating the right way forward—how to open up the opportunities for the flow of digital content, fintech, commerce and so on. In finishing, I should very much like to ask the Minister to share his thinking on the positives and negatives for our digital policy, the digital economy and digital understanding of a post-Brexit world, because equivalent challenges and opportunities will still exist post Brexit.