Data Protection Bill [HL]

Baroness Royall of Blaisdon Excerpts

Monday 30th October 2017 Lords Chamber

Moved by

[Baroness Royall of Blaisdon]

10: Clause 6, page 4, line 35, at end insert—
“( ) A college, school or university is not a public authority or public body for the purposes of the GDPR.”

[Baroness Royall of Blaisdon (Lab)]

My Lords, I rise to move Amendment 10 in my name and the names of the noble Lords, Lord Pannick and Lord Macdonald of River Glaven. In doing so, I declare my interest as principal of Somerville College, Oxford.

The GDPR, which will be brought into effect in domestic law by the Data Protection Bill, will have an impact on many aspects of university business from procurement to the commercialisation of research. Universities up and down the land are therefore now making preparations to ensure that they will comply with the new requirements. It is immensely complex, and throughout the Committee stage issues will be raised which are pertinent to universities.

With this amendment I am concerned about one aspect of the life of universities, colleges and schools which will be severely impacted by the GDPR. It is our ability to fundraise and to maintain alumni relations, hence our amendment, which is probing at this stage. I have only recently become aware of the huge importance of alumni relations and fundraising and of the fact that they are inextricably linked. As a consequence of financial constraints and government encouragement, universities, colleges and schools are having to raise more and more money to provide the education and the excellent facilities rightly expected by students.

As far as universities are concerned, with potentially reduced tuition fees, Brexit and, despite what the Government may say, a reduction in the number of foreign students, the need to raise money will increase. At Oxford, the system that I now know best, the excellent tutorial system demands even greater resources. I do not complain. However, with the introduction of the GDPR our alumni relations and fundraising ability will be severely limited unless we can find a way through, for example by stating that a college, school or university is not a public authority for the purposes of the GDPR. Naturally universities, including Oxbridge colleges, are concerned to ensure that personal data is processed lawfully in the course of contacting alumni for fundraising purposes, and we want to ensure that we work in the most cost-effective way. I should stress that none of the contacts made to our former students relates to cold calling. We are talking about alumni, people who spent three or more years as students, with whom we have therefore have a long-standing relationship. With regard to a college such as Somerville, our alumni feel they belong to a community and they want us to remain in close touch with them.

As the Minister, will be aware, under the GDPR, in order for the processing of personal data to be lawful at least one of the six conditions set out in article 6 of the GDPR must apply. The most important change to the lawfulness conditions by the GDPR concerns the consent condition. The GDPR sets a high standard for consent requiring a positive opt-in, and unless opt-in consent has been obtained, or is obtained in future, current and future contact with alumni will be limited. It is clear that existing consents are unlikely to meet the GDPR standard and as a result all fundraising and alumni databases might have to be rebuilt from scratch and/or a huge exercise undertaken to secure explicit consent from all our former students if the consent condition were to be relied on by colleges to justify their processing of alumni data. This is an enormous administrative task and hugely time-consuming. At Somerville, we are already grappling with the new consent standard, and it is both difficult and detrimental.

I understand that when the Council for Advancement and Support of Education—CASE—met DCMS and the Information Commissioner in May it was suggested that the legitimate interest condition could, in appropriate circumstances, be relied on by fundraisers. However, this condition does not apply to processing by public authorities. While the GDPR contains no definition of public authority, Clause 6(1) states:

“For the purposes of the GDPR, the following (and only the following) are ‘public authorities’ and ‘public bodies’ under the law of the United Kingdom—


a public authority as defined by the Freedom of Information Act 2000”.


The Freedom of Information Act 2000 contains in Schedule 1 a list of public authorities which includes, at paragraph 53,

“the governing body of … a university receiving financial support under section 65 of the Further and Higher Education Act 1992”,

and,

“any college, school, hall or other institution”,

of such a university. It is clear that universities, colleges and schools fall within this definition of public authority, which would mean that the legitimate interest condition could not be applied and they would have to rely on either the public interest condition or the consent condition.

I know that the Bill team recently had a meeting with UUK at which this issue was discussed. Oxford University was not present, but this was not due to lack of interest or concern; it was agreed that Cambridge should represent the interests of Oxbridge as a whole. At this meeting, the Bill team was apparently clear that it had put exemptions in the Bill to protect the position of universities. I am glad that there is no policy dispute, but I have to say that my noble friends and I have been unable to identify the exemptions.

The Minister may say that it is a matter that will be dealt with by guidance, but I regret that in my view guidance will not suffice. This is a matter of huge importance to universities as well as to colleges and schools, and there needs to be clarity in the Bill. I look forward to the Minister’s response. If, as I suspect, we do not reach agreement today, I would be grateful if the Minister’s office could arrange a meeting with interested Peers so that we might discuss this further. I beg to move.

[Lord Pannick (CB)]

My Lords, I declare an interest as a fellow of All Souls College, Oxford. Although All Souls has no students and therefore no alumni, it has former fellows. I endorse everything that was very eloquently said by the noble Baroness. There is a problem here. It needs to be addressed. My understanding is that the Government are sympathetic to the mischief which the noble Baroness has identified. For the reasons she has explained, the mischief is not remedied by the terms of the Bill and I very much hope that the Government will be able to indicate today that they are sympathetic and are willing to meet the noble Baroness, Lady Royall, and others to find a way in which these concerns can be addressed as they ought to be.

--- Later in debate ---

[Baroness Chisholm of Owlpen]

The guidance from the Information Commissioner’s Office is ongoing. I had better go and find out whether we will have it by the time this Bill becomes law, because I do not want to say something at the Dispatch Box that turns out to be wrong. I will have to get back to the noble Lord on that point.

[Baroness Royall of Blaisdon]

My Lords, I am grateful to the Minister for her semi-positive answer. I have to say that if the guidance were available before the Bill became law, that would be quite extraordinary because it is not the norm, but it would be very welcome. I am grateful for her sympathy and understanding, and I realise that there has been a meeting between the university sector and the Information Commissioner’s Office, but personally I still feel the guidance is not enough. I am therefore grateful for the offer of a meeting to discuss this further. I thank everyone who has participated in this short debate. I particularly thank my noble friend Lady Kennedy of The Shaws for quite rightly pointing out that this is a matter of importance for schools, universities and colleges up and down the land, not just the “elite”, as it were—everyone is going to suffer.

With the reassurance from the Minister that we can have a meeting to discuss this further, I beg leave to withdraw the amendment.

Amendment 10 withdrawn.