Data Protection Bill [HL]

Baroness Williams of Trafford Excerpts

Monday 14th May 2018 Lords Chamber

29: Clause 51, page 31, line 2, leave out from first “the” to end of line 3 and insert “restriction imposed by the controller was lawful;”

[The Minister of State, Home Office (Baroness Williams of Trafford) (Con)]

My Lords, Amendments 29 and 30 relate to Clause 51, which enables data subjects to exercise certain rights through the Information Commissioner. Under Part 3, where a person makes a subject access request, it may be necessary for the police or another competent authority to give a “neither confirm nor deny” response; for example, to avoid tipping off that person that they are under investigation for a criminal offence.

Under the Bill as passed by this House, a data subject could exercise their rights under Clause 51 to request that the Commissioner check that the processing of their personal data complied with the provisions in Part 3. Such a request would clearly undermine a “neither confirm nor deny” response, effectively providing a back door for data subjects to find out if personal data was being held on them. To address this, the amendments replace the requirement on the Information Commissioner to check that processing complies with Part 3 with a requirement to check that a restriction imposed by the controller is lawful.

Commons Amendments 31 and 32 relate to Clause 53, which enables a controller when in receipt of a manifestly unfounded or excessive subject access request either to charge a reasonable fee before responding to the request or refuse to act on the request. The amendments extend this latitude afforded to a controller to cover requests made by a data subject under Clause 50, which requires a controller to reconsider a decision based solely on automated processing. Although the vast majority of subject access requests made by data subjects are reasonable, the amendments are necessary to ensure that controllers have a robust mechanism in place to deal with any repeated or malicious requests that they receive. I beg to move.

Motion on Amendment 29 agreed.

--- Later in debate ---

Moved by

[Baroness Williams of Trafford]

That this House do agree with the Commons in their Amendment 174.

174: Schedule 2, page 137, line 4, leave out from “(vi)” to end of line 9

[Baroness Williams of Trafford]

My Lords, these amendments relate to the immigration exemption in paragraph 4 of Schedule 2, which was debated at some length during the passage of the Bill through this House. It may assist the House if I briefly restate the case for this provision.

The Bill and the GDPR extend and strengthen the rights of individuals, giving them easier access to their data and greater control over its use and processing. This is something we can all welcome. However, it is necessary to balance such enhanced rights of data subjects with other competing interests. The Bill therefore provides mechanisms to ensure that data rights cannot undermine investigations by law enforcement agencies, regulators and others. For the same reasons, the Bill makes provision to protect the integrity of the immigration system; for example, to prevent the release of information which would undermine imminent enforcement action.

As I have previously explained, the immigration provision is limited in nature. It does not allow the Home Office—or, indeed, any other controller—to set aside all the safeguards in the Bill; rather, it allows a number of specific rights to be restricted on a case-by-case basis and only to the extent to which giving effect to those rights would be likely to prejudice the maintenance of effective immigration control in an individual case. Decisions will also be subject to oversight by the Information Commissioner and, ultimately, the Information Tribunal.

On Report noble Lords supported the retention of the exemption by a majority of 130. Last week the House of Commons similarly supported the inclusion of the exemption in the Bill by a clear majority of 28. None the less, it is of course right that the exemption should be as tightly drafted as possible. The Government firmly believe that unless there is a compelling reason to the contrary, data processing should always be fair and transparent and it should not be possible to collect data for one purpose and then to retrospectively apply a policy of processing for further, incompatible purposes. It was always the Government’s intention that processing for immigration purposes should have to meet both these principles. But, on reflection, we agree that the provisions in paragraph 4 of Schedule 2 left room for doubt as to the intended approach. Therefore, Commons Amendments 174 and 175 further narrow the exemption to put the matter beyond doubt.

We are also committed to reviewing the operation of the exemption in the light of experience 12 months after these provisions come into force. To inform the review we would naturally welcome the views of interested parties, such as the Immigration Law Practitioners’ Association. Clause 16 would enable us to narrow the scope of the exemption still further should the review conclude that it would be appropriate to do so.

I look forward to hearing what the noble Baroness, Lady Hamwee, has to say about her Amendment 175A, but for now I beg to move.

Amendment 175A (as an amendment to Amendment 175)

Tabled by

--- Later in debate ---

The Minister has told us that the operation of the paragraph will be reviewed after a year and she has mentioned the Immigration Law Practitioners’ Association. I am grateful because I think it is those who have to apply a provision or are on the wrong end of its application whose experience will be important. Having made my requests for assurances, I do not intend to press my amendment but I will be grateful for assistance from the Minister in responding to these very real concerns. They are not ones that I composed: they are a compilation of points that I was given by practitioners this morning.

[Baroness Williams of Trafford]

I thank the noble Baroness for setting out the rationale for Amendment 175A. I wholeheartedly endorse the sentiment behind it— namely, that the data protection principles must underpin the processing of personal data held by the Home Office for immigration purposes. I also unreservedly support the notion that the Home Office needs to abide by the highest standards required by the GDPR and the Bill and to ensure that its staff are properly equipped, including through the appropriate training and guidance, to ensure that the department collectively fulfils its statutory responsibilities when it comes to processing people’s personal data. We want our staff to recognise that new data rights should be seen as an opportunity to improve how we collect, process and use other people’s data and respond to customers’ requests.

I am grateful to the noble Baroness for giving me foresight of her specific questions. The first concerned the exemption not being used in a blanket way to deny all requests for files concerning immigration held by the Home Office. This will be the case regardless of the believed immigration status of the client. We have been clear, and guidance will be clear, that the exemption can be used only on an individual basis and on a right-by-right basis—that is, a controller can exclude only those rights that would cause the prejudice test to be satisfied. Further, we will withhold only the information that could be likely to cause the prejudice. All other data is currently—and will carry on being—released.

The noble Baroness’s second question concerned the exemption not being routinely applied or applied without meaningful individual assessment in circumstances where the Home Office seeks to acquire data collected by essential public services from other government departments, such as the Department for Education. Where a right is to be restricted, there has to be evidence which a data controller can identify that has satisfied the likely-to-prejudice effective immigration control test and the test that it is still a live concern. That is irrespective of where or from whom the data was gathered.

The noble Baroness’s third question concerned the exemption not being routinely applied or applied without meaningful individual assessment in circumstances where a person or their legal representative is requesting data held by the Home Office so that they can regularise their immigration status or progress an immigration claim. We have been clear—and our guidance will be clear—that a right can be restricted only where there is a risk to the maintenance of effective immigration control. If a person is seeking to regularise their status, it is incumbent upon us to facilitate their efforts, and we strive to do so.

The noble Baroness’s next question was about the exemption being applied solely by the Home Office and not by government contractors carrying out immigration control functions. The exemption may be used and applied by those who work with us. However, the same checks and balances would be applicable in all instances.

The noble Baroness also asked for the exemption to be used only in cases where the Government have a clear and specific reason to believe that the release of data would undermine immigration control in relation to that specific person. That is correct—and it is what paragraph 4 of Schedule 2 provides for.

The next question the noble Baroness asked was about undermining immigration control not including an individual accessing data that may show why they may have reason to be allowed to stay in the UK. We have been clear that, where a person is seeking to regularise their status or appeal a decision, we will disclose all the data we hold to assist them in that and always give the full basis of why a decision has been made to facilitate any appeal.

The noble Baroness rightly asked, for the above reasons, whether it would be used only in a very small number of cases. The answer is yes. We anticipate that it will be a minority of cases and it is a rebuttable assumption that all rights apply to all data subjects.

The noble Baroness’s final question was about the exemption not being applied to British citizens or migrants who are lawfully resident in the UK. The exemption is not designed to apply to those here lawfully. It could, however, be used if a lawful UK resident was involved in an attempt to cause prejudice to the maintenance of effective immigration control—for example, by sponsoring someone in the knowledge that they did not qualify to be here.

I hope that I have answered in full the noble Baroness’s questions. I thank her again for providing me with sight of her questions.

Motion agreed.