Data Protection and Digital Information Bill

Lord Allan of Hallam Excerpts

2nd reading
Tuesday 19th December 2023 Lords Chamber

[Lord Allan of Hallam (LD)]

My Lords, even less than the noble Lord, Lord Knight, can I claim that this is my primary brief, so I want to make a short Back-Bench contribution to the subject, bringing some of my experience from former interests. I declare that I do not have any current financial interests but, if you look at my register entry, you will see that I spent a long time working for a company that was so much at the heart of the data protection debate that the 2016 EU regulation was nicknamed in Brussels “Lex Facebook”.

I do not want speak to the details of the provisions in front of us, and I look forward to hearing some of the arguments, particularly from the noble Baroness, Lady Kidron, with whom I worked closely in the context of the Online Safety Act; I think she has some really important points to raise on what is in the Bill. I also look forward to the maiden speech of the noble Lord, Lord de Clifford.

The one thing I really want to spend a short amount of time on today is to flag a concern that I will not attempt to resolve: I would rather leave that to my noble friend Lord Clement-Jones and others who will to be in Committee on the Bill. It is the concern around EU adequacy that I think should really be front and centre of our discussions when we consider this legislation. As I say, I do not intend to be active in later stages of the Bill—unless we fix the NHS between now and Committee, which would be a blessing for more reasons other than enabling me to take part in consideration of data protection legislation.

The flag that I am raising will be in something of a Cassandra-like tone. It is something I think is very likely to happen, but I am not expecting the Government to believe me and necessarily change direction. I have been intimately involved in these discussions over many years. If people have been following this, they will know that the EU had an adequacy agreement with the United States that had full political support within the EU institutions but has successively been struck down in a series of actions in the European Court of Justice. All the politicians wanted data to flow freely between the United States and the EU, but the law has not allowed that to happen. So the alarm bells ring. The noble Lord, Lord Knight of Weymouth, said he thought the Commission had doubts; that worries me even more. Even where the Commission is saying that it is comfortable with the adequacy of the UK regime, the alarm bells still ring for me because it said that repeatedly over the US data transfers and it turned out not to be the case.

There are three main areas where we can predict that the risk will occur. The first is where the core legal regime for data protection in the UK is deemed to be too weak to protect the interests of EU data subjects. The second is where there are aspects of the UK legal regime for security-related surveillance that are seen as creating unacceptable risk if EU data is in the hands of UK entities. The third is where redress mechanisms for EU data subjects, especially in relation to surveillance, are regarded as inaccessible or ineffective. These are all the areas that have been tested thoroughly in the context of the United States, and any or all of them may end up being tested also in the European Court of Justice for the United Kingdom if EU citizens complain in future about the processing of their data in the UK. The first angle will test the complete package of data protection set out in the many pages of this Bill. The second will consider our surveillance practices, including new developments such as the Investigatory Powers (Amendment) Bill, which is before us right now. Any future changes to UK surveillance law, for example, following a terrorist outrage, may end up being tested and queried before the European Court of Justice.

Regarding redress, our relationship with the European Court of Human Rights is critical. Any suggestion that we start to ignore ECHR judgments, even in another area such as immigration policy, may be used to argue that EU citizens cannot rely on their Article 8 right to privacy in the United Kingdom. My advice to the Minister is to properly test all these angles internally on the assumption that we will be arguing them out at the European Court of Justice in the future. This is difficult. I know that the UK authorities, like the US authorities, will not be comfortable sharing details of their surveillance regime in a European court, but that is what will be required to prove we are adequately safe if a complaint in respect of UK surveillance is made. It is really important that we hear the strongest lines of attack, and that we invite privacy activists, in particular, to offer them: the Government should invite in the kinds of people who will be taking those court cases so they can hear their strongest lines of attack now and test all our legislation against them. We certainly should not rely on assurances from the European Commission; I hope the Minister can give us more than that in his response. The key dynamic from the transatlantic experience is that this is between EU privacy activists and the European courts, rather than being something the Commission entirely controls.

The consequences of the loss of EU adequacy, or even significant uncertainty that this is on the horizon, will be that UK businesses that work on a cross-channel basis will be advised by their lawyers to move their data processing capability into the EU. They would feel confident serving the UK from the EU, but not the other way around. This is precisely what has happened in the context of transatlantic data flows and will hardly make Britain the best place in the world to do e-business. I hope the Minister will confirm that it would be a very undesirable outcome, to use parliamentary language, and that we will be taking one step forward but two steps back if that is a consequence of this Bill.

Having planted that flag, it is regrettable I will be unable to help noble Lords as they try and thread the needle of getting the legislation right. I have every sympathy for those seeking to do that; I have less and less sympathy for the Government, because they chose to bring the legislation forward, unlike other important legislation like the mental capacity Bill, which was left off the agenda, as I keep reminding the Government. I hope noble Lords will keep this Cassandra-like warning current in their minds as they consider the Bill; I do not want to be standing here in five years’ time saying, “I told you so” and I do not think noble Lords want me here in five years’ time saying that either. With that in your Lordships’ ears, I hope the Minister and Members who are scrutinising the Bill can really dig into this adequacy point and not hold back, because it is a genuine, serious threat to all kinds of businesses in the United Kingdom, not just digital ones.