Data Protection Bill [HL]

Debate between Lord Ashton of Hyde and Lord Brown of Eaton-under-Heywood

3rd reading (Hansard): House of Lords & Report: 2nd sitting (Hansard): House of Lords
Wednesday 17th January 2018 Lords Chamber

[Lord Ashton of Hyde]

My Lords, I turn now to an issue that is pertinent to us all: parliamentary privilege. I am sure that noble Lords will agree that it is paramount that both this House and the other place continue to be safeguarded in their processing of personal data in connection with parliamentary proceedings.

This issue was raised in previous debates by the noble and learned Lord, Lord Brown of Eaton-under-Heywood, to whom I am very grateful. Those debates influenced our thinking on how the Bill currently provides for parliamentary activity, and I am pleased to announce that the amendments in this group have been tabled to ensure that privileges under the current law will not disappear when we enter the new data protection framework.

I will start with Amendments 5 to 8. Amendments 5 to 7 restrict information, assessment and enforcement notices served by the commissioner from requiring a person to comply with the notice if compliance would involve infringing the privileges of either House of Parliament. Put simply, the commissioner’s notices are “switched off” where there would be an infringement of parliamentary privilege. Amendment 8 prevents the commissioner giving the House a penalty notice with respect to the processing of personal data by or on behalf of the House. These amendments have been tabled to ensure that parliamentary proceedings will not be impeded by the commissioner and that Parliament will maintain the freedom to do its work that it currently enjoys.

Amendments 9 to 13 relate to criminal liability and seek to prevent corporate officers of either House of Parliament being liable to prosecution as a data controller. This is the current position in the Data Protection Act 1998, and our amendments seek to clarify the Government’s intention to maintain the effect of Section 63A of the 1998 Act. The amendments also make equivalent provision for government departments and data controllers for the Royal Household. It should be noted, however, that these provisions do not prevent corporate officers being liable for their own conduct when acting as data controllers on behalf of either House, for government departments or for the Royal Household. This maintains the current position, and we believe that it is an important safeguard that allows full parliamentary privilege while balancing the rights of data subjects.

Amendments 14 and 15 revert to the current position under the Data Protection Act 1998 in relation to the processing that is necessary for the functions of the Houses of Parliament or for the administration of justice by removing the additional “substantial public interest” test. On reflection, we could not see how such processing would not be in the substantial public interest, so the test appeared redundant. On that basis, the Houses of Parliament will have to consider simply whether processing is necessary for the purposes of their functions, as is the position now.

Amendments 20 and 21 make a corresponding amendment to Schedule 8, where processing is necessary for the administration of justice under the provisions in Part 3 for law-enforcement processing, to maintain a consistent approach across the Bill.

Amendment 18 is to Schedule 2 and extends the exemptions from the GDPR relating to parliamentary privilege to include an exemption from article 34(1) and article 34(4) of the GDPR. Article 34 requires controllers to communicate a personal data breach to the data subject where the breach is likely to result in a high risk to the rights and freedoms of the subject. The amendment excludes this requirement from applying to parliamentary proceedings and also restricts the ability of the commissioner to oblige either House to comply with it.

I hope that the House will agree that these amendments, taken as a package, will ensure that there will be no chilling effect on the functions of Parliament and will restore the regime that applies under the Data Protection Act 1998. It has the approval of the House authorities. I beg to move.

[Lord Brown of Eaton-under-Heywood (CB)]

My Lords, I strongly support this group of amendments, perhaps unsurprisingly given that they have now been brought forward in place of a series of broadly similar amendments which, as the Minister has mentioned, I tabled on Report. They achieve the same basic objective, which is to safeguard parliamentary privilege and thereby ensure that this House, along with the other place, can continue to go about its business and fulfil its vital constitutional role without inappropriate inhibitions and concerns with regard to the protection of data and privacy, which of course the Bill as a whole is rightly designed to protect.

As I made plain on Report, I was prompted to table the original amendments by and on behalf of the officials of both Houses, that is to say, the clerks and counsel, because of their concern about how, unamended as it then was, the Bill risked infringing parliamentary privilege in the various ways that the Minister has recounted. These concerns were raised and over recent months they have been discussed extensively between officials and the Bill team. Again I express my gratitude and pay tribute to the Bill team for its hugely constructive help and co-operation throughout. As now formulated, these amendments substantially and realistically meet the concerns of officials, and accordingly I welcome them.

Data Protection Bill [HL]

Debate between Lord Ashton of Hyde and Lord Brown of Eaton-under-Heywood

Committee: 1st sitting (Hansard): House of Lords
Monday 30th October 2017 Lords Chamber

[Lord Brown of Eaton-under-Heywood (CB)]

My Lords, when I came into the Chamber, I had not the faintest intention of speaking in this debate. I do so, above all, for one reason: not because I am opposed to the amendment, although I am, very substantially, for the reasons given by the noble Lord, Lord Pannick. I do so because, in my experience, it is very unusual nowadays to vote at the outset of Committee stage on so fundamental a question as that raised by the amendment. It is surely yet more unusual—spectacularly so—to do so on a manuscript amendment filed this morning, which none of us has had sufficient time to deal with, on a very tricky area of the law, which so fundamentally alters the original amendment. As we have heard, that amendment was completely hopeless. The noble Lord, Lord Lester, described it as “constitutionally illiterate”. At least this one tries to introduce the concept of a balanced right which previously was missing.

It is true that I come from a different tradition where you do not vote on anything or decide anything unless you have heard the arguments. I rather gather that there may be a whipped vote on the other side, so the amendment is going to be voted on by noble Lords who have not heard the arguments of the noble Lords, Lord Pannick, Lord Faulks and Lord Lester, and who do not recognise the difficulties and the fundamental importance of this amendment. I seriously urge that it is not pressed to a Division today.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, I am grateful to all noble Lords who have spoken, many of whom do not appear to support these amendments. I particularly thank the lawyers in the House, who have instructed us on the legal position. I feel slightly like the lay person who was talked about, which I am, I hasten to add.

On a political view, it is important to remember that only three weeks ago at Second Reading it was clear that the Bill was widely supported across the House. Many noble Lords highlighted areas where further scrutiny and perhaps improvement were desired, but the House was unanimous in the view that data protection laws needed updating, that the general data protection regulation standards were the right standards, and that we must do everything to maintain future free flows of data. We shared those conclusions because we understand the role and value of data in our digital world and how it is the basis of delivering education, social mobility and economic advantage. That is why it is so sad that in this first group of amendments, on the first of seven days of Committee, for a Lords starter Bill, the opposition parties have threatened to suspend the usual business arrangements whereby we can debate in Committee, meet subsequently outside the Chamber and often come to agreement before the Bill leaves our House—an arrangement which does not prevent votes when they are needed, but which has worked well in the past. I urge noble Lords not to put this at risk. The Data Protection Act has stood the test of time because it was not a partisan piece of legislation, and we must not allow this Bill to become one.

Many noble Lords have said that these amendments are made in good faith to ensure that the UK is given a data protection adequacy agreement by our largest trading partner. This is the right ultimate objective, but it is the wrong route to get there. Contrary to the charge of the noble Lord, Lord Stevenson, we have not forgotten the importance of a free flow of data. In fact, ensuring we maintain a free flow of data is our number one priority, and we want to achieve that from the moment of Brexit, not wait to become a third country and then start the application process for adequacy. I direct those remarks especially to the noble Lord, Lord Clement-Jones. That is why last year we committed to ensuring that the UK adopts GDPR standards. That is why in August we published our plans and ambitions for the free flow of data once we leave the EU. That is why we have presented this House with this Bill: a Bill which builds a comprehensive regulatory system for personal data that covers everything that could be scrutinised in future adequacy negotiations, including areas which are not currently subject to EU jurisdiction. That answers the question of the noble Baroness, Lady Hamwee, on adequacy and the point made by the noble Lord, Lord Clement-Jones.

In the past, 12 countries have negotiated adequacy agreements with the EU Commission, including Canada, Israel, New Zealand and the USA. None of these was forced by the EU Commission to put the charter into their law in order to obtain adequacy. It is not a requirement and it is peculiar to suggest that it will be. It is a myth that we need this amendment to secure a future agreement. Why is that? The GDPR itself, which will become part of our law, says in Recital 4:

“This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data”.


Recital 173 says:

“This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data”.


The noble Lord, Lord Stevenson, was reported over the weekend to be claiming that the Government were scaremongering. We were not. We were deadly serious about the risks, so I am delighted that the noble Lord has now recognised that Amendment 4 needs further thought. What a pity, therefore, that he was unable to discuss it with the Government.

I listened to the noble Baroness, Lady Ludford, who addressed the original Amendment 4. The problem, which I think has been alluded to, is that subsection (3) of the proposed new clause creates an absolute unqualified right to data protection. As attractive as that sounds, it is fatal, for two reasons. First, data protection is not an absolute right, as many noble Lords have said, and the GDPR says it explicitly, too:

“The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality”.


Secondly, both the GDPR and the Bill create a number of exemptions from data rights, which we will debate over the next few weeks. However, while we may disagree on some exemptions, I think that we all agree on the important ones. Terrorists must not be given unrestrained access to information held about them by the security services. Scientists must not usually be prevented from advancing research and furthering understanding. Therefore, the original Amendment 4 creates a risk at precisely the time we need reassurance.

However, Amendment 4A is a welcome improvement. We received this amendment just before noon today. Data protection is not the simplest area of our law, and at Second Reading many noble Lords commented on the complexity of the subject. It would be irresponsible of the Government to accept an amendment of this sort with just a few hours to consider it. What does it mean for future data flows and trade? How does it interlock with the rest of our legislation on information rights? What will the courts make of it?

At best, Amendment 4A is unnecessary or may not achieve what it seeks to achieve. Two particular problems with it were mentioned by the noble Lord, Lord Pannick. First, it has no value, and it only creates legal confusion. Secondly, subsection (4) of the proposed new clause is unwise. Rights often conflict; the Bill and the Human Rights Act manage those conflicts, while subsection (4) does not. At worst, as my noble friend Lord Faulks, outlined, it may have unintended consequences which nobody has been able to consider. Our initial analysis is similar to that given by the noble Lord, Lord Pannick, that Amendment 4A probably does very little. It does little other than summarise what the Bill does. The Bill protects personal data rights, and Amendment 4A reminds us of this. None the less, with so much at stake, we must give this amendment full and careful legal analysis.

The noble Lord, Lord Stevenson, has been placed in a difficult position. Labour is in a muddle over this. But that is exactly why we do not usually vote in Committee. This stage is for resolving muddles and for understanding the issues. It is not the stage for tabling amendments on the day and voting on them hours later, without even discussing it with the Government. I cannot see how this is a service to the House, which prides itself on careful reflection.

The noble Lord, Lord Stevenson, reminded us at Second Reading about the number of Bills that he and I have worked on together. He said that this was the sixth. I pay tribute to the careful, detailed—and sometimes even enjoyable—scrutiny he has given. We have had many useful meetings. Today is the first day in Committee and the first group of amendments on the Bill. We should continue with the positive spirit that we have built together, setting out our arguments and concerns. We can continue to meet outside the Chamber, and I and the Bill team are always happy to listen to and meet other interested noble Lords. On Report, we can reflect and, where we disagree, we can divide.

Therefore, I hope that noble Lords will see that now is not the time and these are not the amendments on which we should divide at this stage. They are unnecessary and they may be deficient. This Bill is essential for our social and economic future, and we risk wrecking it at the first hurdle. I therefore ask the noble Lord to withdraw the amendment.