Crime and Policing Bill

Lord Clement-Jones Excerpts

Thursday 5th February 2026 Lords Chamber

Moved by

[Lord Clement-Jones]

464: Clause 192, page 223, line 33, at end insert—
“(4A) Before the appropriate national authority makes regulations under subsection (1) for the purpose of implementing a new international agreement, or significantly altering an existing agreement, the authority must conduct and publish a comprehensive Privacy Impact Assessment.(4B) The Privacy Impact Assessment required under subsection (4A) must analyse and report on—(a) the necessity and proportionality of the information sharing arrangements,(b) the mechanism by which individual rights, including those under Article 8 of the Human Rights Act 1998, will be safeguarded,(c) the risks of non-compliance with the data protection legislation or of unintended consequences arising from the sharing of personal data, and(d) the nature and volume of personal data intended to be shared or accessed under the agreement.(4C) The appropriate national authority must lay before Parliament, no later than 12 months after the first regulations are made under this section, and annually thereafter, a report on the operation of regulations made under this section.(4D) The annual report required under subsection (4C) must include, in particular—(a) an assessment of the overall volume and categories of information shared under the regulations,(b) a detailed analysis of the impact of the regulations on the privacy and data protection rights of individuals, and(c) a summary of any internal reviews, audits, or legal challenges relating to information sharing under the agreements implemented by the regulations.”Member's explanatory statement
This amendment requires a privacy impact assessment to be carried out before regulations are made under this section.

[Lord Clement-Jones (LD)]

My Lords, in moving Amendment 464 I will speak to Amendments 467, 468 and 503, in my name. These amendments collectively address the governance of Clauses 192 to 194, which grant the Secretary of State broad powers to make regulations giving effect to international law enforcement information-sharing agreements. Following the recent passage of the Data (Use and Access) Act 2025, we are now operating in a new legal landscape, where the statutory threshold for protecting data transferred overseas has been lowered. These amendments are not just desirable; they are essential safety mechanisms to fill that gap.

Amendment 464 would be a safeguard of, so to speak, look before you leap. It stipulates that, before regulations are made under Clause 192 to implement a new international agreement, the authority must publish a comprehensive privacy impact assessment. The necessity of this assessment has intensified following the enactment of the Data (Use and Access) Act. The UK’s new test for onward transfers of data has lowered the bar. It no longer requires foreign protections to be essentially equivalent to ours, but merely not materially lower. This creates a dangerous new risk profile. The European Data Protection Board has explicitly noted that this new test omits key safeguards against foreign government access and removes redress mechanisms for individuals. If the general statutory floor has been lowered, Amendment 464 becomes the essential safety net. We must assess these specific risks via a privacy impact assessment before we open the digital borders, to ensure that we are not exposing UK citizens to jurisdictions where they have no legal remedy.

This brings me to Amendment 467, which addresses the nature of the data being shared. Where regulations authorise the transfer of highly sensitive personal data, such as biometrics, genetics or political opinions, this amendment would require enhanced protective measures. All this highlights the illusion of data protection when transferring data to high-risk jurisdictions that lack the rule of law. We know that in authoritarian states domestic intelligence laws will always override the standard contractual clauses usually relied on for data transfers. Because the Data (Use and Access) Act has removed the requirement for foreign safeguards to be essentially equivalent, we cannot rely on the general law to protect highly sensitive biometric or health data. My amendment would restore the requirement that transfers of such sensitive data must be demonstrated to be strictly necessary and proportionate. We cannot allow efficiency of data sharing to deny the reality that, in some jurisdictions, once data arrives, the state will have unrestricted access. Transparency must follow these powers.

Amendment 468 would mandate the production of an annual report on international law enforcement information sharing. This is vital because we are entering a period of divergence. The European Commission, at the urging of the European Data Protection Board, will be monitoring the practical implementation of the UK’s revised data transfer regime. If the EU will be monitoring how our data laws operate, surely Parliament should be doing the same. We need an annual report to track whether these law enforcement transfers are inadvertently exposing UK citizens to jurisdictions where they have no effective legal redress. Without this feedback loop, Parliament is legislating in the dark.

Finally, Amendment 503 would ensure that regulations made under Clause 192 are subject to the affirmative resolution procedure. Given that the primary legislation governing data transfers has been loosened, it is constitutionally inappropriate for these specific law enforcement agreements to slip through via the negative procedure. Amendment 503 would ensure that these regulations, which may involve the transfer of our citizens’ most sensitive biometric data to foreign powers, must be actively debated and approved by both Houses of Parliament.

We support international co-operation in fighting crime, but it must not come at the cost of lowering our standards. These amendments would restore the safeguards that recent legislation have eroded. I beg to move.

[Lord Davies of Gower (Con)]

My Lords, we thank the noble Lord, Lord Clement-Jones, for his amendments and the importance that he has obviously placed on the right to privacy of the general public.

I support the principle behind Amendment 464. Sharing information often carries a risk with it, particularly when it is for the purposes of law enforcement, and especially when this is done internationally. Law enforcement data contains information that is far more personal to the individual or case in question than the norm. Any data of this sort must be handled with the highest discretion. Ensuring that the sharing of this data respects the right to privacy carries no unintended consequences and, most importantly, is necessary and should be the benchmark from which regulations are made.

If this amendment is accepted, I do not see the additional need for Amendment 468. At the very least, the privacy impact assessment under Amendment 464 should form the basis of any annual report that Amendment 468 would mandate. Less is more when it comes to admin and reports, so I am hesitant to support a new report that is not necessarily needed.

I think Amendment 467 is sensible. In general, internationally shared data should not include information prejudicial to any individual, let alone domestic citizens. This particularly extends to the sharing of biometric data for the purpose of unique identification or genetic identification.

These categories of data are obviously vital for the purposes of law enforcement, but law enforcement extra territorially risks placing this data in the wrong hands. This and similar data should therefore be particularly protected, which is the aim of the noble Lord’s amendment. I hope that the Minister can outline what the Government intend to do to ensure that the international sharing of personal data is undertaken in the most discreet and protected manner.

[Lord in Waiting/Government Whip (Lord Katz) (Lab)]

My Lords, it is a pleasure to kick off what I very much hope will be the last day in Committee—not to jinx it. I am grateful to the noble Lord, Lord Clement-Jones, for setting out the case for these amendments, which relate to the provisions in Clauses 192 to 194.

International law enforcement information-sharing agreements are a vital tool that provide law enforcement officers with access to new intelligence to fight crime, increase public protection and reduce the threat of societal harm posed by international criminality. To clarify, these measures provide the appropriate national authority with the power to make regulations to implement both new and existing legally binding international law enforcement information-sharing agreements. Such regulations may, for example, make provision for the technical and, where appropriate, operational detail to facilitate the information sharing provided for in a particular agreement.

The UK is recognised globally for having one of the most robust data protection regimes, anchored in the Data Protection Act and UK GDPR, which ensure that privacy is protected even in the most complex areas of law enforcement and international co-operation. This Government are committed to maintaining these high standards and ways of working to ensure that data protection and privacy are not compromised as we strengthen cross-border security. UK law already requires data controllers to conduct a data protection impact assessment for any activity that is likely to result in a high risk to individuals’ rights and freedoms. Public bodies and law enforcement authorities are bound by the Human Rights Act, the European Convention on Human Rights and the Equality Act, and they must duly assess activities accordingly.

Existing data protection principles and statutory requirements, particularly data protection impact assessments, already cover the concerns raised by the noble Lord’s amendments, making new duties duplicative and unnecessary. As is required under Article 36(4) of the UK GDPR, regulations made under this power as they relate to the processing of personal data will require consultation with the Information Commissioner’s Office.

The international law enforcement information-sharing agreements preceding the making of regulations under Clause 192 are subject to the usual treaty ratification procedures, including the provisions regarding parliamentary scrutiny provided for in Part 2 of the Constitutional Reform and Governance Act 2010. Any such agreement will be laid before Parliament with an Explanatory Memorandum, which would include the background to why the Government are entering into the agreement, its implementation and a note of any existing domestic legislation and human rights considerations. Additionally, an overseas security and justice assistance assessment will be required. Introducing additional scrutiny requirements would risk duplication and provide no additional substantive information to Parliament beyond what is currently available.

We must also consider the operational sensitivity of such processing. Law enforcement data sharing involves sensitive systems and procedures. Publication of such assessments may inadvertently expose vulnerabilities or methods that criminals or adversarial parties may seek to exploit.

Ministers regularly update Parliament on international law enforcement co-operation, including data sharing. I have a long list of examples before me—I will not detain your Lordships with too many of them. The Cabinet Office issued the Government’s response to the EAC report Unfinished Business: Resetting the UK-EU Relationship on 23 January this year and published it shortly thereafter. A couple of days before, on 21 January, my noble friend Lord Hanson appeared before the EAC to discuss the UK-EU reset, which focused on the LEJC, migration and the border partnership. You do not have to go far back for another example: on September 8, the Foreign Affairs Committee questioned the Cabinet Office and FCDO Ministers on post-summit implementation, co-ordination and future UK-EU co-operation frameworks. That is just the tip of the iceberg when it comes to parliamentary oversight of these matters.

Law enforcement authorities and government departments work closely together to assess international law enforcement capabilities and their effectiveness. Such assessments, by their very nature, are operationally sensitive and would not be suitable for publication. Specifically singling out international law enforcement data sharing also risks presenting a skewed picture of wider domestic operational activity, given that law enforcement outcomes are often the result of multiple capabilities and instruments being used. Owing to the breadth of law enforcement authorities that may be engaged in such information-sharing activity, and the likely multiple data systems, sourcing and collating operational data that would be suitable for inclusion in a published annual report would create significant demand and risk diverting resource from other critical law enforcement priorities.

We must also consider the implications for the international parties to such agreements, who may have concerns about the publication of such data and assessment, particularly where it may relate to operationally sensitive matters. That, in turn, may affect and limit the negotiability of future agreements. Such reports could potentially expose operational practices that it may not be appropriate to place in the public domain. We must be mindful that agreements will vary in scope with international partners; to publish detail on the volumes of data exchanged may inadvertently cause concern from international partners on differing operating scopes.

Finally, as to whether regulations made under Clause 192 should be subject to the draft affirmative procedure, I simply point the noble Lord to the report on the Bill by the Delegated Powers and Regulatory Reform Committee, which made no such recommendation. We are usually held to the high standards of that committee and admonished when it finds us wanting. In this case, we were not found wanting, which I think is a very good tick that I pray in aid.

I understand the concerns of the noble Lord, Lord Clement-Jones, about these clauses, but I hope that I have reassured him that data protection remains at the heart of our approach. With that in mind, I ask him to withdraw his amendment.

[Lord Clement-Jones (LD)]

My Lords, I thank the Minister for his detailed reply. It was very cheerful, which I find quite extraordinary in the circumstances. It is almost as though he has been reading Voltaire’s Candide: everything is for the best in all possible worlds. I will read carefully what he said, but there was an extraordinary amount of complacency built into his response about the nature of sharing data across borders—specifically that the existing regime is sufficient to safeguard these transfers and that my amendments would introduce unnecessary friction into law enforcement co-operation. That is because the rules of the game have changed since the Data (Use and Access) Act 2025.

The Information Commissioner can operate only within the legislation provided, which is no safeguard in those circumstances. I have the highest regard for the Information Commissioner and his office, but they have to operate within the bounds of the law, which have changed since the Act was passed. I mentioned the European Data Protection Board and so on. The Minister has performed some kind of parliamentary jujitsu by seeming to say that sensitive data, which I cited as being one of the reasons why I tabled my amendments, makes it far too difficult to do what I am proposing. I admire his speechwriting but I must say that I do not think that is an answer.

I will withdraw my amendment, but I believe that the Act that we spent so long debating has changed the rules of the game and that these amendments are necessary to ensure that international co-operation does not become a backdoor for the erosion of privacy. I will come back to this but, in the meantime, I beg leave to withdraw my amendment.

Amendment 464 withdrawn.