Designs and International Trademarks (Amendment etc.) (EU Exit) Regulations 2019

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Monday 4th March 2019 Grand Committee

[Lord Clement-Jones (LD)]

My Lords, as with the last SI, the noble Baroness has put her finger on a large number of issues. Although this SI does not compete with the 600-page one that is still to come, I am afraid that, even at 60 pages, its length demonstrates the number of rights that sadly are going to be lost and which are extremely valuable to designers, particularly fashion designers and particularly at events such as London Fashion Week.

I start by asking whether the Minister could expound the situation as far as the exhaustion of design rights of this nature is concerned. The situation was wonderfully simple for those who wished to exhibit new designs at London Fashion Week, for example, knowing that their designs would be protected on the continent—those who exhibited in Paris had them protected here, and those who exhibited on the catwalk here had them protected all over the EU. Perhaps the Minister will explain what the actual exhaustion situation will be, particularly with the new SUDRs.

The mechanisms are relatively straightforward. These are similar to those adopted for the equivalent of the EU trademark. As I read it, there is a level of automaticity about the registration of the new right. It would be churlish not to welcome the fact it will include the features that are characteristic of the European design right, in terms of lines, contours, colours, shapes, textures and so on. That is an extremely important aspect.

I assume that, although there is a level of automaticity—entirely as the noble Baroness said—the sting will come in the renewal at the end of the three years, or whenever it occurs. The Explanatory Memorandum talks about this costing a total of £500,000. It would be useful to know where that estimate derives from.

Again, we are told that relevant stakeholders were consulted. Can the Minister again unpack whatever round table it was that took place? It is rather like Colonel Mustard in the drawing room: where was the deed done on consultation? It is important that we know when examining these statutory instruments that the right people were consulted and are happy, as far as it is possible to be happy with a no-deal Brexit SI, with the proposals set out. I look forward to hearing what the Minister has to say.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I am very grateful for the comments of the noble Baroness, Lady McIntosh, and the noble Lord, Lord Clement-Jones, which have covered much of the ground that I was going to raise, so I shall not go back over it. As both of them have said, this is a complicated area. My feeling from the comments made is that it is likely to become more complicated after a no-deal exit, not least because of an additional design right.

On that point, as the noble Lord, Lord Clement-Jones, pointed out, it has taken this rather odd set of circumstances to persuade the Government that there is a problem with our whole range of design rights. We have raised in the House before the question of why there is such a focus in the UK on registered design rights, as against the very much larger number of unregistered design rights used in fast-moving industries such as fashion and why those industries do not use the registration system at all. Bringing in another model just to try to fill a gap seems to overcomplicate the whole structure, although it provides additional cover, as the noble Lord said, and I welcome that.

Does the Minister recognise that an issue is looming here? Do we need another in-depth look at this whole area to try to unbottle some of the problems that we have caused in the past few years by bringing in additional layers of legislation and regulation and consider whether we need a new approach, because the industry has moved away from the current regulatory structures?

Having said that, a number of points raised need answers, and I look forward to hearing what the Minister will say. I have only a couple to mention. The noble Baroness mentioned paragraph 12 of the Explanatory Memorandum. I have two points on that. At paragraph 12.11, there is a rather odd piece of typography. It states:

“An Impact Assessment has not been prepared for this instrument because [].”


There are just two square brackets, so we do not know why it was not prepared, although we can guess. Can the Minister confirm why we have not had an impact assessment and not leave us hanging? It is a bit like a missing third act.

I have a point about cost recovery, which was well argued by the noble Baroness. The resourcing issues of this are not small: they may be £500,000, they may be £375,000, but they are still substantial. On a cost-recovery model, who pays? Are we saying that designers currently registering designs—which is about 10% of the total design component of industry—are carrying the costs not only of the existing arrangements but the additional burden of having to produce another registered design system introduced because of the possibility of defects in the relationship of those registered on the European basis? It is all very well saying that this is a benefit to the designers, but it is at a cost. I should be grateful if the Minister would confirm my reading of the situation.

I asked this question on the previous statutory instrument, but I did not get a full answer. We seem again to be engaging in asymmetry. There would be an argument for saying that if we have to have a no-deal exit, when that happens, the arrangements for design protection must be limited to the UK because no reciprocity is promised from the EU, yet here we are saying that we in the UK will continue to recognise the registration process which takes place in EU countries after we leave but are unable to offer that right to those who register designs with the UK, even with the additional right. Why are we doing that? Is that an asymmetric approach, or is there something we do not know about the arrangements that have been made for that? I am not against what has been going on. However, if I am right, I think the consequences are that, while overseas or European designers may benefit from having their designs copyrighted—the catwalk example is a good one, in that you can have a fashion show in Paris and be confident that your designs will be covered in Britain—in Britain, we will not be able to do that because there is no necessary reciprocity. That seems unreasonable and I would be grateful to know who benefits from it when we hear from the Minister.

Patents (Amendment) (EU Exit) Regulations 2018

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Wednesday 6th February 2019 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, the noble Lord, Lord Warner, has expressed the impact on the life sciences industry extremely effectively and eloquently, and I do not wish to repeat anything of what he said. Quite apart from the damning quote from the chief executive, Mike Thompson, the key sentence that I saw in the ABPI’s briefing was:

“The signal the Government has sent to global pharmaceutical companies large and small is that the UK will be less committed to IP protection after Brexit than it has been to date”.


For a major industry to consider that seems extremely damning.

As the noble Lord, Lord Warner, pointed out, the Minister said that it is correct to raise these issues and he is keen to start exploring them, so there is some intention now to have some consultation post the SI rather than proper consultation before it. I think we are looking forward to hearing a bit more of a concrete proposal from the Minister with regard to what precisely is planned.

The Minister’s six and a half-page letter, as we must now call it, dealt with the question of participation in the unified patent court, as set out in the White Paper last autumn. I made the point in Committee that if the UP convention is ratified by Germany and comes into force ahead of our exit date, the UK will need to work out how to remain a member of the UPC or withdraw from the systems, which could have significant impacts on business. In that context, I questioned in Committee whether the UK will have to acknowledge the supremacy of EU law and the ECJ as part of the signing up process. In his letter, the Minister advises that,

“when ruling on domestic cases, UK courts will not be bound to follow decisions of the UPC, or rulings of the European Court of Justice applied by the UPC”.

The last time we discussed this SI, I brandished a 39-page opinion on the subject, so I am rather baffled by the advice that the IPO and the Minister have received in those circumstances, if we have signed up to the unified patent court agreement. I would very much like to hear a bit more clarification on that subject from the Minister.

[Lord Stevenson of Balmacara (Lab)]

My Lords, this is another good debate on these issues. I will not fall out with the Minister about the length of his letter—we can brag about size elsewhere if we wish to—but it came out of my printer at eight pages. I leave that curious intellectual puzzle to him to sort out. Maybe there were other issues that had to be added in.

The Minister could well have dealt with other matters, including various aspects of whether the Silhouette case would apply in this area of the law; one of the points raised in the correspondence was the question of whether Silhouette, which applies to one aspect of our intellectual property, in fact has resonance through its relationship to the other aspects of the IP world and will also be applied. However, that may be for the future.

The noble Lord, Lord Clement-Jones, is right to raise questions about the unified patent court, which could change the game here. If the Minister is minded to confirm any of the points raised by the noble Lord, can he also confirm that premises for the unified patent court have been acquired in London? Are they fully available and ready to be moved into? We are expecting the courts to be operational very shortly, but it would be useful to have confirmation that this is still the case.

Trade Bill

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Committee: 4th sitting (Hansard): House of Lords
Monday 4th February 2019 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, my noble friend Lord Fox has introduced his amendment extremely eloquently and convincingly. In supporting it, I highlight the fact that without the right deal on movement of talent and skills, our creative industries will face major challenges. Some 5.7% of the UK workforce is made up of EU 27 nationals. However, 6.1% of the creative industries workforce is made up of EU 27 nationals. More than that, 10% of the design, publishing and advertising workforce are EU 27 nationals. Some 25% of our visual effects in film—VFX—workforce is from the EU, and that rises to 30% in gaming. We are highly dependent, in those areas of the creative industries, on EU 27 nationals.

Take the music industry, for example. Some £2.5 billion was generated by music in export revenue. Germany, France and Sweden are among our top export markets, and are major destinations for our musicians. In the recent ISM survey of musicians, 39% said that they travel to the EU more than five times a year; 12% travel to the EU more than 20 times a year. More than one in eight performers had fewer than seven days’ notice between being offered work and having to take it, and more than a third of musicians said they received at least half their income from working in the EU 27. There are warnings from these musicians from their experience with the rest of the world. More than a third of musicians had experienced difficulties with visas when travelling outside the EU. In fact, of those experiencing difficulties, 79% identified visas as the source of those difficulties. Musicians in particular rely on being able to work and tour in Europe freely, easily and often with little notice.

It is equally important that the other people vital to touring, such as roadies and technical staff, are able to travel on the same basis. It is also vital that instruments and equipment can be moved around easily, and this must be a reciprocal arrangement. On touring, the Government have said that the UK will look to reach an agreement allowing musicians and museums to tour major events with their equipment and goods. What is considered a major event is not clarified and there are few details on what an agreement would look like.

The Government propose that the new immigration system will preserve the current rules for employing non-visa nationals for short-term work to join a UK production. This allows them to work for up to three months without a visa, requiring only a certificate of sponsorship from their employer, which is cheaper and easier to obtain. For periods longer than three months, the Government are reaffirming that the current tier 5 creative and sporting route, which caters for creative workers such as musicians, actors or artists who are working and touring in the UK, will continue. This is welcome but, again, without the right reciprocal provisions, Brexit is likely to make touring much more difficult for musicians and crews to move across Europe. Increased red tape will make it harder to promote music overseas.

Then, if the withdrawal agreement is agreed, from January 2021 non-visa nationals looking to take up permanent employment in the UK, such as VFX workers, will need to obtain a tier 2 visa. This requires sponsorship from an employer, which must pay a skills charge to make the recruitment. Workers must meet a minimum salary requirement to be eligible for a tier 2 visa. Like my noble friend, I welcome that the Government now plan to consult on the appropriate level for this requirement in the coming year, but the Migration Advisory Committee—MAC—has recommended that it stays at £30,000. There will need to be considerable changes to these proposals if the Government are to ensure that sectors such as the creative industries continue to thrive post Brexit. As the Creative Industries Federation has said,

“high skills do not always command a high salary”.

There is still a huge lack of clarity. The UK Screen Alliance has criticised the plans for a post-Brexit visa system. It says the Bill’s proposed visa system will “severely limit” the VFX and animation industries’ access to international talent. It also says that expensive new EU visas will add significantly to operating costs and impact on the sector’s competitiveness in the global market. Alan Bishop, the chief executive of the Creative Industries Federation, said about the White Paper:

“Unfortunately there is very little in this white paper which will give creative businesses and freelancers in the UK any confidence for the future … government has failed to recognise the challenges freelancers face within the current immigration system—a significant challenge for the Creative Industries Federation where 35% of creative workers are self-employed. Freedom of movement has given British businesses access to the best and brightest freelancers from the EU, presenting those businesses with opportunities to grow and contribute to the continuing health of the UK economy. For international non-EEA freelancers however, the current immigration system provides no long-term route. This is why the Federation has called for the introduction of a freelance visa”.


Those are the words of two significant organisations in this field.

The Government have had plenty of time to consider all these issues and have had plenty of sound advice, not least from quarters such as the July report of the House of Lords European Union Committee, Brexit: Movement of People in the Cultural Sector. That is why this amendment is so important, and I very much hope that the Minister will reflect in his response that the Government fully understand the needs of the creative sector.

[Lord Stevenson of Balmacara]

My Lords, a powerful case has been made by the party to my left. My sadness is that the framing of the amendment before us deals largely with how any future trade agreement with the EU should have a relaxed approach to the mobility framework and, picking up the point of our earlier debate, tries to insert in some measure the fourth pillar of the GATS process, which allows for individuals to travel in support of goods and services.

The case we heard, and the emotion it raises, are about the much broader ideas of freedom of movement and the ability to transfer skills, particularly in the creative industries. Although it was not specifically mentioned, presumably it seeks to try to loosen the way in which the Government currently treat overseas students. There is a wider, richer, deeper and more important argument about the need for mobility, its importance for any modern nation state and the contribution it can make to our economy and our culture. That needs to be answered, but it is not picked up particularly by this amendment.

We too discovered this problem when tabling amendments. The title of the Bill means that we can not have as broad a discussion as we would wish. However, there is an immigration Bill coming, and others in your Lordships’ House will want to pick up many of the points made here and raise them in the context of a much wider and more appropriate set of immigration conditions and arrangements, which will satisfy much of the discussions we have heard this afternoon.

On the narrow question of where we move, it would be wrong to try to seek a broader solution to the problems identified through a generic approach. There is no doubt that what appeared to be—and it was appearance rather than reality—unbridled immigration was a factor in the referendum that led to the formation of the Brexit arrangements. We would be stupid to ignore that. There are probably answers and solutions that would be satisfactory to all concerned, but not in this amendment. Nevertheless, I will listen carefully to what the Minister says in response to this point. This issue will not go away and we look forward to returning to it at a future stage.

Patents (Amendment) (EU Exit) Regulations 2018

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Monday 14th January 2019 Grand Committee

[Lord Clement-Jones]

I thank the noble Lord for that intervention because that is exactly the impression that I had got.

To add to the Minister’s woes, I want to go off into a completely different subject that he himself raised at the very beginning: the issue of the Agreement on a Unified Patent Court and the unified patent. The unified patent has come up; the Minister has mentioned it and it was included in the technical note in September. There is a big issue surrounding the Agreement on a Unified Patent Court and the unified patent. If the agreement is ratified by Germany and comes into force ahead of any exit date, the UK will need to work out how to remain a member of the UPC or withdraw from the system, which could have a significant impact on business. Of course, at this stage it is not clear if the agreement will come into effect at all, but if it does and if, as a third-party country, the UK then wants to take part, is it not clear—I have a 39-page legal opinion on this subject—that we, the UK, will have to acknowledge the supremacy of EU law and the ECJ as part of signing up to the UPC agreement? What kind of “taking back control” for Brexiters will that be?

What advice have the Government received on this matter? I heard what the Minister had to say: he made the very positive statement that we were going to sign up. Have the Government had any further observations on the UPC agreement and the unified patent? How do they envisage UK legislation dovetailing with both systems, assuming that it is ratified?

[Lord Stevenson of Balmacara (Lab)]

My Lords, this has been a good debate that has raised lots of issues. I think the noble Lord, Lord Clement-Jones, is right that there are real questions to be asked here, although I feel that we are experiencing a bit of a split focus here. It is like being part of the film “The Matrix” because there seem to be two different levels of debate going on. There are the particularly narrow questions about the statutory instrument as presented, with which I think there are some substantial difficulties, but there are also the wider issues about why we are doing all this and the way that we are doing it. The noble Lord, Lord Deben, and others have focused on the absurdity of a situation where we are trying to persuade ourselves that, despite our best instincts, despite all the training that we have had here and despite everything that we do every other day of our lives, we are quite happy to sit here and wave this through just because it might not happen. That seems to be Alice in Wonderland rather than “The Matrix”, but perhaps they come together in a curious way which I have yet to experience.

The noble Lord, Lord Clement-Jones, commented on the Unified Patent Court, which is an intriguing area of public policy which has yet to have its full ramifications explained. He is absolutely right that the UK has committed itself to ratifying the UPC and intends to join up. I am sure that the Minister will confirm that when he comes to respond. Of course, with that comes the continuing role of the ECJ, because all judgments of the UPC—although there will be a platform of it operating here in London in property which has already been bought and refurbished in premises on a lavish scale which may not have been seen by the press yet, but I am sure that when they are there will be a bit of a scandal—will be absolutely redolent of the way in which the European continuing engagement will have to operate. That is because so many people hold unified patents and will need to have them defended in ways which are important not only here but in the six other areas where the court will be operating. But that is part of the further discussion and debate along with the consultation issues which I agree need to be bottomed out at some stage, but perhaps not today.

I may just stunt the time taken up by other speakers by looking at the other four SIs which are due to be discussed shortly by the noble Lord, Lord Bates, and others. I am sure that he will have read through and inwardly memorised the rather clever phrasing used by HM Treasury which I recommend to the department as it might wish to use it in the future and thus avoid some of the confusion. It states:

“HM Treasury has not undertaken a consultation on the instrument, but has engaged with relevant stakeholders on its approach to Financial Services legislation under the European Union (Withdrawal) Act 2018, including on this instrument, in order to familiarise them with the legislation ahead of laying … The instrument was also published in draft, along with an explanatory policy note, on 31 October 2018, in order to maximise transparency ahead of laying”.


That is wonderful phrasing and I congratulate the Treasury on having found a way out of an apparently insoluble problem. If it can defeat the noble Lord, Lord Adonis, and his assembled minions, obviously it will be well ahead of the game.

Centre for Data Ethics and Innovation

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Wednesday 21st November 2018 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I am grateful to the Minister for repeating the Statement made elsewhere. He was present for part of the debate on artificial intelligence on Monday. On reflection, it is a bit surprising that the Government were not able to accelerate the announcement of this new body. It would have helped a lot in that debate. No doubt the tyranny of the grid is to blame again, but many of us would have felt the benefit had we known, not least, that the membership of the board had been enhanced by those Members of your Lordships’ House already referred to.

To go back in history a bit, the Centre for Data Ethics and Innovation came out of amendments we proposed during the passage of the Data Protection Bill, but it was built on excellent work by the Royal Society and others. We should pay tribute to the groundwork that led to today’s announcement. Those amendments had a lot of support from around the House and would have gone into the Bill had we been able to push them further, but we could not get them within the bounds of the Bill’s framing. We should say clearly that the model we had in mind then was the independent Human Fertilisation and Embryology Authority. In preparing the thinking in this new area of advanced technology and data processing and protection, one needed a carefully balanced body that could regulate in the context of difficult ethical issues raised by research and development.

I will now ask a number of questions about the body itself, and I hope that the Minister will respond, in writing later if not now. The body was originally intended to be an independent statutory body, but it is not because no powers have yet been established. What is the progress on that? The reports I have read suggest that that is still an objective of the Government, although they are making a virtue of the fact that it is an advisory committee in the interim period. In some senses, they will probably be judging its success, which is a bit worrying given that the whole benefit would be that it was independent of government, long-term and able to look without fear or favour at the big issues. If it is an advisory committee of the department, how independent will it be in practice? Is funding secured? Can it spend what it needs to get the research and advice it needs? How much of the original thinking about the HFEA remains? As an advisory committee, can it request information? One problem is the difficulty of extracting information from the behemoths that populate the international information society.

The press release rightly describes the membership as “stellar”. Given the names already mentioned here, I think we should recognise that. I confess that my application was weeded out very early in the game. This was unfortunate, because I would have been delighted to be part of that. Having seen the full list and heard why they were chosen, it is clear that the right decisions have been reached and I bear no malice to those responsible—honest. If the membership question comes up later, I am still around.

In the absence of the new centre starting up, we have only two or three areas of activity. We have a statement as a result of the consultations that took place. It talks about the focuses being to provide clear guidance and regulation and to lead debate about how data can be used in the future. But there are still some problems that need to be resolved, and I will be interested to hear the Minister’s comments. The AI report we discussed at length in a very good debate on Monday, when there were notable speeches from the right reverend Prelate the Bishop of Oxford and the noble Lords, Lord Reid and Lord Browne, shows the range of issues that are going to be up for discussion. These are very abstruse areas of intellectual activity such as ethics and the nature of machines—whether they are responsible for their actions and, if so, how any redress can be obtained. The noble Lord, Lord Browne, posed questions about intelligent weapons and what controls must be placed on them. It is a very stretching agenda. All we know is that issues currently in the list include data trusts, algorithms and consumer experiences. I do not think there will be a shortage of those. Can the Minister explain what the process will be? I gather an overall strategy document will be revealed.

There are some concerns about the balance between advice and regulatory action. I think the plan would be for advice to be offered to government and regulatory action to be taken by existing or other bodies. Could we have confirmation of that? There is a question about the balance between ethics and innovation. Clearly, innovations are difficult to support if they raise big ethical issues too quickly; they often need to be tested over time and analysed. It would be useful if there were a way forward on that. Of course, there is the whole question of how the Government intend to treat public data, its use and value for money, and the extent to which it will be available.

Lastly, the new centre, which I wish extremely well, enters a rather crowded space with the Information Commissioner’s Officer, Ofcom and the CMA, all of which have statutory functions in this area, but perhaps I may counsel that also to come are the Alan Turing Institute, which is now up and running, and the Open Data Institute. Therefore, there will be a need for some time for this whole process to settle down and for leadership from the Government on how it will work.

The responses to the consultation showed a clear public wish for consistency and coherence, and I hope that in that process there will be room for consultation. I do not wish the new body to be a proselytiser for data or indeed for artificial intelligence, but there is a difference between proselytising and being in an explanatory mode, reassuring people and explaining to them the benefits as well as the risks of this new technology. The centre needs to be public facing and fully engaged in that process, and I wish it well.

[Lord Clement-Jones (LD)]

My Lords, I too thank the Minister for repeating the Statement. He was missed in the debate on Monday. I have had the benefit of reading the Government’s response to the consultation on the Centre for Data Ethics and Innovation. I share the enthusiasm for the centre’s creation, as did the Select Committee, and, now, for the clarification of the centre’s role, which will be very important in ensuring public trust in artificial intelligence. I am also enthusiastic about the appointments—described, as the noble Lord, Lord Stevenson, said, as “stellar” in the Government’s own press release. In particular, I congratulate Members of this House and especially the noble Baroness, Lady Rock, and the right reverend Prelate the Bishop of Oxford, who contributed so much to our AI Select Committee. I am sure that both will keep the flame of our conclusions alive. I am delighted that we will also see a full strategy for the centre emerging early next year.

I too have a few questions for the Minister and I suspect that, in view of the number asked by me and by the noble Lord, Lord Stevenson, he will much prefer to write. Essentially, many of them relate to the relations between the very crowded landscape of regulatory bodies and the government departments involved.

Of course¸ the centre is an interim body. It will eventually be statutory but, as an independent body, where will the accountability lie? To which government department or body will it be accountable? Will it produce its own ethics framework for adoption across a wide range of sectors? Will it advocate such a framework internationally, and through what channels and institutions? Who will advise the Department of Health and Social Care and the NHS on the use of health data in AI applications? Will it be the centre or the ICO, or indeed both? Will the study of bias, which has been announced by the centre, explore the development of audit mechanisms to identify and minimise bias in algorithms?

How will the centre carry out its function of advising the private sector on best practice, such as ethics codes and advisory boards? What links will there be with the Competition and Markets Authority over the question of data monopolies, which I know the Government and the CMA are both conscious of? In their consideration of data trust, will the government Office for Artificial Intelligence, which I see will be the responsible body, also look at the benefits of and incentives for hubs of all things? These are beginning to emerge as a very important way of protecting private data.

What links will there be with other government departments in giving advice on the application of AI and the use of datasets? The noble Lord, Lord Stevenson, referred to lethal autonomous weapons, which emerged as a major issue in our debate on Monday. What kind of regular contact will there be with government departments—in particular, with the Ministry of Defence? One of the big concerns of the Select Committee was: what formal mechanisms for co-ordinating policy and action between the Office for Artificial Intelligence, the AI Council, the Centre for Data Ethics and Innovation and the ICO will there be? That needs to be resolved.

Finally, the centre will have a major role in all the above in its new studies of bias and micro-targeting, and therefore the big question is: will it be adequately resourced? What will its budget be? In the debate on Monday, I said that we need to ensure that we maintain the momentum in developing our national strategy, and this requires government to will the means.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Monday 14th May 2018 Lords Chamber

[Lord Clement-Jones]

My Lords, I thank the Minister for his explanation. In many ways, when these clauses came to the House we missed a trick; I do not think we quite understood at the time that the Information Commissioner did not have adequate powers. It was rather a sorry sight to see the Information Commissioner hanging around for several days outside Cambridge Analytica waiting to be allowed to enter and inspect, so these amendments are extremely welcome—as, of course, is the new criminal offence the Minister mentioned.

I will say one thing: it is not entirely clear whether these powers are on all fours with, for instance, the Competitions and Markets Authority, Ofcom, Ofgem, and so on, in terms of the ability to make a dawn raid. I have looked at it but it is not entirely clear that that is possible. Clearly, in the current circumstances, the misuse of data is an extremely important aspect. It would be very interesting to hear from the Minister whether at the end of the day these are modelled on the other regulators. Does the Information Commissioner have very similar powers, and is a dawn raid available to her? Given that there are safeguards in the Bill—a warrant from the High Court and so on—that would be desirable. We have discovered that it is important for the Information Commissioner, as a result of the Cambridge Analytica scandal, to have all the powers necessary.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I associate myself with what has just been said by the noble Lord, Lord Clement-Jones, and I agree with the Minister that this is a welcome step forward. I have three minor points to put to him and I shall ask a question about the powers at the end. He said several times that he had had conversations with and was in agreement with the ICO about the powers that were taken. Following up on what the noble Lord, Lord Clement-Jones, said, has the ICO agreed that these powers are what she asked for and will achieve what she aims to do in cases such as that of Cambridge Analytica?

Secondly, what are they modelled on? I have had the benefit of a conversation with the Bill team and the Minister on this and I think the answer to the question of whether they are modelled on the Competition and Markets Authority’s powers is that they are coming from slightly different directions. It is not necessary that the powers should be exactly the same, but I think the answer is that they were broadly what was envisaged for the CMA when it was set up and therefore appropriate for the powers required by the ICO. Can the Minister confirm that is the case?

My third question is one that we have explored at length in Committee and on Report. Given these new duties and responsibilities, which are substantial and will have to be exercised with great care but will add a burden to its existing work—as was laid out in the Bill when we saw it in this House some time ago—will the resources be available to the ICO to carry out that work? If not, what will the Government do about that? This bears particularly on the question of staff and staff capacity because, as the Minister says, we are talking about the cutting edge of technology.

My final point is that we are legislating in haste. There is no reason why we should be suspicious of that but it was done very quickly and there was not as much scrutiny as one would have wished, in either this House or the other place. I was not able to find this in the Bill itself, but can the Minister confirm whether, should it turn out that these powers are not as well drafted or well expressed as they could be, he has the powers to go back and amend them through the appropriate procedures in due course, should that be necessary?

--- Later in debate ---

[Lord Clement-Jones (LD)]

My Lords, on these Benches, we are very sympathetic to Amendments 53A and 53B. Like the noble Lord, Lord Mitchell, we find it difficult to understand why it has been impossible to come to some sort of agreement. I hear what the Minister said: that he is sympathetic, but not so sympathetic that he agrees with the amendments. This disagreement about whether a statutory code, guidance or whatever is the right way forward seems to be dancing on the head of a pin.

I pray in aid the intervening report of the AI Select Committee on precisely this matter, which supports the contentions of the noble Lord, Lord Mitchell. In our report, we stated:

“Increasingly, public sector data has value. It is important that public organisations are aware of the commercial potential of such data. We recommend that the Information Commissioner’s Office work closely with the Centre for Data Ethics and Innovation in the establishment of data trusts, and help to prepare advice and guidance for data controllers in the public sector to enable them to estimate the value of the data they hold, in order to make best use of it and negotiate fair and evidence-based agreements with private-sector partners”.


That seems fair and square along the lines proposed by the noble Lord, Lord Mitchell.

In the course of our inquiry, we also looked carefully at the sorts of arrangements made by DeepMind—not only the benefits, which he very fairly outlined, but the issues with how sharing that data was organised, which of course led to an investigation by the Information Commissioner’s Office. Of course, NHS data is particularly important in this context. In our report, we stated:

“The data held by the NHS could be considered a unique source of value for the nation. It should not be shared lightly, but when it is, it should be done in a manner which allows for that value to be recouped”.


So, fair and square, we are with the noble Lord, Lord Mitchell.

It would be somewhat ironic if the Secretary of State, in his response to our Select Committee in three or four weeks, said, “Yes, we agree: there should be something along these lines”, but we had missed the opportunity in this Bill.

[Lord Stevenson of Balmacara]

My Lords, we supported the amendments that my noble friend Lord Mitchell tabled in Committee and on Report, and we support him in his journey through this process. The issue is probably complicated by the fact that, had this Bill been delayed by a matter of months from now, we would probably find that this issue was bobbing up all over our public realm, where people are beginning to realise the value of the assets that they hold. To the extent of being a first mover, I think that my noble friend has probably suffered from that, but I hope that the Minister will show some sympathy and support for him.

--- Later in debate ---

[Lord Clement-Jones]

My Lords, very briefly, we had considerable debate while the Bill was going through the House on whether we should incorporate Article 18(2) and we obviously did not prevail while the Bill was going through this House. Although this does not go as far as incorporating Article 18(2), which I regret—I would clearly like to see the whole loaf, so to speak—at least this gives the possibility of Article 18(2) being incorporated through a review. Will the Minister say when he thinks the review will be laid, in the form of a report? I am assuming that,

“within 30 months of commencement of the Bill”,

means within 30 months from 25 May this year. I am making that assumption so that we can all count the days to when the report will come back for debate in Parliament.

[Lord Stevenson of Balmacara]

My Lords, the work done by the noble Baroness, Lady Kidron, in joining the dots, as it were, between the original proposal and having a proper approach to children using the internet and all the other things they use, and the way they would get redress if there is a problem, has been a joy to watch. She has stuck at it like a terrier, she has not let Ministers off the hook, she has been firing off emails and phone calls from faraway places and causing their lives to be an absolute misery, but it is a good thing because we have got to where we need to be.

As the noble Lord, Lord Clement-Jones, said, it was always a surprise that the Government did not want to include Article 18(2) as well as Article 18(1), because it completes the support for consumers of internet services, which the Bill sets out to do but for which there is a derogation and they have chosen not to exercise it. I am very glad about that, but perhaps the Minister can explain one thing that I did not quite get right in my mind as I was listening to him. The review is to check whether Article 18(2) would make it a more effective consumer measure than it is currently under the Bill as drafted—the Act, as it will be. It is not restricted to vulnerable people. The way it was expressed seemed to suggest that it would cover only other vulnerable people. In any case, children are not vulnerable: they are extremely interested, very wise and often sagacious about the internet but they are not vulnerable to it. They may well get themselves into vulnerable situations, in which case they need redress, through bodies such as child-specific agencies, but I do not think that was the intention. I would be grateful if that could be addressed.

Secondly, a moment of levity flashed through my mind when the Minister was talking about the need for the Inland Revenue to track down where reservists had got to. I cannot believe that is the only way the Ministry of Defence keeps in touch with its reserve, but I do not dissent from this being a very good measure.

--- Later in debate ---

[Lord Clement-Jones]

My Lords, as the Minister made clear in his lucid introduction, this is a really significant group of amendments. It is very good to see that some of the work that was done in this House has come back in the form of amendments. In particular, the Minister will remember that it was my noble friend Lord McNally who raised issues around Thomson Reuters in the first place. However, I know that there will be considerable pleasure in the financial services industry, which is very concerned about such things as money laundering, anti-corruption measures and so on, and making sure that it can process data in pursuance of achieving those important goals.

I congratulate the noble Baroness, Lady Neville-Jones, on her campaign, which has clearly borne fruit here. I had not heard what the noble Lord, Lord Pannick, had said but there seems to be a bit of a hole in the Bill if that is the case. I can certainly testify to the fact that arbitrators are an incredibly important part of our judicial system. Indeed, within it they are one of our global competitive advantages; therefore if anything is done that is to the detriment of our arbitration system, it would be really quite serious.

[Lord Stevenson of Balmacara]

My Lords, I too congratulate the Government on bringing forward these amendments. They cover a wide range but, as the noble Lord, Lord Clement-Jones, said, they are an important part of the actual mechanics and workings of the system once it is going. We will certainly need a few successes where people believe that something has been done to make sure that their lives are easier, rather than more difficult, as a result of this legislation. Even your Lordships’ House will suffer quite considerably in the processing tasks that it will have to carry. I seem to remember that, after an informal chat with the Minister, we were going to get a statement from him about how he felt about that and how things might progress. Maybe I am pushing him a little too far; perhaps we will get a letter or something about it later.

I echo the congratulations to the noble Baroness, Lady Neville-Jones, who fought an understated but effective campaign on an important area, which I am glad to see was picked up. I thought the diversity amendments were the sort of thing that could easily have been dropped off for being too complicated and difficult. This is possibly not the right Bill but it is really important that we got them in here. There could have been use made of some provisions by employers and others who did not want to face up to the reality of the world today, saying that they would not be able to process data in a way that would allow us to see whether progress has been made on this.

We on the Labour Benches were also consulted by Thomson Reuters, which felt that there was a bit of a lacuna in some things it was asked to do about money laundering. I am glad that the Bill team finally came round on that and agreed that there was something there. It brought forward a measure.

I am particularly pleased about safeguarding, which was quite a late addition to Committee. We brought it back on Report. It was obviously something that needed much wider consideration. Again, I wondered whether there would be time to bring it through. It has been possible to do so. We now have a very satisfactory approach to this. It covers not just sports, which was the area we raised, but the wider consideration of vulnerable people in clubs and in health and welfare situations where there needs to be consideration of what process and steps could be taken if suspicions were raised. We do not have to read the papers today to realise how damaging that can be if it is not caught quickly. We welcome the amendments.

Artificial Intelligence

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Thursday 26th April 2018 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I thank the Minister for repeating the Statement made earlier in the other place. We welcome it in its generality, although I have some comments about individual points. The most striking thing is that there is no reference in the Statement or the papers that accompany it to the excellent report recently published by your Lordships’ Select Committee on Artificial Intelligence. It may just be a case of the Government getting their retaliation in first. I hope not; I hope that in time they will respond positively and carefully to the various recommendations made by that excellent report and look forward to returning to the topic then.

AI clearly presents huge opportunities for the UK, and it is important that the Government are taking it seriously, as I think they are in the Statement. Responsibilities go with that initiative, as is evident in some of the points made, but I shall probe further on them.

On R&D spend, which is at the heart of the Statement, as reflected in the press statement issued jointly by DCMS and BEIS, the ambition is to get to 2.5% of GDP, with an eventual target, although it is not quantified, of more than 3%. Sweden, Austria, Germany, Belgium and Finland all have R&D expenditure of more than 2.5%, and South Korea spends more than 4% of GDP on R&D. If the UK really seeks to be a leader in AI and technology innovation, as we hope it does, why is the target so modest?

My second point is about the link back to young people and the school curriculum. It was suggested that the Government discouraged the independent review led by Professor Wendy Hall and Jérôme Pesenti from looking at the curriculum in primary and secondary schools, which you would think would be part of the process of trying to get our country as a whole geared up to do more across AI. If they were told that they could not go there because looking at the curriculum is very thorny and difficult, what on earth are the Government going to do about it? There is good news in the extra funding for teachers, but teachers do not create curricula; curricula have to be created in the wider context of education. I should be grateful if the Minister would comment on whether there is to be movement on that.

Also in education, there is the rather curious phrase that the Government are going to “create” 200 PhDs, as if they are something that you just print or issue, like coinage. Further reading and looking in more detail at other parts of the Statement should reveal that this will be funding for a welcome increase in the number of people taking PhD programmes. Presumably they will be independently offered by universities, not simply created by government diktat. However, are we not in the middle of a crisis of funding for higher education? Where in the Statement—I could not find it—is any reference to how the students will live on the additional PhDs that are being created? To narrow my question down, will the PhDs mentioned be part of the independent review of higher education, which is looking primarily at undergraduate courses but needs to look also at masters and PhD students?

We have looked at digital infrastructure time and again in this House, and each time the Minister has come to the Dispatch Box and talked about what progress has been made he has been met by a torrent of scepticism and concern that the reality is rather different from what the Government think. At the heart of this must be a commitment from the Government to get ahead of the rather unaspirational USO that they are about to introduce and go to fibre to the premises. FTTP broadband is the only way we can take the benefit of the technology, invest and get the returns that we will need as a country. We are so far behind the EU average on FTTP, which is 24% penetration. We are at about 2.7% penetration. Countries such as Portugal, Latvia and Lithuania have coverages of 86%, 85% and 81% respectively. What are the Government going to do about that? This will not get us to where we need to be.

On visas, there is a welcome suggestion that tier 1 numbers will be doubled, although that takes us to only 2,000—presumably per year. Will the Government reflect on whether that will be sufficient to reach the ambitions set out in the Statement?

I have two final points. In the Data Protection Bill, we have been concerned about whether sufficient resources and powers are available for the Information Commissioner to carry out her very responsible job of trying to ensure that we have a proper data regulatory structure. I understand that amendments are to be tabled that will increase the powers of the ICO, and look forward to discussing them when they reach the House—perhaps next week or the week after—but the question of resources is still open-ended. It seems that the Government will back and expand our AI activity. If that is the case, can they assure us that the additional resources required by the Information Commissioner’s Office will be provided at the appropriate time and that she will have the powers she needs?

Finally, on the very welcome news that the centre for data ethics and innovation is beginning to take shape and apparently has a budget of £9 million, what exactly is its current status? As I understand it, no legislative process has taken place, and I would be interested to know the timetable for that. Will the funding be limited to £9 million, or will other funds be available? More importantly, will it have a statutory position? The Government rightly pick up the need to ensure that all the work that is going on and is foreshadowed in the Statement will be effective for our economy, but it will be effective only if people trust that their data will not be abused and that there is appropriate understanding and a proper regulatory processes in place which engage with the ethical issues. We need a little more information on that. I should be grateful if the Minister could respond on when that will happen.

[Lord Clement-Jones (LD)]

My Lords, having immersed myself in the subject of AI for the past year, I am absolutely clear that there is complete cross-party consensus on the potential for AI in the UK. I welcome today’s sector deal, particularly the evidence of cross-departmental working, which underlies quite a lot of the work that is beginning to take place. I very much hope that today’s sector deal is simply the tip of the iceberg of the Government’s AI policy and ambition. I note that the Minister used the word “ambition”, and I very much hope that this is but the first in a number of steps that need to be taken.

I hope we will have a much more extensive debate when the Government’s response to our Select Committee report is issued in due course, because it covers so many aspects. As I see it, today’s sector deal is essentially a nailing down of the commitments made in the industrial strategy, the proposals in the Hall-Pesenti review and the commitments made in the last Budget. I should be very interested if the Minister could unpack how much actual new money is involved in today’s sector deal, because I see it essentially as a packaging up for the sector rather than a new, dramatic development.

There are many aspects of the sector deal to welcome, not least the role of the British Business Bank in helping finance AI developers, growth companies, and so on. I hope they will be given an even more important role in the future, and I hope they will not go the way of the Green Investment Bank, which is an absolute object lesson for the Government in this respect.

The Select Committee thought that the fundamentals of government policy were right but it was a question of scale, ambition, co-ordination and drive behind the policies of the new bodies involved. There are many examples of this. The noble Lord, Lord Stevenson, rightly mentioned infrastructure investment. When only 3% of the country is covered by ultra-fast broadband, a £1 billion investment is neither here nor there. It is a bit of encouragement but it will not move us very fast up the curve compared to our international competitors. Then again, the scale of the skills gap is absolutely huge. I know that there was some negotiation as part of the Hall-Pesenti review, but 200 new PhDs in AI, as mentioned by the noble Lord, Lord Stevenson—off-the-shelf or not—being initially financed is the absolute bare minimum required.

Then again, we are heavily dependent on skilled EU workers. A Brexit brain drain is already threatening the UK tech sector, which relies heavily on foreign talent from the EU. DeepMind is already setting up a laboratory in Paris because of that. We need overseas students to stay. Will the Government reinstate post-study work visas for graduates in STEM subjects who find suitable employment within six months of graduating? The noble Lord, Lord Stevenson, mentioned a doubling of tier 1 visas. That is very welcome but why do not the Government declare, as the Select Committee suggested, a shortage occupation in tier 2 for machine learning and computer skills? That might make a huge difference. Collaborative research with EU countries is at risk as well. How will we fill the gap post 2020?

As virtually every Select Committee witness told us, creative skills will be crucial in the mix as well. What are the Government doing to emphasise not just STEM but STEAM in our schools? There is a dangerous dropping off of arts and creative subjects already. But, of course, it is not simply about the opportunities, of which there are many, but mitigating the risks as well, and making sure that we retain and build public trust in the new technologies involved. Inclusion is of crucial importance in this context. A strong inclusion and diversity agenda ran through our Select Committee report, which has been welcomed. In particular, we need more women in digital roles to help fill the skills gap. What are the Government doing to develop a culture that is inclusive, respectful and encourages women to pursue careers in AI?

Ethics must likewise be moved forward. I hope that the Government move forward quickly with this via the Centre for Data Ethics and Innovation by convening an international conference and other forms of international collaboration. I include the EU in this. Yesterday it published its report, Artificial Intelligence for Europe. In that, the role of the Charter of Fundamental Rights is highlighted as being the instrument by which one could incorporate a code of ethics. This makes the vote on Monday doubly valuable and I hope the Government will take due note. That is a very helpful way of making sure that we have an ethical framework that could cover most European countries.

I could raise many issues, not least data, which the noble Lord, Lord Stevenson, mentioned. I hope the Government will be talking to the Competition and Markets Authority about issues such as data monopolies. I hope that, as the Data Protection Bill goes through the Commons, they will look at whether we have real strength, and whether Article 22 of the GDPR really gives us sufficient rights of explainability for autonomous decision-making, as I raised in this House.

Finally, it is about ambition. If the UK wants to be seen as a world leader in any aspect of AI development, it needs to move as quickly as other countries, such as Canada and France. It must set its ambitions high to be a global player. It must welcome talent in growing its AI industry from start-ups to the next level.

Data Protection (Charges and Information) Regulations 2018

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Tuesday 20th March 2018 Grand Committee

[Lord Clement-Jones (LD)]

I thank the Minister for her comprehensive introduction. We all accept the need for a well-resourced Information Commissioner’s Office. On Report, we welcomed what the noble Lord, Lord Ashton, who was the Minister at the time, had to say in response to an amendment from the noble Lord, Lord Puttnam, about the commitment to ensuring that the commissioner has adequate resources to fulfil her role as a world-class regulator and to take on the extra regulatory responsibilities set out in the Bill. There is no argument between us about the principles of funding the Information Commissioner’s Office. The pledges made by the noble Lord, Lord Ashton, were very welcome. We wish the Information Commissioner well with her extended role and her extended £33 million budget.

That does not come without a cost to data controllers. It is not simply a question of deciding the budget and then deciding what people pay, without considering affordability. Local authorities have put to me that they are very concerned at the lack of consultation offered to all affected parties, including the LGA, ahead of the new charging model. Apparently, approximately 40,000 data controllers were written to, inviting them to respond to the consultation: I understand that about 2,000 did so. However, not all affected parties were offered the opportunity to contribute. The consultation, and responses to it, are not publicly available, which differs from most government consultation. Will the Minister commit to publishing the outcome of the consultations?

Local authorities are concerned by what appears to be a rather arbitrary increase in the charges that they will have to pay to the ICO as data controllers. I also understand that it is proposed that elected representatives will be subject to a small increase in their charge. Under the new charging model, councils with 250 or more employees are defined as large data controllers and are subject to the highest fees under the SI. In practice, most councils that would have been paying £500 to register with the ICO will now have to pay £2,900. This is an increase of 480%; an inflationary increase would have seen the fees rise from £500 to £623.61. This comes at a time when local government is under significant financial pressure and local councils are receiving no additional government funding to help implement the GDPR.

It seems from the Explanatory Memorandum that the Government are considering an exemption for elected representatives, subject to a full review of exemptions in general. In the current process, there are exemptions from the requirement to register with the ICO. These include exemptions for those maintaining a public register, for staff administration purposes, for advertising and for accounting. I refer the Minister to paragraph 7.10 of the Explanatory Memorandum, where the Government state their intentions about the review.

On these Benches, we would definitely support an exemption for elected representatives. Councillors should not have to pay a charge to the Information Commissioner to correspond with their residents and should not incur a cost associated with their duties in representing their constituents. I am interested to hear what the Minister has to say about the review which is heralded in the Explanatory Memorandum.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I agree with just about everything that the noble Lord, Lord Clement-Jones, said, particularly on the comments—they have been passed to me as well—from the Local Government Association, which seems to have been badly hit by the changes. He will remember, although I think this predates the Minister, that we went through some of the thinking behind the charges in what is now the Digital Economy Act. He will recall the debate and discussion at that time; it is good to see it coming through now in a form that we can look at.

I will not repeat some of the issues that have been raised because I come at this with a slightly different argument, although we arrive at roughly the same place. First, noble Lords could not have gone through the Data Protection Bill without recognising, as the Minister did, the huge amount of extra work and responsibility that will lie with the ICO after it went through. It is an astonishing step change. Yes, it is true that that is reflected in the additional resources, which will be calculated to flow from these changes and increases in the fee structure, but two questions arise. We are relying for the arithmetic on work that was done, as I understand it, by working through the new charge structure; the department has modelled the anticipated income generated to try to come up with something. Two things occur to me from that.

First, what happens if the calculations are wrong? As we speak, we are living through a situation in which a huge additional workload has suddenly landed on the ICO’s desk. Cambridge Analytica was not a household name before this week’s revelations but if the matter goes to court to get submissions, the ICO will have to prosecute and defend itself. I cannot quite see where that was built into things. I am not looking for a specific response but I want to sharpen the question. It is all very well being on a cost-recovery basis when the funds exceeds the expenses, but what happens when they do not? Who will carry the cost? Can the Minister comment on that? Secondly, would it be possible to get a bit more detail about how this plays out in real terms, given the reserves that are allowed to be carried forward and the implication for what work would have to be cut if it is not possible to carry forward deficits from year to year? We are talking about government accounting so, presumably, the NAO will be watching very carefully. I worry a bit about what will happen in the short term. I do not want a detailed response now but I would be happy to get a letter on that.

My second point is about the assertion made that somehow the structure we have here is a way of responding to what was described in paragraph 7.2 of the Explanatory Memorandum as building,

“regulatory risk into the charge level”.

I do not understand what risk is being assessed here. Again, this may need a more considered response. Is it the numbers? It is clear that there will be a lot more tier 1 organisations and therefore a lot of detailed administration and housekeeping, but does that equate to risk? I think not. I therefore wonder why the charge, relatively speaking, is being kept at roughly what it was before—it is still £40—and has been extended.

I do not think that the noble Lord, Lord Clement-Jones, made this point today but I am sure that he raised it in discussion in Committee and on Report. We are talking about a situation where it did not matter whether you registered with the system under the Data Protection Act 1998, despite the fact that the noble Lord did not get his amendment through on having a statutory register for these things. I am sorry about that. There will effectively be a register for all those who use data, which will be policed to some extent. Therefore, the chances are that anyone who was not paying before will certainly be caught now. There is a huge additional element here that has not been previously caught or considered. I am intrigued by that. Therefore, the comment made about not wanting micro-organisations to pay for their activities further up the scale struck me as a little odd. Perhaps we might come back to that.

Tier 2 includes the mid-range of the organisations. A lot of companies are in this area; in fact, the bulk of activity in the industry. Yes, they should pay for services received but I would hazard that they are extremely low-risk. I cannot believe that major breaches of personal data are happening in a large number of small and medium-sized enterprises. That bears comparison with the new third tier that has been introduced to look at large organisations; we are talking about Facebook and other organisations which I do not need to name. We are asking them only to pay a modest proportion more than small and medium-sized organisations. I do not know how that equates to risk. It seems that the evidence of this week is that 50 million Facebook accounts could have been picked up and used in some alleged way of trying to influence elections. We are talking about damage on a substantial scale, which is not the same, in any sense, as that which might occur to citizens—the local joiner, plumber or building firm mislaying their accounting records for a short period. However, I am prepared to listen to the arguments on that.

--- Later in debate ---

[Lord Clement-Jones]

Yet their resources are shrinking on a daily basis.

[Lord Stevenson of Balmacara]

It is not so much whether they should be paying—we probably accept that they should, though how much is in question—it is the fact that they were not consulted. The consultation exercise did not reach that far and the Minister was going to try to give some information about why that could have been.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

3rd reading (Hansard): House of Lords & Report: 2nd sitting (Hansard): House of Lords
Wednesday 17th January 2018 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, we should all thank the noble and learned Lord, Lord Brown, together with officials of the House, for having prompted these amendments. In thanking the Minister I want also to mention in dispatches my noble friend Lady Hamwee. She highlighted this point early on in Committee, I think to the incredulity of the House at the time because it was thought that it was only Members of Parliament who should have the exemptions in the Bill. These elegant solutions demonstrate that parliamentary privilege covers both Houses.

[Lord Stevenson of Balmacara]

I too thank the noble and learned Lord, Lord Brown of Eaton-under-Heywood, for his stalwart work in bringing forward these important amendments. What he did not say but we should also recognise is that on a couple of occasions he had to stay late in order to do that, I am sure far beyond his normal bedtime.

Unfortunately, squeezed out in the second group of amendments which I also supported but which did not find favour with the Government, was an effort to try to retain the current arrangements under which noble Lords of this House who wish to speak about individual cases would be able to do so on the basis that they would be treated as elected representatives. That did not win the support of the Government and therefore will be left to the other place, which I am sure will immediately seize on it and see the injustice reversed. In due course it will come back to us. With that, I support the amendment.

--- Later in debate ---

[Lord Clement-Jones]

My Lords, I congratulate the noble Earl on the assiduous way in which he has pursued these issues on behalf of the insurance industry, and thank the Minister for his close engagement on them. We very much welcome these amendments but I have a couple of clarificatory questions for the Minister, the answers to which would be helpful in making sure that we all understand the exact position of the insurance industry relative to these new provisions.

The proposed derogation to paragraph 13A of Part 2 of Schedule 1 does not specifically address the processing of data relating to criminal convictions or offences. First, can the Minister confirm that paragraph 28 of Part 3 of Schedule 1 may be read in conjunction with paragraph 13A of Part 2 to permit the processing of data relating to criminal convictions or offences where it is necessary for an insurer to process this data for policy underwriting and claims management or related money laundering and anti-fraud activities? The reference in paragraph 13A to,

“racial or ethnic origin, religious or philosophical beliefs or trade union membership, genetic data or data concerning health”,

would appear to preclude this, but we assume that this is not the intent.

Secondly, can the Minister confirm that the processing of special category data or data relating to criminal convictions or offences by insurance companies and related intermediaries, such as reinsurers and brokers, for the purposes of conducting insurance-related business and managing claims will be regarded by the Government as purposes that are in the “substantial public interest”?

[Lord Stevenson of Balmacara]

My Lords, I welcome these amendments and it is nice to hear the story that has come through of a listening Bill team and a listening Minister, and the way in which the industry has organised itself to make sure that the perceived faults were remedied.

If it is of interest to the House, a lot of us have been doing events with professional bodies and others interested in this whole area since the Bill started. I was reflecting just before this Third Reading debate that there were really only three things that came up time and again at these sessions, after the presentations by the experts and others such as us who were trying to keep up with what they were saying. The first was Article 8 of the European Charter of Fundamental Rights—that came up time and again. People did not understand the basis on which their rights would be retained, but we have dealt with that.

The second was the—unpronounceable—re-identification of previously anonymised data. I suspect that was because there are one or two very active persons going around all these groups—I seemed to recognise their faces every time it came up—who were anxious to make sure that this point was drilled back to Ministers. We have found a way forward on that, which is good.

The third item was the insurance industry time and time again raising points similar to those raised by the noble Earl, Lord Kinnoull, by suggesting that there was a problem with efficient markets and the operation of customer good, and that the Government had to look again. We are very glad that the Government have done so. I have now ticked off all my list and it is done.

--- Later in debate ---

[Lord Clement-Jones]

My Lords, I will just slip in for a couple of minutes in the light of the Minister’s very shrewd appraisal of the progress on the Bill. I had not quite realised that the Bill team were treating the Digital Economy Bill as a dress rehearsal for the Data Protection Bill, but that is really why this has gone so smoothly, with very much the same cast on the Front Benches.

We on these Benches welcomed many aspects of the Bill on its introduction last October and continue to do so. Indeed, it has improved on the way through, as the Minister pointed out. I thank my noble friends Lord Paddick, Lady Hamwee, Lord McNally, Lady Ludford and Lord Storey for helping to kick the tyres on this Bill so effectively over the last four months. I also thank the noble Lord, Lord Stevenson, and all his colleagues for a generally harmonious collaboration in so many areas of common interest.

I very much thank the Minister and all his colleagues on the Front Bench and the excellent Bill team for all their responses over time to our particular issues. The Minister mentioned a number of areas that have been significant additions to the Bill. I thank the Minister for his good humour throughout, even at late hours and on many complicated areas. We are hugely pleased with the outcome obtained by the campaign of the noble Baroness, Lady Kidron, for age-appropriate design, which many of us on these Benches think is a real game-changer.

There is just a slight sting in the tale. We are less happy with a number of aspects of the Bill, such as, first, the continuing presence of exemptions in paragraph 4 of Schedule 2 for immigration control. Solicitors need the facts to be able to represent their clients, and I am afraid these immigration exceptions will deny access to justice.

Secondly, the Minister made a pretty good fist of explaining the way the new framework for government use of personal data will operate, but I am afraid, in the light of examples given, for instance by the noble Earl, Lord Clancarty, in relation to the Department for Education’s approach to the national pupil database, and now concerns over Public Health England’s release of data on 180,000 patients to a tobacco firm, that there will be continuing concerns about that framework.

Finally, one of the triumphs of debate in this House was the passing of the amendment from the noble Baroness, Lady Hollins, calling for, in effect, Leveson 2. The response of the Secretary of State, whose appointment I very much welcomed at the time, was rather churlish:

“This vote will undermine high quality journalism, fail to resolve challenges the media face and is a hammer blow to local press”.


On Sunday he did even better, saying it could be the “death knell” of democracy, which is pretty strong and unnecessary language. I very much hope that a sensible agreement to proceed is reached before we start having to play ping-pong. I am sorry to have to end on that slightly sour note, but it is an important amendment and I very much hope that it stands.

[Lord Stevenson of Balmacara]

My Lords, from this side of the House, I also thank the Bill team, as I think I can call them. What we faced when we first came across the Bill was a beast—a beast dressed up as legislation but a beast in many ways. As the Minister said, we got round most of it but then discovered there were another 250 amendments coming down the track from the Government. Although they were dressed up as being small, trivial things, you have to read them and understand them, and they add a little to one’s workload.

If we did not learn to love the Bill, we certainly at least respect it. It is a good Bill, now much better than it was before. I hope it will have the longevity of its predecessor, the 1998 Act. It has the same aspirations and aims but, because of the inclusivity of the age-appropriate design and other matters that the noble Lord, Lord Clement-Jones, mentioned, it also begins to shape the debate that we still need to have about how and under what conditions we as a mature democratic society wish to engage with those who provide information, data, statistics, facts, communications and other things in relation to the electronic world in a way that is, if not comparable to, at least as effective as what is applied in the current non-virtual world. That is not the subject of the Bill, I am afraid, but it is something that will trouble this House now and in the future. We should not shy away from it because at its heart lies the future of our society. Morality and ethics are dimensions that we have not yet touched on in the Bill; they are still to come. They may well be foreshadowed for us by the creation of a data ethics commissioner of some kind. I welcome that and hope it will come forward quickly. Without it, we really are not in a very good place, despite the strength of the Bill.

For my part I am grateful to my noble friend Lord Kennedy and to my apprentice—if I can call someone of such distinguished age and experience that—my noble friend Lord Griffiths of Burry Port, who is going to take over my responsibility here in the main, although, as the Minister said, I am not leaving the Front Bench; I am simply moving sideways to accommodate those with greater skills and abilities than I have myself.

I have enjoyed the Bill tremendously. It is the sixth Bill that I have done with DCMS, and five of those have been with the current team. With familiarity comes a certain ability both to see through the artifices as they come at you but also to recognise a true offer when it comes, and both sides have benefited from that. We understand some of the pressures a bit more, particularly the difficult time that any Bill team has when it is agreed to move forward but the processes and procedures in Whitehall are so slow that they cannot keep pace with our aspirations for doing it. That is very frustrating for all concerned.

On that point, but not related to the mechanics, there is a question that the House must address at some point in the near future. What happens when it is agreed around the House, through Second Reading and Committee and approaching Report, that a desired amendment would bring public good but it cannot be moved because it falls outwith the narrow scope of the Bill, is a frustration that we have all encountered on this Bill and the previous Bill that I was involved with. There is a solution to that which should be discussed by the Procedure Committee. I hope it will do so in the near future, and I will be writing to it to that effect.

The Bill team have been absolutely fantastic. I gave them a rousing welcome when they first arrived because they have a trick at DCMS, which I recommend to all departments, of bringing together in one place at the very beginning of the process all the documents that you need to work out what you are talking about. If only every Bill team did that, we would all have much easier lives. They did it again this time, and it was fantastic. I have enjoyed working with them; their professionalism and efficiency were wonderful and a great help to us. Our support is minuscule in comparison; effective and efficient though Nicola Jayawickreme and Dan Stevens are, there are only two of them to support all our work. I wish to ensure that our sincere appreciation is on the record.

This has been an enjoyable ride. I have had a great time, waxing lyrical on things I did not think I would ever want to talk about. I hope that the Bill passes, and that when it comes back we will be able to deal with it expeditiously and appropriately.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Report: 3rd sitting (Hansard - continued): House of Lords
Wednesday 10th January 2018 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, I thank the Minister. We on these Benches had considerable activity from the academic community, security researchers and so on. I am delighted that the Minister has reflected those concerns with the new amendments.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I echo the noble Lord’s words. We also welcome these amendments. As has been said, this issue was raised by the academic community, whose primary concern was that the way the Bill had originally been phrased would make important security research illegal and weaken data protection for everyone by that process. It would also mean that good and valid research going on in our high-quality institutions might be at risk.

I do not in any sense want to question the amendments’ approach, but I have been in further correspondence with academics who have asked us to make a few points. I am looking for a sense that the issues raised are being dealt with. Either a letter or a confirmation that these will be picked up later in the process of the Bill is all that is necessary.

First, it is fairly common-sense to say that companies probably would not be very happy if a researcher picks up that they are not doing what they say on the tin—in other words, if their claim that their data has been anonymised turns out not to be the case. Therefore, proposed new subsection (2)(b) may well be used against researchers to threaten or shut down their work. The wording refers to “distress” that might be caused, but,

“without intending to cause, or threaten to cause, damage or distress to a person”,

seems a particularly weak formulation. If it is only a question of distress, I could be distressed by something quite different from what might distress the noble Lord, who may be more robust about such matters. I think that is a point to take away.

Secondly, we still do not have, despite the way the Minister introduced the amendment, definitions in the Bill that will work in law. “Re-identification”, which is used in the description and is part of the argument around it, is still not defined. Therefore, in proposed new Clause 161A(3), as mentioned by the noble Lord who introduced the amendment, the person who,

“notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification”,

has to do this,

“without undue delay, and … where feasible, not later than 72 hours after becoming aware of it”.

That is a very tight timetable. Again, I wonder if there might be a bit more elasticity around that. It does say “where feasible”, but it puts rather tight cordon around that.

We are trying to make it safe for researchers and data scientists to report improperly de-identified data, but in the present arrangements the responsibility for doing all this lies with the researcher. We are asking a researcher to go to court, perhaps, and defend themselves, including arguing that they have satisfied Clause 162(2)(a) and (b) and Clause 162(3)(a), (b) and (c), which is a fairly high burden. All in all, we just wonder whether how this has been framed does the trick satisfactorily. I would be grateful for further correspondence with the Minister on this point.

Finally, there is nothing in this amendment about industry. It may not be necessary but it raises a question that has been picked up by a couple of people who have corresponded with us. The burden, again, is on the researcher. Is there not also a need to try to inculcate a culture of transparency in the anonymisation processes which are being carried out in industry? In other words, if there is a duty on researchers to behave properly and do certain things at a certain time, should there not also be a parallel responsibility, for example, on companies to properly and transparently anonymise the data? If there is no duty for them to do it properly, what is in it for them? It may well be that that is just a natural aspect of the work they are doing, but maybe the Government should reflect on whether they are leaving this a little one-sided. I put that to the Minister and hope to get a response in due course.

--- Later in debate ---

[Lord Clement-Jones]

My Lords, as a result of the vagaries of grouping, redrafting and so on, I am in danger of being the tail that wags the dog on this group of amendments, especially as Amendment 175 deals with the processing of personal data to which the GDPR does not apply. Amendment 175A is a much broader amendment, dealing with the implementation of not only article 82 but other aspects that are extremely desirable.

I know that the Minister will be fairly brief in response, so I will not rehearse all the arguments we put forward in Committee. The noble Lord, Lord Stevenson, led on this group of amendments and put forward many of the arguments made by a great number of organisations, such as Which?, Age UK, Privacy International and the Open Rights Group, for this kind of group representation, along the lines of the super-complaints in the Consumer Rights Act, which are highly desirable. I recommend—which shortens the job I have of introducing this amendment—that the Minister reads the blog on the Privacy International site written by the chair emeritus of PI’s board of trustees, Anna Fielder. She puts the arguments extremely well and wrestles with some of the points that the Minister made in Committee, which is extremely useful. I am certainly not going to go through all that, let alone the polling data, which I think refutes quite a lot of what the Minister said. This is extremely desirable. I support very strongly what the noble Lord, Lord Stevenson, has tabled. It is quite comprehensive in many ways. I look forward to his introduction of his amendment.

Finally, a very important factor in all of this is the support of the Information Commissioner. She has come to the conclusion, as she wrote very convincingly in her second memorandum, that we need to have this kind of right of representation where consent has not necessarily been obtained. I think we should listen very carefully to what she has to say. I beg to move.

[Lord Stevenson of Balmacara]

My Lords, I am grateful to the noble Lord, Lord Clement-Jones, for his introduction and for paving the way to the comments I want to make. He suggested further reading but I might be able to shorten the reading list for the Minister, because I am going to cite a bit of what has been sent as part of that package. We went through most of the main issues and had a full response from Ministers the last time this was raised, in Committee. But since then we have of course amended the Bill substantially to provide for a significant amount of age-appropriate design work to be done to protect children who, either lawfully or unlawfully as it might be, come into contract arrangements with processors of their data.

That data processing will almost certainly be done properly under the procedures here. We hope that, within a year of Royal Assent, we will see the fruits of that coming through. But after that, we will be in uncharted territory as far as younger persons and the internet are concerned. They will obviously be on there and using substantial quantities of data—a huge amount, as is picked up when one sees one’s bills and how much time they spend on downloading material from the internet and has to find the wherewithal to provide for them. But I am pretty certain there will also be occasions where things do not work out as planned. They may well find that their data has been misused or sold in a way they do not like, or processed in a way which is not appropriate for them. In those circumstances, what is the child to do? This is why I want to argue that the current arrangements, and the decision by the Government not to allow for the derogation provided for in the GDPR under article 82 to apply, may have unforeseen consequences.

I am grateful to the noble Lord, Lord Clement-Jones, and the noble Baroness, Lady Kidron, for supporting Amendment 175A, and I look forward to her comments later on, particularly in relation to children’s use. It is important to recognise that, if there is a derogation and it is not taken up, there has to be a good reason for that. The arguments brought up last time were largely along the lines that it would be overcomplicated to have two types of approach and that, in any case, there was sufficient evidence to suggest that individual consumers would prefer to be represented when they do so—of course, that falls away when we talk about children.

In Amendment 175A, we are trying to recognise two things: first, the right of adults to seek collective redress on issues taken up on their behalf by bodies that have a particular skill or knowledge in that area and, secondly, to do this without the need to form an association with an individual or group, or a particular body that has a responsibility for it. The two parts of the amendment will provide a comprehensive regime to allow victims of data breaches to bring proceedings to vindicate rights to proper protection of their personal data, always bearing in mind that children will have the additional cover provided by theirs being a third-party involvement. We hope that there will not be serious breaches of data protection. We think that the Bill is well constructed and that in most cases it will be fine, but the possibility that it will happen cannot be ignored. This parallels other arrangements, including those in the Consumer Rights Act 2015, which apply to infringements of competition law—not a million miles away from where we are here—and for which there is a procedure in place.

To anticipate where the Government will come from on this, first, I think they will say that there is a lot going on here and no evidence to suggest that it should work. I suggest to them that we would be happy with a recognition that this issue is being applied elsewhere in Europe and that there is a discrepancy if it is not in Britain. Secondly, there may be a good case for waiting some time until we understand how the main provisions work out. But a commitment to keep this under review, perhaps within a reasonable time after the commencement of the procedures—particularly in relation to children and age-appropriate design—to carry out a formal assessment of the process and to consider its results would, I think, satisfy us. I accept the argument that doing too much too soon might make this difficult, but the principle is important and I look forward to the responses.

--- Later in debate ---

[Lord Stevenson of Balmacara]

My Lords, we can be quite brief on this matter. It is an open secret that both the Government and Her Majesty’s loyal Opposition, joined by others who have signed Amendment 181, were keen to try to move ahead with the idea of setting up a data ethics board or panel and giving it powers and teeth, particularly in light of the recent Budget, in which it was clear that there was money available for it to be established and start spending. We felt that it would be nice to get that going. Unfortunately, the rules of the House are so tight that it has not been possible to find a form of words for the powers that would be used to set up this advisory board which would be sufficiently broad to give a proper basis for the ambitions that we all share for it. On the basis that I think the Government may have something to say about this, I will not extend the discussion on this, because there is so much common ground. I look forward to hearing from the Minister, but to get the debate going I beg to move.

[Lord Clement-Jones]

My Lords, we are at the last knockings on most of the Bill. It is rather ironic that one of the most important concepts that we need to establish is a new data ethics body—a new stewardship body—called for by the Government in their manifesto, by the Royal Society, by the British Academy and by many others. Many of those who gave evidence to our Select Committee want to see an overarching body of the kind that is set out, and with a code of ethics to go with it. We all heard what the Minister had to say last time; we hope that he can perhaps give us more of an update on the work being carried out in this area.

This should not be and I do not think it will be a matter of party contention; I think there will be a great deal of consensus on the need to have this kind of body, not just for the narrow field of data protection and the use of data but generally, for the wider application in the whole field, whether it is the internet of things or artificial intelligence, and so on. There is therefore a desire to see progress in fairly short order in this kind of area. One of the reasons for that is precisely because of the power of the tech majors. We want to see a much more muscular approach to the use of data by those tech majors. It is coming down the track in all sorts of different varieties. We have seen it in debates in this House; no doubt there will be a discussion tomorrow about social media platforms and their use of news and content and so on. This is therefore a live issue, and I very much hope that the Minister will be able to tell us that the new Secretary of State is dynamically taking this forward as one of the top items on his agenda.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Report: 2nd sitting (Hansard): House of Lords
Wednesday 13th December 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, the Government must be quaking in their shoes whenever a Back-Bencher offers to come to their help. I looked across at the Dispatch Box when I heard the noble Lord, Lord Moynihan, make that offer and I saw a definite quiver come over the Minister’s face. Clearly, we are in for something rather interesting. We were entertained by the noble Viscount, Lord Falkland, with his worries about the BHA, but he said he thought that it is really quite simple at the end of the day—we need to keep the money out and sort out the betting influences that are affecting all our sports. He is absolutely right. The public have come to the end of their tether and it is time that we got this sorted: we have to keep sport clean and eliminate cheating. The data is key to this, as the noble Lord, Lord Moynihan, said.

We expect a great deal of our athletes in terms of their whereabouts and their strict liability, so we have to make sure that the systems under which they operate are fair, properly organised and regulated. In short, we have such high stakes in this that we have to be sure that we up our game—I am sorry about the puns. We should be clearer than we are at the moment about who has responsibility for what and how it is operated, and that is what this amendment is about. DCMS needs a stronger NDPB, in the form of UKAD or a successor body, and there needs to be an authority exercised with care and consideration as to how the rules will apply and to whom they apply. All these definitional points, all the concern about where it goes, are tied up in that set of constructs, which is what this amendment deals with. I think it is very powerful.

If noble Lords look back at the way in which a state was able to influence the way that the drug-testing system operated in the winter Olympic Games in Russia, they will understand how this thing has got to a new level of concern. We must have appropriate safeguards and ways of operating in place to insulate those who are trying to do the right thing from the charge that they are involved too closely. The public will stand for no less. I recommend this amendment very strongly and we will support it should it be necessary to take it to a vote. I hope that that will not be necessary, because as the noble Lord, Lord Moynihan, said, this is an area of such importance that the right thing to do would surely be for the Government to accept this amendment today and bring it back at Third Reading with a proper wording and proper consideration that will reassure any who still doubt it. In the interim, we will support it if necessary.

[Lord Clement-Jones (LD)]

My Lords, as ever the noble Lord, Lord Moynihan, made his case extremely well. We on these Benches share his objectives and, indeed, most of the objectives of the noble Lord, Lord Stevenson, around clean sport, particularly putting UKAD on a statutory footing and having a proper framework around the powers in the Bill.

I know that the noble Lord, Lord Moynihan, feels that these need a proper definition and control. However, despite the noble Lord’s best efforts this amendment is not the finished article. Sadly, there are still discussions taking place. Noble Lords have had a great deal of material from governing bodies, including the England and Wales Cricket Board, the Rugby Football Union, the British Horseracing Authority and the Sport and Recreation Alliance, which by itself represents some 320 organisations.

Further discussions need to take place so that we get to an agreed position. I feel very uncomfortable at this point. All those governing bodies may be speaking with different voices, as the noble Lord, Lord Moynihan, suggests, and he has entered discussion with them in good faith, but other voices have come to us saying that they are not yet able to accept what he has put forward. There is still work to be done. I very much hope that the Minister will take on board the fact that many of us around the House, particularly on these Benches, want those conversations to continue and an agreed amendment to be brought forth at Third Reading.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Committee: 6th sitting (Hansard): House of Lords
Wednesday 22nd November 2017 Lords Chamber

[Lord Stevenson of Balmacara]

My Lords, this is a relatively narrow point and affects only a very small part of the Bill, but is still quite important. The amendments in the group mainly cover the question of how the Bill can reach out to the question about anonymisation and how, or not, it plays against de-identification. There are two amendments and a clause stand part Motion which relate to other slightly different issues, which we will get to in turn.

Amendment 170CA would insert into the Bill the term “anonymisation”, as there is no definition of de-identification in the Bill. I will come back to explain what that means in practice. Amendment 170CB provides an important exemption for data scientists and information security specialists dealing with a particular area, because there is a fear that the introduction of criminal sanctions might mean that they would be caught when they are trying to consider the issue for scientific and other reasons. Amendment 170CC adds a definition of identified data—after all, if it is to be criminalised, there needs to be a definition. This definition will cover cases which involve names of individuals, but will also cover those where fingerprints, for instance, are used to identify people.

The clause creates a new offence of knowingly or recklessly re-identifying information that has been de-identified without the consent of the controller. Amendment 170F asks for guidance relating to this offence. It is at the request of the Royal Society, because it wants clarity on the legal basis for processing.

Amendment 170G concerns transparency. If we are going to go into this area, it is very important that we know more about what is happening. The amendment suggests that the Information Commissioner,

“must set standards by which a data controller is required to anonymise personal data”.

There may be lots of new technologies soon to be invented or already available, and it is important that the way in which this important work goes forward can be flexed as and when new technologies come forward. We think that the Information Commissioner is in the strongest position to do that.

The other set of amendments to which our names are attached, Amendments 170E and 170H, relate to particular problems that can arise in large databases within health. There is a worry that where re-identification occurs by accident or just through the process of using the data, an offence will be created. MedConfidential suggests that some form of academic peer reviewing might be useful in trying to assess whether this was a deliberate act or just an unfortunate consequence of the work being done by those looking at the dataset concerned. The further amendment, Amendment 170H, clarifies whether an offence actually occurs when the re-identification work applies to disseminated NHS data —which of course, by its very nature, is often rather scattered and difficult to bring together. There is a particular reason for that, which we could go into.

At the heart of what I just said is a worry that certain academics have communicated to us: that the Bill is attempting to address what is in fact a fundamental mathematical problem—that there is no real way of making re-identification illegal—with a legal solution, and that this approach will have limited impact on the main privacy risks for UK citizens. If you do not define de-identification, the problem is compounded. The reference I have already made suggests that there might be advantage to the Bill if it used the terms used in the GDPR, which are anonymisation and pseudonymisation.

The irony which underlies the passion with which we have received submissions on this is that the people likely to be most affected by this part of the Bill are UK information security researchers, one of our academic strengths. It seems ironic that we should be putting into the Bill a specific criminal penalty which would stop them doing their work. Their appeal to us, which I hope will not fall on stony ground, is that we should look at this again. This is not to say in any sense that it is not an important issue, given the subsequent pain and worry that happens when datasets certified as anonymised are suddenly revealed as capable of being cracked, so people can pick up not just details of information about dates of birth or addresses but much more important stuff to do with medical health. So it is very important—and others may want to speak to the risk that it poses also to children, in particular. I hope that that is something that we might pick up.

There needs to be a proper definition in the Bill, whatever else we do about it, and that would be right in a sense. But we would like transparency about what is happening in this area, so that there is more certainty than at present about what exactly is meant by anonymous data and whether it can be achieved. That could be solved if the Information Commissioner is given responsibility for doing it. I beg to move.

[Lord Clement-Jones (LD)]

We are in the thickets here at the interface between technology, techno-speak and legality. Picking our way through Clause 162 is going to be rather important.

There are two schools of thought. The first is that we can amend this clause in fairly radical ways—and I support many of the amendments proposed by the noble Lord, Lord Stevenson. Of course, I am speaking to Amendment 170E as well, which tries to simplify the language and make it much more straightforward in terms of retroactive approval for actions taken in this respect, and I very much hope that parliamentary draftsmen will approve of our efforts to simplify the language. However, another more drastic school of thought is represented by many researchers—and the noble Lord, Lord Stevenson, has put the case very well that they have put to us, that the cause of security research will be considerably hampered. But it is not just the research community that is concerned, although it is extremely concerned by the lack of definition, the sanctions and the restrictions that the provisions appear to place on their activities. Business is also concerned, as numerous industry practices might be considered illegal and a criminal offence, including browser fingerprinting, data linkage in medicine, what they call device reconciliation or offline purchases tracking. So there is a lot of uncertainty for business as well as for the academic research community.

This is where we get into the techno-language. We are advised that modern, privacy-enhancing technologies such as differential privacy, homomorphic encryption—I am sure that the Minister is highly familiar with that—and question and answer systems are being used and further developed. There is nothing worse than putting a chill on the kind of research that we want to see by not acknowledging that there is the technology to make sure that we can do what we need to do and can keep our consumers safe in the circumstances. The fact is that quite often anonymisation, as we are advised, can never be complete. It is only by using this new technology that we can do that. I very much hope that the Minister is taking the very best legal and technology advice in the drafting and purposes of this clause. I am sure that he is fully aware that there is a great deal of concern about it.

--- Later in debate ---

[Lord Stevenson of Balmacara]

My Lords, at earlier stages of the Bill, the Minister and others have been at pains to stress the need to ensure that, whatever we finally do, the Bill should help to build trust between those who operate and accept data and those who provide it—the data subjects. It is important that we look at all aspects of that trust relationship and think about what we can do to make sure that it fructifies. Amendment 184 tries to add to the Bill something that could be there, because it is provided for in the GDPR, but is not there. Will the Minister explain when he responds why article 80(2) of the GDPR is not translated into UK legislation, as could happen? The proposed new clause would provide that,

“a body or other organisation which meets the conditions set out in that Article has the right to lodge a complaint, or exercise the rights, independently of a data subject’s mandate”.

I will largely leave the noble Lord, Lord Clement-Jones, to introduce Amendment 185 because he has a new and brief style of introduction, which we like a lot.

[Lord Clement-Jones]

It is not a new style.

[Lord Stevenson of Balmacara]

It is certainly new to me. He may have been here a lot longer than I have and there have been other occasions where he has been less than fulsome in his contributions. But I am not in any sense criticising him because everything he says has fantastic precision and clarity, as befits a mere solicitor. It is important that we give him the chance to shine on this particular issue as well.

I mentioned what a pleasure it is to have the noble Baroness, Lady Neville-Rolfe, here today, particularly because she will speak very well to the fact that only a few happy months ago we worked on the Consumer Rights Bill, which is now an Act, in which a power was given to private enforcers to take civil action in courts to protect collective consumer rights via an enforcement order. The campaigning consumer body Which? is the designated private enforcer.

Also, in the financial sector, Which?, Citizens Advice, the Federation of Small Businesses and the Consumer Council for Northern Ireland have the power to present super-complaints to the FCA. The super-complainant system is working very well; one reason why the PPI mis-selling scandal was discovered was as a result of the work of Citizens Advice. These independent enforcers of consumer rights in the traditional consumer sector and in the consumer finance sector exist. Why is there no equivalent status for digital consumer enforcers? That is the question raised by the amendment.

The powers for independent action here are important in themselves and I am sure other noble Lords will speak to that point, but they are also really important at the start of this new regime we are bringing in. With the new Data Protection Bill we have a different arrangement. Far more people are involved and a lot more people are having to think harder about how their data is being used. It makes absolute sense to have a system that does not require too much knowledge or detail, which was aided and abetted by experts who had experience in this, such as Which? and others, and would allow those who are a little fazed by the whole process of trying to raise an action and get things going to have a steady hand that they know will take it on behind them.

The Government will probably argue that by implementing article 80(1) of the GDPR they are providing effectively the same service. That is a system under which an individual can have their case taken up by much the same bodies as would be available under article 80(2). However, when an individual complainant is working with a body such as Which?, we are probably talking about redress of the individual whose rights have been breached in some way and exacting from the company or companies concerned a penalty or some sort of remuneration. One can see in that sense that the linking between the individual and the body that might take that on is important and would be very helpful.

However, there are cases—recent ones come to mind such as TalkTalk, Equifax, Cash Converters and Uber—where data has gone missing and there has been a real worry about what information has escaped and is available out there. I do not think that in those cases we are talking about people wanting redress. What they want is action, such as making sure that their credit ratings are not affected by their data having come out and that they could perhaps get out of contracts. One of the issues that was raised with EE and TalkTalk was that people had lost confidence in the companies and wanted to be able to get out of their contracts. That is not a monetary penalty but a different form of arrangement. In some senses, just ongoing monitoring of the company with which one’s data is lodged might be a process. All that plays to a need to have in law in Britain the article 80(2) version of what is in the GDPR. I beg to move.

[Lord Clement-Jones]

My Lords, I strongly support Amendment 184. The Minister will have noticed that Amendment 185 would simply import the same provisions into applied GDPR for this purpose. The rationale, which has been very well put forward by the noble Lord, Lord Stevenson, is precisely the same.

I do not know whether the Minister was choking over his breakfast this morning, but if he was reading the Daily Telegraph—he shakes his head. I am encouraged that he was not reading the Daily Telegraph, but he would have seen that a letter was written to his right honourable friend Matt Hancock, the Digital Minister, demanding that the legislation can and should contain the second limb that is contained in the GDPR but is not brought into the Bill. The letter was signed by Which?, Age UK, Privacy International and the Open Rights Group for all the reasons that the noble Lord, Lord Stevenson, put forward. The noble Lord mentioned a number of data breach cases, but the Uber breach came to light only last night. It was particularly egregious because Uber did not tell anybody about it for months and, as far as one can make out from the press reports, it was a pay-off. There is a very important role for such organisations to play on behalf of vulnerable consumers.

The Which? survey was particularly important in that respect because it showed that consumers have little understanding of the kind of redress that they may have following a data breach. A recent survey shows that almost one in five consumers say that they would not know how to claim redress for a data breach, and the same proportion do not know who would be responsible for helping them when data is lost. Therefore the equivalent of a super-complaint in these circumstances is very important. To add to that point, young people are often the target of advertising and analysis using their personal data. I think they would benefit particularly from having this kind of super-complaint process for a data breach.

I hope very much that the Government, who I believe are conducting some kind of review, although it is not entirely clear, will think about this again because it is definitely something we will need to bring back on Report.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Committee: 5th sitting (Hansard): House of Lords
Monday 20th November 2017 Lords Chamber

[Lord Stevenson of Balmacara]

My Lords, with so many codes of practice flying around it would not be hard to lose one in the crowd, but this one stands out. With this amendment, we are suggesting to the Government that there is a need at the top of the pyramid for a code of practice which looks at the whole question of data ethics and morality. We discussed this topic in earlier sittings of the Committee and I think we were of one mind that there was a gap in the overall architecture of the organisations supporting data processing, which concerned us, in the sense that there was a need for an expert body.

The body could be some sort of combination along the lines of the HFEA or the Committee on Climate Change. It would have a duty to look at the moral and ethical issues affecting data collection and use, and be able to do some blue-sky thinking and to provide a supervisory approach to the way in which thinking on these matters would have to go. We are all aware, as has been mentioned many times, that this is a fast-moving technology in an area full of change where people feel a bit concerned about where their data is and how it is being looked at. They are worried that they do not have sufficient control or understanding of the processes involved.

The amendment suggests to the Government a data ethics code of practice which I hope they will look at with some care. It would begin to provide a hand of support to individuals who are concerned about their data and how it has been processed. Under this code of practice the commissioner could set out the moral and ethical issues, rather than the practical day-to-day stuff. It would focus on duties of care and need to provide examples of where best practice can be found. It would increase the security of personal data and ensure that the access to its use and sharing were transparent, and that the purposes of data processing were communicated to data subjects.

Some codes of this type already exist. I think that the Royal Statistical Society has been behind a number of codes on the use of our overall statistics, such as that operated within the OSS. Having read that code, I was struck by how apposite it was to some of the issues faced in the data-processing community. Some of the wording of this amendment comes from that, while other wording comes from think tanks and others who are working in this field. It will also come as no surprise to the Committee that some of the detail in the code’s latter subsections about privacy settings, minimisation standards and the language of terms and conditions also featured in the proposed code recommended to the Committee by the noble Baroness, Lady Kidron, in relation to children’s use of the internet and how their data is treated. The amendment meets other interests and examples of activity. It seems to fulfil a need, which is becoming more pressing every day, and is ambitious in its attempt to try to make sure that whatever regulatory and statutory provisions are in place, there will also be a wider dimension employed, which I think we will increasingly be part of.

I do not expect the Government to accept the amendment tout court, because it needs a lot more work. I fully accept that the drafting is a bit rough at the edges, despite the fact that we spent a lot of time in the Public Bill Office trying to get it right. I have already explained that I am not very good at synthesising in the way that the Bill team obviously is. I have no doubt that when he responds the Minister will be able to encapsulate in a few choice words what I have been struggling to say over the past three or four sentences—he nods, so it is clearly going to hit me again. I hope that he will take away from this short debate that this is an issue that will not go away. It is an issue that we need to address, and it may be that the new body, which was, I think, generally accepted by the Committee as something that we should move to in short order, might take on this as its first task. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, the noble Lord, Lord Stevenson, is too modest about his drafting—I think that this is one of the most important amendments to the Bill that we have seen to date. I am just sorry that we were not quick enough off the mark to put our name to it. I do not know which hand the noble Lord, Lord Stevenson, is using—there seem to be a certain number of hands involved in this—but anybody who has read Jonathan Taplin’s Move Fast and Break Things, as I did over the weekend, would be utterly convinced of the need for a code of ethics in these circumstances. The increasing use of data in artificial intelligence and algorithms means that we need to be absolutely clear about the ethics involved in that application. The noble Lord, Lord Stevenson, mentioned a number of codes that he has based this amendment on, but what I like about it is that it does not predicate any particular code at this stage. It just talks about the desirable architecture of the code. That makes it a very robust amendment.

Like the noble Lord, I have looked at various other codes of ethics. For instance, the IEEE has rather a good code of ethics. This is all of a piece with the stewardship council, the data ethics body that we debated in the previous day in Committee. As the Royal Society said, the two go together. A code of ethics goes together with a stewardship council, data ethics committee or whatever one calls it. You cannot have one without the other. Going forward, whether or not we agree today on this amendment, it is very clear that we need to keep coming back to this issue because this is the future. We have to get it right, and we cannot prejudice the future by not having the right ethical framework.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 13th November 2017 Lords Chamber

[Lord Clement-Jones]

My Lords, we will see if the EU withdrawal Bill gets passed, but that is a matter for another day.

I thank the Minister for his remarks. There are many aspects of his reply which Members around the House will wish to unpick.

[Lord Stevenson of Balmacara (Lab)]

Perhaps I may pursue this for a second. It is late in the evening and I am not moving fast enough in my brain, but the recitals have been discussed time and again and it is great that we are now getting a narrow understanding of where they go. I thought we were transposing the GDPR, after 20 May and after Brexit, through Schedule 6. However, Schedule 6 does not mention the recitals, so if the Minister can explain how this magic translation will happen I will be very grateful.

[Lord Stevenson of Balmacara]

I knew I was slow. We are moving to applied GDPR; that is correct. The applied GDPR, as I read it in the book—that great wonderful dossier that I have forgotten to table; I am sure the box can supply it when we need it—does not contain the recitals.

[Lord Clement-Jones]

My Lords, just to heap Pelion on Ossa, I assume that until 29 March the recitals are not part of UK law.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Monday 13th November 2017 Lords Chamber

[Lord Stevenson of Balmacara]

My Lords, it always used to be said that reaching the end of your Lordships’ day was the graveyard slot. This is a bit of a vice slot. You are tempted by the growing number of people coming in to do a bit of grandstanding and to tell them what they are missing in this wonderful Bill that we are discussing. You are also conscious that the dinner hour approaches—and I blame the noble Baroness, Lady Hamwee, for that. All her talk of dining in L’Algorithme, where she almost certainly had a soup, a main course and a pudding, means that it is almost impossible to concentrate for the six minutes that we will be allowed—with perhaps a few minutes more if we can be indulged—to finish this very important group. It has only one amendment in it. If noble Lords did not know that, I bet that has cheered them up. I am happy to say that it is also a réchauffage, because we have already discussed most of the main issues, so I will be very brief in moving it.

It is quite clear from our discussion on the previous group that we need an ethics body to look at the issues that we were talking about either explicitly or implicitly in our debates on the previous three or four groups and to look also at moral and other issues relating to the work on data, data protection, automatics and robotics, and everything else that is going forward in this exciting field. The proposal in Amendment 78A comes with a terrific pedigree. It has been brought together by members of the Royal Society, the British Academy, the Royal Statistical Society and the Nuffield Trust. It is therefore untouchable in terms of its aspirations and its attempt to get to the heart of what should be in the contextual area around the new Bill.

I shall not go through the various points that we made in relation to people’s fears, but the key issue is trust. As I said on the previous group, if there is no trust in what is set up under the Bill, there will not be a buy-in by the general public. People will be concerned about it. The computer will be blamed for ills that are not down to it, in much the same way that earlier generations always blamed issues external to themselves for the way that their lives were being lived. Shakespeare’s Globe was built outside the city walls because it was felt that the terribly dangerous plays that were being put on there would upset the lieges. It is why penny dreadfuls were banned in the early part of the last century and why we had a fight about video nasties. It is that sort of approach and mentality that we want to get round to.

There is good—substantial good—to be found in the work on automation and robotics that we are now seeing. We want to protect that but in the Bill we are missing a place and a space within which the big issues of the day can be looked at. Some of the issues that we have already talked about could easily fit with the idea of an independent data ethics advisory board to monitor further technical advances in the use and management of personal data and the implications of that. I recommend this proposal to the Committee and beg to move.

[Lord Clement-Jones]

My Lords, the noble Lord, Lord Stevenson, has been admirably brief in the pre-dinner minutes before us and I will be brief as well. This is a very important aspect of the debate and, despite the fact that we will be taking only a few minutes over it, I hope that we will return to it at a future date.

I note that the Conservative manifesto talked about a data ethics body, and this is not that far away from that concept. I think that the political world is coalescing around the idea of an ethics stewardship body of the kind recommended by the Royal Society and the British Academy. Whatever we call it—a rose by any other name—it will be of huge importance for the future, perhaps not as a regulator but certainly as a setter of principles and of an ethical context in which AI in particular moves forward.

The only sad thing about having to speed up the process today is that I am not able to take full advantage of the briefing put forward by the Royal Society. Crucially, it recommends two things. The first is:

“A set of high-level principles to help visibly shape all forms of data governance and ensure trustworthiness and trust in the management and use of data as a whole”.


The second is:

“A body to steward the evolution of the governance landscape as a whole. Such a stewardship body would be expected to conduct expert investigation into novel questions and issues, and enable new ways to anticipate the future consequences of today’s decisions”.


This is an idea whose time has come and I congratulate the noble Lords, Lord Stevenson and Lord Kennedy, on having tabled the amendment. I certainly think that this is the way forward.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Committee: 3rd sitting (Hansard): House of Lords
Monday 13th November 2017 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, the noble Earl, Lord Kinnoull, has clearly and knowledgeably introduced the amendment, which I strongly support. He made clear through his case studies the Bill’s potential impact on the insurance industry, and I very much hope that the Minister has taken them to heart. Processing special category data, including health data, is fundamental to calculating levels of risk, as the noble Earl explained, and to underwriting most retail insurance products. Such data is also needed for the administration of insurance policies, particularly claims handling.

The insurance industry has made the convincing case that if the implementation of the Bill does not provide a workable basis for insurers to process that data, it will interrupt the provision to UK consumers of retail insurance products such as health, life and travel insurance, and especially products with health-related consumer benefits, such as enhanced annuities. The noble Earl mentioned a number of impacts, but estimates suggest that, in the motor market alone, if this issue is not resolved, it could impact on about 27 million policies and see premiums rise by about 3% to 5%.

There is a need to process criminal conviction data for the purposes of underwriting insurance in, for instance, the motor insurance market. Insurers need to process data to assess risk and set the prices and terms for mainstream products such as motor, health and travel insurance.

The key issue of concern is that new GDPR standards for consent for special category data, including health, such as the right to withdraw consent without experiencing detriment, are incompatible with the uninterrupted provision of these products. As the noble Earl, Lord Kinnoull, has clearly stated, there is scope for a UK derogation represented by these amendments, which would be in the public interest, to allow processing of criminal conviction and special category data when it is necessary for arranging, underwriting and administering insurance and reinsurance policies and insurance and reinsurance policy claims. I very much hope that the Minister will take those arguments on board.

[Lord Stevenson of Balmacara (Lab)]

My Lords, the noble Earl, Lord Kinnoull, has done us a great favour in introducing with great skill these amendments, which get to the heart of problems with some of the language used in the Bill. We are grateful to him for going through and picking out the choices that were before the Government and the way their particular choices seem to roll back some of the advances made in the insurance industry in recent years. I look forward to the Minister’s response.

Our probing Amendment 47 in this group is on a slightly higher level. It is not quite as detailed—nor was it intended to be—as the one moved by the noble Earl. We were hoping to raise a more general question, to which I hope the Minister will be able to respond. Our concern, which meets the concerns raised by the noble Earl, Lord Kinnoull, and the noble Lord, Lord Clement-Jones, is where the Government want to get to on this. It must be true that insurance is one of the key problems facing many people in our country. It is the topic that will be discussed in the QSD in today’s dinner break as it bears heavily on financial inclusion issues. So many people in this country do not take out insurance, personal or otherwise, and suffer as a result. We have to be very careful as we take this forward as a social issue.

However, an open-ended derogation to allow those who wish to gather information to make a better insurance market surely also raises risks. If we are talking about highly personal profiling—we may not be because there are constraints in the noble Earl’s amendment—it would lead to a more efficient and cheaper insurance industry, but at what personal cost? For instance, if it is possible to pick up data from those who perhaps unadvisedly put on Facebook or Twitter how many times they get drunk—I am sure that is not unusual, particularly among the younger generation—information could be gathered for a profile that ought to be taken into account for their life, health or car insurance. I am not sure that we would be very happy with that.

Underlying our probing amendment is to ask the Minister to respond—it may be possible by letter rather than today—on protections the Government have in mind. What sort of stock points are there that we can rely on as we move forward in this area? As processing becomes more powerful and more data is available, pooled risks are beginning to look a little old-fashioned. The old traditional model under which insurance is gathered is that the more the pool is expanded, the risks are spread out more appropriately across everybody. The trouble is that the more we know, we will be including people who are perhaps more reckless and therefore skewing the pooling arrangements. We have to be careful about that.

There is obviously a social objective in having a more efficient and effective insurance market but this ought to be counterbalanced to make sure that those people who are vulnerable are not excluded or uninsurable as a result. The state could step in, obviously, and has done so, as we have been reminded already in our Committee discussions about the difficulty of getting insurance for those who build on flood plains. However that is not the point here. This is about general insurance across the range of current market opportunities being affected by the fact that we are not ensuring that the data gathered is both proportionate and correct in terms of what it provides for the individual data subjects concerned.

--- Later in debate ---

[Lord Clement-Jones]

I must say how delighted I am that on this occasion we had the noble Lord advocating his own amendment. I was nearly in the hot seat last week, but we have just avoided it. I was delighted at his powerful advocacy because of course the noble Lord is extraordinarily well informed on all matters to do with sport, and this goes to the heart of sport in terms of preventing cheats who prevent the rest of us enjoying what should be clean sport, however that may be defined. All I have to do is pick out one or two of the elements of what the noble Lord said in my supportive comments.

There is the fact that neither “doping” nor “sport” is defined in the Bill, as the noble Lord pointed out. There is no definition of the bodies to be covered by paragraph 21, which is extremely important. He also made an extraordinarily important point about UKAD. Naming UKAD in the Bill, as the amendment seeks to do, would add to its authority and allow it to carry out all the various functions that he outlined in his speech. If it is necessary to add other bodies, as he suggested, that should of course be considered.

The noble Lord’s reference to performance-enhancing substances, which again are mentioned in the amendment and included in the World Anti-Doping Code, ties the Bill together with that code and was very important as well. Finally, the point that he made about gender and the substances used in connection with gender change was bang up to the minute. That, too, must be covered by provisions such as this. So if the Minister is not already discussing these issues with the noble Lord, Lord Moynihan, I very much hope that he is about to and will certainly do so before Report.

[Lord Stevenson of Balmacara]

My Lords, once again your Lordships’ House is very grateful to the noble Lord, Lord Moynihan, for raising this issue and, as the noble Lord, Lord Clement-Jones, said, for doing so in such a comprehensive way. It is in the context of the much wider range of issues that the noble Lord, Lord Moynihan, has been pursuing regarding how sport, gambling and fairness are issues that all need to be taken together. We have been supporting him on those issues, which need legislation behind them.

Noble Lords may not be aware that we have been slightly accused of taking our time over the Bill. I resist that entirely because we are doing exactly what we should be doing in your Lordships’ House: going through line-by-line scrutiny and making sure that the Bill is as good as it can be before it leaves this House. We saw the noble Lord, Lord Moynihan, at the very beginning of Committee and he then dashed off to Australia to do various things, no doubt not unrelated to sport. He has had time to come back and introduce these amendments—but, meanwhile, the noble Lord, Lord Clement-Jones, and I were debating who was going to pick the straw that would require us to introduce them. We were very lucky not to have to do so because they were introduced so well on this occasion.

Our amendment in this group is a probing amendment that picks up on some of the points already made. It raises the issue of why we are restricting this section of the Bill to “sport”—whatever that is. If we are concerned about performance enhancement, we have to look at other competitive arrangements where people gain an advantage because of a performance-enhancing activity such as taking drugs. For instance, in musical competitions, for which the prizes can be quite substantial, it is apparently possible to enhance one’s performance—perhaps in high trills on the violin or playing the piano more brilliantly—if you take performance-enhancing drugs. Is that not somehow seeking to subvert these arrangements? Since that is clearly not sport, is it not something that we ought to be thinking about having in the Bill as well? I say that because, although the narrow sections of the Bill that relate to sport are moving in the right direction, they do not go far enough. As a society, we are going to have to think more widely about this as we go forward.

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Monday 30th October 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, in moving Amendment 5, I will also speak to Amendment 6. Both are in my name. I will respond later to Amendment 115, which is in the same group but was tabled by other noble Lords. Amendments 5 and 6 are probing amendments to try to tease out what appears to be a change of definition between various parts of the Act.

Amendment 5 relates to page 3 and Clause 3(1), (2) and (3) in Chapter 1, which raise concerns about what exactly is happening with the arrangements. It is easier if I read out the two subsections concerned. Clause 3(2) states that:

“Chapter 2 of this Part … applies to the types of processing of personal data to which the GDPR applies by virtue of Article 2 of the GDPR”.


That is the question I want to peruse, because later in the Bill, on page 11, Clause 19(1)(a) refers to activities which operate. This amendment is a probing one to try to tease out an answer that we can read in Hansard so as to know what exactly we are talking about. It may appear to be a narrow difference or nitpicking, but “an activity” is a very broad term for anything in relation to data processing and contrasts with the narrow way in which Clause 3(2)(a) talks about “types of processing”. Are these the same? If they are not, what differentiates the two? If they are different, why have we got different parts in different areas of the Bill?

Amendment 6 relates to page 3, line 31. This question of definition has come up in relation to Chapter 3 of the part. I understand this to be more of a recital, if I may use that word, than a particular piece of statute and it may not have normative effect, if that is the correct terminology. Clause 3(3)(b) says that the part to which this applies,

“makes provision for a regime broadly equivalent to the GDPR to apply to such processing”.

What is “broadly” in this context? Maybe I am obsessed with the use of English words that have common meanings, but again it would be helpful to have a bit more information on the definition from the Minister when he responds.

Perhaps more than the “quite” used in response to an earlier amendment, this has not got transatlantic resonances, but it is important in questions of adequacy in any agreement we might seek with the EU in the future. “Broadly equivalent” carries echoes of an adequacy agreement, which would assert that the arrangements in the two countries concerned—the EU on the one hand and the third country on the other—were sufficiently equivalent to allow for future reliance on the processes in the third country to be treated as appropriate for the transfer of data into and from, in relation to future industrial processes.

We are aware that an element of legal decision-making arises, which might change that “broadly equivalent” to a higher bar of requirement in the sense that the court is beginning to think in terms of “essentially equivalent”, which is very different from “broadly equivalent”. Again, I would be grateful if the Minister could respond to that. I beg to move.

[Lord Clement-Jones (LD)]

I will speak to Amendment 115 in this splendidly and creatively grouped set of amendments. The Government appear to have removed some of the extraterritorial elements in the GDPR in applying derogations in the Bill. Paragraph 9(d) of Schedule 6 removes all mention of “representative” from the Bill. This could have major consequences for data subjects.

Article 3 of the GDPR extends its provisions to the processing of personal data of data subjects in the European Union by a controller not established in the European Union. This happens when a controller is offering goods or services into the European Union. In such circumstances, article 27 requires a representative to be appointed in a member state, if a controller is not in the Union. This article is removed by paragraph 23 of Schedule 6.

Recital 80 of the GDPR explains the role of the representative:

“The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority … including cooperating with the competent supervisory authorities … to any action taken to ensure compliance with this Regulation. The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”.


Supposing that a company incorporated in the USA does not have a place of permanent establishment in the UK but still falls within article 3, such a company could be established in the USA and use its USA website to offer services to UK citizens without being caught by the Bill. Can the Minister reassure us that there is a solution to this problem?

--- Later in debate ---

[Lord Clement-Jones]

My Lords, I thank the Minister for that interesting exposition, which ranged from now into the future. He has given a vision of the post-Brexit shape of our data protection legislation. Extraterritoriality will apply even though the language used may be that of the applied GDPR as opposed to the GDPR itself—just to be confusing, perhaps as much as the Minister confused us.

I want to be absolutely clear that we are not derogating from the GDPR in extraterritoriality. That seems to be the nub of it. The Bill makes changes to the applied GDPR—I would like to read in Hansard exactly what the Minister said about the applied GDPR because I did not quite get the full logic of it—but there is no derogation in the GDPR on extraterritoriality. It would be helpful if he could be absolutely clear on that point.

[Lord Stevenson of Balmacara]

Perhaps the Minister will respond to that because I, too, am troubled about the same point. If I am right, and I will read Hansard to make sure I am not misreading or mishearing what was said, the situation until such time as we leave through Brexit is covered by the GDPR. The extraterritorial—I cannot say it but you know what I am going to say—is still in place. Therefore, as suggested by the noble Lord, Lord Clement-Jones, a company operating out of a foreign country which was selling goods and services within the UK would have to have a representative, and that representative could be attached should there be a requirement to do so. It is strange that we are not doing that in the applied GDPR because, despite the great improvement that will come from better language, the issue is still the same. If there is someone that our laws cannot attack, there is obviously an issue. Perhaps the Minister would like to respond.

--- Later in debate ---

[Lord Clement-Jones]

My Lords, I thank the noble Baroness for introducing these amendments in not too heavy a style, but this is an opportunity to ask a couple of questions in relation to them. We may have had since 20 October to digest them; nevertheless, that does not make them any more digestible. We will be able to see how they really operate only once they are incorporated into the Bill. Perhaps we might have a look at how they operate on Report.

The Bill is clearly a work in progress, and this is an extraordinary number of amendments even at this stage. It begs the question as to whether the Government are still engaged in discussions with outside bodies. Personally, I welcome that there has been dialogue with the insurance industry—a very important industry for us. We obviously have to make sure that the consumer is protected while it carries out an important part of its business. I know that the industry has raised other matters relating to third parties and so on. There have also been matters raised by those in the financial services industry who are keen to ensure that fraud is prevented. Even though they are private organisations, they are also keen to ensure that they are caught under the umbrella of the exemptions in the Bill. Can the noble Baroness tell us a little about what further discussions are taking place? It is important that we make sure that when the Bill finally hits the deck, so to speak, it is right for all the different sectors that will be subject to it.

[Lord Stevenson of Balmacara]

My Lords, I thank my noble friend Lord Knight and the noble Lord, Lord Clement-Jones, for raising points that I would otherwise have made. I endorse the points they made. It is important that those points are picked up, and I look forward to having the responses.

I had picked up that the Clause 4(2) definition of terms is probably a recital rather than a normative issue, and therefore my noble friend Lord Knight’s point is probably not as worrying as it might otherwise have been. But like him, I found that it was tending towards the Alice in Wonderland side. Subsection (1) says:

“Terms used in Chapter 2 and in the GDPR have the same meaning in Chapter 2 as they have in the GDPR”.


I sort of get that, but it seems slightly unnecessary to say that, unless there is something that we are not picking up. I may be asking a negative: “There’s nothing in here that we ought to be alerted to, is there?”. I do not expect a response, but that is what we are left with at the end of this debate.

I have one substantial point relating to government Amendment 8. In the descriptions we had—this was taken from the letter—this is a technical amendment to ensure that there is clarity and that the definition of health professional in Clause 183 applies to Part 2 of the Bill. I do not think that many noble Lords will have followed this through, but it happens to pick up on a point which we will come back to on a later amendment: the question of certain responsibilities and exceptions applying to health professionals. There was therefore a concern in the back of my mind about how these would have been defined.

My point is that the definition that appears in the Bill, and which is signposted by the way that this amendment lies, points us to a list of professionals but does not go back into what those professionals do. I had understood from the context within which this part of the Bill is framed that the purpose of having health professionals in that position was that they were the people of whom it could be said that they had a duty of care to their patients. They could therefore by definition, and by the fact of the posts they occupied, have an additional responsibility attached to them through the nature of their qualifications and work. We are not getting that out of this government amendment. Can the Minister explain why polishing that amendment does or does not affect how that approach might be taken?

Data Protection Bill [HL]

Debate between Lord Clement-Jones and Lord Stevenson of Balmacara

Monday 30th October 2017 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, right from the outset, I had better declare that this is a probing amendment. I shudder to think of another chastisement from the noble Lord, Lord Ashton —that would be too terrible to contemplate. Chastisement from the noble Baroness? Even better.

The amendment is about whether we should put the Bill on all fours with the Data Protection Act 1998. Personal data is defined in Clause 2(2), and then Clause 2(4) goes on to talk about “processing” of data, in terms of requiring the personal data to be recorded in order that it can be subject to,

“an operation … performed on personal data”.

It follows that, if the information is not recorded, it is not capable of being processed under the Bill as it cannot be subject to an operation.

Where I am slightly confused is looking at article 5(1)(f) of the GDPR, which talks about personal data being,

“processed in a manner that ensures appropriate security”,

which means that security obligations apply to recorded information about an individual and perhaps not to unrecorded information, which may be, for instance, disclosed in a conversation. If a controller fails to control his staff and a staff member discloses information in an unrecorded form, is that controller in breach of the security principle?

It would have been crystal clear in the Data Protection Act 1998 because Section 1(2) of the DPA closes that kind of loophole. That is exactly the wording that has been adopted in the amendment. Perhaps the Minister can explain whether we are incapable of using that definition because it is the GDPR or simply because we have failed to incorporate and bring forward equivalent provisions from the 1998 Act. I beg to move.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I support the amendment in the names of the noble Lords, Lord Clement-Jones and Lord McNally. I will speak also to Amendments 3 and 9 in this group. This is a wide-ranging, rather stretching group covering a lot of detail, and I am sure the noble Baroness the Minister, who is making her first appearance on this Bill, will be able to cope with it with ease and will not have to resort to having meetings outside or anything; it will be a straight answer. I mean no disrespect to the noble Lord the Minister who spoke earlier.

Amendment 3 is a probing amendment. I make that absolutely clear, like the noble Lord, Lord Clement-Jones, did. It is about the rather disputed issue, as I understand it, of the status that many of the big tech companies that operate in the United Kingdom have in relation to the Act. Are they, as I think I have heard in other meetings, data controllers in the sense that the Bill sets out to achieve; in other words, are they responsible for all the elements that will be raised in the Bill and in the GDPR in relation to that issue? I am looking for a clear and straightforward answer on that, because it seems to me that there has been too much evasion and difficulty in pinning down some of the definitional points that this issue raises.

Having established that they are data controllers and that the material and data that they go through are subject to the Bill in its entirety—and, by implication, the GDPR—in which territory will this power exist? Obviously, that has relevance both pre and post Brexit. For instance, I asked the representatives of a large company who came in to brief us about their concerns about the Bill the very same question and received the answer that they regarded themselves as being European data controllers, which was a strange combination of thinking, and that they had selected, because it seemed appropriate at the time—again, I would be interested in having more information on that if it is available—that the Irish Information Commissioner would be responsible for any activities that were regulated under the Act and they would look to that body. Irrespective of whether or not that is true, and I suspect it is, that leads to a question about the role the Information Commissioner in the United Kingdom has in relation to companies which choose a European domicile and have a responsible information commissioner who is not in this country and therefore not subject to any regulatory or statutory provisions provided by this Parliament. There is no particular reason why this should be wrong. I am not in any sense making accusations that would arise from that, but it is important that we have on the record a very clear narrative on this point because it will raise a lot of questions if we do not.

Amendment 9 has already been referred to in the debate on Amendment 1, in relation to where the recitals that accompany the GDPR are going to end up. Reflecting on what was said by the Minister in that debate, I found that very helpful in answering the questions that Amendment 4A raised. Therefore, it poses another question about why the Government decided—well, they have no choice—to have an arrangement under which the GDPR comes into play, as required, on 25 May 2018. However, at that point the recitals will not be brought into effect. I understand that the recitals do not have statutory power in the GDPR, but it is quite clear, from reading around on this subject and hearing of cases already raised in relation to data processing, that they are helpful to those who have side issues arising from the GDPR. The recitals help them to understand what the legislation actually means and, without them, there may well be a problem, at the least, in getting a consistency of approach across the EU. It is therefore important that we should know where the recitals are going to end up. If they are not being brought in, to what extent can they be relied on and, if so, by whom?