Data Protection (Charges and Information) (Amendment) Regulations 2019

Lord Griffiths of Burry Port Excerpts

Monday 18th February 2019 Lords Chamber

[Baroness O'Neill of Bengarve (CB)]

My Lords, these amendments represent a little island of calm in a turbulent ocean. For once, I am referring not to Brexit or the backstop but, rather, to the fact that we are in the middle of some very turbulent changes in our regimes for the protection of data and privacy and many other aspects of communication. This morning, we saw the publication of the report of the Digital, Culture, Media and Sport Committee of the other place on disinformation and “fake news”. In so far as I have got into the report—which is not very far—it is very welcome in that it represents a much broader view of the threats to democracy from the present regime for controlling the use of data. There is much more to be said, and I hope that the Minister will be able to say something about the ways in which the broader picture will be taken into account. These amendments do not need changing because of the broader picture, but it is curious to fiddle with the small stuff when such major and serious issues are happening in this domain.

[Lord Griffiths of Burry Port (Lab)]

My Lords, this seems a sensible measure and the issues have been well rehearsed. There was one area where there was some confusion in my mind, and I hope that noble Lords will not mind my bringing it to their attention now. I, too, am looking forward to not having to pay £40—that is good news, but in exempting Members from both Houses, candidates and so on from the need to pay that charge, we recognise that many of us have other duties and obligations not related to our being Members of this House. We are in employment, we run things and so on, and we handle people’s data other than in the sense that has been described. I guess they will have to pay their £40 or whatever it is, but my confusion lies in the hinterland between those two modes of operation: information gained in respect of activities of one kind can without too much imagination become useful in respect of those of another kind. I wonder whether some thought has been given to handling that kind of confusion and, if so, how. It would be helpful if the Minister could say something about that; otherwise, this seems like common sense and we would have no hesitation in wanting it to go forward.

[Lord Ashton of Hyde]

My Lords, I am grateful to all noble Lords who have responded. This statutory instrument is unique among those I have dealt with recently in having gained a speedy and generally favourable response; I am grateful for that.

I am grateful to the noble Lord, Lord McNally, for his welcome. He spoke about financing political parties and the need to give advice—as indeed did the noble Baroness, Lady Ludford. I can say that the House authorities will take that on board and provide some clear advice, taking into account the new requirements if this statutory instrument is passed; I am very pleased about that.

I acknowledge—the noble Baroness, Lady Ludford, was right about this—that the approach to funding the ICO was originally set by the Digital Economy Act, which was superseded by the Data Protection Act. The method of funding the ICO, and the question of whether it is adequate, have been occupying us for several years. I am pleased that we have finally resolved it. The noble Baroness is right that we decided to do it this way and not as part of the GDPR. Supervisory authorities can be funded in a number of ways. The reason for doing it this way was that it did not involve much practical change from the ICO funding arrangements under the Data Protection Act 1998 and a register is not necessary.

The noble Baroness, Lady O’Neill, talked about an ocean of calm within a broader picture that is possibly not so calming. I agree with her that it is a small but important issue. It is right to deal with an issue that promotes—or at least does not prevent—demographic engagement; and a commitment was made when the regulations were debated last year that we would look at this and take it forward. It is important to carry forward what we said; I take on board her points about the issues alluded to in the DCMS Committee’s report, as outlined this morning. Generally speaking, we have not yet had time to analyse it in great detail but, together with the Cabinet Office, we will be taking forward a lot of these issues around disinformation and its effect on elections, particularly through the online harms White Paper, which will be coming out soon.

The noble Lord, Lord Griffiths, mentioned that Peers have other duties; he asked about the way this exemption would apply in relation to their duties in the House of Lords and elsewhere. He is quite right that, if they are a data controller and have other duties that are not subject to an exemption, they would be required to pay the charge. I will mention this to the House authorities when they issue their advice and hopefully they can be clear. Ultimately, the Data Protection Act says that you must have lawful authority to handle personal data and it is up to you to make sure that is the case; if you handle personal data—other than data that has some limited exemptions provided in the Act—then you will have to pay the charge.

[Lord Griffiths of Burry Port]

I wonder if I could ask for a little more resolution on the matter. My mind is filled with pictures of activities that I myself have engaged in where, by doing work for which I am remunerated, I gain some kind of control of people’s data or the use of it, and at the same time I can be involved in an area where I am exempt from all that. Because of the homogeneity of the activities, one paid and one not, it is not difficult to see that the dividing line between what qualifies and what does not might be difficult to establish, even with the good will of the authorities of the House who write the best guidance that has ever been written.

[Lord Ashton of Hyde]

If the guidance does not produce clarity in the noble Lord’s mind, then I think the answer is to avail himself of the ICO’s telephone hotline, which is there specifically to answer questions such as the ones that he has asked. He will be able to give them the specific examples of where he is unable to be clear. That applies generally to people in public office such as him but also, importantly, to other small businesses; there is a specific small-business hotline that is there exactly to answer questions like his. I hope that has covered most of the issues.