Data Protection Bill [HL]

Lord Lester of Herne Hill Excerpts

Monday 6th November 2017 Lords Chamber

[Lord McNally (LD)]

My Lords, as my noble friend Lord Clement-Jones indicated, I shall speak to Amendments 41 and 44, which were eloquently introduced by the noble Lord, Lord Griffiths. I had no idea that it was a maiden speech from the Front Bench, and it is to the discredit of the Labour Party that it has taken him so long to climb to the top of the greasy pole. Having got there, I hope that he enjoys the view.

As the noble Lord indicated, these amendments are inspired mainly by Thomson Reuters and others in the City. I attended a seminar in the City some weeks ago in which the corporation, the City of London Police and some leading companies talked about the challenges that data was bringing them. At the core of this is a concern that the Bill is loosely and poorly worded in preventing private companies doing work with data which will help them to keep best practice in line with the objectives for corporate governance and efforts to fight crime, terrorism, slavery, bribery and corruption.

I hope the Minister can give some comfort that the Bill will give cover to companies, financial institutions and others to carry out this kind of data activity and allow screening by private companies for the purposes of checking against non-UK laws on terrorist financing or money laundering. It should be amended to allow compliance with widely recognised guidelines such as those promulgated by the Financial Action Task Force. In the light of the Minister’s response and in consultation with those who have asked us to raise this matter, we would see whether we wanted to take it further. At the source of these amendments is a concern on the part of companies which I think genuinely want to help.

[Lord Lester of Herne Hill (LD)]

My Lords, I want to raise an issue which I would be grateful if it were thought about, although I would not dream of asking the Minister to give an informed reply today. I am puzzled especially by Amendment 37, spoken to by the noble Lord, Lord Griffiths, because I spent a good deal of my time developing the Equality Act 2010 and we were very concerned when doing so about issues of personal privacy and enforceability.

Obviously, one size does not fit all when it comes to equal opportunity and treatment. It is fairly easy to operate a policy measuring ethnicity, for example, without any problem about privacy; it is pretty easy to do so in respect of gender, although gender does not at the moment figure in the list for some reason, but it becomes terribly difficult when one is dealing with sexuality, religion or philosophical belief, which are for some reason in the list at the moment. I would be grateful if the Minister could reflect with people from the Government Equalities Office on whether this is an example of overlegislation, which it would be much better to prune down.

I am all in favour of affirmative action to promote equality between the sexes or people of different ethnicity, but when it comes to religion, philosophical belief and the other matters that are either there at the moment or would be there under Amendment 37, I get very worried. For example, I once represented the Church of Scientology—successfully—in establishing that scientology is a religion. I would not like these provisions to be the source of conflict and division between one kind of religion and another, or one kind of no religion and humanists, and so on. I think it is an example of overlegislation and underlegislation, and needs to be sorted.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, I am grateful to all noble Lords who have participated. I am especially grateful for the clear way in which the noble Lord, Lord Griffiths, outlined the case for all his amendments. He could have chosen an easier Bill to start on, I must say, but he did it very well. I am grateful for the opportunity to set out the purpose of various conditions included in Schedule 1, this time specifically with reference to Part 2.

As we have already discussed, for “special categories of data” to be processed lawfully, controllers must demonstrate that their processing meets one of the processing conditions set out in article 9 of the GDPR. We have already touched on several of these. Here we turn to processing which is,

“necessary for reasons of substantial public interest”.

Clause 9 requires that controllers wishing to rely on this processing condition must meet one of the conditions set out in Part 2 of Schedule 1.

Paragraph 7 of Schedule 1 allows processing of certain specified special categories of personal data for the purpose of promoting equality of opportunity. Amendment 37 seeks to expand this condition to permit the processing of additional categories of personal data. This is unnecessary because the categories of data referred to in the amendment are either not considered by the GDPR framework to be special categories of data in the first place or covered by the categories already listed in paragraph 7 of Schedule 1; for example, “Personal data revealing age” need not be listed because it is not subject to additional protection to begin with.

The Government accept that the existing special categories of data are broad and in some circumstances will overlap with the categories of data suggested in the amendment; for example,

“Personal data revealing a disability”,

will fall within the special category of “Data concerning health”. But in these cases, paragraph 7 already permits the processing of such data for equality-monitoring purposes. I will read carefully the remarks of the noble Lord, Lord Lester. I suspect his point is to do with what is and what is not a special category of data, but I will read Hansard and write to him, and copy other noble Lords. I thank him for not requiring a considered answer tonight.

Amendments 38 and 39 address the condition in paragraph 8 which permits the processing of data where this is,

“necessary for the purposes of the prevention or detection of an unlawful act”.

Amendment 38 would make it clear that the condition was available only if the unlawful act in question was “serious”. I can understand the rationale behind the amendment but the Government consider that it might nevertheless be in the substantial public interest for an organisation to process data for the prevention or detection of an unlawful act that was not obviously “serious”. An offence such as driving without a licence or insurance may not be the most serious in terms of the maximum penalty available, but it could still be in the substantial public interest for it to be reported by the data controller. Paragraph 8 ensures that data controllers are empowered to make that call and be accountable for their decision.

Amendment 39 would make the condition available only,

“under circumstances in which it is reasonably clear that a data subject is unlikely to give consent”.

While similar provision is made in other conditions where required, the Government consider that it would not be appropriate in this case, given that the purpose is to process data in circumstances where seeking consent risks prejudicing the prevention or detection of an unlawful act.

Amendment 40 would remove the word “dishonesty” from paragraph 9(2)(a) so that an organisation could rely on this provision only if it were processing sensitive categories of personal data to protect the public from malpractice, other seriously improper conduct or the other listed behaviours. The Government consider that there might be situations where an organisation would also need to process data to protect the public from dishonesty that does not necessarily amount to malpractice or improper conduct. It is therefore right that the paragraph covers the full gamut. This processing condition is not new; a similarly worded provision already exists under the current Data Protection Act.

The noble Lord, Lord Griffiths, suggested that there was a need for a further definition of “dishonesty”. I am afraid we do not agree. The word has a plain English meaning, defined in the dictionary. Furthermore, to define it here would cause confusion as it is used throughout UK legislation.

Amendment 41 would extend the scope of the same processing condition so that it could also be used to protect bodies and associations, rather than just the general public, from dishonesty, malpractice and improper conduct. It is one thing to allow the processing of an individual’s personal data for the purposes of protecting the general public—that is, other individuals; there is a neat symmetry there—but quite another to suggest that it could be processed to protect organisations from reputational harm. On that basis, I cannot agree to include it.

Amendments 43 and 44 address the processing condition in paragraph 12 which allows organisations such as banks to make disclosures “in good faith” under the Terrorism Act 2000 and the Proceeds of Crime Act 2002 about third parties who are suspected of terrorist-financing offences or money laundering. This processing condition is intended to protect organisations that disclose data on the basis of a genuine suspicion, even if it turns out later not to have been well founded. Noble Lords will recall that this condition was debated and agreed to as part of the Criminal Finances Bill earlier this year. The condition is tied to the improvement of a specific statutory regime—known as the suspicious activity reports regime—and is designed to give legal clarity to encourage the sharing of information to prevent serious crime and terrorism. I know there are some in the financial sector who have suggested that these provisions should go further to permit screening by private companies for the purposes of checking against non-UK laws on terrorist financing and money laundering. As noble Lords may be aware, the relevant provisions in the Criminal Finances Act were commenced only at the end of last month. We are not convinced that there is a need to amend them at such an early stage.

Amendment 45 would amend the processing condition relating to,

“confidential counselling, advice or support”,

in paragraph 13. It would add “guidance” to the list of processing activities which are permitted under this provision. This paragraph is not new; the relevant wording is drawn directly from existing legislation. But I am happy to put on the record the Government’s view that guidance is already covered by this provision and thus there is no need to amend it.

Amendments 45A and 64 in the name of my noble friend Lady Neville-Jones seek to clarify the legal status of processing by patient support groups. The Government strongly support the varied and important work of patient support groups and I am grateful for my noble friend’s time in meeting me recently. It is important to reiterate that groups such as Unique will have access to a number of provisions already in the Bill, even in cases where consent cannot be obtained, or reobtained, from the data subject.

We discussed the provisions for scientific research last week. In addition, paragraph 13 of Schedule 1 makes provision for confidential counselling, advice and support. Taken together, the provisions I have mentioned—for consent, scientific research, and confidential counselling, advice and support—seem to cover a great deal of the vital work undertaken by patient support groups. But the Government retain an open mind on this and I will read my noble friend’s contribution in Hansard carefully.

--- Later in debate ---

[Lord Lucas (Con)]

My Lords, I offer a slight contrast to that. I hope that this clause will help with a couple of sorts of problems that I have come across over the last 20 or 30 years. One concerns children at university who become suicidal and their parents are never told because everybody believes they have a duty of confidentiality and cannot communicate with the parents. A friend of mine got very close to going over the edge but fortunately one of his friends told his parents and then everything got sorted out. Suddenly regarding parents as aliens when someone is 18 and in severe psychological difficulty is an uncomfortable effect of the way that current regulations are perceived. I hope that this provision might loosen things up.

Another aspect is dealing with schoolchildren with eating disorders. Many aspects of eating disorders present as social interactions with other children. However, if there is an absolute prohibition on discussing someone’s condition with other children, even the children who share a bedroom with them in boarding school, that seems to me destructive of the interests of the child. Therefore, I would like to see—and I hoped that I was seeing—a slight broadening of the current regulations which might lead to arrangements which allowed the best interests of the patient to come into effect rather than a strict adherence to the dogma of, “We can’t tell anybody”.

[Lord Lester of Herne Hill]

My Lords, the Minister rightly signed on the face of the Bill his statement of its compatibility with the European Convention on Human Rights. I wonder whether the answer to the question of the noble Lord, Lord Kakkar, is not provided by the Human Rights Act itself, which says that all legislation, old and new, must be read—and given effect, if possible—compatibly with the convention rights. One of those convention rights is the right to privacy. The right to privacy embraces the equitable duty of confidentiality referred to by the noble Lord, Lord Kakkar. Therefore, the reassurance is given by the Human Rights Act rather than by anything else. The relevant provisions of this Bill would have to be read compatibly with that. However, I may be speaking out of turn.

[Lord Patel (CB)]

My Lords, if I have understood the noble Lord, Lord Lucas, wrongly, I am sure that he will correct me. However, the impression he gave was that the confidentiality between a doctor and a patient forbids the doctor to inform a family member if the patient is likely to suffer harm, even self-inflicted harm. That is not the case. The doctor is bound to respect confidentiality, but if that is likely to result in not informing the family of the harm that may be caused to a patient, or distress to the family, it is not true that confidentiality will still hold.