Data Protection Bill [HL]

Lord McNally Excerpts

Committee: 1st sitting (Hansard): House of Lords
Monday 30th October 2017 Lords Chamber

[Lord Cormack (Con)]

My Lords, I appeal to the noble Lord, Lord Stevenson, not to rush the House on this matter. The amendment is clearly deficient. This morning I was with the director of the Victoria and Albert Museum, Dr Tristram Hunt, who urged me, if I possibly could, to say something briefly this afternoon. He gave me a brief that I have not had a chance to master, but it is quite clear that all the directors of our great national museums and galleries have real misgivings about Amendment 4 and, from what I have heard, would have similar misgivings—or most of them—about Amendment 4A. There is no constitutional need for us to divide this afternoon. Shortly after I came into your Lordships’ House, I remember that the late Lord Jenkin of Roding said, “We don’t normally vote at Committee stage in our House. It’s better to air the arguments and then to come back to them on Report”. That was wise advice and the House should heed it today.

[Lord McNally (LD)]

My Lords, I suspect that this is going to be a shorter debate than perhaps was at first imagined, but I feel it is important that I add one or two words. When I was Minister at the Ministry of Justice, preceded by the noble Lord, Lord Faulks, I met a distinguished American lawyer. I said to him by way of introduction, as I regularly did, “Now, I’m not a lawyer”. He looked at me and said, “Then I’ll speak very, very slowly”.

I feel a bit like that after all the howitzers have been rolled out this afternoon—the noble Lords, Lord Faulks, Lord Lester and Lord Pannick, along with a more helpful contribution from the noble and learned Lord, Lord Goldsmith. I intervened because it would be very wrong, or very misleading, if Ministers were to take this mini-debate as an escape from a real problem. I was, although the post may have been slightly misnamed, Minister for Data Protection for three and a half years. Between 2010 and 2013 I had the job of going across to Brussels for negotiations on a lot of the issues that we are now discussing. What struck me there was how much influence we had in bringing together legislation that met the concerns mainly of western Europeans about a light-touch form of regulation and the concerns mainly of eastern Europeans who had fairly recent experience of how state abuse of power could be used against the citizen and the individual.

The point that I want to leave with Ministers is that, whatever fault our legal experts have found with the amendment, it underpins a real concern, which the noble and learned Lord, Lord Goldsmith, picked up: the layman, the ordinary citizen, wants to be assured that by the end of the Bill’s passage, on which we are only just starting, it will very much protect civil rights, civil liberties and individual freedoms. One of the great challenges we face is that this extraordinary change in the structure of our society, brought about by this fourth industrial revolution based on data, really calls into question a lot of the protections that we thought we had.

I hope the Minister will take and grab hold of what was said in introducing this Bill. We are attempting in these amendments, particularly in Amendment 4A, to meet a real and genuine concern of ordinary people who are perhaps not as clever as the noble Lords, Lord Pannick, Lord Lester, and others, but who have a concern about the abuse of power. There has been no sense of shame or regret. I understand and have been passionate all my life about the defence of the freedom of the press, but I wish that the press did not rush so quickly to scream, “They’re trying to curb the freedom of the press”, when all that the press has done since Leveson is try to sabotage any proper press regulation. I worry about saying, “Well, it will stop various parts of our society using this new data”, without seeing and recognising the huge amount of evidence already of massive abuses of data which impinge on our very democracy. I felt it worth saying, even if I had to listen to the lawyers, that the layman also has a voice in this, and we have a real duty to make sure that this legislation is up to the task presented by the new data world.

[The Earl of Lytton (CB)]

I realise that, in rising to speak on this particular part of the Bill, I depart slightly from the purpose of the noble Lord, Lord Stevenson—but I thank him for raising the issue all the same.

Of course, we are dealing with the overview of the Bill. The noble Lord, Lord McNally, almost wrote my introduction. What has worried me for some considerable time, notwithstanding the Bill’s provisions that provide for data subject to error correction, is the manifest inclusion of data in the data processing function, which is broadly drawn—namely, the inclusion of information that is knowingly false or recklessly included in that process, and which can affect the life chances of individuals. We know of significant and high-profile circumstances in which false information has been included and has either affected a significant class of people or has seriously damaged the life prospects of individuals.

Given that the collection of data is part of the processing function, it seems to me that very little is being said about responsibility for those sorts of errors—in other words, the things that one could or should have realised were incorrect or where there was a disregard for the norms of checking information before it got into data systems. We heard at Second Reading how difficult it is to excise that information from the system once it has got in there and been round the virtual world of information technology.

Could the noble Lord, Lord Stevenson, or the Minister in replying, say whether there is anything apart from the Bill—I do not see it there at the moment—that enables there to be some sort of sanction, for want of a better word, against knowingly or recklessly including data that is false and which affects the life chances and prospects of individuals because it is capable of being identified with them and can be highly damaging? That is something that we may need to look at further down the line. If I am speaking in error, I shall stand corrected.

Data Protection Bill [HL]

Lord McNally Excerpts

Committee: 1st sitting (Hansard - continued): House of Lords
Monday 30th October 2017 Lords Chamber

[Lord Stevenson of Balmacara]

As a Scot I can hardly complain, and I am always bewildered, too—not only about this but about many other things. Our Amendment 17 in this group is also one of bewilderment. Clause 8 is headed:

“Child’s consent in relation to information society services”,


and refers to “preventive or counselling services” not being included. This goes back to an earlier amendment, when we established that these references are actually recitals and not part of the substantive GDPR, so we are back in what is not normative language and issues that we cannot possibly talk about in relation to the wider context because we are talking about the law that will apply.

There are three points that need to be made and I would be grateful if the noble Lord would either respond today or write to me about them. The first is to be clear that the reference to “information society services”, which is defined, has nothing in it that would suggest that it is a problem in relation to the lack of inclusion of preventive or counselling services. The answer is probably a straightforward yes. Secondly, what are the preventive or counselling services that we are talking about? I think the context is that these are meant to exclude any data processing relating to a data subject if the data subject concerned—with parental consent if the subject is younger than 13 and on their own if they are older than 13—who is taking a form of counselling that may be related to health or sexual issues would not be allowed to be included. Is my understanding of that right? I am sure that it is.

Thirdly, could we have a better definition of preventive or counselling services because those are very wide-ranging terms? Yes, they come from a recital and perhaps in that sense they can be tracked back to earlier discussions around the formation of the GDPR, but they have to be applied in this country to situations in real life. I am not sure what a preventive service is and I should like to have it explained. Counselling services I probably do get, but do they include face-to-face counselling or is this about only online counselling services? Is it the same if the child is being accompanied by a parent or guardian? There are other issues that come into this and there is a need for clarity on the point.

While I am on my feet I should like to respond to the amendment moved by the noble Baroness, Lady Howe, who has campaigned long and hard on these issues. We would be bereft if she did not enter into this Bill with all its implications for children, given the wisdom and experience that she brings to the table. The point she makes is one of simple clarity. There is a need to be very careful about the evidence gathering on this issue and it is probably not appropriate for it to be left to Ministers in regulations. There needs to be a wider discussion and debate on the matter, perhaps involving the Children’s Commissioner and other persons with expertise. She has made her point very well and I should like to support it.

[Lord McNally (LD)]

My Lords, I associate myself with the amendment in the name of the noble Baroness, Lady Howe. We are in Committee and it is a probing amendment. When we discussed it with colleagues the feeling was that 13 might be the right age but, as the noble Baroness indicated, it needs probing and some thinking about.

There is a danger, particularly in a House with our age group, that we assume these technologies are understood by the young—even the very young. We all hear anecdotes of parents or grandparents who have to consult their eight year-olds on how to make various gadgets work, but that misses the point. A frightening amount of information is being freely given. I mentioned at Second Reading that my generation and my parents’ generation had thoughts of personal privacy that my daughter and her contemporaries seem to have no thought of. They are very happy to exchange information about themselves, what they do and where they are with gay abandon.

When we get to the very young it is very important to make sure—we will discuss this in later amendments, if not tonight—that there is sufficient understanding and information to make informed choices, otherwise we get into very dangerous territory indeed. Therefore we are, not for the first time, in the noble Baroness’s debt for raising these questions. Late as it is, it is right that we put on record that these things, along with the amendments that will follow in the next couple of groupings, need to be taken as a whole before we make a final judgment as to the right age.

[Lord Ashton of Hyde]

My Lords, I echo the comments of the noble Lord, Lord McNally, to say we are grateful to the noble Baroness, Lady Howe. I acknowledge, particularly after her Second Reading speech, that she has not immediately demanded that the age be put back up to 16, which I thought she might. She has produced an interesting amendment.

Amendment 16 would give the Information Commissioner the power to determine the age threshold at which children can consent to their data being processed by online information services. This would be based on consultation and evidence. While it is certainly a preferable proposal to a blanket increase to 16, I am afraid I still cannot agree.

First, the Information Commissioner’s role as an independent regulatory authority is to administer and enforce the application of data protection legislation. As part of that role the Commissioner provides advice to businesses, organisations and individuals on the proper implementation of the legislation and on their rights under that legislation, and provides redress for breaches of individuals’ personal data. It also has an advisory function in relation to Parliament, the Government and other institutions. By contrast, the question of affixing the age below which parental consent is required has much broader-ranging considerations and implications, including an important moral dimension. Requiring the Information Commissioner to be the one to answer it would place on the officeholder an extra demand for which the office is neither designed nor resourced.

Secondly, the GDPR specifies that it is member states that should make this important decision. It does not give the power for states to delegate this choice to another regulatory body. Therefore, this amendment would make the Bill as a whole non-compliant with the GDPR. It is for those reasons that the Government consider that the question should be decided by this House and the other place rather than by a regulatory body. I realise that, in saying that, we leave ourselves open to further discussions on this matter.

Data Protection Bill [HL]

Lord McNally Excerpts

2nd reading (Hansard): House of Lords
Tuesday 10th October 2017 Lords Chamber

[Lord McNally (LD)]

My Lords, I am delighted to follow the noble Lord, Lord Stevenson, in this debate. I am a little puzzled, because some months ago I took part in a rather emotional debate where we said farewell to him on the Front Bench and, since then, they seem to have been working him harder than ever. As the Minister will already have gathered from his intervention, although he can look to the noble Lord’s support for the Bill, in many parts it will be like Lenin’s support for the social democrats: like a rope supports the hanging man. We will look forward to working with the noble Lord, Lord Stevenson, on many of the points that he has raised, not least on part 2 of Leveson.

I open this debate for the Liberal Democrats because, as the Minister has already explained, my noble friend Lord Clement-Jones is chairing the Committee on Artificial Intelligence this afternoon. He will return to the fray later in the Bill’s passage to do a lot of the heavy lifting with my noble friend Lord Paddick.

While wishing the Bill well, our approach will be to try to ensure that individuals have to the maximum extent possible control of their own data and that data are used responsibly and ethically by individuals and by both public and private bodies. This will be of particular concern in law enforcement areas where, for example, the use of algorithms throws up concerns about profiling and related matters.

It is clear that the Brexit decision and timetable will cast a long shadow as we debate the Bill. The Information Commissioner, Elizabeth Denham, has already warned that data adequacy status with the EU will be difficult to achieve within the Government’s Brexit timetable and a major obstacle has been erected by the Government themselves. The European withdrawal Bill makes it clear that the EU Charter of Fundamental Rights will not become part of UK law as part of the replication process, yet Article 8 of the charter relating to personal data underpins the GDPR. How then will we secure adequacy without adhering to the charter?

As the noble Lord, Lord Stevenson, indicated, there are many other issues relating to the GDPR and Brexit, particularly the need to examine and test the derogations in the Bill, which I am sure will be raised by colleagues and others and which we will probe further in Committee.

While referring to the Information Commissioner, I put on record our view that the Information Commissioner’s Office must continue to be adequately funded and staffed during this period of great uncertainty. The biggest changes since our debates on the Data Protection Act 1998, or even the early stages of the GDPR, which I was involved in as a Minister at the MoJ from 2010 to 2013, is that the threat to civil liberties and personal freedoms now comes not only from agencies of the state but from corporate power as well.

A week today, on 17 October, the Royal Society of Arts will host a discussion entitled “The Existential Threat of Big Tech”. The promotion for this event says:

“The early 21st century has seen a revolution in terms of who controls knowledge and information. This rapid change has profound consequences for the way we think. Within a few short decades the world has rushed to embrace the products and services of four giant corporations: Amazon, Facebook, Apple and Google. But at what cost?”.


That question prompts an even more fundamental question. We have become accustomed to the idea that some financial institutions are too big to fail. Are we approaching a situation where these global tech giants are too big to regulate? As a parliamentarian and democrat, every fibre of my being tells me that that cannot be so. We have to devise legislation and have the political courage to bring the global tech giants within the compass of the rule of law, not least in their roles as media operators, as the noble Lord, Lord Stevenson, indicated.

These modern tech giants operate in a world where the sense of privacy which was almost part of the DNA of my own and my parents’ generation is ignored with gay abandon by a generation quite willing to trade their privacy for the benefits, material and social, that the new technology provides. That is why we are so indebted to the noble Baroness, Lady Lane-Fox. Her speech in the debate she initiated in this House on 7 September is required reading in approaching the Bill. That speech contains her oft-repeated warning about sleepwalking to digital disaster, but it also robustly champions the opportunities open to a digitally literate society. I know that she will have an ally in my noble friend Lord Storey in championing better and earlier digital education in schools. The noble Lord, Lord Puttnam, recently pointed out that Ofcom already has an existing statutory duty to promote digital education. It will be interesting to learn how Ofcom intends to fulfil that obligation.

The elephant in the room always in discussing a Bill such as this is how we get the balance right between protecting the freedoms and civil liberties that underpin our functioning liberal democracy while protecting that democracy from the various threats to our safety and well-being. The sophisticated use of new technologies by terrorist groups and organised crime means that we have to make a sober assessment of exactly what powers our police and security services need to combat the terrorist attack and disrupt the drug or people trafficker or the money launderer. The fact that those threats are often overlapping and interconnected makes granting powers and achieving appropriate checks and balances ever more difficult.

On the issue of crime fighting, I recently attended a conference in the Guildhall, sponsored by the City of London Corporation, the Atlantic Council and Thomson Reuters. Its title was “Big Data: A Twenty-First Century Arms Race”. It could have been called “Apocalypse Now”, as the threat to business, the state and the individual was outlined, from existing technologies and from those fast approaching and identified. I was encouraged that there seemed to be an appetite in the private sector to co-operate with the police and government to ensure that big data can be effectively tamed to ensure better compliance, improve monitoring and reporting and prevent illicit financial flows. I will be interested to know whether the Government have a similar appetite for public/private co-operation in this area.

One point was made with particular vigour by Thomson Reuters. With offerings such as World-Check, it plays a key role in Europe and globally in helping many private sector firms and public authorities identify potential risks in their supply chains, customers and business relationships. It made it clear that it will be needing a number of clarifications in the Bill so that it will be able to continue to provide its important services, and we will probe those concerns and the concerns of others in the private sector in Committee.

In Committee we will also seek to raise concerns brought to us by Imperial College London and others about the efficacy of Clause 162 on the re-identification of de-identified personal data. We will need to probe whether the clause is the best way of dealing with the problem it seeks to address. I notice that the noble Lord, Lord Stevenson, gave it his approval, as did the Information Commissioner, but it is a legitimate question.

There is no doubt that the greater transparency and availability of data provided by government has contributed to citizens’ better understanding of and access to government information and services, but public concerns remain about the use of data in certain sectors. For example, although there are clear benefits to medical research from giving researchers access to anonymised medical data, it remains a matter of concern to the public, the media and the profession itself. Your Lordships will have received a briefing from the BMA on the matter and I am sure probing amendments will be required in Committee.

I am by nature an optimist, so I believe the noble Baroness, Lady Lane-Fox, when she tells us, as she did in this House a month ago, that,

“we can harness the power of these technologies to address the other great challenges we face”.—[Official Report, 7/9/17; col. 2110.]

In my youth I read Robert Tressell’s The Ragged Trousered Philanthropists, a parable about how working men were complicit in their own exploitation. We are in danger of becoming the 21st century’s ragged trousered philanthropists if we do not have a framework of law by which we can constrain big data from misusing the information we so profligately provide every day in every way.

I do not believe that sprinkling Bills with Henry VIII clauses is an answer to the challenge of future-proofing. Perhaps there is a case for expanding the remit of the National Data Guardian to act as an early warning system on wider data abuse—or that of the Information Commissioner or our own Select Committee—but there is a need. I fear that without some permanent mechanism in place, we will be for ever running up the down escalator trying to match legal protections to technical capacity. But that is no excuse for not trying to improve the Bill before us. We will work with others so to do. Looking at the speaking list, the Minister is not going to be short of good and expert advice on how to do that.