Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

Debate between Lord McNally and Lord Adonis

Monday 18th February 2019 Lords Chamber

[Lord McNally]

The Minister never said anything about difficult foreigners, but there has always been the impression that this would all be as smooth as smooth. “Do they not understand that we are trying to be helpful?”, we ask, when we have caused Europe so much disruption and cost by this act. In this case, it is essential that we are part of the ongoing dialogue. This GDPR is not the end of the process. As the House was discussing last week, these European laws are going to develop. How we then act and deal with them is going to affect where jurisdiction lies—with European or British courts.

[Lord Adonis]

The noble Lord has raised a litany of concerns about the GDPR regime after Brexit and cited a number of people who briefed him about it, including QCs and Members of the European Parliament. However, he will have noticed that there has been no public consultation at all on these regulations. There has been no opportunity for people directly affected to publicly brief us. Does he share my concern about that? Would he like to comment on the process of public consultation on these regulations?

[Lord McNally]

It is, of course, a farce. These regulations are all being rushed through at the last minute and we know that we have to put them in place as the cliff edge approaches.

I do not want to be rude to Fieldfisher, because it provided some excellent briefing but, my God, the lawyers must be rubbing their hands at the cornucopia that is going to be tipped out to them as companies and individuals try to make sense of the reality. Whether we get a deal, or fall out, it will be a jagged, uncertain, unclear leaving.

--- Later in debate ---

[Lord Adonis]

My Lords, the noble Baroness, Lady Ludford, has raised some important points. It is totally unjustifiable that there is no impact assessment for this regulation; I hope that the Minister will address and explain that. The noble Baroness also made an important point about the way that data adequacy will be assessed if we are outside the EU, particularly in a no-deal scenario.

I will extend that to cover my perennial theme of consultation. No issue affects businesses and individuals across the country more than data. Indeed, we went through the whole GDPR exercise precisely because this is so central to our individual and community life. The fact that there has been no consultation at all on this regulation seems truly indefensible, so I hope that the Minister will say why that has been the case. The noble Lord, Lord McNally, said that data is now the new oil. He is absolutely right; it is as important to the functioning of our economy and our society as energy—it is a form of energy—and there clearly should have been consultation. Can the Minister say why there was no consultation? I assume that he will tell us again that there was no time, which begs the question of why we are going through this no-deal process at all if there is not time to conduct the normal processes of government in respect of it.

As ever, there is a bizarre twist to the statement on consultation. Paragraph 10 of the Explanatory Memorandum states:

“The government has not consulted publicly on this instrument”.


I presume that that means that they have consulted privately, and the House needs to know who has been consulted privately. The only body mentioned in paragraph 10 is the Information Commissioner’s Office, with which, it states, the regulation has been developed in consultation. Who else has been consulted privately and what were the selection criteria? Since the regulation was published, there have been representations. What representations have been made to the Minister’s department and what was their content?

The noble Baroness, Lady Ludford, also raised the issue of trying to assess the impact. Again we have doublespeak in respect of the regulations. We are told that their literal interpretation means that there is no further impact over and above the operation of existing European law. However, that is after, in the words of the White Queen in Alice in Wonderland, you have believed six impossible things before breakfast. Paragraph 12, entitled, “Impact”, states:

“There is no, or no significant, impact on business, charities or voluntary bodies arising from this instrument”,


but concludes:

“Data flows from the EEA to the UK may be restricted post-exit, but that is as a consequence of the UK leaving the EU, not as a result of this instrument”.


It is impossible to separate the instrument from the fact that we are leaving the EU. The noble Baroness put her finger on a very important point, which is that if we leave the EU with a deal on the basis recommended by the Prime Minister, the impact might be radically different from that envisaged under the instrument, for two reasons. First, there will be a transition period in which nothing changes but, secondly, the political declaration heralds negotiations on a whole set of issues, including trade and data flows, which might well lead to our continuing in the existing GDPR regime. So the last sentence of paragraph 12 is not true. It is not true to say that the issue of data flows and the regulation of data is dependent on the UK leaving the EU, not as a result of the instrument. There is a crucial difference between leaving the EU with a deal—in particular, with a deal that maintains the status quo—and without a deal.

When the noble Lord, Lord McNally, cited one of his expensive lawyers, who had suggested that there may be additional complexity—

[Lord McNally]

Oh!

[Lord Adonis]

I was not suggesting that they were his personal expensive lawyers, just expensive lawyers who have chosen to brief him; I know that he could not possibly afford expensive lawyers. When he said that it depends on what happens as time goes on, he put his finger on a very important point. The whole point of no deal, with a separate regime under our ICO, is that we could quite quickly find ourselves diverging, and as we diverge, that will quickly impose burdens over and above those that would apply even if we left the EU with a deal.

I am also not sure it is true to say that there would be no burdens as a result of the regulations even at the outset. I am a lay man in this business, and trying to understand what is going on is very difficult, particularly because there has been no consultation and we do not have the opportunity to assess what people who are expert and directly affected have said. The reason I intervened on the Minister in his opening remarks is that, having been a company director who has had to deal with the implementation of the GDPR, I know that having a representative dealing with data matters inside the EEA is very important. Many companies have offshored a lot of their data-control activities, and the requirement of the GDPR that they must have a representative inside the EEA—which I think is the correct thing to do—is a definite burden. It means that companies not only have to employ additional individuals but have to set up additional offices, in essence, to cope with those flows in many cases, particularly if they are dealing with significant data-handling exercises which are outside the EEA at the moment. This happens all the time with call centres in India; many companies are in this territory.

My understanding of what the Minister said in our earlier exchange is that if we leave with no deal and therefore must set up our own UK data-monitoring regime immediately, there will be a requirement for every company operating outside the EEA—which must, under the GDPR, have a representative inside the EEA—to have a representative in the United Kingdom. I would be grateful if the Minister could confirm that because if it is true, that is an immediate and potentially significant burden.

The other important point is that people need to understand that these arrangements are reciprocal. One reason why we as a country have such a good services industry is that a lot of companies based in the UK do substantial business in the EEA and beyond. That is great. My assumption, although it is not spelled out in the Explanatory Memorandum, is that in a no-deal scenario, data controllers who are based in the UK but do substantial business in the EEA will be required by the European Union to have representatives in the European Union over and above their data controllers in the UK; these are not currently needed. I would be grateful if the Minister could address that point. This flows logically from the new regime being set up. I would be astonished if that is not the case because I do not think that the European Union would regard having a data controller in the United Kingdom as meeting its standards of data adequacy. I would be grateful if the Minister could confirm that.

On that point, it is apparent that this immediately imposes a burden, potentially a significant one, on every company that handles data in the European Union or the EEA, as opposed to just in the UK. That represents a substantial proportion of our companies. If we had had an impact assessment, as the noble Baroness, Lady Ludford, suggested, this issue would have been brought out and we would know its effect. If there had been public consultation, we would know, but there has been none—and we have had no impact assessment. To my surprise, the Select Committees of this House that oversee instruments and put them to us have not raised these issues, which seem substantial and should have been raised before these instruments came to this House.

--- Later in debate ---

[Lord Adonis]

I have to say that this for me is a black box. Because of my other duties I have not been able to spend time analysing what is going on in Sub-Committees A and B, but this is very important because hundreds of these instruments are coming to us.

I turn to the issue of there being no consultation, which my noble friend Lord Rooker referred to. I have been going on about it for weeks. This has been true of every single no-deal instrument that has come to your Lordships. It is deeply and profoundly unsatisfactory. In my view this ought to have been flagged up for each of these instruments from the beginning and ought to have been a reason for them not to come before the House. How can we possibly conduct the proper business of the nation in terms of changing the law when we do not have any public consultation with any of the sectors that are affected by these instruments? We are dependent on the expensive lawyers of the noble Lord, Lord McNally, even to spell out the most basic features of these regulations—which, first, will not be apparent to those of us who are lay people and, secondly, which those people who are affected have had no opportunity to present except through the agency of expensive lawyers who seek to make a living. Of course, the expensive lawyers referred to by the noble Lord, Lord McNally, will now advertise their wares to companies, telling them what the impact of these things is going to be because they did not have a chance to engage with them earlier and make their views known, particularly if they start being adversely affected.

[Lord McNally]

My Lords, I never described them as expensive lawyers—otherwise they might never write to me again. I said that they were distinguished lawyers.

--- Later in debate ---

[Lord Adonis]

My Lords, I do not think that it is possible for my blood pressure to be higher on these matters. However, I hope that the blood pressure of the House is high, because we are supposed to be legislating on behalf of the country, and the proceedings of your Lordships in respect of these no-deal statutory instruments are an absolute farce. I do not think that the procedures of the House are working well. The fact is that the two chairs of our relevant sub-committees cannot even agree on a letter to send to the Treasury in respect of the handling of consultation. The fact that it is about six months after we started getting the initial flow of statutory instruments on this matter coming to the House is in itself deeply unsatisfactory and is not a good commentary on the way our parliamentary proceedings are working. Moreover, the fact is that what we get are bromides from the Government that there is no change, based on there being no impact assessments, no consultation and a complete misreading of what the situation is in any event, because it involves a denial of all of the negative consequences that will flow from leaving the European Union, which of course is the underlying fact that they should be grappling with in the first place when conducting consultations and impact assessments. It is deeply unsatisfactory.

The right thing for this House to do would be to reject these instruments. We should not be a party to such an abuse of our constitutional procedures as is taking place with these no-deal instruments. What we will be faced with, though—I feel this pressure myself—is that we could crash out of the European Union in an unconscionable act of misgovernment in the course of five weeks’ time, so we have to do our level best to ensure at least that there is a statute book in place for that eventuality. But I and other noble Lords want to put on the record that the situation we are faced with, and which gets worse with every debate that flushes out more facts about what is actually happening, is a complete abuse of our constitutional procedures.

[Lord McNally]

That last point is very important. Somebody pointed out the other day that one day there will be a full judicial inquiry into how this process has been carried through. Ministers and civil servants should be aware that one day there will be accountability for the way this has been done.

[Lord Adonis]

The noble Lord is right, but I do not think that that day is far off; I think it will come soon. Let us be clear: we are not talking about a natural disaster. As a Minister, I often had to deal with those. When there are ash clouds and volcanoes erupt, you have to take very difficult and extreme decisions at short notice. Here we are talking about an act which the Government are inflicting on the country, with no external agency whatever. Not only that, but the Government could this afternoon terminate the situation we are faced with, in respect of these no-deal regulations, by the Prime Minister announcing that she is not proceeding with no deal and that she will, on behalf of the United Kingdom, submit a request to extend Article 50—or, as we now know she can do from the judgments of the European court, rescind it unilaterally. This will be a big matter for the public inquiry that the noble Lord, Lord McNally, is referring to. All the consequences of this no-deal situation are caused by the Government, and the remedy for them is entirely at the disposal of the Government. It is our absolute duty to point this out all the way through this process, so that at least some of us in the parliamentary system can point to the fact that we did our level best not to take the nation to the edge of the cliff where we are now at.

Coming back to this instrument, it is totally unacceptable that we are dealing with such an important set of regulations relating to the fundamental issue of data and data protection and there has been neither an impact assessment nor any public consultation.