Data Protection Bill [HL]

Lord Pannick Excerpts

Report: 2nd sitting (Hansard): House of Lords
Wednesday 13th December 2017 Lords Chamber

Moved by

[Lord Pannick]

48: Schedule 2, page 138, line 44, at end insert—
“Confidential trust information
The listed GDPR provisions do not apply to personal data in respect of which the controller is (or acts as agent or confidential adviser to) a trustee or other officer of a private trust to the extent that the data consists of information—(a) which records any person’s deliberations about the manner of exercise of a power or discretion under that trust, (b) which discloses any person’s reasons for any particular exercise of such power or discretion, or(c) upon which such deliberations or reasons were or might have been based.”

[Lord Pannick (CB)]

Amendment 48 is in my name and the name of the noble and learned Lord, Lord Walker of Gestingthorpe. It concerns the law of trusts, and I should mention, as the noble and learned Lord is unlikely to do so, that for many years he was the leading trusts practitioner at the Bar. During his career on the Bench, including in the Appellate Committee of this House, in the Supreme Court and in the Judicial Committee of the Privy Council, he gave many of the leading judgments that define the modern law of trusts.

I declare a much more modest interest as a practising barrister. I am not a specialist in the law of trusts but, as I explained in Committee, I know that the law has long recognised that a trustee is not obliged to disclose to a beneficiary the trustee’s confidential reasons for exercising or not exercising a discretionary power. The law recognises that if the trustee were to have such a duty of disclosure it would impede the trustee’s ability to perform his or her function, the effective exercise of which depends on confidentiality. The public interest is protected because the court has an inherent jurisdiction to supervise and, where appropriate, to intervene in the administration of trusts.

A recent Court of Appeal judgment, Dawson-Damer v Taylor Wessing, has prompted a concern of trust practitioners about the applicability of data protection law in this context. I have received powerful representations on this subject from the Trust Law Committee, which is a group of leading academics and practising lawyers. One of its concerns is that in other jurisdictions, such as Jersey, the data protection legislation contains express statutory restrictions on the right of a data subject to make a subject access request where that would intrude on the principle of confidentiality. Those who practise in this area are very concerned that offshore trusts, and offshore professionals providing trust services, are already actively encouraging the transfer of trusts business away from this jurisdiction because of data protection concerns. The irony in this is that data protection law may be driving trust business towards less transparent offshore jurisdictions.

The noble and learned Lord, Lord Walker, and I, accompanied by other trusts lawyers, had the benefit of a very helpful meeting with the Minister—the noble and learned Lord, Lord Keen—and members of the Bill team. I am extremely grateful to them for the very constructive discussions we had. I very much hope that the Minister, when he replies to this short debate—I hope it will be short—will be able to confirm three matters.

The first is that the Government understand and are sympathetic to the concerns raised by the Trust Law Committee, which I have just summarised. The second matter, which I hope the Minister can confirm, is that the Government’s view is that article 15(4) of the GDPR, which states that the right of access,

“shall not adversely affect the rights and freedoms of others”,

applies in this context to protect the confidentiality principle. The third matter, to which I hope the Minister will be able to respond, is that if that view is shown to be erroneous in future litigation—I anticipate the Government do not believe this will be the case, but if it were to occur—I hope the Government would consider using the delegated powers conferred by this Bill to enact a specific and express exemption. I recognise, of course, that the Minister will be unable to commit the Government to any future course of action. I hope that the Minister will be able to respond positively on those three matters. They would go a long way to alleviating the concerns of trusts lawyers. I beg to move.

[Lord Walker of Gestingthorpe (CB)]

I have added my name to the amendment proposed by my noble friend Lord Pannick, and I shall say a few words in support of it. I do not want to repeat any of the points my noble friend has made, but I shall say a little bit about the practicalities of the documents that are likely to be the subject of data access requests by a disappointed beneficiary who wants to circumvent by the use of these powers the traditional confidentiality of discussions between trustees, even if put down on paper, which has been established in English law for about 50 years or more.

Discretionary trusts are still very common—surprisingly, in a way, given the increasingly complex inheritance tax provisions that affect them. I am talking about trusts with English law as the proper law and trustees resident in this country, who pay all the income tax, capital gains and inheritance tax that is due from them from time to time. In my experience, trustees of long-term discretionary trusts are often not solicitors or accountants but friends or acquaintances—reliable people trusted by the settlor with important discretions. Solicitors and accountants are, of course, involved, but they get their fees for professional advice. The trustees themselves generally get no remuneration for taking on what are sometimes huge and increasingly worrying responsibilities.

Discretionary trusts commonly confer wide discretions over both the disposition of income and the eventual destination of capital—usually it is a trust over income and powers over capital, but I need not go into those technicalities. Often, there will be a large class of beneficiaries who can be the objects of the exercise of the trustees’ discretion, typically a settlor’s children and remoter issue, very often their spouses or some remoter relatives or friends—named, of course, rather than just left as “friend”—and named employees and retainers. All those beneficiaries are, in a sense, in competition with one another. They do not, of course, seek favours from the trustees, but the fact is that the trustees sometimes have to exercise very difficult decisions on how to spend resources.

It is the duty of the unremunerated trustees to keep themselves fully informed about the beneficiaries. They have to take account of births, deaths, marriages, separations and divorces; of success or failure in education, and in business or professional life; of disability or injury—and sometimes, sadly, of beneficiaries who have become addicted to drink, drugs or gambling. So let us imagine trustees of a discretionary trust who meet once or twice a year to consider how they will distribute income and whether they will distribute capital in the course of that year, or six months. In a sense, all the beneficiaries are in competition, and inevitably the confidential minutes of the trustees’ deliberations will record how the trustees approached those competing demands and how they measured up, as they have to in a sense, the claims of one beneficiary rather than another on the settlor’s bounty. It is a consideration by the trustees collectively of all the competing claims on the settlor’s bounty, yet the data subject, to use the phrase in the Bill, who will in this case typically be a disgruntled and disaffected beneficiary, is entitled to information about the data subject himself or herself alone. That is fundamental to how the provisions work, which is underlined by paragraph 14 in Part 3 of Schedule 2, which relieves the data controller, who in this case will be the solicitor or accountant who keeps the trust records,

“to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information”.

If one looks at the practicalities, the likelihood is that those confidential minutes would have to be so savagely redacted with the censor’s blue pencil as to be barely comprehensible—certainly, not giving any sort of true picture of how the trustees had operated. Redaction would be troublesome and oppressive to the trustees, but even more oppressive—and I come back to the central point made by the noble Lord, Lord Pannick—is the fact that the trustees, who are typically unremunerated and doing their best to do what is sometimes a very difficult job, would be compelled to disclose what was not redacted to the disaffected beneficiary: the data subject. For those reasons, which I have briefly given, and all the reasons given by the noble Lord, Lord Pannick, I support the amendment.

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, I begin by thanking the noble Lord, Lord Pannick, and the noble and learned Lord, Lord Walker of Gestingthorpe, for taking the time to meet me and officials to explain in detail the concerns following the debate in Committee. The question about the interaction of the fundamental principles of trust law and the GDPR is a valid one that we understand, and which deserves a response.

In Committee, my noble friend the Minister conveyed that it is not our intention to compel trustees to disclose the kind of information described in the noble Lord’s amendment. The Government both understand and are sympathetic to the noble Lord’s concerns in this respect.

Article 15 of the GDPR confers a general right for a data subject to seek access to personal data held by a controller, but there are a number of exemptions, set out directly in both article 15 and in Schedule 2 to the Bill. The amendment of the noble Lord, Lord Pannick, seeks to add an additional exemption to Schedule 2 to preserve the confidentiality of trustees’ decision-making and to minimise the risk of disagreement between beneficiaries and trustees, to which the noble and learned Lord, Lord Walker, referred. The Government’s position remains that article 15(4) of the GDPR already prevents the disclosure of the material the noble Lord’s amendment is concerned with. This is because the Government consider that the,

“rights and freedoms of others”,

referred to in article 15(4) includes the rights of both trustees and other beneficiaries. Where disclosure under data protection law would reveal information about a trustee’s deliberations or reasons for their decisions that would otherwise be protected from disclosure under trust law, the Government’s view is that disclosure would adversely affect the rights and freedoms of trustees and beneficiaries in the trustees’ ability to make independent decisions in the best interests of the trust without fear of disagreement with beneficiaries.

While I appreciate the noble Lord’s concerns, rushing to codify what in trust law is generally referred to as the Londonderry principle would, we consider, be a disproportionate step. The wider potential risks and unintended consequences involved mean that pre-emptive action in this area, far from clarifying the position, might actually confuse it. Should the law be tested after Royal Assent and found wanting—which, I stress, the Government do not expect to happen—the delegated power in Clause 15(1) allows the Secretary of State to bring forward regulations to correct this. By that point it will be much clearer what deficiency, if any, has in fact been identified in the law and we would expect a Government to consider those powers in such circumstances. I hope that is a full and adequate response to the three points the noble Lord, Lord Pannick, made. In those circumstances, I invite him to withdraw the amendment.

[Lord Pannick]

I am very grateful to the Minister. He has responded positively to each of the points that I made. I know that the House is anxious to move on to reaffirming freedom of speech. Therefore, I will say no more other than to beg leave to withdraw the amendment.

Amendment 48 withdrawn.

--- Later in debate ---

[Lord Lester of Herne Hill (LD)]

My Lords, we had rather strong debates in Committee and I am not going to repeat any part of those. I have thought about how I could best help the House at this stage, and I think it is by stating what I believe the law to be and why Amendment 50A, if carried, would put the Bill in breach of the Human Rights Act and the European Convention on Human Rights.

When the Bill was first introduced, the Minister certified, as is required under the Human Rights Act, that in his view it was compatible with the convention rights; those being the right to free speech, the right to personal privacy and the right to equal treatment without discrimination. The amendments that the noble and learned Lord, Lord Keen, has introduced in this group would pursue the convention rights and, if carried, as I hope they will be, make sure that the Bill continues to be compatible with the convention rights.

In the light of the speech by the noble and learned Lord, Lord Brown, it would be quite unnecessary and wrong for me to go through the relevant law in any detail. But perhaps I can help the House a bit by giving a very brief summary of why I consider the government amendment compatible, and the amendment put forward by the noble Baroness, Lady Hollins, or those supporting Hacked Off and all the rest, incompatible.

The position is this. Article 10 of the convention protects the right to free speech and freedom of the press, subject to necessary and appropriate exceptions. One exception is, of course, personal privacy, which is guaranteed by Article 8 of the convention. The test the convention uses, as interpreted by the European Court of Human Rights, is a pressing social need test. The starting point is free expression and any restriction or limitation on that right must be in accordance with legal certainty and must be proportionate. The Human Rights Act requires that all legislation, old and new, including this Bill, must be compatible with the convention rights. It also requires courts to read and give effect to the convention compatibly with those rights.

Together with the noble Lord, Lord Pannick, I edited a textbook, the third edition of which we published in 2009. It has a whole chapter on free speech and another on privacy. What I am trying to summarise now, we spelled out in that large textbook some years ago. I am trying to help the House by giving a legal opinion on what I consider the law to be. I very much hope that the noble and learned Lord, Lord Keen, will correct me if I have got it wrong in any respect, because the House needs to know that if it were to support Amendment 50A, it would, in my view and that of the noble and learned Lord, Lord Brown, put the Bill in breach of the convention and the Human Rights Act. The Minister could then no longer certify that it was compatible with the convention rights.

[Lord Pannick]

My Lords, I declare an interest as the co-author with the noble Lord, Lord Lester, of Human Rights Law and Practice, available in all good bookshops. I declare an interest also as a practising barrister. I have represented newspaper groups many times in relation to privacy and freedom of speech issues, but I have also represented individuals complaining about breaches of their privacy—individuals as diverse as Max Mosley and Her Majesty the Queen. Noble Lords may remember that the contents of Her Majesty the Queen’s breakfast tray were disclosed in the Daily Mirror by a footman who was, in truth, a foot-in-the-door man from that paper. I speak, therefore, from legal experience.

I agree entirely with what was said by the noble Lord, Lord Lester, my noble and learned friend Lord Brown of Eaton-under-Heywood and my noble friend Lord Colville. We should be very slow indeed to limit the scope of the exemptions for journalists and in relation to academic, artistic and literary material. Without these exemptions, as defined in government Amendment 50, journalists cannot do their job effectively: you cannot investigate child sex abuse in Rotherham, corruption in Tower Hamlets or any of the other examples that have been given if those you are investigating are entitled to see the data you are processing that relates to them. Such data may not be “necessary” but it may be material that needs to be retained and published. It is as serious as that.

These are not theoretical concerns. Earlier this year, Mr Justice Popplewell dismissed a claim by James Stunt, a businessman who was married to one of Bernie Ecclestone’s daughters. Mr Stunt complained about a number of articles in the Daily Mail and the Mail on Sunday, claiming rights under the Data Protection Act 1998. The judge dismissed the claim, stating in paragraph 56 of the judgment that journalism would be discouraged or impeded,

“if the subject had access to the detailed extent or direction of the investigation, of the information gathered or of the intended story”.

That is right. In my view, government Amendment 50 adopts the right approach with its focus on the reasonable belief—not any belief, but the reasonable belief—of the data controller that publication is in the public interest.

It gives me no pleasure to say that many of the amendments in this and the next group are not concerned with promoting the ability of journalists and others to carry out their essential functions under Article 10 in relation to freedom of speech and freedom of information. They pursue a different agenda: either to encourage newspaper groups to join Impress as their regulator or to punish the press for the wrongdoing of some of its members. I say to noble Lords that that should not be the concern of this Bill, which should focus on protecting freedom of information in relation to data.

I cannot agree with manuscript Amendment 50A. It would provide a field day for those seeking to impede academic work, artistic and literary expression, and journalism that they do not welcome. It would inevitably create a chilling effect on work in academia, the arts, literature and journalism. I simply do not understand how a necessity test would work. When the journalist, the academic or the artistic or literary individual is conducting the processing, they cannot know whether it is necessary for future publication—they may reasonably believe that it will be or that it may be, and that is enough. Manuscript Amendment 50A, if accepted, would seriously damage freedom of expression in this country. As the noble Lord, Lord Lester, said, it would be a blatant breach of Article 10 of the European Convention on Human Rights.

Data Protection Bill [HL]

Lord Pannick Excerpts

Report: 2nd sitting (Hansard - continued): House of Lords
Wednesday 13th December 2017 Lords Chamber

[Lord Pannick (CB)]

My Lords, I repeat my declaration of interest as a barrister acting in privacy cases including, I should mention in relation to this group, acting for the NMA in its unsuccessful attempt to challenge the recognition of Impress, a case which continues.

I shall speak first to Amendment 53. It seeks to remove paragraph 24(3) of the schedule which recognises,

“the special importance of the public interest in freedom of expression and information”.

I am surprised that the noble Baroness is seeking to remove that provision because it has been the law of this country for centuries. Because it has been the law of this country for centuries, a provision to almost identical effect appears in the Human Rights Act 1998 at Section 12(4). It is also the approach taken by the European Court of Human Rights in relation to Article 10. The idea that our law should no longer recognise the special public interest in freedom of expression is therefore a surprising one and would lead this country’s law into conflict with our international obligations under Article 10.

I shall speak also to Amendments 59 and 64 and express my agreement with what has just been said by the noble Lord, Lord Black. If enacted, these amendments would deprive journalists throughout the national and local media of all the exemptions under the Bill unless their employers choose to register with a regulator approved under the royal charter. The question for noble Lords is: why should a journalist on the Financial Times, or indeed on the Borehamwood Times, lose exemptions under this legislation and be hindered from doing his or her job effectively because the newspaper by which they are employed decides that it sincerely does not wish to be regulated by a royal charter regulator?

The fact of the matter, which is quite clear, is that Amendments 59 and 64 seek to use this Bill for what is a wholly extraneous purpose, seeking to compel newspaper groups into submitting to regulation under the royal charter or, as the noble Lord, Lord Black, put it, bullying newspapers in that respect. This Bill is simply not an appropriate vehicle for such an exercise.

[Lord Berkeley of Knighton (CB)]

My Lords, I have listened to the debate for several hours and I am growing increasingly worried about one or two things. In a sense I am going to act as a devil’s advocate. I believe passionately in a free and inquisitive press. For many years, I was one of its number both in the written and the spoken word. I believe that the press is absolutely vital to holding us all to account. But I have begun to feel that, in castrating Leveson’s work to such an extent, the public are going to lose confidence in public inquiries. Let us hope that that does not happen with Grenfell, although the residents of that tower, who live two roads away from me, are already beginning to think so.

Last year I attended a meeting in a committee room where Gerry McCann, PC Jacqui Hames and Hugh Grant spoke of their quite awful experiences. It is important that we remember the victims and recite these woes. I have not heard any expression of acceptance on this side of the House, or concern about some of these matters. I would go with noble Lords much more about not loosening things if I heard some kind of admittance that there are problems.

[Lord Pannick]

The answer to the noble Lord was given by the noble Lord, Lord Finkelstein, in the previous debate. The fact is that many of these individuals have justifiably brought civil claims against the newspaper groups concerned. They have recovered and are continuing to recover very large sums in damages, and no doubt rightly so. The News of the World closed down because of its conduct and individuals went to prison in circumstances where they broke the criminal law. That is the answer. No one is suggesting that terrible things were not done, but there are existing legal remedies and they have been applied.

[Lord Berkeley of Knighton]

I am grateful to the noble Lord, who obviously knows a great deal about the matter—more than I do. I still think that we should question the ability for this to happen in the future. Surely the whole point of the Leveson inquiry was to tighten things up so that this would not happen so much. When I listen to people talking about what happened to them and how they felt that they had very little recourse—although they took civil action and some of them won—I accept that newspapers shut down, but my goodness, perhaps they should have done. These things are right.

In listening to the debate, I was very impressed by the speech of the noble Lord, Lord McNally. It is not that I do not believe in the press—believe me, I think that the press does a wonderful job, by and large—but even those of us who are involved in doing wonderful jobs do so because we can look at ourselves and say, “We got this wrong”. That is what I have not heard enough of. My noble friend Lady Hollins is having a rather tricky time; she is up against some big guns.

What do the future victims have if they do not have recourse to law—if they believe that Leveson was the answer and we gradually remove most of his recommendations, which is what we seem to be doing? Perhaps noble Lords are right; perhaps in law we should be getting rid of them, but I am worried that the public will begin to think, “What are these inquiries? Why does the status quo always remain exactly the same?”. That is why I wanted to speak up for my noble friend Lady Hollins. We must think a bit more about people whose lives are sometimes ruined just by innuendo. As we have heard, they might get a tiny apology at the bottom of the page, but the damage is done—and it can be terrible.

--- Later in debate ---

[Lord Paddick (LD)]

My Lords, I did not intend to speak on these amendments, although we support them from these Benches, but I have to take issue with what the noble Lord, Lord Pannick, said—I think, quoting the noble Lord, Lord Black, from the previous debate—about how we do not need any of this stuff because people can sue the newspapers and achieve redress through those means.

When I was a commander in the Metropolitan Police Service, I was subjected to a kiss and tell story on the front page and eight inside pages of a tabloid newspaper. The story was a mixture of lies and intimate details of my private life and my relationship with somebody I loved and lived with for three and a half years. We broke up in acrimonious circumstances and subsequently he was paid £100,000 by the tabloid newspaper to tell these lies and intimate details of my private life. Thankfully, a group of solicitors and barristers agreed to a conditional fee agreement to pursue the newspaper. However, half way through the preliminaries leading up to the court case, it became apparent that I was unable to secure insurance against losing. Therefore, I was faced with a situation where if I pulled out of the action I would have to pay both sides’ costs—the newspaper’s costs and my own side’s costs because the conditional fee agreement would happen only if the case went to court and I lost—and could have lost my home.

The point is that there are many ordinary people, less high-profile than even I was at that time, who cannot get conditional fee agreements. They do not have the means to sue newspapers. Certainly, I would not recommend anybody going through the stress that I was put through by that newspaper and its lawyers, who tried every trick in the book to try to get us to fold before the court case happened. As it happens, two weeks before the case was due to be heard, they agreed to settle, although they claimed that it was not on the grounds of a breach of privacy but because everything that had been printed in the newspaper was untrue.

For noble Lords to say that there are sufficient safeguards at the moment for ordinary people to take the newspapers to court is, in my respectful submission, completely untrue.

[Lord Pannick]

I am very sorry to hear about the noble Lord’s personal experience and of course I accept everything he says. But will he accept that hundreds of people have brought legal proceedings against national newspaper groups for their wrongful, unlawful action in accessing personal data—for example, by listening to their mobile telephone calls—and publishing articles in consequence of that, and they have recovered very substantial damages, and rightly so, against those newspapers?

[Lord Paddick]

I completely accept what the noble Lord says but there are many hundreds, if not thousands, of other ordinary people who have not been able to claim redress for the wrongs that have been meted out to them by the press.

Data Protection Bill [HL]

Lord Pannick Excerpts

Report: 1st sitting: House of Lords
Monday 11th December 2017 Lords Chamber

[Lord Pannick (CB)]

My Lords, the Minister said that Amendment 1 is designed to provide reassurance that existing EU law rights are fully protected under the Bill. I, too, welcome the Minister’s assurance that further work will be done on this amendment prior to Third Reading. I will suggest four points that need to be considered and included in this amendment.

First, subsection (1)(a) of the proposed new clause refers to the need for data “to be processed lawfully”, but it does not refer to the obligation under Article 8.2 of the charter for data also to be processed fairly. That needs to be included.

Secondly, Amendment 1 does not refer, in subsection (1)(b), to the right to have personal data rectified. Again, that right is conferred by Article 8.2 of the charter.

Thirdly, the government amendment uses weak language in subsection (2), which says that,

“the Commissioner must have regard to”,

and uses “taking account of”. The Minister will know that Article 52 imposes a much tougher standard for limitations. It is a test of necessity, which is echoed in Amendment 2 in subsection (6).

Fourthly, government Amendment 1 makes no mention of the principal of proportionality. Again, that is an important element of Article 52.1 of the Charter, which, again, is mentioned in Amendment 2.

If the objective of the government amendment is to echo the rights that are currently enjoyed under the charter, these issues need to be further considered and, I hope, can be included in the redrafted Amendment 1 that the Government will bring forward at Third Reading.

[Lord Faulks (Con)]

My Lords, I do not wish in any way to spoil the degree of harmony that appears to have grown up over these issues in Amendments 1 and 2. When I looked at both amendments, I was not convinced of the need for either. If, as the Minister rightly says, Amendment 1 does not create any new rights, given that we have a Bill of 242 pages with a number of complex provisions, it seems surprising that we need to restate the principles. Of course, if we restate them, we run into the danger of attracting the attention of the noble Lord, Lord Pannick, who can say, “If you’re going to restate the principles, you may restate them rather better”. Surely it is much more desirable to specify precisely what the Bill is intended to do in those bespoke provisions rather than resort to generality, which inevitably has imprecision.

On Amendment 2, I am not a great fan of the European Charter of Fundamental Rights. The position of the party opposite when it was first advanced was entirely correct: it should not add rights to any protection that already exists in our law. On this so-called right to protection of personal data, if an amendment is to be introduced at this rather late stage of the proceedings, surely the first question is: does it add clarity to the Bill? It does not. Does it provide better protection, doing something that is otherwise not covered by the Bill but ought to be? If that is the case, let us by all means have an appropriate amendment. Why does it not provide clarity? These provisions must ultimately be interpreted by a court, as is recognised by proposed new subsection (7) in Amendment 2, which invites the court to,

“take into account any relevant judgment, decision, declaration or advisory opinion of the … Court of Justice of the European Union; and … European Court of Human Rights”.

Interestingly, the word “must” is used rather than “may”, which is the way that Section 2 of the Human Rights Act invites courts to have regard to the jurisprudence of the Strasbourg court. So a court is going to have to try to make sense of the relevant decision judgment of the Court of Justice of the European Union or the European Court of Human Rights. The ECHR does not have quite the same system of precedent that we have, and courts have often found it difficult to distil from the jurisprudence precisely what they should or should not be following. What if there were a difference between the interpretation of the Court of Justice of the European Union and the ECHR? That would provide further difficulties for a court.

--- Later in debate ---

[Lord Ashton of Hyde]

I completely agree with the noble Baroness. We have applied the GDPR principles to areas such as defence, national security and the intelligence services in different parts of the Bill so that when we seek an adequacy arrangement, we can say to the EU that we have arranged a comprehensive data protection regime that takes all the GDPR principles into account, including areas that are not subject to EU law. That is why, contrary to what we said in Committee, we have taken the arguments on board and tabled government Amendment 1 to provide reassurance on that exact point. We originally said that the rights under article 8 were contained in the Bill, but we are now putting further reassurance in the Bill. Other areas of the Bill, without direct effect, signpost how the Bill should be regarded.

The noble Baroness supports the amendment but would like, I think, to create a free-standing right. I have explained why we do not agree with that. Before Third Reading, we will try to seek a form of words in our amendment that provides more reassurance, so that when it comes to seeking an adequacy decision—we cannot do that until we leave the EU—there will be no doubt about what this regime provides. That would be the best way to do it, I think.

[Lord Pannick]

Does the Minister also agree that a further answer to the points made by the noble Lord, Lord Faulks, and the noble and learned Lord, Lord Mackay of Clashfern, is that it is absolutely inevitable that the detailed provisions of the Bill will be, on occasion, the subject of dispute, uncertainty and litigation, and that it would be very helpful to have a statement of principle on what is intended at the commencement of the Bill? This would not be the first time that a Bill has done that. Everybody would then know what the principles were. Of course, the Minister still needs to consider before Third Reading what that statement should be, but that is the point, as I understand it, of government Amendment 1.

[Lord McNally]

Why does the Minister feel it so necessary to push ahead with his amendment when it is quite clear that the best and most constructive way forward would be for both amendments not to be pressed to allow constructive discussion and resolution at Third Reading?

[Lord Faulks]

My Lords—

[Lord Pannick]

As I understand them, both the noble Lord, Lord Faulks, and the noble and learned Lord, Lord Mackay, doubt the need for any amendments of this sort. I am suggesting to the Minister that there is a real need for a statement of principle—that is all.

[Lord Ashton of Hyde]

I thank the noble Lord. As I said in Committee, we too saw no need for this. The Government have moved because they are always listening and we hope that we can make this more acceptable. I will read what was said by the noble Lords, Lord Pannick and Lord McNally, and my noble friend Lord Faulks, but I would like to press my amendment so that we might have it as a basis for further discussion before Third Reading.

Data Protection Bill [HL]

Lord Pannick Excerpts

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 13th November 2017 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, this amendment arises from concerns about the narrowness of the derogations based on article 89 of the GDPR for research statistics and archiving expressed by a number of organisations, notably techUK. The argument is that there should be a derogation similar to Section 33 of the Data Protection Act 1998. That Act makes provision for exemptions for research and development where suitable safeguards are in place. The GDPR limits this to scientific and historical research, but member states are able to legislate for additional exemptions where safeguards are in place.

The organisation techUK and others believe that the Bill’s provision for scientific and historical research should be broadened, involving the same provisions as Section 33 of the Data Protection Act 1998, and that the definition of scientific and historical research needs clarification. For example, it is not clear whether it would include computer science engineering research. I very much hope that the Minister will be able to clarify that. I recognise that the amendment leads the line in this group but may not be followed in exactly the same way. I beg to move.

[Lord Pannick (CB)]

My Lords, I shall speak to Amendment 86BA, in my name. It concerns the application of data protection principles in the context of the law of trusts. The law has long recognised that a trustee is not obliged to disclose to a beneficiary the trustee’s confidential reasons for exercising or not exercising a discretionary power. This is known as the Londonderry principle, named after a case decided by the Court of Appeal, reported in 1965, Chancery Division, page 9.1.8. The rationale of this principle was helpfully summarised by Mr Justice Briggs—recently elevated to the Supreme Court—in the case of Breakspear v Ackland, 2009, Chancery, page 32, at paragraph 54.

The principle is that the exercise by trustees of their discretionary powers is confidential. It is in the interests of the beneficiaries, because it enables the trustees to make discreet but thorough inquiries as to the competing claims for consideration for benefit. Mr Justice Briggs added that such confidentiality also advances the proper interests of the administration of trusts, because it reduces the scope for litigation about how trustees have exercised their discretion, and encourages suitable people to accept office as trustees, undeterred by a concern that their discretionary deliberations might be challenged by disappointed or hostile beneficiaries and that they will be subject to litigation in the courts.

There is, of course, a public interest here, which is protected by the inherent jurisdiction of the court to supervise and, where appropriate, intervene in the administration of trusts, as the noble and learned Lord, Lord Walker of Gestingthorpe, stated for the Judicial Committee of the Privy Council in Schmidt v Rosewood Trust Ltd, 2003, 2 AC 709.

The problem is that, as presently drafted, the Bill would confer a right on beneficiaries to see information about themselves unless a specific exemption is included. A recent Court of Appeal judgment in Dawson-Damer v Taylor Wessing, 2017, EWCA Civ 74, drew attention to the general applicability of data protection law in this context unless a specific exemption is enacted.

My understanding, which is indirect—I declare an interest as a barrister, but this is not an area in which I normally practise—is that in other jurisdictions such as Jersey, the data protection legislation contains a statutory restriction on the rights of a data subject to make a subject access request where that would intrude on the trustees’ confidentiality under the Londonderry principle. Indeed, I am told that those who practise in this area are very concerned that offshore trustees and offshore professionals who provide trust services are already actively encouraging the transfer of trust business away from this jurisdiction because of the data protection rights which apply here, and which will apply under the Bill.

The irony is that the data protection law is driving trust business towards less transparent offshore jurisdictions and away from the better regulated English trust management businesses. I have received persuasive representations on this subject from the Trust Law Committee, a group of leading academics and practitioners, and I acknowledge the considerable assistance I have received on this matter from Simon Taube QC and James MacDougald.

This is plainly a very technical matter, but it is one of real public interest. I hope that the Minister will be able to consider this issue favourably before Report.

[Lord Hope of Craighead (CB)]

My Lords, I want to add a word in support of the points made by the noble Lord, Lord Pannick, particularly with reference to the concerns that some people have expressed about money being moved out of the very closely and properly regulated regime of English trust law to offshore organisations and jurisdictions which are less careful about how people’s money is handled.

I should declare an interest as Chief Justice of the Abu Dhabi Global Market Courts. I am not suggesting that this has anything to do with Abu Dhabi, but it has introduced me to an aspect of trust law with which I was not previously familiar, and it bears closely on the point made by the noble Lord, Lord Pannick. He referred to Jersey as one of the jurisdictions of concern. One aspect of its legislation which has come to my attention through my connection with Abu Dhabi is the Foundations (Jersey) Law 2009. This is a structure set up by statute under Jersey law which is matched with an equivalent statute in Guernsey. It creates a form of trust which is, as it were, a hybrid between a trust and a corporation with a number of aspects that are described very well in Sections 25 and 26 of the Jersey law.

One of the points about the foundation, which appears in Section 25, is that a,

“beneficiary under a foundation … has no interest in the foundation’s assets; and … is not owed by the foundation or by a person appointed under the regulations of the foundation a duty that is or is analogous to a fiduciary duty”.

So the beneficiary under that system is rather different from a beneficiary under our system, where undoubtedly they have an interest in the foundation’s assets. But also to the point is Section 26, which provides that foundations are,

“not obliged to provide information”.

That has its counterpart in the point made about the Data Protection Act in that jurisdiction. It says that except,

“as specifically required by or under this Law or by the charter or regulations of the foundation, a foundation is not required to provide any person … with any information about the foundation”.

It goes on to say in subsection (2) that the,

“information mentioned in paragraph (1) includes, in particular, information about … the administration of the foundation … the manner in which its assets are being administered … its assets; and … the way in which it is carrying out its objects”.

I do not wish in any way to criticise how the foundation laws are run in Guernsey or Jersey, but it is a pattern which, if repeated in less scrupulous jurisdictions, has obvious attractions. People move into a foundation and nobody knows what part of the foundation money they own, because they are not supposed to own any part of it, and the foundation is not obliged to disclose any information at all. There is a risk that those who are keen, for whatever reason—it could even be for matrimonial reasons—to conceal their assets could move them offshore from a trust such as we have in this country, closely regulated and subject to the ordinary rules, to one of these other bodies, which we would not wish to encourage. One has only to look at the Criminal Finances Act 2017 and some of the clauses in the Sanctions and Anti-Money Laundering Bill that is before the House to see that we are taking a completely opposite line to the foundations laws, because we are insisting that we should be provided with information about what organisations of this kind hold and, indeed, who holds what assets. We have not got as far as actually requiring trusts to do that but, certainly, anyone who puts his money into a company, in an attempt to conceal his assets within the company, will be forced eventually to have that information disclosed.

I add these points to suggest that the point that the noble Lord, Lord Pannick, made has a great deal of substance, which one can trace through the foundations law. I stress again that I am not criticising how this is administered in Jersey or Guernsey—that is not really the point. The point is that those who would wish to copy their systems are subject to less close scrutiny. I also emphasise that I am not suggesting that we in this country would want to adopt a foundations law; that would really be quite contrary to how our current legislation is proceeding. So there is an important issue here about protecting ourselves—and those who set up trusts here and administer them properly according to our rules and conventions—against a loss of business, which would be detrimental not only to those who run the businesses but to the whole ethic by which we practise our trust law.

I hope that the Minister and those advising him will look carefully at the Jersey and Guernsey examples, with a view not to criticism but to sensing the risk to which the noble Lord, Lord Pannick, drew our attention.

--- Later in debate ---

[Lord Ashton of Hyde]

Yes.

[Lord Pannick]

May I add to this fascinating debate? Does this not illustrate one of the problems of the withdrawal Bill—that in many areas, of which this is one, there will be two potentially conflicting sources of English law? There will be this Act, on data protection, and the direct implementation through the EU withdrawal Bill on the same subject. The two may conflict because this Act will not contain the recitals.

[Lord Clement-Jones]

My Lords, all I can say is that I do not know how the legal profession will cope in the circumstances.

Data Protection Bill [HL]

Lord Pannick Excerpts

Committee: 1st sitting (Hansard): House of Lords
Monday 30th October 2017 Lords Chamber

[Baroness Ludford (LD)]

My Lords, I am also pleased, as co-signatory, to support the amendment, the purpose of which is to retain in domestic law wording from the European Charter of Fundamental Rights concerning data protection. This is for the benefit of British citizens and to help ensure that vital data flows for business and law enforcement can continue if we Brexit.

The specific article in the EU charter, Article 8 on data protection, is stronger in this respect than the older non-EU European Convention on Human Rights, which deals with privacy only under the rubric of protection of family and personal life. The Government plan that the charter should cease to be part of UK domestic law after Brexit in Clause 5(4) of the European Union (Withdrawal) Bill. This broader issue will be considered as part of the scrutiny of that Bill, and there is a cross-party amendment tabled in the House of Commons and led by Dominic Grieve MP to remove that clause such that the charter continues to apply domestically in the interpretation of retained EU law. Liberal Democrats strongly support that amendment, but it seems appropriate not to wait for or depend on the success of that broader effort and at least effectively to embed the thrust of the charter as it concerns data protection in this Bill, which largely concerns EU law.

This is extremely important because if we Brexit, the UK will seek from the European Commission an adequacy decision on UK data protection so that transfers between the UK and the EU can continue smoothly—an objective the Prime Minister has singled out for mention. If we leave, EU states may no longer be able to share data with us unless our legal regime on matters including state surveillance powers aligns with EU requirements. The adequacy assessment will be wide-ranging, taking in all aspects of law and practice in the UK. The embedding of the charter’s data protection right in this Bill would be an important safeguard for business continuity—especially for tech companies, which depend crucially on the free flow of data—as well as ensuring that essential cross-border police and intelligence co-operation is not disrupted.

I, my noble friends Lord McNally and Lord Paddick, and other noble Lords raised at Second Reading the need for measures to protect us from threats, not to undermine our civil liberties. We are used to the European Court of Human Rights ruling on privacy issues, several times finding the UK in breach of the convention, but more recently in the digital age it is the European Court of Justice—the EU court—that has come into play as EU law on protection of electronic communications and the provisions of the Charter of Fundamental Rights has begun to bite. The Snowden revelations brought heightened sensitivity about the extent of the legitimacy of the activities of our intelligence services.

The EU data retention directive—the EU law on mandatory mass data retention—was pushed through Brussels in 2005 when the UK had the presidency of the EU by the then UK Home Secretary in an expert piece of lobbying after the London bombings of that year. In a landmark 2014 judgment, the court struck it down as incompatible with the right to respect for private life and data protection under Articles 7 and 8 of the charter. Then, as mentioned by the noble Lord, Lord Stevenson, the judgment on DRIPA last December—technically, the Tele2/Watson case, although initially also involving the then Back-Bench David Davis MP—continued in the same vein, declaring that mass data retention was “disproportionate” to citizens’ rights to privacy. Its implications for the Investigatory Powers Act and the question of whether bulk collection of communications data could be permitted to infringe privacy on the grounds of pursuit of serious crime or threats to national security may be ascertained by the reference to the European court made by the Investigatory Powers Tribunal in September. Certainly, the wide range of powers in the Investigatory Powers Act might look vulnerable to being found in conflict with EU law. The Independent Reviewer of Terrorism Legislation, Max Hill, suggested that it was unclear whether the ruling in the Watson case on safeguards for data retention regimes could be interpreted as applicable to national security.

It is true that while in the EU the national security exemption from EU competence applies but, as was brought out at Second Reading, if we were outside the EU the arrangements for our intelligence agencies would go into the whole mix that is assessed for compliance with EU standards. The court’s decision in July, rejecting the legality of the EU agreement with Canada on the transfer of passenger name record details, provides a salutary lesson in how the court approaches third-country transfers. It struck down the agreement because several of its provisions were incompatible with EU fundamental rights. It is therefore crucial that we embed the wording of Article 8 of the charter.

The Labour Opposition have tabled an amended version of Amendment 4, namely Amendment 4A. This is an interesting variation and I look forward to learning a bit more as we progress about exactly how the new wording would work. As I understand it, the safeguards in subsection (1) of the proposed new clause and the first part of subsection (2), which are replicated from Amendment 4, would and should still govern the,

“provisions, exceptions and derogations of this Act”,

otherwise, the point of writing in safeguards is undermined.

I wonder about the reference to,

“purposes as set out in the GDPR”,

since the GDPR is concerned only with the processes for data manipulated in accordance with purposes set down in other instruments. I am slightly unclear about that.

I believe that there has been concern about a conflict with press freedom. Of course we are suffering here from the fact that we have only a partial bite from the charter, which contains a firm provision on freedom of expression and information as well as on the right to security. When we succeed in retaining the whole charter in domestic law via the EU withdrawal Bill, the whole balancing exercise will become more apparent than with this snapshot. In the meantime, we have to proceed with entrenching this partial aspect of the charter as concerns data protection.

[Lord Pannick (CB)]

My Lords, the problem with Amendment 4 is that it would not incorporate the charter provision relating to personal data. The reason for that is that it addresses the prima facie right to the protection of personal data, but not the limitations and exceptions recognised by the European charter itself. Article 8, like all the other rights in the European charter, is subject to the limitations stated in Article 52. That says that there can be limitations on protected rights if they are provided for by law, are necessary and meet,

“objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others”.

It is because there has to be a balance between this prima facie right and exceptions and limitations that the Bill contains a very large number of exemptions which cover a whole range of circumstances in which the rights of the data subject have to give way to other considerations, such as national security, the detection of crime, taxation, judicial appointments or confidential references for employment. There are many such exemptions.

The Bill contains exemptions because there are other interests in this area, and other rights, which conflict with the right to protection of personal data, and a fair balance is required. The Committee will want to debate the scope of those exceptions and limitations and be satisfied that the balance has been struck correctly. But Amendment 4 suggests that there is some absolute right to the protection of personal data. That is simply wrong. That is why, I imagine, the noble Lord, Lord Stevenson, has tabled manuscript Amendment 4A, which attempts to address the defect in Amendment 4.

I would have wished for more time to consider Amendment 4A, which I understand was tabled only this morning, particularly if the noble Lord, Lord Stevenson, intends to divide the Committee today. I am concerned that Amendment 4A poses two difficulties of its own. First, the value of including Amendment 4A is not clear to me. The Bill already sets out in considerable detail the domestic implementation of the charter obligation; that is, Article 8 read with Article 52. I fear that including Amendment 4A in the Bill would be likely to cause legal confusion and uncertainty in an area where precision and clarity are essential—and, indeed, are provided by the substance of the detailed provisions in the Bill.

Secondly, I fear that the purpose of Amendment 4A is to confer some special, elevated legal status on Article 8 rights concerning personal data for the future, as subsection (4) suggests. I think that would be very unwise because, as I have said, Article 8 rights often conflict with other rights—whether it is freedom of expression, which we heard about, or the right to property—or other interests. The detailed provisions of the Bill illustrate the difficult choices that have to be made in this area.

Amendment 4A seeks to give a special legal status to one charter right in isolation and that is simply inappropriate. For those reasons, I hope that the noble Lord, Lord Stevenson, will not divide the Committee on Amendment 4A. If he does, I will vote against it.

[Lord Faulks (Con)]

My Lords, this is a complex Bill—necessarily so as it balances the need to access data and the need, in appropriate circumstances, to protect data from access, as the noble Lord, Lord Pannick, said. Most of the amendments in the Marshalled List seem to me to be about fine-tuning the provisions to alter the balance a little, one way or another. However, Amendment 4A—charmingly introduced as it was by the noble Lord, Lord Stevenson—seems to be in a different category. It seeks to incorporate the provisions of the Charter of Fundamental Rights into the Bill by including the wording of Article 8.

I do not claim particular expertise in data protection, except to say that every business and every professional is or should be aware of their obligations in this area. I do, however, have considerable experience of the interaction of detailed legislative provisions and rights instruments. My experience stems from legal practice and as a former Minister in the Ministry of Justice. A particular focus of my attention was the European Convention on Human Rights and, to a lesser extent, the charter.

There is always a difficulty in marrying up detailed legislative provisions and broad-based charters or conventions, which are inevitably framed in generalisations. I have always thought that a combination of our Parliament and our courts should be capable of protecting citizens’ rights. However, to help in that pursuit we have the Human Rights Act, which incorporates the European convention into our law and gives the Strasbourg court a significant role.

Data Protection Bill [HL]

Lord Pannick Excerpts

Monday 30th October 2017 Lords Chamber

[Baroness Royall of Blaisdon (Lab)]

My Lords, I rise to move Amendment 10 in my name and the names of the noble Lords, Lord Pannick and Lord Macdonald of River Glaven. In doing so, I declare my interest as principal of Somerville College, Oxford.

The GDPR, which will be brought into effect in domestic law by the Data Protection Bill, will have an impact on many aspects of university business from procurement to the commercialisation of research. Universities up and down the land are therefore now making preparations to ensure that they will comply with the new requirements. It is immensely complex, and throughout the Committee stage issues will be raised which are pertinent to universities.

With this amendment I am concerned about one aspect of the life of universities, colleges and schools which will be severely impacted by the GDPR. It is our ability to fundraise and to maintain alumni relations, hence our amendment, which is probing at this stage. I have only recently become aware of the huge importance of alumni relations and fundraising and of the fact that they are inextricably linked. As a consequence of financial constraints and government encouragement, universities, colleges and schools are having to raise more and more money to provide the education and the excellent facilities rightly expected by students.

As far as universities are concerned, with potentially reduced tuition fees, Brexit and, despite what the Government may say, a reduction in the number of foreign students, the need to raise money will increase. At Oxford, the system that I now know best, the excellent tutorial system demands even greater resources. I do not complain. However, with the introduction of the GDPR our alumni relations and fundraising ability will be severely limited unless we can find a way through, for example by stating that a college, school or university is not a public authority for the purposes of the GDPR. Naturally universities, including Oxbridge colleges, are concerned to ensure that personal data is processed lawfully in the course of contacting alumni for fundraising purposes, and we want to ensure that we work in the most cost-effective way. I should stress that none of the contacts made to our former students relates to cold calling. We are talking about alumni, people who spent three or more years as students, with whom we have therefore have a long-standing relationship. With regard to a college such as Somerville, our alumni feel they belong to a community and they want us to remain in close touch with them.

As the Minister, will be aware, under the GDPR, in order for the processing of personal data to be lawful at least one of the six conditions set out in article 6 of the GDPR must apply. The most important change to the lawfulness conditions by the GDPR concerns the consent condition. The GDPR sets a high standard for consent requiring a positive opt-in, and unless opt-in consent has been obtained, or is obtained in future, current and future contact with alumni will be limited. It is clear that existing consents are unlikely to meet the GDPR standard and as a result all fundraising and alumni databases might have to be rebuilt from scratch and/or a huge exercise undertaken to secure explicit consent from all our former students if the consent condition were to be relied on by colleges to justify their processing of alumni data. This is an enormous administrative task and hugely time-consuming. At Somerville, we are already grappling with the new consent standard, and it is both difficult and detrimental.

I understand that when the Council for Advancement and Support of Education—CASE—met DCMS and the Information Commissioner in May it was suggested that the legitimate interest condition could, in appropriate circumstances, be relied on by fundraisers. However, this condition does not apply to processing by public authorities. While the GDPR contains no definition of public authority, Clause 6(1) states:

“For the purposes of the GDPR, the following (and only the following) are ‘public authorities’ and ‘public bodies’ under the law of the United Kingdom—


a public authority as defined by the Freedom of Information Act 2000”.


The Freedom of Information Act 2000 contains in Schedule 1 a list of public authorities which includes, at paragraph 53,

“the governing body of … a university receiving financial support under section 65 of the Further and Higher Education Act 1992”,

and,

“any college, school, hall or other institution”,

of such a university. It is clear that universities, colleges and schools fall within this definition of public authority, which would mean that the legitimate interest condition could not be applied and they would have to rely on either the public interest condition or the consent condition.

I know that the Bill team recently had a meeting with UUK at which this issue was discussed. Oxford University was not present, but this was not due to lack of interest or concern; it was agreed that Cambridge should represent the interests of Oxbridge as a whole. At this meeting, the Bill team was apparently clear that it had put exemptions in the Bill to protect the position of universities. I am glad that there is no policy dispute, but I have to say that my noble friends and I have been unable to identify the exemptions.

The Minister may say that it is a matter that will be dealt with by guidance, but I regret that in my view guidance will not suffice. This is a matter of huge importance to universities as well as to colleges and schools, and there needs to be clarity in the Bill. I look forward to the Minister’s response. If, as I suspect, we do not reach agreement today, I would be grateful if the Minister’s office could arrange a meeting with interested Peers so that we might discuss this further. I beg to move.

[Lord Pannick (CB)]

My Lords, I declare an interest as a fellow of All Souls College, Oxford. Although All Souls has no students and therefore no alumni, it has former fellows. I endorse everything that was very eloquently said by the noble Baroness. There is a problem here. It needs to be addressed. My understanding is that the Government are sympathetic to the mischief which the noble Baroness has identified. For the reasons she has explained, the mischief is not remedied by the terms of the Bill and I very much hope that the Government will be able to indicate today that they are sympathetic and are willing to meet the noble Baroness, Lady Royall, and others to find a way in which these concerns can be addressed as they ought to be.

[Lord Macdonald of River Glaven (LD)]

My Lords, I have put my name to the amendment and I declare an interest as the warden of Wadham College, Oxford.

It is important to underline, as the noble Baroness has, that fundraising is now intrinsic to the financial well-being of institutions of higher education. That is certainly true of my college. It is intrinsic and critical because, along with conference business and other means of raising money, it helps to plug the gap that exists between fee levels for students and the real cost of educating them. It is clearly in the public interest that colleges and universities be placed in the strongest possible position to raise money to plug that gap.

It is equally important to bear in mind that the sort of fundraising that we are talking about does not involve random mailshots to unsuspecting victims, but regular contact over years with individuals who overwhelmingly regard themselves as members of a close community and are much more likely to complain if they are not contacted than if they are. I have experienced that many times. Requiring colleges to rebuild their alumni databases from scratch could serve no conceivable public benefit; indeed, it would lead to a significant public disbenefit, because it would weaken our ability to fundraise in already straitened financial circumstances.

I certainly agree with the noble Baroness that guidance would be insufficient in this situation. This matter is of such importance to the economic well-being of the institutions in question that it must be dealt with in the Bill. I very much look forward to hearing the Minister’s response and would wish to attend any meeting, should one be arranged.