Covid-19: Broadband

Lord Patel Excerpts

Monday 5th July 2021 Lords Chamber

[Baroness Barran (Con)]

My noble friend is absolutely right, and we are investigating all the areas that he alluded to, particularly for the last 100,000 people who will not currently be reached through either the commercial rollout or our Project Gigabit plans.

[Lord Patel (CB) [V]]

My Lords, the issue with children from deprived backgrounds was not just that they could not get access to broadband but that they did not have the equipment. What plans do the Government have to make both the equipment and the broadband availability free of charge to deprived households?

[Baroness Barran (Con)]

During the pandemic, schools have been able to request free mobile data uplifts for disadvantaged families, and those will remain in place until the end of this month. Over 1.5 million laptops and tablets have been delivered to schools, trusts, local authorities and further education providers, and the Government are investing over £400 million to support access to remote education and online social care services.

Data Protection Bill [HL]

Lord Patel Excerpts

Report: 1st sitting: House of Lords
Monday 11th December 2017 Lords Chamber

[Baroness Chisholm of Owlpen (Con)]

My Lords, I am pleased to be moving the Government’s technical amendments this evening, and, in particular, Amendments 3, 4 and 5 which respond to the concerns raised by the noble Baroness, Lady Royall, and others on behalf of the UK’s universities, schools and colleges. They were worried that the Bill would restrict their ability to process the data of alumni for fundraising purposes. As the noble Baroness explained in Committee, universities, schools and colleges were concerned that being badged as public authorities by Clause 6 would mean they could not rely on the legitimate interests processing condition in article 6(1)(f). This is because the final sentence of article 6(1) states:

“Point (f) … shall not apply to processing carried out by public authorities in the performance of their tasks”.


Universities also doubted whether, in the context of alumni relations, they could rely on article 6(1)(e) of the GDPR, which relates to processing necessary for the performance of a task carried out in the public interest. Although there is a good argument that any fundraising or similar activity which allows universities to improve facilities for students would be considered a “public interest” task, the Government can see why universities might doubt whether all their fundraising work would fall into that category. If universities could not rely on article 6(1)(e) or (f), they say they would be left without an obvious processing condition in situations where obtaining the data subject’s consent, at least in the GDPR sense of that term, was not a realistic option.

Government Amendments 3, 4 and 5 address these concerns by making it clear that public authorities will be treated as public authorities for data protection purposes only when they are carrying out their public tasks. To the extent that they carry out non-public tasks, they would not be defined as a public authority for the purposes of the GDPR and would not be prevented from relying on the legitimate interests processing condition.

We recognise that the amendment does not refer to universities, schools or colleges by name. This is deliberate, meaning that any public authority which is processing data for non-public functions will be able to rely on this provision. The education sector is not the only one to have these worries. I know, for example, that our museums and galleries would welcome the same degree of flexibility, and this amendment will ensure they have it. I am grateful to the noble Baroness for raising this matter and I hope these amendments will provide universities and other similar organisations with the reassurance they need.

I will not go through the remaining amendments in the group one by one, but instead pick out a few which I think may be of broader interest—for example, Amendments 145 and 146. In Committee, my noble friend Lord Hunt of Wirral was among those to express concerns about the inclusion of the term “other adverse effects” in the definition of damage in Clause 159. He asked whether this was broader than the definition in the GDPR. As I set out then, the Government’s intention in including a definition of damage in Clause 159 was to provide clarity, specifically in relation to the inclusion of distress. Clause 159 does not seek to provide a wider definition of damage than is currently provided in the GDPR; nor indeed could it.

None the less, in light of the concerns expressed by my noble friend, the Government have reconsidered this issue and decided to amend the definition to ensure that it is as clear as possible and to minimise the risk of any uncertainty such as that which concerned noble Lords. The amended definition now simply states that the reference to “non-material damage” in the GDPR includes distress. The definition of damage for the purposes of the law enforcement and intelligence services regimes is set out separately in Clause 160. Amendment 146 makes a similar change to that definition so that it is as clear as possible and no longer refers to “other adverse effects”. I beg to move.

[Lord Patel (CB)]

My Lords, I will comment on Amendments 3, 4 and 5. The Minister and the noble Baroness may well feel that I do not give up, and I agree: I do not. I of course understand clearly what the Government are trying to do with the amendment from the noble Baroness, Lady Royall of Blaisdon—that they have agreed to get that into the Bill. It is helpful to know that public bodies need to be defined as such when they are processing data for tasks that are not defined as tasks in the public interest. This opens up the possibility of their instead using legitimate interests as a legal basis under some circumstances: for example, as has already been mentioned, for universities contacting alumni for fundraising purposes.

My point is different: universities and their research activities and how that is recognised, which we discussed. Here, it is more pressing to be clear on what counts as a task in the public interest, since public bodies will need to determine which legal basis is appropriate to the processing they are undertaking in different circumstances. For example, is research conducted in universities a task in the public interest, in which case the university would be considered as a public body for the purposes of the Bill, or is it not? In the latter case the university is not a public body for research purposes, and the research is therefore conducted on the legal basis of legitimate interest.

These differences matter, particularly as the GDPR requires data controllers to be clear on the legal basis they are using. How are public bodies such as universities to make this determination? The clearest answer would be, as I indicated in Committee, that the ICO gives guidance. I understand that the Government cannot direct the ICO to give guidance, so a way needs to be found to clarify which tasks fall under the public interest basis, specifically using the example of university research to provide that clarity. I would be grateful if the Minister commented on that.

Data Protection Bill [HL]

Lord Patel Excerpts

Report stage (Hansard - continued): House of Lords
Monday 11th December 2017 Lords Chamber

[The Earl of Erroll (CB)]

My Lords, I will say a couple of things on this in full support of the proposition made by the noble Baroness, Lady Neville-Jones. These issues are very complicated. We tend to try to brush them aside and hope that they will be dealt with by the person who is enforcing and regulating. But that can be dangerous, because they will find it very difficult as well, and sometimes, if you do not have the intention in the Bill, it may just not happen.

This is important because, although I fully support the intention and objectives of the GDPR in the Data Protection Bill in front of us, which is there for all the right reasons, we have to be careful not to throw out the baby with the bathwater. This is one of those instances where, in trying overzealously to introduce a rules-based system in a complex world and a complex society, you find unexpected consequences. Some of them cannot be defined terribly easily in regulation, but I think it would be wise to put this in an amendment.

We in this House tend to think in principle much more than another place. To try to deal with this in another place when it gets there may be unwise in case they run out of time. It would be good to put something in the Bill in this House at Third Reading, if the Minister were so minded, and I would wholeheartedly support that.

[Lord Patel (CB)]

My Lords, I have already spoken on this at length and I do not intend to repeat myself, but I support the amendment from the noble Baroness, Lady Neville-Jones. This is a very important database. It is not just national but international, and it is difficult to collect. That is why I am glad that an accommodation has been made to support the amendment.

[Lord Stevenson of Balmacara]

My Lords, I add my voice in support of the noble Baroness’s amendment and wish it well. I suspect she has run into the logjam that constitutes the waiting list to see the Bill team and the Ministers, who have been worked so hard in the last few months. But I hope it will be possible, given that there is a bit of time now before Third Reading, for this matter to be resolved quickly and expeditiously before then.

--- Later in debate ---

The amendments have been developed in close liaison with the Wellcome Trust and I am grateful to it for its help. On that note, I hope my noble friend feels able to withdraw her amendment and that all noble Lords feel able to support the government amendments in the group.

[Lord Patel]

Before the Minister sits down, I thank him and his team immensely for taking on board the concerns that I and others expressed about the interventional medical research that the government amendments will now allow. It cannot be overstated: this will now allow important research, including clinical trials, to be undertaken that will advance medical research in the United Kingdom, making it an attractive place to do such research. I thank him immensely; I am most grateful.

[Baroness Neville-Jones]

My Lords, I am extraordinarily grateful to noble Lords who have spoken in support of my amendment, and for the comprehension that the Minister has shown for the work of the patient support groups. They will have greatly appreciated hearing how much the Government support what they do.

I very much hope that we can work on an amendment that will both meet the Government’s concerns and effectively cover the work of those organisations, which, as I think the Minister understands, work in difficult circumstances. They stand ready to participate with the Government in getting language that will both cover their concerns and ensure that we do not open the door to those for whom it is not intended. On that basis, I beg leave to withdraw the amendment.

Data Protection Bill [HL]

Lord Patel Excerpts

Monday 13th November 2017 Lords Chamber

[Lord Puttnam (Lab)]

My Lords, having restrained myself for four and a half hours and having done a huge amount of work in the Library, I will, despite the amendment having been given only a few minutes, detain your Lordships for a few more moments. This is a massive issue.

As a member of the AI committee chaired by the noble Lord, Lord Clement-Jones, I have been struggling to find analogies for just how serious the world we are moving into is becoming. What I have come up with, with the help of the Library, is road safety. I am going to talk about ethics. Probably the most well-known and successful ethicist in your Lordships’ Chamber is the noble Baroness, Lady O’Neill. Last week, when discussing what this Bill is really all about, she put her finger on it. She asked of the Minister:

“Is he suggesting that the aim should be to adapt children to the realities of the online world and the internet service providers, rather than to adapt the providers to the needs of children?”.—[Official Report, 6/11/17; col. 1606.]


This seems to be fundamental to the issue. Because I needed an analogy, I started looking into road safety, and found it very interesting and—if noble Lords will give me a couple of minutes—rather instructive.

In 1929, a royal commission met, having been required to urgently legislate on road safety because of the “slaughter” that was occurring on the roads. I will not take up your Lordships’ time reading out all the information that I got from the Library, but I have it all here. Parliament legislated in 1930, pretty ineffectively, and again in 1932, again ineffectively. In 1934, your Lordships’ House passed a Bill on road safety, which was rejected in another place because of the objections of lobbyists from the automobile industry, the oil industry and the insurance industry. Parliament tried again in 1938, and once again failed.

Here, I must read something extraordinary. Lord Cecil of Chelwood, a Conservative Peer, said at the end of the debate on the report regarding the legislation:

“I believe future ages will regard with consternation the complacency, the indifference with which this slaughter and mutilation on the roads is now regarded. I observe with great interest that in the final paragraph of the Report the members of the Committee themselves say that they are puzzled and shocked … by the complacency with which this matter is regarded”.—[Official Report, 3/5/1939; col. 903.]


Thousands of people were being killed. I put it to the House that if we get this Bill wrong, a lot of people will be hurt; if we get it right, we may save lives. That is how important it is.

I am standing here today because of a man named Ralph Nader. Through an extraordinary series of events in the 1960s, Ralph Nader was able to impose on the American automobile industry, against its wishes, seatbelts. Six years ago in Italy, my life was saved by the combination of a seatbelt and an airbag, so I take this issue pretty seriously. Look at what has happened since 1990 to the number of lives saved by the utilisation of technology that existed 20, 30 and 40 years prior to that—it is extraordinary. In 1930, almost 8,000 people were killed on the roads of Britain, with one million registered vehicles on the road. Last year, fewer than 2,000 people were killed, with 35 million registered vehicles on the road. That is because, at last, technology was brought to bear—against the wishes of the industry lobbyists.

We must understand that there are those who would like this Data Protection Bill to be weak. It is our duty to ourselves and to future generations to make it extremely tough and to not allow ourselves to be undermined by the views of the many sectors of industry that do not share our values.

[Lord Patel (CB)]

My Lords, it is a pity I have to be brief, but I will try. The amendment is interesting and worth debating in greater detail than the time today allows. Remarks have already been made about the report from the Royal Society and the British Academy, which suggested setting up a body but did not define whether it ought to be statutory. It is a pity it did not because, if it had, perhaps the Government would have taken greater notice of the suggestion and taken on board what pages 81 and 82 of their manifesto said that they would do—set up a commission.

To me, there are three important things for any body that is set up. First, it must articulate and provide guidance on the rules, standards and best practices for data use, ideally covering both personal and non-personal data. I see this amendment as restrictive in that area. Secondly, it must undertake horizon scanning to identify potential ethical, social and legal issues emerging from new and innovative uses of data, including data linkage, machine learning and other forms of artificial intelligence, and establish how these should be addressed. Thirdly, and importantly, it should be aligned with, and not duplicate, the roles of other bodies, including the ICO as the data protection regulator and ethics committees making decisions about particular research proposals using people’s data. This important amendment allows us to discuss such issues and I hope we will return to it and perhaps make it wider.

Is such a body necessary? The debates we have had suggest that it might be. The Nuffield Foundation was mentioned. It has suggested that it will set up an ethics commission, and we need to know what the purpose of that will be. What would its role be in the regulatory framework, because it would not be a statutory body? I look forward to that debate but, in the meantime, I support the amendment.

[The Earl of Erroll (CB)]

My Lords, I support the amendment and its very simple principle. We live in a complex world and this tries to lay rules on a complex system. The trouble is that rules can never work because they will never cover every situation. You have to go back to the basic principles and ethics behind what is being done. If we do not think about that from time to time, eventually the rules will get completely out of kilter with what we are trying to achieve. This is essential.

Data Protection Bill [HL]

Lord Patel Excerpts

Monday 6th November 2017 Lords Chamber

[Lord Lester of Herne Hill]

My Lords, the Minister rightly signed on the face of the Bill his statement of its compatibility with the European Convention on Human Rights. I wonder whether the answer to the question of the noble Lord, Lord Kakkar, is not provided by the Human Rights Act itself, which says that all legislation, old and new, must be read—and given effect, if possible—compatibly with the convention rights. One of those convention rights is the right to privacy. The right to privacy embraces the equitable duty of confidentiality referred to by the noble Lord, Lord Kakkar. Therefore, the reassurance is given by the Human Rights Act rather than by anything else. The relevant provisions of this Bill would have to be read compatibly with that. However, I may be speaking out of turn.

[Lord Patel (CB)]

My Lords, if I have understood the noble Lord, Lord Lucas, wrongly, I am sure that he will correct me. However, the impression he gave was that the confidentiality between a doctor and a patient forbids the doctor to inform a family member if the patient is likely to suffer harm, even self-inflicted harm. That is not the case. The doctor is bound to respect confidentiality, but if that is likely to result in not informing the family of the harm that may be caused to a patient, or distress to the family, it is not true that confidentiality will still hold.

[Lord Lucas]

My Lords, I am glad to know that. I have not dealt directly with a doctor on this at all but rather with university and school authorities. In those cases—not steadily and not, thank goodness, frequently—I have encountered a complete unwillingness to risk telling anybody anything for reasons of confidentiality. I hope that principle is misunderstood, but this certainly happens. In cases where there is a very clear principle of confidentiality, the circumstances under which it can reasonably be interpreted as being in the best interests of the patient to breach it need to be better understood by people who are not medically trained so that they feel confident in passing the information back. I am not trying to create law in an extremely difficult area. I hoped that the Bill might lead over time to universities feeling that parents were part of the solution, and to schools feeling that other children were part of the solution, and feeling confident that guidelines had been evolved which allowed them to seek support for these children beyond just their own tight resources. I am delighted to hear what the noble Lord said but that is not what gets through once it has been through the filter of university, at least on the occasions that I have dealt with it. I probably see the cases that go wrong. If something has worked out right, there is no reason why it should come to me.

Data Protection Bill [HL]

Lord Patel Excerpts

Monday 30th October 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I do not need to say very much about our amendments in this group because they overlap to a great extent with what has just been said by the noble Lord, Lord Clement-Jones. I should not really delay the House as it is anxious to get on to other business, but the noble Lord made an interesting comment about the response that might come from my noble friend sitting to my right. In our Whips’ Office we have a regular problem, because Ray Collins and Roy Kennedy are, confusingly, always called Roy Collins and Ray Kennedy. I have never actually heard them be confused when called by their surnames, so we have had a first today. It is always nice to see firsts in our rather dull and restricted life—it is time for dinner.

This is quite an important amendment, and the noble Lord, Lord Clement-Jones, has made the case very well. When I was looking through the Bill and trying to come up with a sense of narrative that we could use here, I wondered about the introduction of “substantial public interest”, which predates this Bill significantly. It appears in the 1998 Data Protection Act but it was not challenged there. It felt to me like a mistranslation—a sort of anglicisation gone wrong, because there should not be gradations of public interest. A matter is either in the public interest or it is not: it should not have to be qualified by the word “substantial” to get it to a different level of concern or consent. In that sense, maybe “substantial” just means of greater sensitivity, rather than more important and therefore to be restricted. I should be grateful if the Minister reflected on that when responding.

I share the concern that the noble Lord, Lord Clement-Jones, raised in his first amendment. By and large, the Bill is pretty good at tying down where there is flexibility and where there is not, but here, the terminology seems very loose. We can understand what Clause 7 means, but the idea that it would be relatively easy to extend and adapt the list in subsections (a) to (d) is quite worrying. If that is to stand, and the defence says that it is reasonable in the circumstances to have such wording, we need to understand the powers under which that list could be adapted or amended. Are they to be found in the Government’s ability to seek regulatory approval, or will it be done in some other form? We ought to know the answer to that.

Since we are back on codes, as mentioned by the noble Lord, here is a code that it is really important to have before we get to Report. I would be grateful if the Minister confirmed that that will be possible. I understand that the issue is not in his hands, because the Information Commissioner will be the person responsible. However, given that the terminology in the Bill will have an impact right across our statutory provisions regarding what is or is not in the public interest, and if this is the long-awaited guidance and the substitute for a proper definition in statute, it is very important that we have it in time to discuss it on Report.

[Lord Patel (CB)]

My Lords, I speak to Amendments 11 and 13, in the name of the noble Lord, Lord Clement-Jones, and Amendment 154, in the name of the noble Lord, Lord Stevenson of Balmacara, and to which I have added my name in support.

When I first read the amendments tabled by the noble Lord, Lord Clement-Jones, I was concerned because I thought them quite restrictive. Now that he has spoken to them, I can see that he intended them to be wider, so I apologise to him that I did not have the opportunity to speak with him beforehand, so that I would have had that clarification. None the less, having said that, I am concerned that the amendment would restrict the interpretation of,

“a task carried out in the public interest”,

and a narrow list is set out in Clause 7(a) to (d). That is a major concern for universities and other institutions involved in research.

It is absolutely important that universities and other public bodies that carry out research functions are able to use,

“task carried out in the public interest”,

as a legal basis for processing personal data. Restricting this clause to apply only to those functions listed in paragraphs (a) to (d) would instantly make all processing of personal data carried out for research purposes with a university illegal. That is unless it could meet the stringent requirements of GDPR-compliant consent, which I will speak to on an amendment in the group that follows.

None the less, providing further clarity through regulations would ensure that “public interest” was not used as a catch-all for public bodies, negating the incentive to restrict the definition in the Bill in the way proposed by this amendment. I have no doubt that we will have a discussion and that the amendment is not intended to be so restrictive. I look forward to the Minister’s summing up.

I support Amendment 154 in the name of the noble Lord, Lord Stevenson of Balmacara. However, under the GDPR, all users and controllers of data will need to be much clearer about the legal basis that they use to process personal data, and more explicit with data subjects about what is happening to data about them. However, this shift is also likely to generate a certain amount of confusion among researchers who process personal data as part of their studies.

An enormous amount of research using personal data is carried out by universities, which constitute public bodies. As it stands, the Bill defines “public interest” in quite a narrow way—and I shall come to that in more detail when I deal with a group of amendments in my name. But “public interest” is an underspecified notion that could be interpreted in many ways, in the absence of authoritative guidance—and it is that absence that the amendment under the name of the noble Lord, Lord Stevenson of Balmacara, deals with. Placing the requirement to produce codes of practice in the Bill will ensure that it is an undertaking that receives the urgent attention that it demands, and I support it for that reason.

[Lord Ashton of Hyde]

My Lords, this is a rather unusual occasion, in that normally noble Lords say that they are going to read very carefully what the Minister has said in Hansard. In this case, I am certainly going to have to read carefully what the noble Lord, Lord Clement-Jones, said, in Hansard. This is a complicated matter and I thought that I was following it and then thought that I did not—and then I thought that I did again. I shall set out what I think should be the answer to his remarks, but when we have both read Hansard we may have to get together again before Report on this matter.

I am glad that we have this opportunity to set out the approach taken in the Bill to processing that is in the public interests and the substantial public interests. Both terms are not new; they appeared before 1998, as the noble Lord, Lord Stevenson, said, in the 1995 data protection directive, in the same sense as they are used in the GDPR and the Bill. That is to say, “substantial public interest” is one of the bases for the processing of special categories of personal data, and this is a stricter test than the public interest test that applies in connection with the processing of all categories of personal data. The noble Lord, Lord Clement-Jones, was wrong to suggest that the list provided in the 1998 Act in relation to public interest was genuinely exhaustive, I think. As he said himself, the effect of paragraph 5(d) of Schedule 2 was to make that list non-exhaustive.

In keeping with the approach taken under the 1998 Act, the Government have not limited the public interest general processing condition. The list in Clause 7 is therefore non-exhaustive. This is intentional, and enables organisations which undertake legitimate public interest tasks to continue to process general data. Noble Lords may recall that the Government committed after Second Reading to update the Explanatory Notes to provide reassurance that Clause 7 should be interpreted broadly. Universities, museums and many other organisations carrying out important work for the benefit of society all rely on this processing condition. For much the same reason, “public interest” has not historically been defined in statute, recognising that the public interest will change over time and according to the circumstances of each situation. This flexibility is important, and I would not wish to start down the slippery slope of attempting to define it further.

The Government have, however, chosen to set out in Part 2 of Schedule 1 an exhaustive list of types of processing which they consider constitute, or could constitute, processing in the substantial public interest. That reflects the increased risks for data subjects when their sensitive personal data is processed. Again, this approach replicates that taken in the 1998 Act. Where the Government consider that processing meeting a condition in that part will sometimes, but not necessarily, meet the substantial public interest test, a sub-condition to that effect is included. This ensures that the exemption remains targeted on those processing activities in the substantial public interest. A similar approach was taken in secondary legislation made under the 1998 Act. The Government intend to keep Part 2 of Schedule 1 under review, and have proposed a regulation-making power in Clause 9 that would allow Schedule 1 to be updated or refined in a timelier manner than would be the case if primary legislation were required. We will of course return to that issue in a later group.

Amendment 15 seeks to make clear that the public interest test referred to in Clause 7 is not restricted by the substantial public interest test referred to in Part 2 of Schedule 1. Having described the purposes of both these elements of the Bill, I hope that noble Lords can see that these are two separate tests. The different wording used would mean that these would be interpreted as different tests, and there is no need to amend the Bill to clarify that further.

Amendment 154 would require the Information Commissioner to develop a code of practice in relation to the processing of personal data in the public interest and substantial public interest. As we have already touched on, the Information Commissioner is developing relevant guidance to support the implementation of the new data protection framework. Should there later prove a need to formalise this guidance as a code of practice, Clause 124 provides the Secretary of State with the power to direct the Information Commissioner to make such a code. There is no need to make further provision.

I hope that that explanation satisfies noble Lords for tonight, and I urge the noble Lord to withdraw his amendment. However, in this complicated matter, I am certainly prepared to meet noble Lords to discuss this further, if they so require.

Data Protection Bill [HL]

Lord Patel Excerpts

Committee: 1st sitting (Hansard - continued): House of Lords
Monday 30th October 2017 Lords Chamber

Moved by

[Lord Patel]

12: Clause 7, page 5, line 6, after “includes” insert “, without prejudice to the generality of the expression “necessary for the performance of a task carried out in the public interest”,”

[Lord Patel (CB)]

My Lords, I shall speak also to my Amendments 14 and 111. Perhaps I may first thank the Minister and his team, who kindly agreed to see me and others to discuss what amendments I might have following my Second Reading speech. I am not sure that we resolved any issues, but I at least thank him for his courtesy and hope that, after today, we will resolve those issues.

I will speak first to Amendments 12 and 14. I beg the Committee’s indulgence for taking slightly more time than your Lordships might expect for a group of amendments, partly because I think this is the only time we are dealing with the major sector issues—the sector being the universities and other research institutions on which we are about to rely a lot for our economic growth; I will come to that. I am supported enthusiastically by the Wellcome Trust, the MRC, Cancer Research UK, the AMRC, the Sanger Institute, the Academy of Medical Sciences, the ESRC and many others. They are extremely anxious that what we do with the Bill does not in any way counter their ability to use data for productive research—and I do mean productive research. I declare an interest: I am a fellow of the Academy of Medical Sciences and of the Royal Society of Edinburgh, and I have a strong association with Dundee University. I cannot miss the opportunity to say that last week Dundee University was ranked number one globally for science innovation, beating every university in the United States. That is a fantastic achievement in science research. It beat all the so-called elite universities in England that we hear about, as well.

Clause 7 sets out a legal basis for processing personal data in the public interest. This reflects article 6(1)(e) of the GDPR. It is incredibly important to get the clause right as it will be the only legal gateway available for many research purposes. Why is this the case? Most research purposes rely on informed consent as a legal basis for processing. Consent is the basis of article 6(1)(a) of the GDPR. However, GDPR-compliant consent for the use of personal data is not always a feasible option as a legal basis. Consent is often important in the interests of fairness and transparency but will not be the appropriate legal basis for much research.

I will highlight two relevant sets of circumstances to illustrate why public interest is a necessary legal basis for many valuable research purposes. The first is where consent is not possible. There are a number of situations in which it is problematic to seek consent. Seeking consent may be impracticable where health data have been collected in the past and the time and expense seeking and approaching individuals for consent would be prohibitive. It may compromise effective population coverage; for example, requiring consent has been shown to have a negative impact on the quality of data for cancer registries. It may cause distress or harm in situations where patients may be inconvenienced or upset by being contacted for their consent to use their data for a research project, even if they do not subsequently object to the research going ahead; for example, contacting people about a study examining unexplained child deaths could cause serious distress. It may lead to bias because of self-selection bias among data subjects when asked a question. It may prevent studies large enough to produce meaningful results because the cost of seeking consent across a large number of people can be very high.

I will give one or two examples pertaining to the five issues that I have described. A study of more than 40,000 people demonstrated a highly significant association between the use of minor tranquillisers such as Diazepam and the risk of serious road traffic accidents. This was done through linking prescriptions issued by GPs and data on hospital admissions and deaths. By the way, this study had considerable implications for the safety of patients prescribed Diazepam, and their treatment, and of course also for other road users, but would not have been possible if data could not be processed on a consent basis. A study of the incidence of breast cancer in women was used to show that affluent women have a higher incidence than socially deprived women, but that socially deprived women had poorer survival statistics. This study used identifiable data without consent; it used hospital and GP records to look at a number of factors involved in cancer treatment.

Access to patient records also helps researchers to identify suitable participants to be invited to take part in studies. This is essential for evaluating new medicines, technologies and interventions for the prevention, diagnosis and treatment of disease. For example, in my own field, when the UK collaborative trial of ovarian cancer screening was set up to investigate different ovarian cancer screening methods, 1.2 million patients were invited to take part by post, leading to 200,000 women consenting to take part. It is a world-renowned study whose results have benefited the whole world. If consent were the only available legal basis, that recruitment strategy would not have been possible as these women had not given consent to the initial contact. Of the 1.2 million women contacted, only 32 women raised any concerns about being contacted.

These are just some of the many examples of vital research that, although very much in the public interest, cannot be done on the basis of consent. The research community has developed a system of robust and proportionate safeguards for these situations, to ensure that research on important topics can be undertaken using personal data where consent is not possible while protecting the research subjects. The use of personal data in these circumstances is controlled through safeguards. Studies using health data are reviewed by the Health Research Authority’s confidentiality advisory group; they must also receive a positive opinion from a research ethics committee to be eligible. The use of this data must be considered to be in the public interest, so we have safeguards.

In this country, we also have the benefit of a National Data Guardian for health and social care—a position I very much hope will be placed on a statutory footing through a Private Member’s Bill that is progressing through the other place. This guardian’s role is to protect patients’ rights and interests over data about them, within and beyond health and care services. The reason for this exposition into the governance of personal data in health research is to illustrate that the UK has a robust, well-established system of safeguards and oversight for processing personal data in the public interest when it comes to health and medical research.

I turn to the second issue: where consent cannot meet GDPR standards. Even with the most rigorous standards and through engagement with participants, consent may not meet the new, stricter standards specified by the GDPR as a basis for processing under article 6(a). The working party of EU data protection regulators—the article 29 working party—produced an opinion in 2011 on the definition of consent that ran to 38 pages. It is not a straightforward legal basis for researchers to use. Furthermore, data collected for research purposes often has significant value beyond the limited, original purpose of its collection. Research can proceed in unanticipated ways, with different teams using the data and processing it in such a way that the data subjects could not feasibly be informed at the outset of the full extent of how their data could be used, for what purposes or by whom.

My own unit started collecting data in 1958, before I even started as a junior doctor, and carried on collecting information manually for over 50 years. The consent we had from the pregnant women who had had babies was to us using the data to improve the services. Subsequently, 45 years later this was the only data available—in this country or worldwide—to prove that the intrauterine environment and the effect on that environment produces adult diseases. That is now well established. That information would never have been available if we did not have that data. We are proud that we have collected it.

Another example is UK Biobank. It relies on broad consent where the participants give consent for pseudonymised data to be used for a variety of research studies under certain conditions. This broad consent approach is approved by an ethics committee and reduces the burden on participants because they do not need to be contacted for consent for each new study. I have no doubt that my noble friend Lady Manningham-Buller will have something to say about this as she is the chairman of the Wellcome Trust, which is the holder of the data.

--- Later in debate ---

[Lord Clement-Jones (LD)]

My Lords, that provokes me to add something. I am not entirely clear whether we are talking about something that is too narrow within the GDPR, or whether it is a lack of a suitably wide derogation on the part of the Government as part of the Bill. For all the reasons that the two noble Lords have mentioned, it seems extraordinary that the beneficial activities that they are discussing are not included as exemptions, whether explicitly or implicitly. It may be that the Minister can give us greater comfort on that, but I am not clear what is giving rise to the problems. As we heard in earlier groupings, I am a fan of having something more explicit, if anything, in the Bill, which is particular perhaps to medical research and other forms of research in that sort of area. But it is not clear whether that is going to be permissible under the GDPR or whether the Government can actually derogate from it in those circumstances.

[Lord Patel]

I shall respond to some of the points raised. First, on the research ethics committee, we established through legislation—and I remember the debates that we had—a national Research Ethics Committee to deal with all applications for biomedical research, but particularly research involving patient data and transfer of data. If I as a clinician want to do a trial, I have to apply to that committee with a full protocol as to what consent procedures and actual research there will be, and what will be the closing time of that consent. If I subsequently found the information that I had could lead to further research, or that the research that I had carried out had suddenly thrown up a next phase of research, I would have to go back to the committee and it would have to say, “Yes, that’s part of the original consent, which is satisfactory to progress with the further research”. It is a robust, nationally driven, independently chaired national ethics committee, apart from the local ethics committee that each trust will run. So the national ethics committee is the guardian.

Furthermore, there is a separate ethics committee for the 500,000 genomes project, run by the Wellcome Trust and other researchers; it is specifically for that project, for the consent issues that it obtains, the information given at the time when the subject gives the consent and how the data can be used in future. The genomes project aims to sequence all the 500,000 genomes, and to link that genome sequence data with the lifestyles that people had and diseases that they developed to identify the genes that we can subsequently use for future diagnosis and treatment—and to develop diagnostic tests that will provide early diagnosis of cancers, for instance. The future is in the diagnostic tests. Eventually we will find them for diseases which have not developed but which have a likelihood of developing. Those diagnostic tests will identify the early expression of a protein from a gene and then find a treatment to suppress that expression well before the diseases develop, rather than waiting until the cancer develops and then treating it.

All this is based on the data originally collected. At this stage, it is impossible to know where that research will lead—that is the history—apart from the clinical trials which are much more specific and you get consent for them. I realise that there is a limit to how much the text of the Bill can deviate from the GDPR, unless it is dealing with specific issues which the GDPR permits member states to provide derogations for. I realise that, post exit, the UK will need an adequacy agreement and some equivalent, neutral recognition of data protection regimes between the UK and the EU. We need that for the transfer of data. For instance, the noble Baroness, Lady Neville-Jones, has talked about extremely rare diseases, which require the exchange of data across many countries because their incidence is low and no one country could possibly have enough information on that group of patients.

The research exemption does not undermine agreement on Clause 7—which is what the noble Lord, Lord Clement-Jones, was leading up to when he asked about the ethics committee. The noble Baroness, Lady Neville-Rolfe, suggested that medical research should be possible through the research exemption, but that has to be wide enough yet not specific enough to encompass wider exemptions. I hope that the Minister will come up with that trick in an amendment which he might bring forward. It will not be restrictive, yet protect the patient’s personal interest.

There is a research exemption for processing specific categories of data, including health data. The legal basis for this is through article 9 of the GDPR, referred to in Part 1 of Schedule 1 to the Bill. However, all processing of personal data also needs an article 6 legal basis: research is not exempt from needing this. I am arguing today that research needs that exemption, defined in wide enough terms. For processing special categories, you need both an article 6 and an article 9 legal basis. We need to have provision for both in the Bill. One of the article 6 legal bases is consent and I have explained why this is not suitable for much research. The other feasible route for universities and other public bodies processing personal data for research is public interest. This is why it is so important to be clear on what processes can use this legal basis.

There was serious concern about the likely impact of the GDPR on research as it was being drafted. However, this was successfully resolved and it provides the necessary flexibility for the UK to create a data protection regime that is supportive of research in the public interest. The Government, and other UK organisations, worked hard to make sure that this was the case. The provision is there: it is now for the Government to act on it. It is also important to seek an adequacy agreement post Brexit: we will have to have one. It will be vital to consider the need to retain, post Brexit, cross-border transfers of data for research. I give the same example of rare diseases as the noble Baroness, Lady Neville-Jones, used. The Government have recognised the value of retaining a data protection regime consistent with the EU, but the research community would welcome knowing whether it will seek a status of adequacy as a third country or an equivalent agreement.

The plea I make is that unless we include a provision, and there are exemptions which can be written in the Bill in the format that is required, we will not be able to carry out much of the research. A question was asked about the life sciences industrial strategy. It is the key pillar of the Government’s industrial strategy Green Paper. It relies on data that the NHS collects and the data that the science community collects and marrying up the two to produce, and lead the world in, treatments and developing technologies. If we are not able to do this, the whole thing will be unworkable.

[Lord Stevenson of Balmacara]

I am very grateful to the noble Lord for a very full response. It was quite a narrow question. I did not need all of that response but I have learned a lot more in the last few minutes—

[Lord Patel]

I thought that it might have been leading up to more.

[Lord Stevenson of Balmacara]

It might have been. The noble Lord has exposed a much greater issue than we thought we were grappling with. The case has now been well made that there are four pillars rather than the three that I adumbrated before. We seem to have a case for special treatment. I am sure that the noble Lord, Lord Patel, with his assiduous workload and high work rate will have made this point several times to officials and Ministers. However, if he is not getting the answers he needs, we have a bit of a problem here, so I hope that the Minister will be able to help us on that.

This goes back to an earlier debate about the public interest. It again worries me—I think the noble Lord, Lord Clement-Jones, touched on this—that “public interest” is becoming an overworked term for rather too many issues. In other words, the argument here is not about the public interest at all; it is about the public good that would come from a differential approach, safeguarded by the ethics approach—I said that was new to me and I am grateful to hear about it—and about reinforcing the contribution that would make to an industrial strategy covering a much broader range of understanding about what we are doing, thus making this country a world centre for all that. So there is a power behind this that I had not appreciated and I am grateful to the noble Lord for explaining it. It is easy to analyse it in this way and come up with the answer that he might want, but is it the right way forward on this?

The noble Lord was wise to point out that there are constraints within the GDPR and limits on what the Government can do, but it must be possible to think more creatively about the problem that has come forward. If, as the noble Lord said, the GDPR opens up the question of not requiring consent in that very formal sense, and we are looking for an evidence-led policy initiative which addresses the public good, it behoves Ministers to think very carefully about how one might take it forward.

This may or may not be the only issue that requires this sort of approach, but the case has been made on its merits that more needs to be done. Listing existing bodies that are not included, to put it in the positive, in a list of issues—for example, the administration of justice is a function of the Houses of Parliament—is not the way into this issue. I appeal to the Minister to think creatively about this because it seems to me that we need a new approach here. I am very convinced by that and look forward to hearing what the Minister says.

--- Later in debate ---

[Lord Stevenson of Balmacara]

I think we have already made the point and we do not need to come back to it. What I took from the noble Lord’s earlier contribution was that one way in which medical research is developed and carried out involves a consent process, and we would not want to change anything in that sense. However, for lots of reasons—the noble Lord gave three or four—you cannot always use consent. You may not want to go to the patient, or perhaps you cannot go to or find the patient. Alternatively, the noble Lord made the more general point that you often collect data without any real sense of where it might go in the future. We are not saying that any of that is good, bad or indifferent—one is no better than the other—but they all need to be considered in a broader understanding of the public good being best served by having the least restrictive system concomitant with appropriate procedures being in place. That is the line, with the ethics committee sitting at the top, that gets you to the point where that would be a fruitful conversation to have with Ministers.

[Lord Patel]

I must make the issue absolutely clear. If I did not do so before, I will set it out again slowly and carefully. Medical researchers are not asking to be allowed to do research without consent. They are asking for consent to be interpreted not in a narrow sense but in a sense that will allow research to continue with consent having been obtained. I shall give an example. When I chaired the UK Stem Cell Bank, we made it clear that consent would have to be obtained from those who donated stem cell material, including embryonic stem cells. Consent was given on the basis that the embryonic stem cells would be used for research to improve healthcare, but at that time it was not possible to say which healthcare.

Embryonic stem cells, properly kept, are immortal: they can survive for generations. There is a classic example of this. Most of your Lordships are familiar with the lady whose tissue was taken in 1950. Her name was Henrietta Lacks—hence the cells are called HeLa cells. These aggressive cervical cancer cells were taken from her in the United States without consent, but they still exist in every laboratory in the world. A billion dollars-worth of drugs have been developed and marketed using HeLa cells. If consent had been obtained, what would that consent have been for? Exactly the same applies to consent for stem cells—it is for the development of drugs.

Researchers are not saying that we should not have consent. They are saying that there ought to be an authority like the ethics committee that gives consent and to which you can go back and say, “By the way, I have that material and I have found more. I am still developing drugs but this is not the same”. I hope I have been clear about that. We are looking for exemptions that are wide enough.

Perhaps I may come back to the matters raised by the Minister and refer, first, to the public interest issues. I understand that the Government do not intend the functions listed in Clause 7 to be exhaustive and to allow, for example, research conducted by universities or NHS trusts to use the public interest legal basis. It would provide much needed clarity and assurance for the research community if that could be made explicit in the Bill. That, basically, is all we are saying on the public interest. There is currently a highly risk-averse culture in data protection, driven in part because people are unclear about the rules and about what they can or cannot do with that data and for what purposes. If it is made clear what they can do or where they have to go to make it clear, that will be helpful. This is why the public interest legal basis matters so much for research. The Data Protection Bill is an opportunity to set out very clearly the legitimate basis for processing personal data, setting out a clear public interest function for research that will give researchers the confidence to know when they are operating within the law.

I will now make a comment about what the Minister said about the safeguards. My Amendment 111 is to Clause 18, which prohibits the processing of personal data to support measures or decisions with respect to particular individuals. This is clearly problematic for any research that involves an intervention for an individual, which forms the bedrock of our understanding of a vast range of treatment of diseases. The range of law covering the use of personal data for research is complex, governed both by data protection law and common law, where duties of confidentiality toward the data subject exist. In my view, the implementation of GDPR through the Bill is an opportunity to provide clear information to researchers about the legal basis for processing personal data and the requirements of accountability, transparency and safeguards.

It is therefore essential that authoritative, comprehensive and unambiguous guidance is created to assist with this transition to a new data protection law. The Health Research Authority is working on guidance for health research, but researchers are urgently in need of this advice to ensure they are compliant by May 2018.

Those are my comments in response to the Minister. I am labouring these points today because this is the only opportunity I will have in Committee to debate these issues at length. I do not wish to rehearse this at Third Reading if we can resolve these issues by communication and find a way out.

Amendment 12 withdrawn.

Data Protection Bill [HL]

Lord Patel Excerpts

2nd reading (Hansard): House of Lords
Tuesday 10th October 2017 Lords Chamber

[Lord Patel (CB)]

My Lords, many of my comments on the Bill are about data collection, usage and storage, particularly as it applies to research and, in particular, health research. In that respect, I will reference many of the comments on research made by the noble Baroness, Lady Neville-Jones, including health research generally and health research for people with rare conditions and how that data might be collected.

Given the rapid advances of data science and our capacity to collect, process and store vast quantities of data, such as genomic data for individuals, ensuring that data subjects have clear rights regarding how their data is used is vital. The recently published life sciences industrial strategy acknowledges both that fact and the significant potential of the data held within the healthcare system, especially for delivering better care and for the research sector.

The importance of getting the governance of personal data right is increasingly being recognised. The Royal Society and the British Academy recently published a report on data governance, calling for careful stewardship of data to ensure that the power and value of data are harnessed in such a way as to promote better human health and human benefit.

The Government have indicated that they recognise the importance of maintaining data flows across borders post Brexit, and that is positive. For instance, three-quarters of the health-related data flow from the UK is to the EU. As far as research is concerned, the relevant provisions of the Data Protection Bill mirror the GDPR and so should not generate problems for international collaborative research as it stands. However, it is imperative that international research that requires the transfer of personal data can continue without disruption post Brexit, and the example of rare diseases used by the noble Baroness, Lady Neville-Jones, is absolutely appropriate. In such situations, research often has to be co-ordinated and conducted across many countries, as there are few individuals with a particular condition in each country. My noble friend Lord Jay referred to the need for adequacy arrangements, and I think that that applies particularly in this area. Therefore, my question to the Minister is: will the UK, as a third country, seek an adequacy decision from the EU for data transfers in this respect?

I now come to Clause 7, which refers to alternatives to consent. The noble Baroness, Lady Neville-Jones, referred briefly to the problems that arise. For many uses of personal data, explicit consent is absolutely the right legal basis for processing that data, and it is positive that, with the GDPR, data subjects’ rights have been strengthened. Medical research will usually rely on a person providing informed consent for ethical reasons, but it is essential that there are alternatives to consent as a legal basis. That is because GDPR-compliant explicit consent sets a high bar for information provision that it may not always be feasible to meet. In many research resources, such as biobanks—I hope that my noble friend Lady Manningham-Buller will refer to that as the chairman of the Wellcome Trust, which is responsible for initiating the UK Biobank—the participants give consent for their pseudonymised data to be used.

In some studies it is not possible to seek consent, either because a very large sample size is needed to generate a robust result, and that would be practically difficult to obtain, or because seeking consent would introduce bias. The use of personal health data without specific explicit consent is sometimes essential for research for the health of the population. If researchers could not process medical records for research without specific explicit patient consent, they could not run cancer registries, which are extremely important in recording all cases of cancer; they could not monitor the hazards of medical procedures, such as the recently discovered implications of CT scans for long-term disease development; they could not assess the unexpected side-effects of routinely prescribed medicines; and they could not identify sufficiently large numbers of people with a particular disease to invite them to take part in trials for the treatment of that disease. The example I would give is the recruitment of 20,000 suitable people for the Heart Protection Study on statins, which has helped transform medical practice throughout the world. I am sure that many noble Lords use statins. This began with the identification of 400,000 patients with a hospital record of arterial disease and that information could not have been accessed without their permission. There are good examples of how this provision would cause a problem as it is enunciated in Clause 7.

We have a well-established, robust system of governance and oversight for non-consensual medical research in the UK; for example, through the Health Research Authority, a confidentiality advisory group, advising on Section 251 approvals to override the common law duty of confidentiality. Patient groups actively advocated for research exemptions during the passage of the GDPR—for example, through the Data Saves Lives campaign. I hope that, in Committee, we might get an opportunity to explore this further to see whether we can somehow modify the Bill to make this possible.

I come now to the public interest issues in the same clause. I understand that the Government intend the functions listed in Clause 7 not to be exhaustive, and to allow, for example, research conducted by universities or NHS trusts to use the public interest legal basis. Again, the noble Baroness, Lady Neville-Jones, briefly touched on that. It would provide much-needed clarity and assurance to the research community, particularly to those in the universities, if this could be made explicit in the Bill. A huge amount of research will rely on public interest as a legal basis. The Government have recognised the value of making better use of data for research, and the recent life sciences industrial strategy confirms the tremendous potential benefits for patients and the public if we can unlock the value of data held by public authorities and promote its use in the public interest.

There is currently a highly risk-averse culture in data protection, driven in part because people are unclear about the rules and what they can or cannot do with data for their purposes—hence I referred to the need for better governance of the data. This is why the public interest legal basis matters so much for research. The DP Bill is an opportunity to set out very clearly what the legitimate basis for processing personal data can be. Setting out a clear public interest function for research will give researchers confidence to know when they are operating within the law. If necessary, any specification of research in Clause 7 could be qualified by safeguards to ensure that the legal basis is used only when appropriate.

Can the Minister confirm that research conducted by, for example, universities or hospitals could use the public interest legal basis for processing personal data? Again, we may have an opportunity to explore this further in Committee.

I come now briefly to Clause 18 and the issue of safeguards. Where exemptions from data subject rights exist for research, robust safeguards to protect data subjects’ rights and interests are essential. Clause 18 transposes Section 33 of the Data Protection Act into the new Bill, but it will have wider application than it did in the Data Protection Act. Under the Data Protection Bill, all medical research undertaken without consent as the legal basis will be subject to the safeguards of Clause 18. Clause 18 prohibits the processing of personal data to support measures or decisions with respect to particular individuals. This is clearly problematic for any research that involves an intervention for an individual, which forms the bedrock of our understanding of a vast range of treatment for diseases.

Let me give the House some brief examples. Clinical trials and other interventional research will be undertaken with the consent of patients, which is ethically essential. However, the standard of consent may not be GDPR compliant as it is not always possible to specify how the data might be used beyond the purpose of the trial itself. Consent is therefore not the appropriate legal basis for much interventional research. This means that the safeguards built into the Data Protection Bill for processing or research purposes will apply. Clause 18 should not apply to interventional research. That research requires the processing of personal data to make decisions about the data subject as that is part of the necessary research design and oversight. If researchers cannot process data in that way, they will not be able to process information about a patient’s condition to assess whether they are eligible to participate in a clinical trial. They will not be able to process information about a patient’s condition to determine to which arm of the trial they should be allocated. They will not be able to remove individuals from a clinical trial if evidence arises of potential adverse effects during the course of the trial. There are significant implications.

A potential solution to this problem would be to modify Clause 18 to exempt research that has been approved by an ethics committee or some other such established safeguard. Implementation of the GDPR through the Data Protection Bill is an opportunity to provide clarity for researchers about the legal basis for processing personal data and the requirements of accountability, transparency and safeguards. At present, there is a great deal of conflicting advice about the implications of the GDPR and there is a risk that organisations will adopt an unnecessarily conservative approach to data protection for fear of committing breaches.

I should like to make two minor points. The Government have committed themselves in their response to Caldicott 3 to putting the National Data Guardian on a statutory footing by 2019. Do the Government intend to table an amendment to do that in this Bill? If they do not, the opportunity will be lost.

Lastly, the noble Lord, Lord Stevenson of Balmacara, mentioned the age of consent for children. The age of 13 seems a ridiculously low age for consent and I would support any amendments that he might introduce.

Digital Understanding

Lord Patel Excerpts

Thursday 7th September 2017 Lords Chamber

[Lord Patel (CB)]

My Lords, I too thank the noble Baroness, Lady Lane-Fox, for initiating this debate and for her brilliant speech.

Connected health or technology-enabled care—TEC, as it is commonly known—is a collective term for telecare, telehealth, telemedicine, m-health, e-health and digital health, which is increasingly seen as an integral and rapidly evolving part of healthcare delivery and of care. For example, the number of health apps on iOS and Android devices alone now exceeds 100,000. By 2018, Europe will be the largest m-health market outside the USA, worth over £8 billion to £10 billion a year. The advantages of digital health to health providers and patients include freeing up time for more direct patient contact and reducing readmissions, A&E attendance and hospital bed usage, which will help reduce the cost of health and social care and will provide better outcomes, especially for patients with long-term conditions because they will be more able to manage their own care themselves. But to deliver this, we will need health delivery systems geared up for it and health professionals trained in digital skills and able to understand and use them.

The noble Baroness, Lady Lane-Fox, in a report to the National Information Board in December 2015, made four key recommendations to achieve this, including free wi-fi in every hospital, building the basic digital skills of the NHS workforce, and a target of 10% of patients registered with GP practices using digital services by 2017. This would include patients in most need of health and social care. Can the Minister say what progress has been made in implementing these recommendations, which would go a long way to making healthcare in the NHS digitally skilled?

Does the Minister also agree that to achieve this, we need all training institutions—from schools and universities to medical schools, nursing schools and those providing continuous education in healthcare—to provide the necessary skills and understanding for the workforce? Does he also agree that when NICE produces guidance, it must have a component of m-health and e-health within it, which it rarely ever has? I understand of course that he may not be able to answer these questions because they might not come under his department, but would he mind passing them on to the appropriate department and maybe writing to us?