Data Protection Bill [HL]

Baroness Jones of Moulsecoomb Excerpts

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 13th November 2017 Lords Chamber

[Baroness Hamwee]

My Lords, the Committee may realise that there are sometimes occasions when none of us quite prepare for amendments and others where more than one of us does, but, as my noble friend knows, I rarely pass over an opportunity to say how offensive the phrase “hostile environment” is. Data protection should be a force for good in dealing with the way our society is going.

My noble friend has reminded the Committee of the provisions of paragraph 4. Over the last few years the state has extended the mechanisms for immigration control very significantly to letting of property, employment, bank accounts, driving and so on. We may be told that the various departments have memoranda of understanding between themselves with the Home Office to deal with all this, but that is an inadequate way of dealing with them. I do not think I will be the only one in the Chamber to think that. Home Office errors are reported embarrassingly frequently. The exemption covers so many rights: rights held by data subjects to access rectification and erasure, and the right to know who is processing data and why, including when data is obtained from a third party.

Liberty, with its usual energy, has provided us with 13 pages of briefing on this amendment. I do not propose to read them all to the Committee. No doubt the Government have read them and are prepared to respond, but I reserve the right to do so on Report if necessary. It reminds us of the work, if we needed reminding, of Lord Avebury, who said that the equivalent, very similar provision with which he was dealing was,

“in danger of being oppressive, deeply worrying to the immigrant community living among us, and one which is in grave danger of infringing the provisions”—[Official Report, 21/7/1983; cols. 1274-75]—

of the European Convention on Human Rights. The Minister will be relieved that I have not yet succeeded in emulating my late, much-missed noble friend to the extent I would like—I never will, but I will continue to try. His words are even more pertinent now, extending beyond the immigrant community to families and employers, to give two examples.

Like my noble friend, I would be interested to know examples and justifications for how the exemption might be applied. Presumably it would facilitate sharing between public services used by an individual, government departments and the Home Office to check the individual’s entitlement. The Government have said that they want to make the immigration system as “digital, flexible and frictionless” as possible. Initially that seems admirable, until one delves into issues such as this. Liberty asks whether the provision extends to activities such as running a night shelter or a food bank, which might well benefit undocumented migrants. Providing shelter and providing food could be construed as activities which undermine “effective immigration control”—to quote the Bill. Would a school have to provide a person’s address without their knowledge and without their even having committed an immigration offence? Underlying all this, what effect could such a provision have on migrants’ willingness to engage with public services?

Other noble Lords will probably have received a briefing from the Migrants’ Rights Network. It is about a legal challenge which it is starting against the NHS’s data sharing, but it is relevant here. The director of Migrants’ Rights Network said:

“We are gravely concerned that immigration enforcement is creeping into our public services, especially the NHS. And therefore, it is important to challenge this data-sharing agreement which violates patient confidentiality, and discriminates against those who are non-British”.


The lawyer acting for Migrants’ Rights Network says in the press release what I have heard from many workers in the field: that the data-sharing arrangement,

“is leaving migrants too scared to access healthcare services they are entitled to, for fear their address and other public information may be passed onto the Home Office. This could have a particularly negative effect on children, pregnant women, people with disabilities and victims of trafficking and abuse”.

It could have a severe effect on public health as well—we will debate all this when we deal with NHS charges in the regret Motion on Thursday.

The data subject will not know that data are transferred to the Home Office for immigration control purposes. The exemption seems to apply to immigrants and those connected with them, and those suspected of having an immigration offence in contemplation, thus turning them into an inferior class of citizen. It allows, or perhaps requires, data controllers, including the Home Office and its various arms, processing information for immigration purposes to ignore the principles on which the use of data is founded under the GDPR and the Bill and protection is applied.

I think that your Lordships might gather that we are very unhappy with this provision. It needs more justification than I think is capable of being provided, although we will of course wait and see.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, the Minister, who is not in his place at the moment, said earlier that he could not understand what I meant by repressive measures, but paragraph 4 of the schedule is exactly what I meant and it is why this amendment would remove it.

The inclusion of an immigration control exemption in the Bill is a brazen violation of the data protection and privacy rights of migrants—both documented and undocumented—and of their families and communities in the name of immigration control. In effect, it removes all the Home Office’s data protection obligations as they relate to its activities to control immigration, as well as those of any other agency processing personal data for the same purpose or sharing data with another agency processing it for that purpose.

As the noble Baroness, Lady Hamwee, mentioned, it is not the first time that the Government have tried to limit data protection rights on immigration control grounds. In 1983, Clause 28 of the then Data Protection Bill had an identical aim, setting out broad exemptions to data subjects’ rights on grounds of crime, national security and immigration control. The Data Protection Committee, then chaired by Sir Norman Lindop, said that the clause would be,

“a palpable fraud upon the public if … allowed to become law”,

because it allowed data acquired for one purpose to be processed for another; and here is another power grab by this Government.

Clause 28 was rightly removed from the 1983 Bill, but today we see it resurrected with even more breadth and even less definition of its objectives. No attempt whatever has been made to define the new objective: nowhere in the Bill or its Explanatory Notes are the notions of effective immigration control or the activities requiring its maintenance defined. I simply do not understand the colossal cheek this Government have to put something such as this into a Bill and then present it in this House—I can understand it going through the other place but certainly not here. It is virtually impossible to come up with an exhaustive list of all the activities that might be included under this, or of individuals who might be affected. The potential list, as, again, the noble Baroness, Lady Hamwee, pointed out, could go far beyond the immigrants themselves and could apply to almost anybody, including some in your Lordships’ House—at least, I hope that some in your Lordships’ House might be involved in shelters and food banks.

I urge the Government to think again. This is probably one of the really nasty bits that the Government have an option to take out, so I hope that they will listen to us.

[Lord Lucas]

My Lords, I thoroughly support this amendment. I really hope that the Home Office has noticed that the Bill is starting in this House and that therefore this is a paragraph we can kill—and should, as we did in 1983. If the Home Office needs something more, it should make a case for it and we should listen, but to have a blanket provision such as this is very destructive of data collection as a whole. To take again the example of the NPD, the fact that data is passed from the NPD to the Home Office has made the bits of data that are being passed totally corrupt: one can no longer rely on that data because so many schools, not unnaturally, are unwilling to shop their parents and drop their parents into what can be extremely difficult circumstances. You destroy the purpose of the data that you pollute in this way; you make it unreliable. I suspect that you also undermine the research exemption: if data is actually being collected to give to the Home Office, how can you claim that it is for research? You start to undermine the Bill in all sorts of insidious ways by having such a broad and unjustified paragraph— unjustified in the sense that no one has made a justification for it. I really hope that the Home Office will think again.

Data Protection Bill [HL]

Baroness Jones of Moulsecoomb Excerpts

Committee: 6th sitting (Hansard): House of Lords
Wednesday 22nd November 2017 Lords Chamber

[Lord Clement-Jones]

My Lords, I strongly support Amendment 184. The Minister will have noticed that Amendment 185 would simply import the same provisions into applied GDPR for this purpose. The rationale, which has been very well put forward by the noble Lord, Lord Stevenson, is precisely the same.

I do not know whether the Minister was choking over his breakfast this morning, but if he was reading the Daily Telegraph—he shakes his head. I am encouraged that he was not reading the Daily Telegraph, but he would have seen that a letter was written to his right honourable friend Matt Hancock, the Digital Minister, demanding that the legislation can and should contain the second limb that is contained in the GDPR but is not brought into the Bill. The letter was signed by Which?, Age UK, Privacy International and the Open Rights Group for all the reasons that the noble Lord, Lord Stevenson, put forward. The noble Lord mentioned a number of data breach cases, but the Uber breach came to light only last night. It was particularly egregious because Uber did not tell anybody about it for months and, as far as one can make out from the press reports, it was a pay-off. There is a very important role for such organisations to play on behalf of vulnerable consumers.

The Which? survey was particularly important in that respect because it showed that consumers have little understanding of the kind of redress that they may have following a data breach. A recent survey shows that almost one in five consumers say that they would not know how to claim redress for a data breach, and the same proportion do not know who would be responsible for helping them when data is lost. Therefore the equivalent of a super-complaint in these circumstances is very important. To add to that point, young people are often the target of advertising and analysis using their personal data. I think they would benefit particularly from having this kind of super-complaint process for a data breach.

I hope very much that the Government, who I believe are conducting some kind of review, although it is not entirely clear, will think about this again because it is definitely something we will need to bring back on Report.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, I support Amendment 184. As the noble Lord, Lord Stevenson, said, the GDPR does allow not-for-profit organisations to lodge complaints about suspected breaches of data protection without needing the authorisation of the individuals concerned. I really do not understand why this has been taken out; it is such an important piece of legislation that gives teeth to data protection. Most people do not have the time or the inclination to lodge complaints against data controllers. So many organisations are now holding data about us that it is ridiculous to suggest that individuals can become data detectives responsible for finding out who holds data on them and trying to work out whether that data is being processed in accordance with data protection rules.

I went through the hassle of getting my own subject access request from the Met police. It took a lot of form filling and cost me £10, which was absolutely not money well spent because the file, when I got it, was so redacted. I did ask for my money back but was not given it. That shows me that most of us will not know that data about us is being held—so the amendment is extremely valid.

Despite my opposition to some provisions in the Bill, I accept that it is very important. However, it is equally important that we get it right and that we do not have all these derogations which mean that it has less authority and power. Personally, I think that the amendment strengthens the data protection regime without any hassle for consumers. I hope that the Government will include it in the next iteration of the Bill.

[Baroness Kidron (CB)]

I, too, support the amendment. One thing that we can all agree on is that data regulations is a complex and highly technical area of the law. As the Bill stands, it asks members of the public to become experts on the subject, which actually creates a significant barrier to its successful implementation. My particular and declared interest in the Bill is the rights of children. It is a pervasive myth in the digital environment that all users are equal. That is a category error, because if all users are equal, children are treated in the digital environment as adults and their long-established rights and privileges do not then apply. So it is on behalf of that demographic that I want to say specifically that this amendment is very important.

Without the amendment, a child would be expected to take on the very adult responsibility of being a named complainant in a regulatory or judicial complaint for a breach of data law. In the case of a child, such a complaint is very likely to be made against a multimillion or indeed multibillion dollar corporation. That cannot be, in anybody’s mind, a fair fight. While the noble Lord’s amendment and indeed the GDPR are designed to benefit all users, I point out that the amendment usefully aligns with the recommendation made by the Children’s Commissioner and the House of Lords Communications Committee that children urgently need champions in the digital environment.

We have seen special provision being made in the Bill for libraries, archivists, the insurance industry, security and intelligence, and possibly even for journalists this evening. Given that, I am waiting for the Government to concede that, like all these other special needs groups, children are data subjects with specific needs. One of those needs is to have an informed advocate if they have a complaint. So, although I do not think that the amendment would adequately fulfil that role, because I would like to see something more formal, it would at least go some way to providing support for children should they have a complaint.

Data Protection Bill [HL]

Baroness Jones of Moulsecoomb Excerpts

Report: 2nd sitting (Hansard): House of Lords
Wednesday 13th December 2017 Lords Chamber

What is the Government’s answer to the lack of anything in the Bill that reflects that sentence as regards automated decision-making? Clause 13 as amended is intended to fill that gap and I very much hope that the Minister will see it as an attractive and practical way of improving the Bill. I beg to move.

[Baroness Jones of Moulsecoomb (GP)]

My Lords, I support Amendment 34 and will speak to Amendments 35, 93, 100, 101 and 102. I retabled these amendments because I think I did not make myself clear in Committee and some of the Ministers’ replies seemed confused. It was pacifying to be soothed in that way but I still have a problem. The noble Lord, Lord Ashton, said:

“All decisions relating to the processing of personal data engage an individual’s human rights, so it would not be appropriate to exclude automated decisions on this basis”.—[Official Report, 13/11/17; col. 1871.]


My point was that there is confusion between the gathering of evidence, the processing and decision-making. My amendments do nothing to inhibit automated data processing or seek to move us back to handwritten records. Automated data processing is unaffected by my amendments, which focus on decisions based on data, however the data is processed. Data could be gathered, processed and analysed completely automatically with no human involvement—a computer could even generate a recommended decision—but where human rights are engaged, the final decision must be made by a human being.

There was similar confusion in the replies of the noble Baroness, Lady Williams, in regard to law enforcement and intelligence service decisions. She said that,

“the unintended consequences of this could be very damaging. For example, any intelligence work by the intelligence services relating to an individual would almost certainly engage the right to respect for private life. The effect of the amendment on Part 4 would therefore prevent the intelligence services taking any further action based on automated processing, even if that further action was necessary, proportionate, authorised under the law and fully compliant with the Human Rights Act”.—[Official Report, 15/11/17; col. 2073.]

Again, there is confusion between the processing, gathering of data and making the decision where human rights are engaged.

I repeat that my amendments allow for data to be processed automatically: they do not allow for a computer to make a decision contrary to someone’s human rights. Decision-makers can be supported by automated processing but the ultimate decisions must be made by a human being. We have to have this vital safeguard for human rights. After all the automated processing has been carried out, a human has to decide whether or not it is a reasonable decision to proceed. In this way we know where the decision lay and where the responsibility lies. No one can ever say, “We messed up your human rights. We interfered with your human rights and it is the computer’s fault”.

I am grateful to Liberty for drafting the amendments I have tabled and I hope that I have explained them fully and rather better than in Committee. I look forward to the Ministers’ replies. I feel strongly about this issue. These words have to be in the Bill so that it is absolutely clear that human rights are protected.

[Baroness Hamwee (LD)]

My Lords, I support my noble friend’s amendments. The points that he made apply almost entirely to Amendments 91, 92 and 94, which relate to later parts of the Bill, including particularly the phraseology “solely” and in Amendment 94 “solely” or “partially”.

I am pleased that the noble Baroness, Lady Jones, decided to retable her amendments. What she said can be summed up as, “Human rights, so human decision”. Human beings will ensure transparency and accountability in a way that machines simply do not. The Minister smiled when the noble Baroness said that she was not sure whether she was clear on the last occasion. I rather wish that I could ask her to give us the reassurances and concessions that that smile might have indicated, but I do not know.

These issues are extremely important. I was thinking about them over the weekend and, although it sounds patronising, the Government are entirely correct to ensure that human rights are engaged in these subjects. Given how central human rights are, they cannot be thought of as an occasional peripheral, particularly not as regards law enforcement and security issues. I have come full circle to thinking that the protection of human rights should be spelled out at the start of the Bill, which would take us back to our debate on Monday about an introductory clause covering the protection of a subject where the right is not absolute because of the criteria of necessity and proportionality. I think that that should be made clear in the Bill and it would put what the noble Baroness is seeking to achieve in her amendments in the right context. I support her in this.