Data Protection Bill [ Lords ] (Third sitting)

Brendan O'Hara Excerpts

Thursday 15th March 2018 Public Bill Committees

If the Government are serious about taking on the double asymmetry—the asymmetry between the humble individual and the gigantic tech giants, and that between a single case and thousands of people having their data breached—they will accept the amendments. They were drawn up and tested very carefully. We sought expert legal counsel to get them right. We are grateful to the House for the fact that they have been framed nice and clearly. I urge Ministers not to fail this basic test of judgment as to whether they are serious about protecting our data rights, and to accept the amendments.

[Brendan O'Hara (Argyll and Bute) (SNP)]

It is a pleasure to serve under your chairmanship this afternoon, Mr Streeter.

I support amendment 154. We strongly recommend that if the Government are, as they claim to be, serious about providing the best possible data protection regime to achieve the gold standard that they often talk about for UK citizens, they should look again at the issue of collective redress and make provision for suitably qualified non-profit organisations to pursue data protection infringements and breaches of their own accord, as provided for by the GDPR.

The right hon. Member for Birmingham, Hodge Hill rightly said that the amendments would allow representative bodies to bring such cases, but would also allow individuals to opt out. Currently there is not a level playing field. If the Bill is not amended, the already uneven playing field will become impossibly uneven for individuals whose rights are breached or infringed—probably by a tech giant.

Collective redress was one of the most controversial and hotly debated issues when the Bill was in the House of Lords. The Government resisted all attempts to change it there. There have been slight amendments since then, and an understanding has been reached, but I feel that what the Government propose does not go nearly far enough to address the concerns expressed by Scottish National party and Labour Members.

Anna Fielder, a former chair of Privacy International, wrote:

“Weak enforcement provisions were one of the widely acknowledged reasons why the current data protection laws, in the UK and elsewhere in Europe, were no longer fit for purpose in the big data age. As a result, it has been more convenient for organisations collecting and processing personal information to break the law and pay up if found out, than to observe the law — as profits made from people’s personal information vastly outweighed even the most punitive of fines.”

That is the situation we are in, and it is incumbent on legislators to level the playing field—not to make it even more uneven. However, as the Bill currently stands, it only enables individuals to request that such suitably qualified non-profit organisations take up cases on their behalf, rather than allowing the organisations themselves to highlight where they believe a breach of data protection law has occurred.

All too often, as has been pointed out on numerous occasions, individuals are the last people to know that their data has been unlawfully and in many cases illegally used. They depend on suitably qualified non-profit organisations, which are there to conduct independent research and investigations, to inform them that that is the case. Indeed, there was a very striking example recently in Germany, where the consumer federation took one of the tech giants to court over a number of platform breaches of current German data protection law, and it won. However, there are numerous examples across the world of organisations and groups highlighting bad or illegal practices that would hitherto probably have gone unnoticed here.

Privacy International recently published a report on the use and possible abuse of personal data connected to the rental car market. Which? has carried out research on online toys that are widely available in this country, which could pose serious child safety risks. The Norwegian consumer council has done similar work on toys, as well as exposing unlawful practices by health and dating apps.

Across the world, there are groups that do collective redress work very successfully in Belgium, Italy, Portugal, Spain, Sweden, Canada and Australia. I urge the Government to reconsider the matter and to see the great consumer benefits and protections that would come from accepting amendment 154. It would give not-for-profit organisations the right to launch complaints with a supervisory authority, as well as seeking judicial remedy, when it considered that the rights of a data subject under the GDPR had been breached.

I repeat that at the moment we have an uneven playing field. If the Bill goes through unamended it will become an impossible playing field for consumers, so I urge the Government to accept the amendment.

[Darren Jones]

I promise not to speak at every opportunity today, Mr Streeter; I am conscious that it is a Thursday and that Members have constituencies to get to, but on this point I will just add my support to the amendment tabled by my right hon. Friend the Member for Birmingham, Hodge Hill.

The Bill puts us in a position that we should not have been in in the first place. The Government’s original view was that they were not going to implement article 80 of the GDPR; they have now gone one step in that direction, and I support the aim that we go the whole hog.

I recognise from my work previous to being an MP that a lot of tech companies are not evil; they want to do the right thing and go about being successful as businesses. It was partly my job in the past to look at these areas of law on behalf of companies, and to work with campaigning groups, regulators and others. It was about being an internal voice to make sure that there was the correct balance within businesses between considering consumers and being pro-business. This amendment would help to facilitate that conversation, because if bodies such as Which? that are private enforcers on behalf of consumers had these legal rights, then of course there would be an obligation on businesses to have ongoing dialogue and relationships. They would have to make sure that consumers’ concerns were at the forefront and that they were doing things in the right way.

The balance to be struck is really important. The Information Commissioner’s Office, for example, has lost quite a lot of staff to other companies recently. The Minister’s Department had to increase the salary bands for ICO staff to try to keep them there. In other sectors of the regulated economy, having private enforcers on behalf of consumers as a collective group works perfectly well for existing regulators.

In the telecommunications sector, in which I have worked in the past, there is Ofcom, which regulates the telecom sector, but there is also Which?, working as a private enforcer under the Consumer Rights Act 2015, which can act on behalf of consumers as a group. That works perfectly well and as my right hon. Friend said, private enforcers will not just start bringing these super-complaints every week, because the risk would be too high. They will only bring these super-complaints when they have failed in their dialogue and have no choice.

--- Later in debate ---

[Margot James]

As I said, the GDPR represents significant change. We believe we should test the effectiveness of the new enforcement scheme before we make further changes of the kind the right hon. Gentleman is suggesting. The Morrisons case was effective. The collective redress mechanism—group litigation orders—was used and was effective. The Information Commission will have new powers under the Bill to force companies to take action when there has been a breach of data.

There are other problems with amendment 154. First, like the right hon. Member for Birmingham, Hodge Hill, we are concerned about children’s rights. We would be concerned if a child’s fundamental data rights were weighed up and stripped away by a court without parents or legal guardians having had the opportunity to make the decision to seek redress themselves or seek the help of a preferred non-profit organisation. Once that judgment has been finalised, there will be no recourse for the child or the parent. They will become mere observers, which is unacceptable and makes a travesty of the rights they are entitled to enforce on their own account.

Secondly, we must remember that the non-profit organisations referred to in the amendment are, by definition, active in the field of data subjects’ rights. Although many will no doubt have data subjects’ interests at heart, some may have a professional interest in achieving a different outcome—for example, chasing headlines to promote their own organisation. That is why it is essential that data subjects are capable of choosing the organisation that is right for them or deciding not to partake in a claim that an organisation has advertised. The amendment would also allow an individual to bring a collective claim on behalf of other data subjects without their consent.

[Brendan O'Hara]

Does the Minister not accept, as I said earlier, that individuals are often the last people to know that their data has been breached and their rights have been infringed? For collective rights in hugely complicated areas, there must be a presumption that those rights are protected, and the Bill does not do that. I do not believe it reflects the principle that individuals are often the last people to know, and that they are the ones who need protecting.

[Margot James]

The Information Commissioner has powers to force companies to notify data subjects of any breach of data, and there is a legal requirement on companies so to do.

The amendment would allow an individual to bring a collective claim on behalf of other data subjects without their consent. We oppose it because it does not give people the protection of knowing that the entity controlling their claim is a non-profit organisation with a noble purpose in mind. I am pleased to say that, as I outlined this morning, the Government’s position was supported in the other place by the Opposition Front Benchers and the noble Baroness Kidron.

--- Later in debate ---

[The Chair]

I think the amendments are to clause 27 of the Bill.

[Brendan O'Hara]

I rise to speak to amendment 161 and amendments 162 to 169.

[The Chair]

That is the next clause.

[Brendan O'Hara]

My apologies.

[The Parliamentary Under-Secretary of State for the Home Department (Victoria Atkins)]

It is a pleasure to serve under your chairmanship, Mr Streeter. Clause 26 creates an exemption for certain provisions in the Bill only if that exemption is required for the purpose of safeguarding national security or for defence purposes. Where processing does not meet these tests, the exemption cannot apply. It is possible to exempt from most but not all the data protection principles the rights of data subjects, certain obligations on data controllers and processors, and various enforcement provisions, where required to safeguard national security or for defence purposes. In relation to national security, the exemption mirrors the existing national security exemption provided for in section 28 of the 1998 Act. The statutory framework has long recognised that the proportionate exemptions from the data protection principles and the rights of data subjects are necessary to protect national security. The Bill does not alter that position.

The exemption for defence purposes is intended to ensure the continued protection, security and capability of our armed forces and of the civilian staff who support them—not just their combat effectiveness, to use the outdated language of the 1998 Act. In drafting this legislation, we concluded that this existing exemption was too narrow and no longer adequately captured the wide range of vital activities that are undertaken by the Ministry of Defence and its partners. We have seen that all too obviously in the last two weeks.

--- Later in debate ---

For an interference with rights to be in accordance with law, it must include safeguards against arbitrary interference. We contest that the provisions regarding national security certificates fall short of that requirement. These clauses, unamended, would leave the Government wide open to legal challenge. We hope that the Minister will see the merit of our amendments and correct the Bill at this stage.

[Brendan O'Hara]

It may come as no surprise that I rise to speak in support of amendments 161 to 169. They are intended to challenge the Government’s plan to introduce a national security certification regime that will allow the restriction of and exemptions from a wide range of fundamental rights on the basis of national security and defence. Although it is absolutely right that, as a country, the UK has the ability to act in its own national security interest, I and many others are worried that the scale and scope of what is proposed in the Bill goes much further than the 1998 Act by widening the national security definition to include a further and, I would suggest, undefined range of defence purposes.

The Minister gave three or four examples earlier, but stressed that it was not an exhaustive list. Given the broad and indefinite nature of those national security exemptions, we are concerned that they do not meet the test of being both necessary and proportionate. How much confidence can we have that an individual’s fundamental rights will be best protected when the exemptions will be signed off by a Government Minister with little or no judicial oversight? It is also concerning that there appears to have been little or no attention to the harmful impact of exempting vast amounts of information from data protection safeguards by relying upon national security certificates.

As we heard earlier, the list of rights that are exempted, set out in clause 26, includes the right to be informed when data is being collected, the right to find out when personal data is being processed and the right to object to automated decision making. Those exemptions are to be exercised by a certificate, which, as I say, will be signed by a Minister, who will certify that an exemption from those rights and obligations is necessary for the purpose of safeguarding national security.

That means that, as the Bill is currently drafted, people’s rights could be removed by a politician without any form of judicial oversight. That cannot be right. We would argue most strongly that there has to be judicial oversight of any such decision, to prevent the removal of individual data protection rights from being permitted purely at the say-so of a Government Minister. I ask the Minister, how do the Government define national security and defence purposes in the context of the Bill? I certainly was not satisfied with the explanation we heard earlier on. I believe that these undefined terms are unnecessarily open-ended and broad, and open to vague interpretation. They could very well result in the removal of an individual’s rights unnecessarily. The lack of a clear definition of national security and defence purposes also means that people will be unable to foresee or understand when their rights will be overridden by the application of these exemptions. Surely that is incompatible with an individual citizen’s fundamental rights.

These exemptions, on the surface, are not limited to the UK’s intelligence and security services. As we heard when debating part 2 of the Bill, which deals with general processing, they broadly permit public authorities, and even private corporations on occasion, to invoke national security and defence as a reason to cast aside privacy rights. Can the Minister explain if, how, and under what circumstances a public authority or private company could invoke national security and defence as a reason to cast aside privacy rights?

That brings me to necessity and proportionality, which are fundamental principles when looking at exemptions from data protection, and which will be examined extremely closely by the European Commission and its legal team when it decides on the UK’s suitability for adequacy after Brexit. The principles of necessity and proportionality are enshrined in the European convention on human rights. A Minister must take them into account when they consider restricting or limiting an individual’s rights, such as those under article 8, the right to privacy.

As the Bill stands, no conditions or tests are imposed on a Minister’s decision to withdraw an individual’s personal data protection rights by issuing a national security certificate. There is no limitation on how a national security certificate should run or how long it should operate for. There is no obligation to review the ongoing necessity of having a live certificate. In effect, a certificate is open-ended and indefinite. My concern is that that may allow the state to use a certificate for activities for which it was not considered relevant or appropriate by the Minister when it was first issued or signed.

That loophole cannot be considered proportionate or necessary. The certificates have to be time-limited. That does not mean that once a certificate has expired it cannot be re-certified, but it would ensure that certificates that are no longer necessary or that have been used beyond their original remit do not continue indefinitely. Perhaps the Minister could explain why she thinks such a system could not work, and why it would not be in the best interest of the state and of protecting an individual’s rights.

As with everything we do, including everything we have done in this area in the past couple of years, the Bill has to be seen against the backdrop of Brexit. Not only do we have to comply with the GDPR, but we have to do so in a way that means the United Kingdom will achieve the vital, much sought after adequacy decision from the European Commission. We also have to keep our laws consistent with EU law to maintain that adequacy status. I fear that the widespread use of exemptions and, perhaps more worryingly, the undefined range of defence purposes could deal a severe blow to the UK achieving an adequacy decision from the European Commission.

Can the Minister tell me whether the Government have been given cast-iron guarantees that the new and undefined range of defence purposes will be consistent with EU law, to allow us not just to achieve adequacy but to maintain adequacy post Brexit?

[The Chair]

I will call the Minister to respond, but before she responds to that point, she wishes to correct the record in relation to a previous point, which I am happy to permit.