Data Protection Bill [Lords]

Chris Bryant Excerpts

Money resolution: House of Commons & Programme motion: House of Commons
Monday 5th March 2018 Commons Chamber

[Matt Hancock]

I am glad that there is a telephone line. I am sure that the Information Commissioner will be watching the debate and will hear the plea for clear guidance on how small organisations in particular should implement data protection standards, whether they are small councils or small businesses. However, the Information Commissioner’s Office has already provided clearer guidance, as well as the telephone line. It is obviously listening, with the aim of getting the guidance right and ensuring that, in lay terms, meeting the new standards is straightforward. This issue came up in the other place as well. It is important for us to get the implementation right, especially in the case of small organisations.

[Chris Bryant (Rhondda) (Lab)]

The Secretary of State has referred to the right to be forgotten. May I suggest that there might be another right, namely the right to be remembered correctly? All too often, in response to freedom of information requests about, for instance, national security, the Government have imposed a blanket ban on the publication of any information—even many years after the individual concerned has died, when it is pretty difficult to see why there should still be a national security issue. I wonder whether it would not be a good idea for us to have some means of extracting such information in 20, 30, 40 or 50 years’ time.

[Matt Hancock]

The Bill does not change the freedom of information regime. However, it does establish a data protection regime relating to intelligence services and national security, about which I shall say more shortly, and which will no doubt be scrutinised by the House. The specific issue of the release of records is not in the scope of the Bill, because it is about the protection of live data rather than the release of records. The 30-year rule has, in the main, been changed to a 20-year rule, but of course there are national security opt-outs, some of which are incredibly important.

[Chris Bryant]

Of course there should be national security opt-outs, and when we were changing the rule from 30 to 20 years, I was one of the Ministers who ensured that they were strong. My anxiety is, however, that all too often the security services impose a complete blanket ban, which means that we as a nation are not properly able to understand what happened in the 1930s, 1940s and 1950s. If we were better informed about that, we might be able to make better decisions for our own national security in the future.

[Matt Hancock]

I do not wish to labour the point. I too was the Minister responsible for national security releases. All I can say is that that is not within the scope of the Bill, and I think the system works effectively.

As recommended by Dame Fiona Caldicott, the National Data Guardian for Health and Care, the Bill creates a new offence of the unlawful re-identification of de-identified personal data. It offers new safeguards for children, including a new code on age-appropriate website design. Currently, the law on parental consent for children on social media is complicated, but in most cases it applies to children up to 12 years old. The Bill provides for consent to be required in the case of children aged up to 13, so that parents have more control but the law is still practical.

The Bill also sets out clearer frameworks for data security—for example, by giving everyone a right to know when their data has been breached. We are strengthening the enforcement powers of the Information Commissioner to reflect a world in which data is held and used in much more sophisticated ways than ever before. Under the Bill, the commissioner can issue substantial penalties of up to 4% of global turnover. When she finds criminality, she can also prosecute. With greater control, greater transparency and greater security for our data, the Bill will help to give us a statute book that is fit for the digital age as we leave the EU.

Let me now touch on some specific areas in a little more detail. This is a forensic Bill with 208 clauses. It covers a vast area of British life, including financial services, sport, the protection of equality and much more. It also includes provisions that will support Members of this House in the work that we do, and it will make it easier for us to take up casework on behalf of our constituents.

The Bill provides for three parallel schemes to protect personal data. First, on general data, which accounts for the vast majority of data processing across all sectors of the economy and the public sector, this part of the Bill works in tandem with the EU’s GDPR, which we have discussed. We know that small businesses need advice on this, and it is important to get right the advice from the Information Commissioner’s Office. It says in my notes that the ICO has a small business helpline, but we have already heard about that in the debate.

--- Later in debate ---

[Tom Watson]

Yes, indeed. Privacy in the age of the net, with huge data flows and information in abundance, is the debate of the age. There is no doubt that this House will be discussing privacy in the years to come, beyond this Bill and beyond further regulation. In this particular Bill, however, we must ensure that privacy is not just entrusted to the delegated powers of the Minister and that it is a fundamental right that our citizens can start to develop.

Parliament is also considering the European Union (Withdrawal) Bill, which, in combination with this Bill, risks eliminating the GDPR as a check on the misuse of ministerial authority to undermine data privacy rights. It gives Ministers power to make secondary legislation to amend any retained EU law, which would include those governing data protection rights. The European Union (Withdrawal) Bill, as currently drafted, eliminates the important data protection rights of article 8, which would otherwise constrain Ministers’ ability to erode fundamental data privacy protections. So we want to make it explicit in the Bill that those protections cannot be eroded. Strong rights need strong enforcement and a proper mechanism to enable enforcement to take place. This is all the more vital where the data rights of children are involved. We therefore want to see the Bill amended to ensure that consumer groups that operate in the privacy field can act on behalf of data subjects without a particular complaint—a right of collective, not just individual, redress.

The Government have chosen not to implement article 80(2) of the GDPR, which gives greater ability for civil society and other representative bodies to act on behalf of citizens and mirrors consumer rights in goods and services. A super-complainant system would help to protect anonymity and create a stronger enforcement framework. Collective redress and representative action led by a recognised body would also help individuals to enforce their rights to data protection when their data is exposed, stolen or misused as part of a large data breach that affects multiple people. It would create a stronger enforcement framework, which would build and reinforce trust without overburdening existing institutions.

I want to turn to two amendments—improvements—made in the other place that the Government have already said they wish to overturn. Indeed, as soon as the votes had taken place, the Secretary of State tweeted that they were votes against press freedom—even though they were also votes in favour of a policy agreed by all parties in 2012, and for which he himself, the former Prime Minister and the current Prime Minister had previously voted. So it was no great surprise when the Secretary of State made his announcement last week about ditching Leveson part 2 and binning section 40 of the Crime and Courts Act 2013. His tweet, as I think he will recognise, somewhat pre-empted his consultation response. However, we live in a country where Parliament is sovereign, so the decision is not entirely up to him. It is up to us in this House. We can decide whether to keep the promises made by David Cameron—and by all parties—to the victims of phone hacking and other press abuse in 2012, or to break them.

[Chris Bryant]

Was there not also a promise, in a sense, to Brian Leveson? The guarantee was that a single inquiry was to be carried out. I am sure that my hon. Friend has seen the correspondence in which Leveson himself says that he fundamentally disagrees with the Government’s position because the only regard in which he thinks the terms of reference should be changed is that they should be increased, so that we could see whether the Independent Press Standards Organisation was indeed any different from the Press Complaints Commission at all.

[Tom Watson]

A characteristically articulate question, there. My hon. Friend will not be surprised to learn that I am coming on to that point in my speech now.

Section 40 of the Crime and Courts Act 2013 legislates for the part of the Leveson system that would provide access to justice for ordinary citizens, while offering protection to journalists and newspapers that signed up to any Leveson-compliant self-regulatory body. I want to take on one argument that I think is a complete red herring. Some elements of the media do not like IMPRESS —the only self-regulator that has so far been given royal charter recognition. They are, to coin a phrase, unimpressed with it. They would prefer not to be regulated by it, and they pretend that section 40 would force them to be members of it. But that is not accurate. There is absolutely nothing preventing those elements of the press that dislike IMPRESS from setting up an alternative self-regulator and seeking royal charter recognition for it. They could seek recognition for IPSO, but it continues to fall short of the criteria applied by the Press Recognition Panel. The fact that they choose not to do so suggests that IMPRESS is not really the problem. So we will seek to retain the amendment on section 40.

--- Later in debate ---

[Peter Heaton-Jones (North Devon) (Con)]

I start by declaring an interest, in that before I became embroiled in the world of politics, I was a journalist for 20 years, although not in the print media—I had the perfect face for radio, so it was the wireless that beckoned. As a former journalist, I take a close interest in two of the matters before us this evening, and I refer to two of the amendments that were made in the other place. I am a bit perturbed as to why we would be dealing with those two specific issues in a data protection Bill, because this Bill seems to be being used somewhat as a Christmas tree, on which all sorts of things can hang, and I am not sure that that is appropriate.

I am sure, however, that the Secretary of State was right to say in his statement last Thursday that the Government will not be accepting those two amendments. I refer, of course, to that on the implementation of section 40 of the Crime and Courts Act 2013, which I shall come on to in a moment, and the amendment providing that we should proceed with Leveson 2. I was glad that he announced on Thursday that we would not be going ahead with that, because it is absolutely the right decision, for a number of reasons, not least because the manifesto on which we were elected nine months ago said that we would not be going ahead with it.

Putting politics aside for a little while, let me say that there are a number of reasons why it is it not necessary to go ahead with that. The main one is that the environment has changed dramatically since the first Leveson inquiry. It has changed dramatically since I was last working as a journalist, which was way back in 2006, but even since 2012 and Leveson 1, the landscape has changed dramatically.

[Chris Bryant]

That is neither here nor there, because the whole point of the Leveson inquiry was to establish what happened. Hundreds of individuals have had to go through the civil courts to try to establish what happened in their individual case. Many of them now know more than the country does about what happened at that time, but they are unable to say so because they have had to sign confidentiality agreements. The truth of the matter is that we still have never got to the bottom of what level of collusion there was between the Metropolitan police and the News of the World, and many newspapers have simply lied.

[Peter Heaton-Jones]

I was coming to some of the points that the hon. Gentleman mentions, but the issue is that if Leveson 2 had gone ahead, it would have been narrowly and tightly about the relationship between the media and the police.

I absolutely welcome Leveson 1: it did a job that needed to be done by shining a light into the dark corners of some media practices and, importantly, giving redress to people who had been wronged by the media—there were too many of those. There are people who feel that it did not go far enough, and some still feel that they did not get their confirmed right of reply, but the fact is that Leveson 1 has happened, and it happened some little time ago.

Leveson 2 would have had the fairly narrow remit of the relationship between the police and the media. The argument I was coming to was that since Leveson 2 was mooted, so much has changed in the regulation of the press, as we have already been discussing. The new regulatory regime is now under way—I might come to some of its drawbacks in a moment—and, furthermore, the practices of the police have changed a lot.

Leveson shined a light on the problems. I take the point made by the hon. Member for Rhondda (Chris Bryant) that the relationship between some officers and some journalists was shown by Leveson 1 to be absolutely inappropriate. I do not believe that we need a costly, lengthy, long-drawn-out second phase of the Leveson process, which probably would not do the job we would be hoping of it anyway.

[Chris Bryant]

The point is that the investigation is sort of happening now through the civil courts, except that it is individual members of the public who have to fork out £350,000 or £450,000 in legal fees to get to the truth. In Leveson 1, Brian Leveson was expressly not able to look at anything for which there might have been any criminal charges. The fact that the Daily Mirror has now admitted—in the civil courts, but not to Leveson—that it did engage in phone hacking is one of the matters that still has not come to the public.

[Peter Heaton-Jones]

However, Leveson 2 would not necessarily put any of that right.

[Chris Bryant]

Yes it would!

[Peter Heaton-Jones]

Well, we do not know that. The difficulty is that a lengthy, costly process that in the end might not even achieve what was hoped for is not the answer. The answer, as the Secretary of State rightly said in his statement on Thursday, is to ensure that we shine a light through proper regulation on the practices that have done wrong to a number of people in the country.

I accept the points made by my hon. Friend the Member for North Herefordshire (Bill Wiggin). We should absolutely focus on the rights of people in this country—people who cannot afford the voice to stand up for themselves—but Leveson 2 was never going to solve that issue. It was going to be a long-winded inquiry that would not have got there, and the Secretary of State made that point convincingly on Thursday.