Data Protection Bill [Lords]

Darren Jones Excerpts

Money resolution: House of Commons & Programme motion: House of Commons
Monday 5th March 2018 Commons Chamber

[Darren Jones (Bristol North West) (Lab)]

I declare my interests as set out in the Register of Members’ Financial Interests.

The data economy is a significant part of the UK economy, with techUK estimating that it will be worth over £240 billion by 2020. As a Bristol Member, I represent part of a region with the largest digital economy in the country outside London. Tech City estimates that £8.1 billion is generated in revenue from the data economy in the Bristol and Bath region.

Digital transformation is not all about business revenues, important as those are. It is about the modernisation of our public services—including, as my hon. Friends have said, the use of citizens’ data owned by the state, such as NHS data—where we fall significantly behind our European neighbours, and about the digitisation of traditional industry, where we also fall behind. Efficient spending of taxpayers’ money on modernised public services and the cracking of our economic productivity challenge will flow from this technological reform. However, as my hon. Friend the Member for West Bromwich East (Tom Watson) said, we must also remember that this is about people as well as processes. I welcome the work that he and others did on the future of work, and I hope that we can debate those issues further in this House.

While digitisation is not all about personal data, it goes without saying that the Bill is incredibly important by providing a comprehensive framework for the collection, processing and protection of citizens’ personal data, and in setting out the rights and enforcement actions that citizens, as data subjects, will have. However, the Bill needs to go further, because this is about something much more fundamental. Yes, we have a role to play in topics such as an industrial strategy and reform of our public services, but we also set the ethical and values-based legal framework on behalf of our constituents. This is about applying traditional civil liberties in a modern setting, where our constituents feel informed, empowered and in control when it comes to the use of their personal data. The Secretary of State said that the Bill would help consumers to build trust. There are good laws on the statute book today, but citizens do not necessarily trust everyone who uses their data, because they do not understand how it gets used or what their rights are. While the Bill is an improvement, I hope more can be done to educate and inform citizens about their rights and build that trust.

Given the time constraints on the Bill—UK derogations need to be on the books by 25 May, and the law enforcement directive by 6 May—I understand why the Government would like debate on it to be narrowly focused. In many ways that is a shame, as this is a prime opportunity to debate some of the most pressing public policy issues of the day. In one way, that is one of the greatest challenges for the Bill, because—this is not a criticism but a statement of fact—this debate is about more than what is in the Bill. The general data protection regulation, which we have heard about this evening and will apply automatically in a few months’ time, will not be implemented by this Bill. If Brexit happens, the regulation will be copied and pasted into UK law under the European Union (Withdrawal) Bill—I say to those on the Treasury Bench that I am optimistic regarding “if” Brexit will happen—yet to my knowledge we have not debated the GDPR or its interpretation in this House. I assume that we will have that opportunity when we consider the GDPR statutory instrument under the withdrawal Bill process.

Other issues include the e-privacy regulation, which is currently stuck in trialogue in the EU; the implementation of the network and information security directive to address cyber-security breaches; and the establishment and purpose of the data ethics unit in the Minister’s Department, a body whose work I hope the House will have further time to debate. I welcome the Information Commissioner’s comments before the Science and Technology Committee a few weeks ago, when she suggested that the new data ethics unit could be the place for public debate about what the public find acceptable in this new, fourth industrial revolution, and that it should not take on enforcement powers, which the ICO currently has. I hope that this place, as well as that unit, will be able to lead that debate with the public.

There are many issues that warrant debate—I look forward to rehearsing them in Committee—ranging from the requirement for human intervention in the use of automated decision-making algorithms, which is something that I and other hon. Members on the Science and Technology Committee have been looking at in detail, to the application of the law to newly defined processes such as the re-identification of pseudonymous data and the public policy requirements to protect children online, not just from criminal issues but from commercial exploitation, through to powers of collective redress for citizens who might not feel able to bring forward complaints or claims of their own. There are also other, most important issues, such as whether the Secretary of State has appointed his own data protection officer for the Matt Hancock app.

Sadly, time does not permit that debate today, so I will focus my final remarks on some issues around the most important process of getting an adequacy decision from the European Commission. First, and in line with the Prime Minister’s latest views that she gave us from the Dispatch Box today, we must be honest about the need to comply with EU law in the future, because to maintain our finding of adequacy, we must continue to be adequate. The European Commission does not take a snap-shot view and say we are adequate for ever more, but will make an ongoing assessment of our compliance.

That means implementing the decisions of the European data protection board, which is subject to the jurisdiction of the European Court of Justice. I hope that Ministers will not say that we will not comply with those decisions, because we would risk failing to win our adequacy decision. Although I agree with the Government’s aim of securing a seat at the table of the data protection board for our Information Commissioner, as she said to me at our Select Committee a few weeks ago, third-country representatives have little influence and, of course, no vote. As a Canadian, she knows that well from her previous work. We must therefore be honest in saying that we will continue to apply EU law as it comes from the European data protection board but that we will have no seat at the table in defining it.

To turn to the debate between my right hon. Friend the Member for East Ham (Stephen Timms) and the Secretary of State about the divergence of views among those on the Treasury Bench, we have seen today that the principle of “America first” will be at the heart of any prospective trade deal with the United States of America, meaning that for agricultural products, for example, the US regulatory framework takes precedence. I hope there is no inclination from the Government, in trying to seek a digital trade deal with the United States, to go for a US-style regulatory framework rather than one with the European Union.

Secondly, there are serious concerns about the Government’s powers under the Bill—from their ability to self-legislate derogations for themselves for extremely broad reasons, such as the exercise of their “official authority”, which I think means “anything at all”, to the ability of various Departments to share personal data without citizens’ knowledge, such as by using pupil, medical or police data for the again broadly defined purposes of “immigration control”, which has been mentioned frequently in this debate.

Lastly, there is the issue of national security. The case in the name of my hon. Friend the Member for West Bromwich East brought a challenge against the Government’s bulk collection of data powers under the predecessor legislation to the Investigatory Powers Act 2016. Interestingly, that case relied on rights in the privacy directive, which we are not discussing today, and articles 7 and 8 of the EU charter of fundamental rights, which the Government seek to abolish under the European Union (Withdrawal) Bill. I hope the data framework that we establish will not prevent such further challenges against national security measures.

The Government seemed to anticipate the application of the ECJ ruling by the Court of Appeal in the case of my hon. Friend the Member for West Bromwich East and others and consulted last November on what amendments were needed to the Investigatory Powers Act to bring it into compliance with the ECJ ruling. In my view, the Government’s position seeks merely to make the case that this whole conversation is one of national security and therefore irrelevant to the European Union. However, as the Schrems case shows, the overall data protection culture of a third country, including its powers of mass surveillance for national security purposes—itself not an EU competence—will be taken into account by the European Commission when deciding on advocacy.

I hope the Minister has a clear answer for the House about how the Government seek to remove fundamental rights, while balancing them to seek adequacy, and whether she has any further insight into what the Prime Minister meant today by getting something “beyond adequacy”. I am a man of definitions and I have been somewhat confused. The Secretary of State previously talking for something akin to adequacy, and I believe that what we need is adequacy. The Prime Minister is now talking about “beyond adequacy”. It would be useful to have clarity on what those terms mean.

Finally, let me make a short comment about Leveson 2. I might understand a Government’s intention to dilute regulations for the regulation of the press that they see as too restrictive—something, I should add, that I disagree with—but I find it extremely hard to understand how a Government with any heart can decide with such haste and disrespect to bring to a close the ability for people who have been victims of press intrusion to seek clarity and justice. That seems both heartless and unnecessary, albeit perhaps politically expeditious. I hope the Government reconsider their position on that most important matter.