Data Protection Bill [HL]

Earl of Kinnoull Excerpts

Monday 6th November 2017 Lords Chamber

[The Deputy Chairman of Committees (The Countess of Mar) (CB)]

If this amendment is agreed, I cannot call Amendments 25A or 26 because of pre-emption.

[The Earl of Kinnoull (CB)]

I speak to Amendment 25A and declare my interests as set out in the register, particularly those in respect of the insurance industry. I thank the noble Lord, Lord Kennedy of Southwark, for a clear introduction to his thinking. I am also looking forward to hearing what the Minister says later on.

Amendment 25A is essentially a probing amendment relating to another problem of unintended consequences of the Bill’s far-reaching provisions. The impact assessment, in its section entitled “policy objectives and intended effects”, talks of setting new standards in accordance with the GDPR,

“whilst preserving existing tailored exemptions from the Data Protection Act”.

Later on, the assessment talks about ensuring that,

“the burden on business is kept minimal”.

Amendment 25A is designed to avert just such an unintended consequence which, although small in words, would be substantial in effect for insurers and therefore affect people who want to take out policies. Without this amendment, the Bill would affect insurers’ ability to process data in relation to obligations in connection with employment law. In short, they will have to redesign all their processes in what is a substantial and important area. The amendment changes the wording back to that in paragraph 2(1) of Schedule 3 to the Data Protection Act 1998, so that insurers can continue to use existing procedures. It is entirely consistent with the GDPR, in particular with article 9(2)(b), which is the bit which affects this and calls for safeguards. I can think of no better watchdogs than the Information Commissioner’s Office and the FCA. I therefore feel that this amendment should be uncontroversial and look forward to hearing the Minister’s reasoning on it. I would welcome discussions outside the Chamber should he want further detail.

[Lord Kakkar (CB)]

My Lords, I support Amendment 108A and remind noble Lords of my entry in the register regarding my duties as a doctor and medical researcher.

The overriding duty in common law to protect medical confidentiality is vital to contemporary clinical practice. There are considerable concerns that Clause 15 might provide an opportunity for that duty to be overridden through the application of future regulations. It is important for Her Majesty’s Government to establish that that is not possible and could not be the case in the future. The provisions in common law regarding medical confidentiality provide further safeguards for healthcare data beyond those provided in current data protection regulation and statute. It would be a retrograde step if provision were made that destroyed those safeguards. That might be manifested in a greater reluctance for individual patients to share their confidential information with healthcare professionals. This may result in a poorer ability for the public interest to be satisfied and safeguarded in terms of collecting data on important public health issues. It may also result in greater reluctance for individuals to participate in medical research or to provide their data for fear that it may be shared in the wrong way. Can the Minister provide reassurance that the application of Clause 15, as drafted, would not result in undermining this common law duty, and therefore have serious unintended consequences in the future? If Her Majesty’s Government are not able to provide that reassurance, how would they go about dealing with Clause 15? Would they include in the Bill a measure such as that proposed in Amendment 108A, or what other mechanism would they provide to ensure that this vital common law duty is in no way affected in the future?

--- Later in debate ---

[The Earl of Kinnoull]

I raise a simple point—that pretty big businesses look after the employment law insurance issues, and they are so incredibly important that they are often compulsory types of insurance because we feel that every business should have them. These huge businesses will have massive change in the way this operates because there is this change. We have just heard that it is not a change, but I hope that the Minister will accept that the insurance businesses—I had a sensitive briefing from the ABI—are worried about that. Accordingly, will he at least be prepared to have a meeting to go through that, otherwise there will be a lot of expense, fuss and bother and maybe some unintended damage to the process of an important type of insurance?

[Lord Ashton of Hyde]

I said that we believe that the term is sufficiently broad to cover processing that would have been permitted hitherto, which the noble Earl refers to. However, of course, if we have got it wrong and if the insurance industry has a point it wants to bring up, it would be sensible, and I would be delighted, to meet him and the industry to discuss that. As I said before, we have an open mind, so I will certainly do that.

On the provisions in paragraphs 2 and 3 of Schedule 1 on health and social care, and public health, respectively, which are the focus of Amendments 27 to 29, it is fair to say that the drafting here has moved on slightly from the approach taken in Schedule 3 to the 1998 Act. However, article 9(2)(h) of the GDPR refers specifically to processing which is necessary for,

“the assessment of the working capacity of an employee”,

and,

“the management of health … care systems”.

Article 9(2)(i) refers specifically to processing which is,

“necessary for reasons of public interest in the area of public health”.

The purpose of paragraphs 2 and 3 of Schedule 1 is to give these GDPR provisions legislative effect. To remove these terms from the clause by virtue of Amendments 27 to 29 would mean that healthcare providers might have no lawful basis to process special categories of data for such purposes after 25 May. I am sure that noble Lords would agree that that would be unwelcome.

The noble Lord, Lord Kennedy, asked some questions on paragraph 2 and asked for an example of data processed under paragraph 2(b). An example would be occupational health. The wording of paragraph 2(2)(f) of Schedule 1 is imported from article 9(2)(h), and I refer the noble Lord—I am sure that he has remembered it—to the exposition given in recital 53.

Paragraph 4—the focus of Amendments 32 to 34—provides for the processing of special categories of data for purposes relating to archiving and research. The outcome of these amendments would be to name specific areas of research and types of records. The terms “scientific research” and “archiving” cover a wide range of activities. Recital 157 to the GDPR specifically refers to “social science” in the context of scientific research, and recital 159 makes it clear that,

“scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research”.

The Government are not aware of anything in the GDPR or the Bill which casts doubt on the application of these terms to social science research or digital archiving.

Finally, on the important issue of confidentiality, Amendments 31 and 70 are unnecessary, because all health professionals are subject to the common-law duty of confidentiality. The duty is generally understood to mean that, if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent. However, beyond relying on the common-law duty of confidentiality, health professionals and social work professionals are bound by the requirements in their employee contract to uphold rules on confidentiality, whether that information is held on paper, computer, visually or audio recorded, or even held in the memory of the professional. Health professionals and social work professionals as defined in Clause 183 are all regulated professionals.

I can therefore reassure the noble Lord, Lord Kakkar—I am also grateful to the noble Lord, Lord Lester, for his support with regard to the Human Rights Act—that the Government strongly agree on the importance of the common-law duty of medical confidentiality but also recognise that it is not absolute. For example, there already are, and will continue to be, instances where disclosure of personal data by a medical professional is necessary for important public interest purposes, such as certain crime prevention purposes or pursuant to a court order. I therefore cannot agree to Amendment 108A, although, as we have already said, the Government are committed to looking at the issue of delegated powers in the round. I will certainly include that in that discussion. Therefore, with that reassurance, I ask the noble Lord to withdraw his amendment.