Data Protection Bill [Lords]

Ed Davey Excerpts

Money resolution: House of Commons & Programme motion: House of Commons
Monday 5th March 2018 Commons Chamber

[Matt Hancock]

Yes, of course. Everyone who is a British citizen will have the right to make sure that data about them is held fairly and accurately, and in alignment with rigorous principles. The hon. and learned Lady raises obliquely the point that the Bill contains important exemptions, including those to allow MPs to act on behalf of constituents as part of their casework, and to ensure that we can properly police our borders. I will come to that in more detail later. Nevertheless, at the heart of the Bill is citizens’ ability to control the data that companies and other organisations hold about them.

[Sir Edward Davey (Kingston and Surbiton) (LD)]

Further to the point made by the hon. and learned Member for Edinburgh South West (Joanna Cherry), will the Secretary of State explain the legal basis for the immigration exemption from the general data protection regulation?

[Matt Hancock]

Yes, of course. Exemptions from the GDPR are allowed so that necessary activities can be carried out, including that of making sure that a minority of individuals cannot abuse data protection law with the sole intent of undermining immigration controls. That is provided for in the necessary exemptions. I know that this point was debated extensively in the other place, but we firmly believe not only that it is important to ensure that we can control our borders through immigration controls, but that this is provided for in the GDPR.

--- Later in debate ---

[Matt Hancock]

I agree that this is a strong set of data protection standards. We intend to stay aligned with the EU standards, not least because they are extraterritorial, which means that anyone wanting to do any business or transactions with EU citizens would have to follow them anyway. There is therefore a very strong case for alignment in this area. Indeed, we have set out that we want the Information Commissioner to remain engaged with the future development of technical standards because we expect the GDPR effectively to become a standard that is increasingly followed around the world by companies that want to engage with the EU, and because we believe that high data protection standards go hand in hand with the capability to innovate and provide for customers. The Prime Minister was, of course, clear about the detail on Friday.

[Sir Edward Davey]

I am afraid that the Secretary of State has not answered the question asked by the right hon. Member for East Ham (Stephen Timms). Is it not true that UK companies will be bound by rules that the EU will decide? Those rules will affect a huge amount of business, but we will have no influence over them after we leave the EU?

[Matt Hancock]

I thought I had answered the question—the right hon. Member for East Ham (Stephen Timms) was nodding, so I thought I had at least had a crack at it. As the Prime Minister set out on Friday, and as we set out for the first time last August, we will seek, through the Information Commissioner’s Office, to remain engaged in those technical discussions about the future of the rules. As was proposed in the Conservative party manifesto, the Bill also gives young people the right to have data about them removed once they are 18 years old.

The second element is transparency, which is absolutely vital. All citizens should be able to know what is happening to their data and how it is being used. The Bill requires data controllers to give people information about who controls data, the purpose of processing it, and how long it will be stored. That is especially crucial in a world in which emerging technologies such as artificial intelligence are making increasingly important ethical decisions. The Bill therefore provides powers for the restriction of automated decision making and safeguards for those whose data is used. Our new centre for data ethics and innovation will advise on those safeguards, so that we can promote innovation and respond quickly to changes in technology with clear and transparent guidelines that are based on openness and consent.

The third principle is security. The Bill enhances requirements relating to the security of data and strengthens enforcement for those who do not comply. Data security and innovation go hand in hand, and this move will benefit customers and all responsible businesses. The Data Protection Act 1998 has served us well and placed the UK at the forefront of global data protection standards, but the world has changed since 1998, and the Bill updates the position to make our laws fit for purpose in an increasingly digital economy and society. It modernises many of the offences under the Act and creates new offences to help us to deal with emerging challenges.

--- Later in debate ---

[Joanna Cherry (Edinburgh South West) (SNP)]

Like my hon. Friend the Member for Argyll and Bute (Brendan O'Hara), I broadly welcome the Bill and its aims. A strong data protection framework is essential for the protection of human rights, particularly the right to privacy. Having a strong data protection framework is also key to the granting of adequacy by the EU Commission following the UK’s exit from the European Union, which of course I very much regret. However, the Bill falls short in the protections it provides in a number of areas, many of which have been ably outlined by my hon. Friend.

I want to focus on the immigration exception. Many of my hon. Friends and I have had emails from constituents who are particularly concerned about it. I am indebted to the Bar Council and the Immigration Law Practitioners Association for the briefings they have provided. Like others, they have pointed out, as I said in my intervention on the Secretary of State, that paragraph 4 of part 1 of schedule 2, which provides for the immigration exemption, is not reflective of the stated permissible exemptions under article 23 of the GDPR. If the Bill goes ahead unamended, it could cause us great problems for any finding of adequacy when we leave the European Union.

If enacted, that exemption will allow the Home Office, for the purposes of immigration control, to deny individuals access to their personal data—information that people can currently access by making a subject access request. The availability of that information is often vital to the fairness of legal proceedings in which individuals need to enforce or protect their rights. For example, for an individual effectively to challenge detention or an unlawful decision by the Home Office, or to make an application for immigration or asylum, they need to understand their own immigration history and to know what information the Home Office holds about them.

This is the information on which claims and legal challenges are often based. When both sides do not have access to the same information, the fairness of legal proceedings is inevitably compromised. Subject access requests are the only route through which legal practitioners can obtain access to that information and understand what are often complicated immigration histories. We all, as Members of Parliament, have experience of complicated immigration histories of people who come to see us in our surgeries. The reality is that many of these people do not have access to the relevant documents, or an accurate recollection or legal understanding of their circumstances. These concerns are not fanciful; they are very real.

To give an example, when someone is held in detention, they do not have access to their paperwork, for obvious reasons. They need their solicitor to be able to make a request to the Home Office to get the necessary information. Another important example is applicants who have been the victims of domestic violence, who have often been controlled by their partners for years. We introduced legislation in Scotland recently to deal with coercive control and recognise it as a real problem in domestic abuse. When a woman, or indeed a man, has been the subject of coercive control for many years before seeking help with immigration matters, a subject access request may be the only way of establishing the basis of any application for settlement and of obtaining independence from an abusive partner.

[Sir Edward Davey]

I am grateful to the hon. and learned Lady for giving way; she is making an excellent speech. Is it not ironic that the Government are planning to consult on improving protections for women who are the victims of domestic violence, but in the Bill they are taking protections away from some of the most vulnerable of them?

[Joanna Cherry]

Indeed it is ironic, and actions speak louder than words. I will certainly raise that matter with the Under-Secretary of State for the Home Department, the hon. Member for Louth and Horncastle (Victoria Atkins), who very decently has offered to meet me to discuss legislation that the Government have in mind about domestic abuse.

Those are just two examples of when it is very important for legal advisers to be able to make a subject access request to the Home Office and not to be met by the sort of brick wall that this immigration exemption, if enacted, would allow. I say “just two examples” because the Immigration Law Practitioners Association has produced, in an annexe to its briefing, a large number of real-life cases that illustrate the very wide range of circumstances in which subject access requests are used and are essential.

It is a sad fact that the Home Office has a well catalogued track record of making unlawful decisions. In a recent answer to a House of Lords question, the other place was told that in the 10 years to 2015, 250,000 appeals were allowed against the Home Office. Allowing the Home Office an exemption from subject access requests in immigration matters will have the effect of insulating the Government from challenges to unlawful decision making, and that is just not right. The Home Office does not apply the law as it has been mandated to by Parliament—or with the consistency that it should. That is why it loses so many cases in the courts.

We often come to the House to hear criticisms of Home Office procedures. While we cannot rectify those procedures under the auspices of the Bill, what we can do is not allow the status quo to get any worse. I exhort the Government to remove this exemption from the Bill, particularly as there are other exemptions in it that the immigration authorities can seek to rely on for the processing of personal data in accordance with their statutory duties and functions, or in the case of an offence having been committed.

This broad-ranging exemption will impact substantially on human rights, and it may also impact on an adequacy decision from the European Commission. Indeed, EU citizens today expressed their concern that these exemptions might have an impact on their ability to enforce their residency rights after Brexit, under the agreements currently being brokered. I urge the Government to look at this very carefully. They have yet to give any reasonable justification for the inclusion in the Bill of this very broad exemption, and I look forward to hearing one, if it is brought forward.

I share the concerns that led to amendments being passed by the Lords, and the cross-party concerns expressed in this House last week when the Government announced their decision to renege on the commitment to hold the second part of the Leveson inquiry. I was very glad to hear the points of order earlier on what Sir Brian Leveson actually said in his letter about his desire for Leveson part 2 to go forward.

I am not convinced by the reasons given by the Government for their decision to ditch any plans for Leveson 2. I endorse what the hon. Member for Rhondda (Chris Bryant) said in this House last week: he said that Members

“should be able to speak without fear or favour.”—[Official Report, 1 March 2018; Vol. 636, c. 971.]

That principle is as important as the freedom of the press, because the need for Members of Parliament to speak without fear or favour comes from the same right as the freedom of the press: the right to free speech and freedom of expression. I am sorry to have to say that I believe that the UK Government have acted out of fear of the press barons, and through favour, because so many of those press barons share their narrow right-wing agenda. There have been many genuine victims of press abuse, from grieving parents—everyone knows whom I am speaking about—to the relatives of those who died in the Hillsborough disaster, and they deserve better than this.

My hon. Friend the Member for Argyll and Bute made it very clear that it is not acceptable that the House of Lords should seek to legislate on matters devolved to Scotland; previously, section 40 applied only to England and Wales. As this is a devolved matter, what happens on press regulation in Scotland is for the Scottish Parliament. Although my colleagues in the Scottish Government have no plans to legislate in this area at the moment, there is debate within the SNP, as in the other political parties, about the best way to ensure that the terrible abuses uncovered by Leveson do not happen again.

In this House, promises were made by the UK Government to implement Leveson’s recommendations, and suspicions have rightly been raised about the motivation for the U-turn in the Conservative party manifesto—a U-turn that was completed with last week’s announcement. It is important to be clear that this is a volte-face on a previous cross-party agreement. I have yet to be convinced that there is not still the same need for the section 40 legislation, and I have previously tried to debunk some of the myths when I have spoken about it in this House.

Let us not sweep these issues under the carpet—let us have a full and frank debate about them—but we should not let the Leveson issues completely dominate the debate about the Data Protection Bill, because it covers very important issues beyond Leveson, of which I have mentioned only one: the immigration exemption. I look forward to debating these matters further as the Bill progresses through the House.

--- Later in debate ---

[Sir Edward Davey (Kingston and Surbiton) (LD)]

It is interesting to follow the hon. Member for North East Somerset (Mr Rees-Mogg). The House should reflect on his speech. Obviously, he was full of great rhetoric, but for some of us, he was playing the man and not the ball, but the House should discuss the ball—the substance—because that is key. I say to him, in language I know he understands, that veritas is a good defence.

I want to speak about the actual Bill, not amendments made in the other House. This piece of legislation is very welcome. It emanates from the EU, and I am delighted that the Government are implementing it. This regulation was being formed when I was a junior Minister in the then Department for Business, Innovation and Skills, and Britain was very supportive of it and was leading on it. Indeed, I served on the Competitiveness Council and formed a like-minded group for growth, on which Britain was leading the way in Europe in developing further the single market in energy and in digital services. It was clear that this regulation was essential for British business, because Britain was leading in digital services and needed this to support our businesses trading across the EU and to give consumers the confidence that this brings. It was a key area for business for Britain, and we pushed it.

It is therefore particularly ironic that we are transposing this regulation into UK law just as we are pulling out of the EU. The legislation before us is excellent; it has cross-party support; and it is a perfect example of why Brexit is a bad idea for the UK. We were highly influential in the conception and birth of this regulation as a member of the EU, but thanks to Brexit, we will not be at the conception and birth of a daughter of this EU regulation. There is bound to be a daughter of the GDPR, given the speed with which these technologies are developing. Inside the EU, the UK fashioned this regulation; we were a rule maker, and we were in control. With Brexit, we will not have a vote, we will be a rule taker, and we will have lost control. There could not be a clearer example of how Brexit will actually weaken Britain’s democracy and sovereignty—the precise reverse of what was promised to the people. Although I welcome this legislation in general, I do fear for the future.

However, I have one massive concern about the Bill. It relates not to what came from the EU, but to what Whitehall has done to the legislation. It used to be called “gold-plating”, but in this case I would call it “dirt-smearing” the regulation. I refer, of course, to the immigration exemption in schedule 2. I am disturbed about that for a number of reasons, some of which other Members have mentioned. However, to get the Minister’s attention, I should say that if the legislation is passed with that exemption, that will put at risk the chances of the UK’s obtaining a data adequacy agreement prior to Brexit—something essential for business and vital for security. The immigration exemption is not allowed under the EU’s regulation; it will be found to be illegal. It is clearly in breach of the EU’s charter of fundamental rights, undermining article 8 on the protection of personal data, article 20 on equality before the law and article 21 on non-discrimination.

Take the central example of what the exemption will mean for citizens from other EU countries—the 3 million here already and those who will come in the years ahead. Does the Minister really expect the Commission and the EU’s Brexit negotiators to turn a blind eye to the theft of data protection rights from EU citizens that the immigration exemption represents? It is a clear and evident breach of faith with the December agreement on EU citizens. There is simply no way that the EU could or should grant the UK a data adequacy agreement if we intend to take data protection rights from its citizens with this measure. That is before Brexit; if we do not secure a data adequacy agreement while we are in the EU, it will be far more difficult and demanding as a third country. The granting of data adequacy for third countries involves a more stringent examination of how national security data is dealt with.

I say candidly to those on the Treasury Bench that if they want their Brexit negotiations to proceed as smoothly as internal Tory party politics allows and to secure the data adequacy agreement that British business desperately needs, they will have to drop that immigration exemption—not water it down, not caveat it, but drop it.

Moreover, the exemption is insulting to freedom, the rule of law and access to justice. What it means, as others have said, is that an individual cannot know why he or she has had their case refused by the Home Office. The Home Office will be under no duty at all to disclose the information in a person’s file and the information used to make the decision. That is an affront to natural justice. In any dispute about how a case has been administered, it is surely self-evident that officials should have to provide that information.

To help Government Back Benchers who care about the rule of law even more, I should say that this affront could affect a British citizen. The administrative mistake might well be that someone has incorrectly been considered not to be British. In the many briefings that we have been given for this debate, there is example after example of British citizens being denied justice, with their very nationality being denied. Only a subject access request by an individual’s lawyer can end up revealing such basic errors of the Home Office.

Let us face it: the Home Office holds the prize for the largest number of mistakes made, week in, week out, by any Department. To take just one example, the Home Office has a shocking 10% error rate on immigration status checks alone. The Conservative party may be happy to take away access to justice and the rule of law from British citizens, but I am not.

Let us look at the impact on fairness. The best way to illustrate how deeply unfair the immigration exemption would be is with a few examples—real life examples, which is to say real people. Let me take some examples from the Law Society brief. It takes the case of Z, a failed asylum seeker attempting to reopen his case:

“The Home Office refused to reopen the case, saying that he had previously left the UK voluntarily and had received a resettlement grant from the Home Office. The SAR revealed that a third person had assumed his identity, and had applied for and secured voluntary return and the grant had subsequently been removed. The file further revealed that there was no cross-checking of signatures, photographs, or fingerprints on the Voluntary Assisted Returns scheme.”

This would have had serious consequences for the individual had the subject access request not revealed the identity theft, but, of course, under this immigration exemption there will be no such right to make that request.

We have talked about issues around domestic violence. We have heard the example of a woman applicant, the victim of domestic violence, who had no knowledge of the immigration applications made for her because her husband had all the papers. A subject access request would be her only path to sorting out her immigration status.

There are many examples showing how unfairly this will work in practice. Another example of Home Office mistakes on identity is the case of a nurse who had been working in the NHS and living lawfully in the UK for many years, but whose application to naturalise as a British citizen was denied because of her alleged poor immigration history. The brief says:

“A SAR was made and it became clear that the Home Office had mixed her up with another Nigerian woman with a slightly similar name and a poor immigration history. Following the SAR, she was able to challenge the Home Office.”

Under this Bill, she would not have been able to do that, and the NHS would have lost a diligent trained nurse.

There are so many other such examples, Madam Deputy Speaker, that I could detain the House longer than you would feel was sensible, so I will not read them out. None the less, I say to Ministers that they exist. If they bothered to read them—I urge them to do so—they would see that these are real people. If this legislation goes through with the immigration exemption, the Ministers on the Front Bench would be responsible for ruining the lives of hundreds, if not thousands, of innocent people, because they would have given the Home Office—the Executive—too much power, which means that it could not be held to account.