Victims and Prisoners Bill

Lord Bellamy Excerpts

3rd reading
Thursday 23rd May 2024 Lords Chamber

Moved by

[Lord Bellamy]

1: After Clause 31, insert the following new Clause—
“Right to erasure of personal data
(1) Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (right to erasure) is amended in accordance with subsections (2) and (3).
(2) In paragraph 1, after point (f) insert—
“(g) the personal data have been processed as a result of an allegation about the data subject—
(i) which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),
(ii) which has been investigated by the controller, and
(iii) in relation to which the controller has decided that no further action is to be taken.”
(3) After paragraph 3 insert—
“4. For the purposes of paragraph (1)(g), a person who has made an allegation about a data subject is a “malicious person” in relation to the data subject if the person—
has been convicted of an offence specified in column 1 of the table in paragraph 5 in relation to which the data subject is a person specified in the corresponding entry in column 2 of that table, or
is subject to a stalking protection order under section 2 of the Stalking Protection Act 2019 or section 8 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) made to protect the data subject from a risk associated with stalking (see section 2(1)(c) of the 2019 Act and section 8(2)(c) of the 2022 Act).
The table is as follows—

Offence	Data subject
1. An offence under section 2 of the Protection from Harassment Act 1997 (offence of harassment: England and Wales)	A person mentioned in section 1(1)(a) or 1(1A)(a) of that Act
2. An offence under section 2A, 4 or 4A of the Protection from Harassment Act 1997 (other harassment and stalking offences: England and Wales)	The person against whom the offence is committed
3. An offence under section 8 of the Stalking Protection Act 2019 (offence of breaching stalking protection order etc)	A person who the stalking protection order was made to protect from a risk associated with stalking (see section 2(1)(c) of that Act)
4. An offence under section 42 of the Armed Forces Act 2006 as respects which the corresponding offence under the law of England and Wales (within the meaning given by that section) is an offence specified in entry 1, 2 or 3 of this table	A person specified in column 2 of the entry in which the corresponding offence is specified
5. An offence under section 70 of the Army Act 1955 or Air Force Act 1955 as respects which the corresponding civil offence (within the meaning of that Act) is an offence specified in entry 1 or 2 of this table	A person specified in column 2 of the entry in which the corresponding civil offence is specified
6. An offence under section 42 of the Naval Discipline Act 1957 as respects which the civil offence (within the meaning of that section) is an offence specified in entry 1 or 2 of this table	A person specified in column 2 of the entry in which the civil offence is specified
7. An offence under section 39 of the Criminal Justice and Licensing (Scotland) Act 2010 (asp 13) (stalking offences: Scotland)	The person against whom the offence is committed
8. An offence under section 1 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) (stalking offences: Northern Ireland)	The person against whom the offence is committed
9. An offence under section 13 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) (offence of breaching order: Northern Ireland)	A person who the stalking protection order was made to protect from a risk associated with stalking (see section 8(2)(c) of that Act)
10. An offence under Article 4 or 6 of the Protection from Harassment (Northern Ireland) Order 1997 (S.I. 1997/1180 (N.I. 9)) (harassment offences: Northern Ireland)	The person against whom the offence is committed”

(4) After section 13 of the Data Protection Act 2018 insert—“13A Meaning of “relevant offence” for purpose of right to erasure(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.(2) Regulations under this section are subject to the affirmative resolution procedure.””Member’s explanatory statementThis clause adds a new ground which data subjects can use to obtain erasure of personal data which has been processed as a result of an allegation about the data subject by a person who has been convicted of a relevant offence or who is subject to a stalking protection order protecting the data subject.

[The Parliamentary Under-Secretary of State, Ministry of Justice (Lord Bellamy) (Con)]

My Lords, I have two matters to address. The first matter is the position on devolution. The majority of the measures in Part 1 of the Bill apply to England and Wales. Clause 18, which relates to the issuing of guidance about victim support services, engages the legislative consent process. The Senedd did not grant legislative consent for this measure. Accordingly, the Government will table in the other place an amendment so that this clause applies to England and reserved matters in Wales only, and consequently removes the requirement to consult Welsh Ministers before issuing guidance.

Part 3 of the Bill applies UK-wide, and I can confirm consent has been granted by the Senedd and the Scottish Parliament. However, the process has not yet concluded in Northern Ireland. In the interest of ensuring the legislation is passed and these vital measures come into force across the UK, we will need to proceed to legislate for all, including Northern Ireland.

Part 2 of the Bill applies to England and Wales, and engages the legislative consent process for the appointment of the independent public advocate. The Bill contains a measure which requires the Secretary of State to consult Welsh Ministers before declaring a major incident in Wales and appointing an advocate. The Senedd did not grant consent for this part of the Bill. We continue to believe that this is an appropriate level of involvement for the Welsh Government and that it respects the legislative competence of the Senedd. Having considered the Senedd’s position, the United Kingdom Government have decided that, in this instance and given the context of major incidents, we will proceed without the Senedd’s consent. It would not be acceptable for the independent advocate provisions not to apply in Wales. It is vital that these measures apply to—

[Lord Watts (Lab)]

Can the Minister explain why the Senedd is refusing to sign up to this agreement? It might be of interest to the House to know why.

[Lord Bellamy (Con)]

I am afraid I am not in a position to say why the Senedd has refused consent; only the Senedd can say. The original issue was whether it should have some kind of veto over the appointment of the independent public advocate, or whether it should simply be consulted. One could infer that it was not satisfied with the requirement to be consulted and wanted a stronger role. That is an inference I draw as I have no inside information on the point. In any event, it is vital, in the Government’s view, that these measures apply to England and Wales to bring the benefit to all victims within England and Wales. So that is the devolution position.

[Lord Thomas of Cwmgiedd (CB)]

I do not know whether, in this procedure, it is permissible for me to answer the question which the Minister was not in a position to. If I might explain, it was hoped that in the spirit of the United Kingdom you might be able to agree on a lawyer. There are an awful lot of lawyers and normally parties can agree, but, as the Welsh Assembly sees it, for some extraordinary reason the Government refused to do what normal litigants do, which is to agree on a lawyer. It stuck on that point because it thought it showed how unworkable the union is becoming if you cannot even agree on a lawyer.

[Lord Watts (Lab)]

Quite frankly, there are lots of lawyers in here. I do not know whether, if we put forward everyone’s name, perhaps the Senedd could agree to someone who is already in the House of Lords.

[Lord Bellamy (Con)]

I think this is not a very useful debate to pursue at this stage of the proceedings. Without going any further, I am under the impression that it is not only the question of agreeing on a lawyer, but whether a standing public advocate should be appointed in the first place. I suggest that is something we should leave aside for today’s purposes.

My second duty is to speak to Amendment 1 in my name on the Marshalled List. I thank the noble Baroness, Lady Morgan of Cotes, and Stella Creasy, a Member of Parliament in the other place, for the amendments they have tabled on this issue, and their engagement with myself and officials in this area. The amendment concerns what to do when there is a malicious complaint to social services and the procedure for removing that complaint, following the conviction of the complainant and the finding that the complaint was malicious.

Amendment 1 will insert into Article 17(1) of the GDPR—in fact, it inserts it into the relevant European directive so we have an unusual example of the UK Government directly amending European legislation—a new Part 2 ground which creates the right for certain victims who are data subjects to request deletion of personal data when the following two circumstances occur: first, when an allegation has been made by a person who has been convicted of relevant criminal offence against the data subject, or the person is subject to a stalking protection order made to protect the data subject from a risk associated with stalking; secondly, following an investigation by the data controller, it has been decided that no further action has to be taken in relation to the allegation.

The relevant criminal offences listed in the amendment are the offences of stalking and harassment against a victim. A power is also taken to update this list by regulations made using the affirmative procedure, should further offences be required to be included in the future. This amendment will provide a specific new ground for victims of stalking and harassment for the deletion of false allegations made about them, and support them to prevent the further distress that retaining this information may cause.

To ensure that the data controller has an important reason to retain the data, the exemptions under Article 17(3) of the UK GDPR will apply. This allows the data controller to refuse the re quest for a limited list of reasons, including whether processing is necessary for compliance with a legal obligation or the performance of a task carried out in the public interest, which could capture refusal for safeguarding reasons. However, data controllers must provide reasons for any refusal and inform data subjects of their right to complain to the Information Commissioner’s Office. We will ensure that guidance, including on child safeguarding, is updated so data controllers understand how the new ground is intended to work. We will also update the victims’ code so that victims are aware of their rights around data erasure.

I therefore commend this amendment to the House, and I hope that what I have said will permit the noble Baroness, Lady Morgan, not to press her Amendment 2 on the marshalled list.

[Baroness Morgan of Cotes (Con)]

My Lords, it is a pleasure to speak on this very important Bill. I am delighted that it covers so many vital issues and will proceed, we hope, to Royal Assent before Parliament is prorogued.

I shall speak to Amendments 1 and 2. I thank my noble friends the Minister and Lady Barran, and their officials, for their engagement on this matter at some speed. I am delighted that Stella Creasy is here to listen to the debate. I thank the noble Baroness, Lady Brinton, my noble friend Lady Finn and the noble Lord, Lord Russell, for their support, as well as the Opposition Front Bench.

Politics is the “art of the possible”, as the important quote goes. The Government have now accepted, after resisting for many months, the principle behind Amendment 2, which we repeatedly tabled in this House at various stages of the Bill. As we have heard, the law should be updated to recognise that, in cases of stalking and harassment, one of the things that the stalker or harasser can do to prolong their victim’s agony is to make a false and malicious allegation which stays on the record, and data controllers hide behind their rights in not deleting it even when the allegation has been found to be both false and malicious.

I recognise the progress that has been made in the tabling of Amendment 1. As ever, of course, the devil is in the detail. As my noble and learned friend Lord Bellamy has said, there are still grounds under Article 17(3) of the GDPR on which a data controller could refuse to delete the data. I really welcome his clear commitment that there needs to be strong guidance to the ICO and data controllers in the Explanatory Notes to the Bill, and also provisions in the victims’ code. The danger with all this is that we still leave the burden on victims to argue for the data to be erased, and the power remains with the data controller. That is what worries me about those exemptions in Article 17(3).

In that guidance, the data controller must be told that they need to set out substantive grounds for refusing any request for erasure of the data. We also hope that the Government will set out scenarios in which those exemptions in Article 17(3), provided for in law, cannot be used in cases where data records have been created as a result of malicious conduct.

Having said all that, I recognise where we are at this time in this Parliament. I will be interested to hear what other noble Lords might say in this short debate and what the Minister might say in summing up. I recognise and thank my noble and learned friend for the progress that he has made on this issue.

--- Later in debate ---

[Lord Bellamy (Con)]

My Lords, there is little I can add. In preparing the guidance, the Government will take into account all the points, particularly those made by my noble friend Lady Morgan. The word “automatic” may be a slightly difficult word in the guidance, but I anticipate that it will be made extremely clear that in these circumstances the data controller would have to provide very clear reasons for not deleting the complaint concerned. I hope that will be covered comprehensively in government guidance, whichever Government are in power.

Amendment 1 agreed.