Digital Economy Bill

Lord Keen of Elie Excerpts

Committee: 3rd sitting (Hansard): House of Lords
Monday 6th February 2017 Lords Chamber

[Baroness Hamwee (LD)]

My Lords, I come rather late to the table with the Bill, but fresh, if that is the term, from the Investigatory Powers Act, as does the noble and learned Lord. Like me, he may have reflected on the fact that one of our basic documents in debating the Investigatory Powers Act was called by David Anderson A Question of Trust; the issue of trust is equally relevant to the provisions in the Bill. Like other noble Lords, I see the value of sharing information but—and for me it is a big “but”—with constraints, limits, conditions, checks. I would say balances but I do not think they always do the job. It would be too easy in this area to let convenience obscure other considerations. I have concerns about fundamental issues and I have difficulty, as I suspect do other noble Lords, knowing quite what to raise where, but my most fundamental concern is about respect for privacy. The use of bulk data, which we will come to, is bound to raise this.

I share concerns which have been raised about providers—not the public authorities and public services themselves, but the providers. Maybe we have to be realistic, as our public services are now provided so much through commissioning and procurement but, as I read the Bill, the regulations will not be required to list specific providers. I may be wrong about that. If providers have to be included, it would be appropriate for the public to be reassured, for instance, that the public authority in question maintains a register of its providers and publishes it. Maybe, also, all records of information held under these provisions should be destroyed at the termination of the provider’s contract.

The purposes set out here include well-being, which includes the contribution to society. I am not going to let this pass without saying that that risks being read, and I read it, as very paternalistic. I cannot see how it properly covers anything that is not covered by the other well-being provisions. Others have suggested that Clause 30 might lead to profiling. There is certainly a concern over health information, which we will come to separately. I also find it quite hard to think: if you are not contributing to society, are you not deserving of or entitled to public services? I think it is a very unfortunate term to use in legislation.

I share the concerns about Clause 33. At the very least, to share personal information to prevent anti-social behaviour which is not a crime—we know it is not a crime; you do not even need to go to the legislation about anti-social behaviour to know that, because it is referred to separately from crime—is going several steps too far. I start—I am not suggesting that others do not—from the premise that personal information should be kept confidential unless there is good reason not to do so, and if it is not confidential it needs to be treated with the greatest care and sensitivity. Respect for private life is one of our basic values. The Minister would be able to quote Article 8 of the European Convention on Human Rights—as I will do—without reading it. It says that there are “necessary”—I stress that word—exceptions in the interests of national security, public safety, the economic well-being of the country, the prevention of disorder or crime, the protection of health or morals or the protection of the rights and freedoms of others. I support the amendments—I think they are in this group—that would import the term “necessary”.

Article 8 refers to disorder and crime, but—I will not be surprised if the Minister quotes some case law at me on the definition of “disorder”—I would have thought that in this context it must refer to something a good deal more serious than what may fall within “anti-social behaviour”.

The Investigatory Powers Act includes the much-welcomed and much-discussed “privacy” clause; during the debate on that we considered the requirements of both necessity and proportionality. The Act also refers specifically to the Human Rights Act and to crime as a consideration when it is a serious crime, and it refers to using “less intrusive means”. These points are all relevant to this debate.

For my part, this amounts to support for all the amendments in the group and a concern to persuade the Government to look at the issues through the lens of rights to privacy as well as efficiency. Most citizens accept—indeed, expect—that in a digital age government departments will share information, but with narrower purposes and stricter checks than the Bill offers.

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, I am obliged to noble Lords for their observations on this group.

The powers in Chapter 1 of Part 5 will support the delivery of better services to achieve specified objectives, such as providing assistance to those suffering, for example, from fuel poverty. Your Lordships would all appear to be agreed on the need for effective data-sharing, but when we talk about that we must mean data-sharing that is secure and commands the trust of the general public—that is sufficiently ring-fenced to give confidence in the whole process. No one would take issue with that.

In that context I make this observation at the outset. It applies not only to this group of amendments but to further groups that we will come to this afternoon and perhaps much later this evening. We have to look at the provisions in this Bill in the context, first, of the Data Protection Act 1998, because the provisions of that Act apply in the context of this Bill. Therefore, as we look at the Bill, we must remember the protections that already exist in law with regard to data in this context. First, processing of personal data must always be fair and lawful. Secondly, data cannot be processed in a way that is incompatible with the purpose for which they were gathered. Thirdly, personal data must be,

“adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed”.

The personal data should be “accurate”, so a subject may be in a position to demand that they should be corrected.

Furthermore, on the point made by the noble Baroness, Lady Hamwee, personal data can be kept no longer than is necessary for a particular objective. Where, therefore, they have been employed for a particular objective—or a party has received them for a particular purpose—and a need to keep the data for that purpose can no longer be displayed, they cannot be retained.

[Baroness Hamwee]

My Lords, will the noble and learned Lord address—in a later group, if not this one—why the terminology in the Bill is “personal information” rather than “personal data”, which might have made the marrying-up of the legislation a bit easier?

[Lord Keen of Elie]

Indeed I can. The reason is that in the present context, personal information extends to bodies corporate and other personalities that are not otherwise covered by the first definition. I will elaborate upon that later but that is why there is a distinction between the two terms. We can see that the two terms substantially overlap but it is only because of that technical distinction that they are employed in this way. I hope that that satisfies the inquiry from the noble Baroness, Lady Hamwee.

The Data Protection Act not only circumscribes the use of data in very particular ways—for example, personal data must be processed in accordance with the data subject’s rights under the Act and be held securely to guard against unlawful or unauthorised processing, which addresses a point that many of your Lordships referred—but provides remedies in the event that those obligations are not adhered to. Generally speaking, that involves a complaint to the Information Commissioner.

Of course there have been lapses in data control. We are well aware of many of them. The noble Lord, Lord Collins, alluded to Concentrix, where there clearly appeared to have been lapses such that the Revenue terminated its contract without further notice in November of last year. We recognise that there are risks associated with data and data-sharing. That is why we emphasise the need to look at the provisions in the Bill not only alone but in the context of the Data Protection Act.

[Lord Collins of Highbury]

There were obviously risks associated with the contract for Concentrix and the fall-out from that contract is certainly ongoing, because of the people who have suffered hardship. The Government will undoubtedly have to investigate even more because at the moment, we are dealing only with the people who have appealed. Can the Minister tell us exactly why the existing provisions for a risk assessment did not stop this contract from going sour?

[Lord Keen of Elie]

As the noble Lord is aware, Concentrix was not the only incident in which there were data breaches. They have happened not only in the context of parties operating with government but also entirely in the private sector. So far as I am aware, no one has made a claim for infallibility where data protection is concerned. Albeit that we aspire to the highest standards in data protection, we are not making claims of infallibility.

The noble Lord, Lord Collins, also referred in the present context to the GDPR, which will come into effect as a European regulation in May 2018. I reiterate that the provisions in Part 5 of the Bill are compatible with the GDPR. The noble Lord appeared to take some issue with that term, but let me be clear: the provisions of Part 5 are drafted in such a way as to be compatible with the regulation. When the regulation comes into direct force, we will look at the provisions of the Act and the codes of practice to ensure that they are consistent with it. That is the way in which these things are done. The regulation is not yet in force and will be applied to the existing statutory structure from May 2018. I reassure him that it has always been intended that Part 5 of the Bill should be compatible with the regulation, for very obvious reasons.

Then there is the matter of the draft codes of practice. At this stage they are, of course, a draft. Those drafts have incorporated comments and advice from practitioners right across the public sector, from the Information Commissioner and from the devolved Administrations, so they have brought in that body of knowledge at this stage.

--- Later in debate ---

[Baroness Byford]

I specifically asked why the responsibility has been placed on gas and electricity suppliers to have regard to some of the things stated in the Bill, and I would be grateful for an answer. I do not mind if the answer is not given now, but if that could be clarified I would be grateful.

[Lord Keen of Elie]

I am perfectly prepared to write to my noble friend to clarify that point, and I will place a copy of any letter in the Library.

[Lord Collins of Highbury]

I thank the Minister for his response. One of the things that we will encounter as we go through this section is the fact that the 1998 Act has some fundamental principles but that we have the Bill before us because there is a need for greater clarity. The world has changed in the past 20 years, certainly in the way that we handle and interrogate data. We no longer simply say that this set of data will go to that person and so on. We do not necessarily even have to share the whole dataset. The point is about how one might interrogate data. It is a very different world. I am not suggesting for one moment that errors do not occur, accidents do not happen and mistakes cannot happen, but in the modern world we conduct risk assessments to understand how we can minimise those things. That is what I want properly addressed when we come back to some of these issues.

The Minister says that the Government will consider the report of your Lordships’ committee. If there are to be further amendments, I hope that we will have time to consider them and even to put down our own amendments to ensure that the principles about which we are concerned will be able to be addressed. With those comments and, if you like, fair warnings, I beg leave to withdraw the amendment.

Digital Economy Bill

Lord Keen of Elie Excerpts

Committee: 3rd sitting Hansard - continued): House of Lords
Monday 6th February 2017 Lords Chamber

[Baroness Hamwee (LD)]

My Lords, I, too, support the various amendments in this group. “Having regard to” a matter always seems to leave some wriggle room. If there should be exceptions to compliance—because I think we are talking about compliance here, not about consistency—then those should be spelled out. I accept that having codes of practice outside primary legislation allows for flexibility, which might be useful, for a response to experience of the operation of the code and, perhaps, for changing circumstances. However, there is so much reliance on codes of practice here that an inclusive process for constructing and finalising them is very important, as well as transparency in operation.

The noble and learned Lord will probably have a better recollection than I have of the discussion during the passage of the Investigatory Powers Bill about providing transparency by way of ensuring that people who were affected by the transmission of information knew about it. This was rejected for security reasons, but that would not be the case here. The overall objective has to be transparency and inclusiveness.

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, Amendment 81 and the other amendments in this group are intended, of course—and I understand this—to strengthen enforcement of the codes of practice in relation to the public service delivery, debt and fraud, and research powers by requiring authorities who use the powers to “comply with” rather than “have regard to” these codes. The noble Lord, Lord Collins, has sight of a loophole, and the noble Baroness, Lady Hamwee, has encountered wriggle room, but I would take issue with those descriptions.

There is common ground here. We, too, believe that the codes are an important part of the data-sharing powers. However, the Government believe that “have regard to” is the right level of obligation for a code of practice. This is a legal obligation. Such persons when disclosing or using information will be expected as a matter of law to take the codes seriously and follow their requirements in all cases unless there are cogent reasons why they should not do so. It is, of course, common practice for legislation to set out the critical limitations on a power while codes of practice—which are more adaptable, as the noble Baroness, Lady Hamwee, acknowledged—are advisory tools that supplement with regard to best practice, principles and guidance.

The noble Lord, Lord Collins, alluded to a situation in which an authority exceeds its powers for the public good. In such a situation—without going into the detail of it—the authority would be exceeding its powers and it would have to answer for that, whatever the public good might justify in other circumstances.

Key conditions for the disclosure and use of information are set out in the Bill, including what can be shared, by whom and for what purpose. We have followed a common approach taken by government and others, including the Information Commissioner, to provide more detail on how data are to be shared in a code of practice. That does not mean that the code is to be treated lightly. Legal consequences may follow if the code is disregarded, as the Delegated Powers and Regulatory Reform Committee pointed out in its report on the Bill. The relevant Minister can make regulations to remove a body’s ability to share information under the power if it fails to adhere to the code. The noble Lord, Lord Collins, raised the question as to whether that is considered sufficient in the circumstances. We do consider that that is a sufficient safeguard in the circumstances. I also remind noble Lords—in particular, the noble Baroness, Lady Janke—that the first requirement of the Data Protection Act is that processing of data should be fair and reasonable. That underpins in existing legislation the whole approach that should be taken to this Bill.

The noble Baroness, Lady Hamwee, sought to draw a distinction between the provisions here and those in the Investigatory Powers Act about knowledge of data transfers. Of course, although we are not necessarily dealing here with national security, we are dealing with issues such as fraud, where it would be wholly inappropriate to give people advance notice of data sharing, particularly if one were going to address issues of criminal conduct.

Amendment 107B would require breaches of the code of practice on the public service delivery power to be reported to the Investigatory Powers Commissioner. It also places a duty on the Investigatory Powers Commissioner to investigate serious breaches and, where necessary, to inform the relevant individual of the breach. In doing so, the commissioner would have to ask the person in breach to make submissions before making a decision. With respect, the amendment would impose a considerable additional function on the Investigatory Powers Commissioner, where he or she would be bound to deal with breaches of a code of practice on information sharing which in no way relates to the commissioner’s remit of investigatory powers.

Indeed, placing such duties on the Information Commissioner would effectively be broadening the Information Commissioner’s remit without appropriate consultation. It would, as with Amendment 81B, cut right across the functions of the Information Commissioner, as distinct from the Investigatory Powers Commissioner; the Information Commissioner being responsible for upholding the Data Protection Act 1998, and also the safeguards and procedures for dealing with breaches of the code, which are already set out in various provisions. Such an amendment would blur the lines between the responsibilities of the Information Commissioner and the Investigatory Powers Commissioner and potentially lead to confusion and unnecessary duplication. If, in making those observations, I referred to the Investigatory Powers Commissioner when I meant the Information Commissioner and referred to the Information Commissioner when I meant the Investigatory Powers Commissioner, that simply underlines how easy it is to cause confusion in this area.

Amendments 108, 115, 134 and 151 call for the codes to be subject to approval by Parliament. A similar requirement was also raised by the Delegated Powers Committee in its recent report. We are carefully considering that proposal and I assure noble Lords that we will be responding to it shortly. Amendments 109 and 135 would introduce a requirement for the Minister to consult publicly on the code for a minimum of 12 weeks before issuing or reissuing it. Amendments 110, 152 and 190 would require that the Minister demonstrate that responses to the public consultation,

“have been given conscientious consideration”.

The policy in respect of these powers, and much of the content of the codes of practice, have been developed over two years of open policy development with a range of public authority and civil society organisations. The code sets out procedures and best practice drawn from guidance produced by the ICO and Her Majesty’s Government. We amended Clauses 36, 45, 53 and 61 in the other place to ensure our code will be consistent with the Information Commissioner’s data-sharing code of practice. The clauses contain a requirement that the Minister consults the devolved Administrations, the Information Commissioner and any other person the Minister considers appropriate prior to the issue or reissue of the code. I assure noble Lords that these other persons will include civil society groups and experts from the data and technology areas. It is, indeed, our intention to run a public consultation before laying the code before Parliament. I need hardly add that all consultations are taken seriously by the Government and all responses considered with appropriate conscientiousness.

I understand the interest in the codes and the desire to make sure they are effective. The codes will provide a strong safeguard for the use of the power, backed up by real consequences if they are not adhered to. With that, and while we consider the recommendations of the Delegated Powers Committee further—as I have indicated, we intend to do that in the very near future—I invite the noble Lord to withdraw his amendment.

[Baroness Hamwee]

The noble and learned Lord warned us against giving advance notice to potential fraudsters, but I think we are talking in these amendments about notice which may be in retrospect. I am looking at the noble Lord who has tabled the amendments. There are different issues, I think, about giving notice in advance and telling people that you have transferred information. Maybe we need to come back to the distinction between the two at the next stage. On the requirement to have regard but not necessarily to comply, does that not point up the real weakness of a code that is not approved by Parliament? These two bits of fragility seem to me to go hand in hand and undermine the security, as it were, of the regime.

[Lord Keen of Elie]

I am content that we return to the noble Baroness’s first point if she feels that there is a point of distinction to be made. On her second point, I do not accept that there is fragility in this context. We are well aware, by virtue of past practice, that this formulation is appropriate to the application of codes of practice. Indeed, the noble Baroness herself observed that when applying one’s mind to a code of practice, a degree of flexibility is necessary. One cannot freeze them. That is why we consider that the wording here is appropriate.

[Lord Collins of Highbury]

I thank the Minister for his response. Obviously, the codes of practice are key to giving a sense of security and to building public confidence. They are critical, which is why noble Lords want to see exactly how they will end up. I am very happy with the reassurance that the Minister gave regarding parliamentary involvement and consideration of the report of your Lordships’ committee. That is very welcome and we will return, obviously, to some of the issues, particularly on medical information and other information set out in other groups. We will return to the subject of the Investigatory Powers Commissioner in the next group and I will explain in that discussion why we see, perhaps, a distinct role, arising from the debate this House had on the Investigatory Powers Act. In the meantime, I beg leave to withdraw the amendment.

--- Later in debate ---

[Lord Keen of Elie]

My Lords, Amendment 81B seeks to place a duty on the Investigatory Powers Commissioner to ensure that the data-protection rights of citizens are considered and protected under the public service delivery power. The effect of this amendment would be to impose similar duties on the Investigatory Powers Commissioner as are already carried out by the Information Commissioner. It is for that reason that we do not consider that this amendment is necessary. I understand the points that the noble Lord, Lord Collins, has made in this context. We are all concerned to ensure that these powers are ring-fenced as far as is reasonably practicable and that any breach should be policed to the extent required. However, in our view, the Investigatory Powers Commissioner is not the appropriate party to deal with this matter. The Bill is not about investigatory powers, and accepting this amendment would result in a substantial and, as I sought to indicate earlier, confusing addition to the portfolio of the Investigatory Powers Commissioner.

We are of course concerned that there should be public confidence in the provisions of the Bill and in the whole body of data-sharing powers. I understand the observation of the noble Lord, Lord Collins, that the Investigatory Powers Act does everything possible to ensure security is there, so that only the given powers are exercised and that the rights of the individual are put at the head of any agenda, but that is clearly the intention of this Bill as well. That can be achieved by having regard to the position of the Information Commissioner in the context of the present provisions.

I understand and indeed admire the noble Lord’s suggestion that we should in some sense be seeking to future-proof the Bill. There are limits to our ability to do that, but I will return to that point in the context of the regulations that come into force in May 2018. We have already had regard to that in order to try to ensure that the provisions of the Bill will comply with imminent regulations, such as those I have just referred to.

The noble Lord also raised the question of confidentiality and the concerns that have been expressed by the medical profession in that context. Let us be clear that, as noble Lords will recollect, common-law obligations of confidentiality are rarely if ever absolute. We know that various common-law issues of confidentiality tend to be subject to one qualification or another. Concerns have been expressed over the interaction between the provisions of the Bill and medical confidentiality, primarily in respect of the statutory override within the Bill. The provisions of the Bill are clear that sharing data under the powers in the Bill does not breach any existing duty of confidentiality. That includes the common-law duty of confidentiality to the extent that it applies to patient information.

The use and processing of medical information is governed by common law, but also by the Data Protection Act 1998, by the provisions of the Human Rights Act 1998 and indeed by specific legislation which allows, requires or prohibits certain uses of such data. There is no blanket ban on the use of medical information outside the patient-doctor context, and it is not the case that every instance of sharing such information will constitute a breach of confidentiality. Indeed, the General Medical Council’s 2017 guidance expressly states personal information can be disclosed,

“without breaching duties of confidentiality”,

in particular circumstances, one of which is where the disclosure is,

“approved through a statutory process that sets aside the common law duty of confidentiality”.

So it is acknowledged by the General Medical Council itself that this may occur from time to time, and the provisions of the Bill are structured to reflect this. They override duties of confidentiality only in order to ensure that public authorities have clarity in terms of what they can and cannot share under the powers of the Bill. I hope that goes some way to meeting his concerns about confidentiality in that context.

Amendments 84, 87, 119, 138 and 213, which are also in this group and were referred to by the noble Baroness, Lady Janke, cover a broad range of suggested additional safeguards and restrictions on the use of the powers. They seek to introduce, among other things, an express data minimisation rule, a requirement to conduct and publish a privacy impact assessment and provisions extending the Information Commissioner’s powers in respect of enforcement notices. They also introduce a provision enabling data subjects to request that inaccurate personal data disclosed under the powers be amended. We are firmly of the view that while all of these requirements represent important safeguards on the use of our powers, they are already provided for in different ways under the Bill, the codes of practice or existing legislation, including in particular the Data Protection Act 1998. Indeed, under the DPA only the minimum personal data necessary may be shared to achieve the particular objective, and all personal data that is held must be accurate. I hope that that goes some way to meeting one of the points made by my noble friend Lady Byford about excess data being given to public authorities. That is simply not permitted in the existing legislation, particularly the requirements of the Data Protection Act 1998. Over and above that, the Information Commissioner already has a range of mechanisms to enforce compliance with the DPA. Amendment 213, which would insert a new clause on enforcement notices, would not add to those powers in any material way.

Further, Amendment 213 requires certain information to be gathered in respect of the benefits of data-sharing arrangements. Again, that is not necessary: bodies wishing to exercise the powers in these provisions must consider benefits as part of their privacy impact assessment. We acknowledge the importance of privacy impact assessments and, following discussions with the Information Commissioner’s Office, will look to return to this matter on Report to address concerns about public authorities’ adherence to the Information Commissioner’s specific guidance on privacy impact assessments, as well as privacy notices. I hope noble Lords will accept our willingness to return to that matter in due course.

Amendment 213 would bar the processing of personal information under the powers for particular purposes. With respect and understanding of what lies behind the amendment, our approach is simpler and more complete. There are specific limited purposes for which personal information can be disclosed under Part 5 of the Bill. Other than a few limited exemptions, the disclosure or use of personal information for other purposes is not permitted. Tough new criminal sanctions will apply to all unlawful disclosures.

Amendment 87 seeks to introduce a duty to review in the public service delivery power, akin to the existing duty in the debt and fraud powers. All data-sharing arrangements under the debt and fraud powers have to be piloted and reviewed after three years to ensure that the powers deliver demonstrable benefits. The public service delivery powers are different in kind, being more conventional data-sharing powers, constructed specifically to improve the delivery of services to citizens in cases of acknowledged need, such as assisting those suffering from fuel poverty.

On that point, my noble friend Lady Byford essentially raised the question of definitions—what do we mean by “fuel poverty”, “well-being” and “warm home discount”, as mentioned in Clause 31? All this is dealt with in Part 2 of the Energy Act 2010, which contains the schemes referred to in Clause 31(3)(a). I hope further consideration of those provisions of the Bill may go some way to meeting her concerns about those definitions.

On the question of private fraud, of course we are alert to the idea that where there is data sharing there may be data intrusion, and we are determined to guard against that. That is why we seek to ring-fence these powers in the way that we do in the Bill. We have not claimed that any system we introduce will inevitably be infallible; history tells us that where we ring-fence, people will seek to go under, over or through such a fence. However, we shall try to ensure that all data that are shared in this context are kept as secure as we reasonably and practicably can keep them.

Amendment 88 would change the definition of “personal information”, a point raised by the noble Baroness, Lady Hamwee. The point here is that in the current draft “personal information” includes “a body corporate”. The existing definition is intended to capture all persons, including all corporate bodies, to ensure that taxpayer information, including that of bodies corporate, is protected irrespective of the size of the organisation. Narrowing the definition would limit the protections for HMRC data under these powers, which would be likely to affect significantly HMRC’s willingness to make use of the powers. I am sure the noble Baroness is aware that the disclosure of data by HMRC is subject to additional statutory controls quite distinct from the provisions of the Bill, and these have to be factored in. This is where the term “official” comes into use because the existing statutory legislation uses that term in the context of data and disclosure. Therefore, for the purposes of consistency, that term is used in this context. It is not an attempt to suggest that the janitor, or anyone else, should be responsible for disclosing relevant information—certainly not the commissioners of revenue in isolation.

Amendments 87 and 93 are also in this group. Clause 33(7) provides that a disclosure under the public service delivery power does not breach any obligation of confidence or any other restriction on the disclosure of the information. This provision ensures that public authorities can be confident that their disclosure is lawful, provided that they comply with the strict requirements of this legislation. To remove that subsection would undermine a primary objective of providing authorities with the legal certainty required to ensure efficient and effective data sharing under these powers. In other words, where they satisfy the requirements of this legislation, they do not have to go back and worry about any aspect of the common law of confidentiality on individual occasions, which would effectively make the provision unworkable.

Amendment 93 seeks to expressly exclude health data from the public service delivery clauses. I have already touched upon this. The Government believe that this amendment, while well intentioned, is unnecessary and would lead to the kind of legislative barriers that the Bill is designed to overcome. As I have indicated before, the Government recognise the particular sensitivities around identifiable health information, and indeed this was highlighted in the National Data Guardian’s recent review of data security, consent and opt-outs. For this reason, health bodies in England are not included in the draft list of bodies that will be permitted to use the powers in the Bill. Health and adult social care information, however, could potentially be of considerable assistance in bringing benefit to individuals, as this power aims to do. I acknowledge that we may wish to bring such bodies within the scope of these powers in future, but we will form a view on this after the implementation of the National Data Guardian’s recommendations and public consultation on the issue. We believe it would be wrong to rule out that possibility until that debate has been concluded. However, I underline the point that at present health bodies in England are not included in the draft list of bodies that will be permitted to use these powers.

I turn to Amendment 100. Clause 34(8) provides that the prohibition on onward disclosure, and its associated provisions, do not apply to personal information disclosed by HMRC. The amendment seeks to remove that provision. There was a suggestion that someone was seeking consistency here. Throughout Part 5 of the Bill, in order to take account of HMRC’s statutory duty of confidentiality and maintain consistency with the existing statutory framework in respect of HMRC information, the Bill contains separate provisions for the disclosure of information by HMRC. Criminal sanctions apply to the disclosure of HMRC information, but it is all framed slightly differently in order to be consistent with earlier statutory provision. I refer in particular to the Commissioners for Revenue and Customs Act 2005, which already covers these areas. The effect of the noble Baroness’s amendment would be to create two regimes for disclosing HMRC information under this power. We suggest that that would undermine consistency between Part 5 of the Bill and the provisions that already exist under the Commissioners for Revenue and Customs Act 2005. I hope that that goes some way to explaining why HMRC, though not a special case, is dealt with slightly differently within Part 5.

The noble Baroness, Lady Byford, then referred to Amendment 196. Again, in the context of accountability for public interest disclosures of non-identifying HMRC information, the aim of Clause 65 is to enable Her Majesty’s Revenue and Customs to meet requests from external organisations to provide aggregate statistics or general information, which is what other government departments do. Safeguards for disclosure of personal information will continue to apply for the reasons I have already alluded to. This amendment, again, would be inconsistent with HMRC’s existing statutory framework which authorises officials to act on behalf of the commissioners of revenue. It would not be practicable for the commissioners of revenue to have to deal with each of these requests. Indeed, it would be an unnecessary use of public resources if that was the case.

The noble Lord, Lord Clement-Jones, raised a point that appears to have prompted a note from the Box which I have not yet read. I shall scan it now. And I will undertake to write to the noble Lord. On that occasion, I will use typescript.

In those circumstances, I invite noble Lords not to press these amendments.

--- Later in debate ---

[Lord Keen of Elie]

I am obliged to the noble Baroness, Lady Hamwee. Although the definition of personal information differs from the definition of personal data in the DPA, all personal data shared and used under the public service delivery provisions must be handled in accordance with the framework of rules set out in the DPA, and in particular with the data protection principles, because the DPA is not overridden by this chapter. To the extent that the class of personal information is wider than personal data, although the DPA does not directly govern such information, we still expect that information will be handled in accordance with that framework because of the requirements of the codes of practice under Part 5. I hope that answers the noble Baroness’s question.

[Baroness Hamwee]

My Lords, I see an amendment at Report coming up.

--- Later in debate ---

On data that could be used to detect fraud, there seems to be no reason why the standard declaration for this purpose could not cover all lawful anti-fraud activities. Law-abiding citizens could, as with the provision of bank or mobile phone statements, allow transparency here, and this could reduce the opportunity for people to cheat the system. People would then be able to better detect fraudulent activity themselves. Indeed, such an ability would be most helpful for the Office of the Public Guardian which has a large fraud department. It would allow it to directly access data concerning a subject’s finances, which is currently held by a court-appointed or person-appointed deputy, attorney or guardian. This would allow the fraud department to investigate much more effectively as it would not have to seek permission from that appointee, a situation which has allowed fraud to occur in the past. There have been notable examples of difficulties in detecting financial fraud. Amendment 213C may specifically help with such detection.

[Lord Keen of Elie]

My Lords, the noble Lord, Lord Collins, should make no apology for revisiting the issues of transparency and public confidence because they lie at the heart of what this Bill is attempting to achieve and are contained in Part 5. It may be déjà vu again but that is perfectly justified by the circumstances. We are all concerned to ensure that there is such transparency within these provisions as to maintain, and perhaps even restore, public confidence in the use and sharing of data.

Amendment 82ZA proposes that, within six months of the Act coming into force, an independent review of the collection and use of data by the Government and commercial organisations is conducted. With respect, the scope of the review appears extremely broad and goes much further than the provisions of Part 5. The Royal Society and the British Academy are undertaking a review to consider the ethical and legal frameworks needed in the United Kingdom as data technologies advance. We intend to consider the findings of that review when it is published. In addition, I mentioned that the general data protection regulation will come into effect in the United Kingdom in May 2018. The implementation of that regulation will represent a significant change to the data protection legal framework for both the public and private sectors, including strengthening rights for individuals so that they have more control over their personal data. We intend to work with the Information Commissioner to explore how we can best meet these requirements, as well as to improve transparency in this space. As such, we do not see the value in commissioning a further major review of data ahead of preparing to implement the new data protection framework when the regulation comes into force in May 2018.

Amendment 103 also seeks to improve the transparency of data sharing under the powers in Part 5. As I have indicated, we support this intention as transparency, along with the protection of personal data, is clearly at the heart of all these proposals. There are, however, a number of real problems with the proposed new clause. Setting the requirement and contents in primary legislation would significantly restrict our ability to explore and consider the benefits and consequences of publishing a register. For example, there may be a need to exempt the inclusion of certain types of data sharing for reasons such as national security or commercial confidentiality.

Ahead of the 2018 regulation coming into force, we will work with the Information Commissioner’s Office and other interested parties to explore how we can best meet its requirements and improve transparency. In our view, the statutory codes of practice in the Bill are a more appropriate vehicle for setting out requirements to support greater transparency. We will run a public consultation on the codes of practice as well as the required statutory consultations and we propose, as part of that, to gather views on the type of information about data sharing that should be captured and made public, as well as the risks and benefits. In addition, the draft codes already contain requirements for privacy impact assessments to be prepared and published. Further, we are continuing to explore with the Information Commissioner whether more can be done in this Bill to ensure that his codes of practices on privacy impact assessments and privacy are fully considered when data are shared under Part 5. I hope to return to this point later in the proceedings.

Amendment 104 proposes an obligation for organisations to report data breaches and submit associated audit returns to the Information Commissioner’s Office. As I have indicated, the EU general data protection regulation will apply in the United Kingdom from May 2018. The new regime will introduce tough measures on breach notification, making it a requirement for all data controllers and data processors to report breaches to the Information Commissioner’s Office if they are likely to result in a risk to the rights and freedoms of individuals, and the individuals affected must also be notified where there is a high risk. The new regime will also allow tougher penalties to be imposed on organisations in breach of the rules. I believe these will be penalties of up to 4% of the organisations’ total global annual turnover, or €20 million.

Under current arrangements, the Information Commissioner’s civil monetary penalties guidance says that he can take into account what steps, if any, the person or organisation had taken once they became aware of the contravention, when determining the amount of the monetary penalty to be issued, so there is provision for those who delay or defer the reporting of data breaches. At this stage, we are confident that the Information Commissioner has the necessary powers to take action against those organisations that are in breach of the rules so, while I accept the spirit of the amendment and understand the need for transparency, I do not believe it is necessary as the new tougher rules under the EU regulations will apply from May 2018. As I stated, under the current regime, the commissioner can and does take into account what steps, if any, an organisation has taken in addressing breaches and in deciding penalties under the Data Protection Act.

Amendment 111 would require a secure audit record to be compiled specifying the personal information shared under the public service delivery power. This well-intentioned amendment is also considered unnecessary. The code of practice that has been drafted in support of the public service delivery provisions already requires an audit to be kept by data controllers of information shared under this power, and the Information Commissioner’s data-sharing code of practice similarly requires organisations to keep records of information shared. In addition, the EU general data protection regulation will apply to Part 5 and place further specific legal obligations on organisations to maintain records of personal data shared and of processing activities. Organisations will now make the necessary preparations to comply with that regulation.

For the benefit of the noble Baroness, Lady Finlay, I emphasise that the processing of personal data under the public service delivery power must already be in accordance with the Data Protection Act. The Information Commissioner is responsible for enforcing and promoting compliance with the Data Protection Act. The commissioner undertakes a programme of consensual audits across the public and private sector to assess their processing of personal information. The commissioner also has the power to conduct compulsory audits of public sector entities to evaluate compliance with the data protection principles. The commissioner has powers to obtain access to the information she may need to conduct those assessments.

Digital Economy Bill

Lord Keen of Elie Excerpts

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 6th February 2017 Lords Chamber

[Baroness Jones of Whitchurch (Lab)]

I expected more people to be inspired by the contribution of the noble Lord, Lord Arbuthnot, and to join in the debate. I am rising to give my support to Amendments 105 and 106 and to thank the noble Lords, Lord Arbuthnot and Lord Carlile, for highlighting this simple failure in company policy, which can lead to much bigger dangers and threats. As the noble Lord said, it can have commercial implications, personal privacy implications and, ultimately, national security implications. While we all have a part to play setting the highest standards of data protection, it is true that all too often we put the focus on national Governments without recognising the equal responsibilities of the private sector and private companies to play their part. This is particularly vital, given the number of private sector organisations which access data for government contract work. However, it also extends into other realms of commercial activity, such as commercial personal profiling, in which companies build vast data banks of our shopping habits, our friends, our movements—literally, where we are moving around in cities and towns—and our vulnerabilities, all of which have huge value both in their own hands and in the hands of cyber-thieves. These are issues which we have also flagged up in other amendments tabled today, and we have tried to build in more safeguards. My noble friend Lord Collins has said that we believe that individuals should have the right to know what information is being held about them, for example. They should have the right to be able to withdraw permission for the data to be held, and they should have the right to know immediately if a data breach has taken place.

We welcome the amendments, which would begin to address some of our concerns, by putting a straightforward obligation on companies to prepare a cybersecurity report each year, detailing the measures being taken to ensure that data are being kept safely. It is a simple ask, and it should not really be necessary, but the all too frequent security breaches taking place underline why a legal requirement has to be imposed. An Institute of Directors report last year showed that companies tend to keep quiet when there has been a security breach. As a result, there are no accurate figures on the extent of this crime, or the extent to which companies are being held to ransom. A survey of business leaders found that only half had a formal strategy in place to protect themselves and just 20% held insurance against an attack. Yet we also know that companies are also losing confidence in their encryption systems, their staff capabilities and awareness and the ability of their software to withstand a deliberate assault.

This is a huge issue. Of course, we have a vested interest in sorting this out, as often it is our personal data which are being stolen. But on a wider sphere it impacts on everything from company finances to sensitive market data and research and development. So we very much welcome the initiative set out in these amendments, and agree with the noble Lord, Lord Arbuthnot, that they are helpful. In itself, they will not completely solve the problem, but they represent another small step in getting companies to act responsibly in managing the data that they hold.

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, Part 5 of the Bill requires public authorities and specified persons to specify and meet specific legislative conditions and controls on the handling of personal information. As I have said on a number of occasions this evening, these provisions will be underpinned by codes of practice setting out data security requirements, including cybersecurity. A body that fails to meet these could be prevented from using the data-sharing powers. That is the context in which I turn to Amendments 105 and 106.

Amendment 105 would require all but the smallest of companies to conduct audits on their cybersecurity and to report annually on it and their data protection measures. Clearly, the Government recognise that effective cybersecurity risk management is important to the success of the economy and, indeed, to ensuring the safety and integrity of private citizens’ data. The Government conducted the Cyber Security Regulation and Incentives Review in 2016 to consider whether we need additional regulation or incentives to boost cyber risk management in the wider economy and it showed strong justification for regulation to secure personal data.

The Government will seek to improve cyber risk management through our implementation of the EU general data protection regulation in May 2018. Its requirement to report breaches to the Information Commissioner and individuals affected, and the fines that can be issued under it, will represent a significant improvement. These will be supplemented by a number of measures to more clearly link data protection with cybersecurity, including through closer working of the Information Commissioner and the National Cyber Security Centre. However, we will not seek to pursue further general cybersecurity legislation for the wider economy as would be required by Amendment 105.

We believe that mandating the inclusion of cyber risk information in annual reports, or the introduction of legal provisions for cyber audit, is unlikely to be an effective way of encouraging large-scale change in cyber risk management. Instead, the National Cyber Security Centre plans to work with stakeholders to develop guidance for investors. The long-term aim of the organisation is to include cybersecurity in the guidance it provides to businesses on the kind of information it wants to see in an annual report, and in the reports it provides to investors each year on every listed company.

Amendment 106 is very broad in its aims and, as such, could have unintended consequences for the diverse range of grants that the Government fund each year. The supporting audit and insurance regime would be costly and challenging to enforce given the diversity of grant recipients, including those from voluntary and research communities. Furthermore, this amendment is unnecessary as many of these checks are in place as a matter of routine. The level of cybersecurity risk in grants will continue to be monitored and consideration given to how recently launched grant standards could be used to strengthen guidance in this area. This provides a far more flexible and proportionate solution than legislation.

With respect to subsection (2) of the proposed new clause in Amendment 106, the Government are already taking tangible steps to reduce the level of cybersecurity risk in their supply chain. As of October 2014, suppliers of central government contracts that involve the handling of personal data or the supply of IT products and services must demonstrate they have met the technical requirements set out as part of either the government-owned Cyber Essentials scheme or a suitable equivalent. The scheme was developed jointly with GCHQ and industry to support organisations of all sizes and across all sectors in getting a good, basic level of online security in place. In response to my noble friend Lord Arbuthnot I would observe that, as of the end of December 2016, nearly 5,500 certificates had been issued under the scheme, and we have a strategy in place to significantly increase the adoption of the scheme over the coming year. With that explanation, I hope my noble friend will withdraw his amendment.

[Lord Arbuthnot of Edrom]

My Lords, I am grateful to my noble and learned friend for his comments. From what he says I suspect that the Government are not quite there yet. However, I hope that my amendments will help to encourage them along a path of some form of regulation in this area. I suspect that the arguments my noble and learned friend used were similar to those that were first used when financial audit was suggested. However, I am grateful for what he has said. I am also particularly grateful to the noble Baroness, Lady Jones, for what she said and for the gracious way in which she said it. However, my amendments were aimed not so much at government as at business. I suspect that this will be part of a long-term campaign, so, with those words, I beg leave to withdraw the amendment.

--- Later in debate ---

[Baroness Hamwee (LD)]

My Lords, perhaps I may ask a couple of questions which arise from the fact sheet on this issue. On civil registration, it says:

“The Bill establishes a framework, with appropriate safeguards, to share bulk registration information where there is a clear and compelling need”.


I wonder whether the Minister can help the Committee in understanding where that is translated into the Bill. The fact sheet also says:

“There are no intentions to share data with the private sector or for data to be used for any commercial purposes”.


It then goes on to say that,

“the powers would not permit this”.

However, I am sure that the Minister will understand my querying the words “no intentions”, because they suggest that there could be a change, and possibly one with which Parliament is not hugely involved. I am going to assume that the points made by the Delegated Powers and Regulatory Reform Committee are in the rather large pile of items that it raised and which the Government will reply to before Report, so I am referring to that only in passing, but it would be very helpful to understand how the points in the fact sheet, which is where many people would start, move over into the legislation.

[Lord Keen of Elie]

My Lords, the proposals in Chapter 2 of Part 5, which are being addressed here, will ensure that citizens are able to access future—can I have a moment to sort out my own speaking notes?

[Lord Maxton (Lab)]

While the Minister is doing that, can I ask whether this amendment covers Scotland? He is replying as the noble and learned Lord, Lord Keen of Elie. Registration of births, deaths and marriages was not introduced in Scotland until 1855 rather than 1837—I think—so does this amendment cover Scotland?

[Lord Keen of Elie]

I believe it was 1836 in England not 1837.

[Lord Maxton]

It was 1855 in Scotland.

[Lord Keen of Elie]

It does not extend to Scotland. It is a provision pertaining to England and Wales. I am obliged to the noble Lord for giving me time to find my place in my notes. It is greatly appreciated.

As I said, the proposals in Chapter 2 of Part 5 will ensure that citizens are able to access future government digital services efficiently and securely, while removing the current reliance on paper certificates. I will address the two amendments first before addressing the clause stand part aspect of this debate.

Amendment 113 would add a requirement for a civil registration official to be satisfied that the information is required by a recipient to fulfil one or more of their functions before disclosing data and also seeks to add a requirement that an individual must have given valid consent under data protection legislation prior to any disclosure of their personal data. With respect, this amendment is unnecessary because disclosure of personal data under these clauses will already be subject to the provisions of the Data Protection Act. To require explicit consent in all cases would exceed the requirements of the Data Protection Act and the purpose of this clause. Disclosure will take place without consent only if to do so would be consistent with the Data Protection Act, which governs fair disclosure. Examples of how the powers would be exercised in practice include allowing registration officials to disclose information within and across local authority boundaries in order to safeguard children. Being able to share information will ensure that children are known to the local authorities in which they reside and action can be taken to address any needs of the child or the parent. That is what lies behind this matter.

Amendment 116 seeks to amend the Births and Deaths Registration Act 1953 to introduce an electronic register for the registration of births and deaths. However, the proposed amendment to Section 25 of the 1953 Act as currently drafted does not go far enough. The legislation which provides for the registration of births and deaths is based on legislation in place in 1836—or 1837—and very little has changed to the process of registering births and deaths since then. The Act would need more amendment in order to introduce an electronic register. Moving to an electronic register would remove the requirement for hard-copy registers and the electronic register of births and deaths would be the legal record instead of the paper registers. It is certainly an area of reform that the Government are keen to take forward. However, we need more time. I reassure noble Lords that the Government will look in more detail at what changes need to be made to the Act in order to bring in this change and we will consider legislating in due course. We recognise the benefits that the noble Lord, Lord Clement-Jones, suggested could be achieved once that entire process is completed. In light of those points, I hope that the noble Lord will agree not to press that amendment.

I turn to my noble friend Lady Byford and her opposition to the clause standing part of the Bill. Unless there is a specific statutory gateway, information from the records of births, marriages, civil partnerships and deaths may not be disclosed by registration officials other than in the form of a certified copy of an entry, such as a birth or death certificate, on payment of the statutory fee. As I have indicated, the system is outdated and based on paper processes from the 19th century. This clause introduces new data-sharing powers that allow registration officials to share data from birth, death, marriage and civil partnership records with public authorities for the purposes of fulfilling their functions. However, only the minimum amount of data will be provided to enable the public authority to fulfil the function.

My noble friend asked for examples of the benefits of sharing such registration data. Being able to share data about deaths with local authorities would assist in combating housing tenancy fraud. The National Fraud Authority estimates that housing tenancy fraud costs local authorities £845 million each year. An example of this is when someone continues to live in a property following the death of the tenant even when they have no right to do so. The sharing of birth data within the local authority would assist social services, for example, if they wanted to engage with one of the parents in the interests of a child. Sharing marriage data would help to target those living together if there were a fraudulent claim to be single for the purposes of claiming benefits. Sharing death data within local authorities would help them to recover medical equipment following the death of an individual.

There are many examples where such data sharing would be of assistance. It paves the way for citizens to access government services more conveniently, efficiently and securely, for example, by removing the current reliance on paper certificates to access services. This will provide more flexibility and will modernise how government services are delivered. An example is where registration officials will be able to share data on births that have occurred in one district, but where those concerned live in a neighbouring district with no hospital. This would allow local authorities more accurately to plan the provision of health care, school planning and other local services. Being able to share death data across boundaries will also help to prevent unwanted mail being sent to the family of a deceased person.

Registration officials will be able to share registration data only with the public authorities defined in new Section 19AB of the Registration Service Act 1953. Any data sharing will of course be carried out strictly in accordance with the requirements of the Data Protection Act. The sharing of registration data will be underpinned by a statutory code of practice as required by Section 19C. One of the requirements in the code will be that the Registrar-General must personally approve any request for the sharing of large amounts of data.

Before data are shared, the code of practice requires privacy impact assessments and data-sharing agreements to be drawn up and agreed with public authorities to include such things as how data are to be used, stored and retained. Data will be able to be used only for the purpose they have been provided and retained only for as long as necessary. Data-sharing agreements will forbid the creation of a database or the linking of registration data in any way. Any breach would be reported to the Information Commissioner, who has the power to impose penalties where it is appropriate to do so. I hope that that deals with the fears expressed about the bulk use of such registration data.

[Lord Clement-Jones]

My Lords, I am not sure whether the Minister has dealt with the questions raised by my noble friend.

[Lord Keen of Elie]

I apologise for omitting to respond to the questions asked by the noble Baroness, Lady Hamwee, by reference to the fact sheet. Rather than poring over the provisions of the Bill, I will undertake to write to her pointing out the cross-reference between the terms of the fact sheet and the relevant provisions in the Bill. I will place a copy of that letter in the Library.

--- Later in debate ---

[Lord Stevenson of Balmacara]

My Lords, in an idle moment, a moment of complete frivolity, I looked up GOV.UK to check facts—I thought that would be a useful contribution to the debate. The date we have all been searching for is 1837: the General Register Office is part of Her Majesty’s Passport Office and contains records dating back to 1837. I thought that would be useful.

I beg to move Amendment 117A in my name. This stems from my period of service as chairman of a wonderful charity called StepChange, which deals with individual debt owed by ordinary people. In the time I was there—I resigned about two years ago—we had about 600,000 people a year contacting the telephone helpline or going online to try to seek solutions to their debt problems, so it is a very significant problem in British society and something we must take a great deal of care about. Most people who came to us were struggling with multiple debts; in other words, they owed money to a variety of different sources, ranging from local authorities, mobile phone companies, debt collection agencies, Revenue & Customs, payday lenders, utility companies and catalogue lenders—there is a very large number of them.

A median client would be aged about 45, female and owing about £20,000 to eight different creditors, so it is a significant problem that people get into. Within that, with a tremendous requirement now for debt advice, with lots of people struggling with debt, one worrying trend has been how bad central and local government have been in dealing with people, particularly those with multiple debts. A recent survey of about 1,000 StepChange clients found widespread aggressive enforcement from local authorities even when people were asking their authority for help. Clients were more than twice as likely to be threatened with court action or bailiffs than to be offered an affordable payment option. This is despite guidance being issued by central government about how debts should be treated.

Of course, what happens when people face strong demands, very often from central or local government, is that they tend to go to people who can lend them money quickly, probably from an existing credit line, almost certainly, until recently—but even today it is still happening—taking out a payday loan. They try to borrow more to try to pay back original debts and get themselves into a worse situation than they were before. The same survey asked clients to rate what their creditors had done to them and whether they treated them fairly or unfairly. I am afraid to say that public sector creditors came out very badly, occupying three of the top six places in the unfair treatment table. It is interesting to note that HMRC, for instance, scored no better than payday lenders, which the Government, through the FCA, have spent a lot of time trying to sort out over recent years.

That is the background of our concern. We welcome the provisions in the Bill to think again about how debts owed to the public sector are collected. In that light, these amendments are put forward for suggestion, they are probing amendments at this stage, and I hope that they will elicit a response, because it is not just StepChange, the debt charity, that has been concerned about this. Citizens Advice has also raised concern about public sector debt collection practices, finding that public sector creditors are,

“mostly out of step with financial services and utilities companies when it comes to setting affordable repayment rates, and that our clients can suffer detriment when public bodies have uncoordinated and inconsistent approaches to debt collections ... central government debt collection lags behind the higher standards expected of other creditors”.

This is focused on individuals who have problems with their debts, but of course there is a wider cost to society as a whole which, through relationship breakdown, homelessness and difficulties with maintaining concentration at work, et cetera, has been estimated at about £8 billion a year. The Bill contains clauses that relate to this and they seem to suggest that central government as a whole—but in this case HMRC—are thinking about how the data-sharing powers that are coming should be used to allow them to collect several debts at once, but also to do it in a slightly different way. I hope that is the case. We are back with our old friend, the code of practice, because what is said in the code of practice will determine whether this will work.

I have, then, four things I invite Ministers to respond to. First, Clause 45 is limited to departments that seek data-sharing powers and says only that they should “have regard to” the code of practice. This has, I think, been picked up in other amendments that we have considered today. It would be good if the code of practice were also embedded in a much stronger statutory provision, to give it real bite. We have seen examples of guidance—I mentioned one involving central government issuing guidance on council tax collection methods—but such guidance does not work, because it is non-binding and only advisory. If there is a code, it should be embedded in the statute and people affected by it should be able to refer back to it to make sure that it works properly.

Secondly, the public body itself must believe that this is the way in which it needs to operate. Within the amendments are a range of issues that central government bodies might pick up that would match the best practice in utilities, banks, credit cards and store cards—all of which have been through the cycle of trying to get money out of individuals who owe them and other people money, and have recognised that you have to deal with people with multiple debts in a completely different way from those who just owe money directly. That is gradually changing the way people operate. There is further to go, but it is a lesson that should be learned. I hope that the codes can be adapted to reflect that.

Thirdly—this may be too much of an ask, but it should be recognised—this Bill applies only to public bodies, and their creditors, when they are seeking to use the data-sharing powers. The problem is, of course, wider than the data-sharing powers. Problems with central and local government debt collections are widespread: practices need to be reformed and this is not likely to relate only to places where data sharing is used. The Government should think ahead about this and try to set out an understanding for all their agencies that poor debt-collection practices can harm the rate at which they get their money back and the time it takes, and it will also harm the financially vulnerable people. Taking account of that across all their practices would be a very good thing.

These amendments, therefore, try to raise those points, but there is one other thing that the Government should try to do, which is in the first amendment. It is to take a lesson from Scotland—I am sure that the noble and learned Lord from Scotland will wish to pick this up and think harder about it—where, when you have a private or a public debt and seek guidance from the state agency that operates that scheme, you are given statutory protection from excess charges and your interest rates are frozen, providing you stick to your debt repayment plan. That means that people get a breathing space, time to organise their finances, think about their budgets and work out what they are going to do, without the terrible pressure from those who are owed money to start repaying it. It is only when all those issues have been brought together, and an agreement reached between the creditors and the agency, that repayment begins. That has a very much higher rate of success than any other scheme. England lags way behind on this, and it would be no skin off the Treasury’s nose if it took a leaf out of the Scottish Government’s book and brought in their procedures—with a statutory breathing space that gave some hope to people who want to repay their debts but cannot do so because the practices are not as good.

[Lord Keen of Elie]

My Lords, I acknowledge the point made by the noble Lord, Lord Stevenson, that this is a significant issue, and I understand that this is a probing amendment to allow us to consider some of the wider issues that he has touched on in the debate.

Amendment 117A seeks to include in the Bill an additional purpose: to enable debt information to be shared under the powers provided by Clause 41. It seeks to state explicitly that debt data can be disclosed,

“for the purpose of helping individuals to manage their debts”.

There is also a reference to the breathing space, and I will come back to that point in a moment in response to the questions posed by the noble Lord.

In the first instance, we would venture that the amendment is not necessary. The provisions as drafted enable information to be shared,

“for the purposes of the taking of action in connection with debt owed to”,

a public authority or the Crown. This includes but is not limited to, for example, identifying or collecting debt. The provision is sufficiently broad to enable sharing for the purpose set out in this amendment. That is the position of the Government. The Government are considering the recommendations that have been made following work to look into the merits of introducing a breathing space for customers, which we are aware is available in other jurisdictions. While the Government are considering these recommendations, it would be premature to incorporate a reference to this initiative in the Bill at this time. I hope the noble Lord will accept that the matter is being looked at.

--- Later in debate ---

[Baroness O'Neill of Bengarve (CB)]

My Lords, I rise briefly to support this amendment. There seems to be something quite perverse in obstructing the access of the Statistics Board to datasets that are in the hands of other public bodies. That is a very simplified account, but it is a curious place in which to have an obstacle. I hope that the Minister can consider this clause very seriously.

[Lord Keen of Elie]

I am obliged to the noble Baronesses for their interest in this part of the Bill. As your Lordships will be aware, Clause 68 gives the UK Statistics Authority the powers to access important data needed to produce official statistics to support decision-making.

On Amendment 199, new Section 45B gives UKSA a right of access to information held by Crown bodies. A Crown body must respond in writing to a formal notice issued by the UK Statistics Authority and explain any refusal to give the authority information. If the Crown body’s explanation is inadequate or it fails to respond or comply, the UK Statistics Authority may lay the request and any response before the relevant legislature. A Crown body must therefore either comply with the notice or explain its refusal in writing. Where the Statistics Authority puts that correspondence before Parliament, then Parliament can judge the body’s actions openly and transparently. We consider that this is the right approach, creating effective, proportionate accountability and transparency.

Of course, my noble friend Lady Byford would argue that the amendment is a more effective means of requiring a Crown body to give the Statistics Authority the information. We cannot accept that it is either necessary or desirable. The Statistics Authority is part of the Crown, as are government departments. As my noble friend anticipated, it would be extremely novel, and possibly unprecedented, to legislate to compel one part of the Crown to obey another. Even the Health and Safety at Work etc. Act 1974 excludes the Crown from being subject to enforcement measures such as prosecution, instead providing long-standing structures to help departments to work with each other administratively. In this context, new Section 45B strikes the right balance. I hope that explanation reassures my noble friend.

--- Later in debate ---

[Baroness Finlay of Llandaff (CB)]

My Lords I declare my interest as chair of the National Mental Capacity Forum, and in that role I have been working closely with the Office of the Public Guardian.

For some time the Public Guardian has wanted to move away from the wet signature requirement for the creation of lasting power of attorney for both health and welfare, and property and financial affairs decisions, as laid out in the Mental Capacity Act 2005. This amendment would allow that process to be purely electronic and carried out online, with the safeguards it outlines. A digital process should now be secure given the advances in technology since the original provision was made, and the amendment would simply allow the Secretary of State to make appropriate regulations rather than creating the process.

As the hour is late I am inclined to ask the Minister, if he has any reservations about this amendment and the powers it would give to the Secretary of State, to curtail the debate by meeting with me and the Public Guardian before Report. However, I am rather pre-empting the Minister’s decision. If he decides to accept my amendment, that would be just wonderful. I beg to move.

[Lord Keen of Elie]

My Lords, in view of the hour, it occurs to me that it would be appropriate to give a lengthy and detailed analysis of powers of attorney, and, indeed, to take us back to the Powers of Attorney Act 1971 and the subsequent developments of the law. Nevertheless, and despite the enthusiasm from the Opposition Benches, I am perfectly happy to accept the kind invitation advanced by the noble Baroness, Lady Finlay, and to meet with her to explain the Government’s position on this matter. I would be obliged if she could at this stage withdraw the amendment.

[Baroness Finlay of Llandaff]

My Lords, in light of the forthcoming meeting—which I am sure the Public Guardian will wish to join—I beg leave to withdraw the amendment.

Digital Economy Bill

Lord Keen of Elie Excerpts

Committee: 4th sitting (Hansard): House of Lords
Wednesday 8th February 2017 Lords Chamber

[Lord Stevenson of Balmacara]

My Lords, I am not a lawyer—I feel a bit uncomfortable joining this debate; I am sure there are issues it is much beyond my abilities to deal with. But I say to the Minister before he responds, the point made about the degree of concern in the industry is important. This is a big and complicated Bill with many different aspects. It reaches far into aspects of our digital world. This clause, however, is the one that has generated the largest number of responses and—to judge from the meetings I have had with people—the most anger.

In a sense, so what? If it is the right decision, it should go ahead. However, it is clear that there is a lot of support for the current situation, even though there are arguments against it. The point was made time and again that the existing arrangements seem to work well, so why are we changing them? The industry, as I said, is pretty well united against it. One or two are speaking up for it but they do not represent the majority of voices we have heard.

There is also a real danger that—particularly at a time of uncertainty over technological change and regulatory positioning—having a period when we deliberately create confusion and delay until the new guidelines, or baselines, are established, is probably not the best way of making progress. Uncertainty over a long period will affect investment, which is not what we want. So there are reasons for asking the Government to be very clear that this is the right way forward.

We all share the same wish: we want an efficient and trusted regulator that can deal with this complicated, fast-moving and complex area. But it would be quite improper to have a situation in which there was a very limited right of appeal on any case determined not to have been carried out correctly—not so much about the judicial aspects, but on the merits of the case; in other words, where the evidence does not support the decision that has been taken.

I do not understand quite what the difficulties are. I have looked back over comments made by the noble and learned Lord when he was Advocate-General for Scotland. He is on the record in a number of places and a quick search with an algorithm of some complexity, which I could not possibly describe, reveals him to have said several things about judicial oversight. As it has developed, he says, it has,

“provided us with a flexible standard of oversight, which in many senses is wide-ranging”.

However, judicial oversight is the issue and that is what we have to emphasise. He might like to reflect on that in relation to what has been said. There are other things—I will not quote them as I am sure he is embarrassed enough already, or perhaps not. But the issue needs bottoming out—there is a serious point at its heart. There are issues that will affect the whole nature of the business we are regulating in this manner which need to be resolved.

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, I am obliged to the noble Lord, Lord Clement-Jones, for raising this matter because it has generated a great deal of heat and debate in the context of the Bill. I appreciate the point made by the noble Lord, Lord Stevenson, with respect to the number of responses there have been. I just emphasise that judicial review is a form of judicial oversight, and a very effective one, but I will elaborate on that in a moment.

We are aware that the major telecoms operators in particular, and their agents, have lobbied vigorously and in detail on this point. Indeed, the noble Lord, Lord Clement-Jones, brought out many of the points that have been made by their agents in the course of that vigorous and detailed lobbying. I shall not go into the detail of Ofcom’s position on this. It has expressed its position very clearly and we understand it. What I would say is that there is no single position for all utility sectors, and both judicial review and appeals on the merits may be used in the same sector for different kinds of appeals. It is not a black and white situation.

The Government’s case is not that this change is needed to ensure consistency with other utility sectors but that the public interest will be best served in the communications sector by an appeals regime that focuses on errors which Ofcom is alleged to have made, rather than asking the court to reach a different conclusion. Let us remember that Ofcom is a qualified regulator and its decisions are entitled to respect. They are informed decisions and they are not irrational. They are not determined on the toss of a coin. That is why judicial review is an appropriate approach.

The noble Lord, Lord Clement-Jones, also talked about consumers. I find that interesting. Perhaps I may refer briefly to the Which? response to Clause 75. It sees this measure as one of the most important currently contained in the Digital Economy Bill, saying that it will give the regulator the power and confidence to take the necessary actions to protect consumer interests without fear of costly and lengthy litigation procedures. Introducing a judicial review standard for appeals in telecoms will mean that decisions made by Ofcom in the interest of consumers should be easier to implement and quicker to take effect. That is a reflection of Ofcom’s own view of the matter. This is not necessarily about coming to the aid of Ofcom but about recognising these matters from the perspective of the consumer. That is extremely important.

Currently, appeals brought under Sections 192 to 196 of the Communications Act against Ofcom’s regulatory decisions are decided “on the merits” by the Competition Appeal Tribunal. That exceeds and, as the noble Lord, Lord Clement-Jones, acknowledged, effectively gold-plates Article 4 of the EU framework directive, which requires that the merits of the case are duly taken into account in any appeal. That is not quite the wording of the proposed amendment.

The result of this over-implementation is an unnecessarily intensive and burdensome standard of review that can result in very lengthy and costly appeals litigation, which in turn can hinder timely and effective regulation. Some of the appeals that have taken place have done so over extraordinarily lengthy periods. Of course, the very large communications operators are in a position to fund that sort of appeal process. Clause 75 will change the standard of review so that the Competition Appeal Tribunal will decide appeals against Ofcom’s decisions by applying the same principles as would be applied by a court on an application for judicial review and, in particular, judicial review of other administrative actions. This will focus appeals on the key questions of the legality and reasonableness of Ofcom’s decision-making.

The noble Lord, Lord Stevenson, suggested that there might be cases in which there was simply no merit in a decision. If that was so, and if Ofcom proceeded without reliance on the facts of a particular case, that would be amenable to review under a judicial review standard.

[Lord Lester of Herne Hill]

Judicial review itself varies according to whether or not there is a European element. If the review is about a case where free speech under the convention is concerned or an EU directive is concerned, then judicial review embraces the principle of proportionality. However, if it is not about a case where European law can be involved—either system of European law—under the deciding case law, judicial review does not apply the principle of proportionality. In other words, it still—in my view, wrongly—does not look at whether the means employed to pursue a legitimate aim are necessary to achieve that aim. Is not what I have just said an indication of the unsatisfactory nature of relying on judicial review as the solution?

[Lord Keen of Elie]

With respect to the noble Lord, Lord Lester, I have to say no, because here we are dealing with judicial review in the context of the EU framework directive, which requires that the merits of the case are duly taken into account in any appeal, therefore effectively introducing the issue of proportionality into that process. Therefore, even if there are cases which some might criticise as involving too narrow an approach to judicial review, that does not apply here. This is an incidence in which the issues of proportionality will arise in the context of judicial review. By taking this route, we are applying an appropriate standard to Ofcom’s decision-making.

As has been acknowledged by noble Lords, this is a fast-moving sector, and regulation needs to be able to keep pace with technological and market changes. This is rather difficult when appeals can drag out for a year after a regulatory decision has been made. As the UK’s expert regulator in the telecommunications sector, it is right that Ofcom itself should be given an appropriate margin of appreciation by the tribunals. That is why we have an expert regulator there—so that it can make an informed decision that should be given an appropriate margin of appreciation by the Competition Appeals Tribunal.

A judicial review basis for appeals is intended to be a flexible process that will ensure that those affected by Ofcom’s regulatory decisions can still challenge those decisions effectively within the framework of Article 4 of the EU framework directive. A number of Ofcom’s regulatory decisions are already appealable only on a judicial review basis. I made the point earlier that, with regard to individual regulators, you can find instances in which there is a merits-based appeal for some matters and a judicial review standard in respect of others.

By changing the standard of review to reduce over-lengthy and costly litigation, this clause will enable consumers to benefit sooner from the outcome of decisions made by Ofcom in pursuit of its statutory duty to further the interests of consumers. I emphasise that: one of Ofcom’s statutory duties is to further the interests of consumers. The clause will also remove a significant potential barrier to the participation of smaller communications providers in the appeals process, benefiting smaller, “challenger” communications providers. Again, they are inhibited by the prospect of massive merits-based appeals going before the Competition Appeal Tribunal.

The noble Lord, Lord Clement-Jones, has tabled two alternative approaches. Amendment 215 would replace the existing “on the merits” standard with a requirement for the tribunal to take,

“due account of the merits of the case”.

I acknowledge that the amendment essentially replicates the wording of Article 4 of the EU framework directive, albeit it is not identical to it. While this would in one view remove the gold-plating of the existing standard in a technical sense, the Government consider that it would not lead to any substantive change in approach. That might be why this proposal is being pushed so hard by the major operators in the telecoms sector. It would not, therefore, result in quicker appeals, timelier implementation of regulatory decisions or resultant consumer benefits.

Amendment 216 would alternatively replace the existing “on the merits” standard of appeal with a list of specified grounds. The tribunal would be able to uphold an appeal only where it was satisfied that Ofcom’s decision was wrong on one or more of these grounds. However, as noble Lords may be aware, the previous Government consulted on a similar approach in 2013 and we do not consider that this approach has merit. On balance, we consider that such an approach would risk significant satellite litigation if it were to be introduced—about the nature of the new standard of appeal, for example, which could lead to longer appeals and further regulatory delay. A standard of review based on judicial review principles, including the principles of proportionality in the context of the application of the European directive, which is well understood and used in many other sectors, will minimise this kind of uncertainty. In these circumstances, I invite the noble Lord to withdraw his amendment.

Digital Economy Bill

Lord Keen of Elie Excerpts

Committee: 4th sitting (Hansard - continued): House of Lords
Wednesday 8th February 2017 Lords Chamber

[Lord Foster of Bath (LD)]

My Lords, it is four years after the Leveson inquiry, and I certainly believe that Section 40 of the Crime and Courts Act 2013 should be implemented, and should be implemented now. I voted for it in your Lordships’ House last October and I certainly support the amendments today, which have much the same effect. I also support the fail-safe amendment moved by the noble Lord, Lord Stevenson, although I hope that it is not necessary and that Section 40 will be brought in.

Some incredibly misleading statements have been made about the impact of Section 40. Most of the newspapers, as we know, do not support its implementation and have featured some quite amazing one-sided editorials. To the best of my knowledge, none of them has permitted a right of reply. I am the former Member of Parliament for the wonderful city of Bath, which is included in my title, so I am sure that noble Lords will not be surprised that I take a particular interest and am an avid online reader of the Bath Chronicle. Three weeks ago it published one of these anti-Section 40 diatribes. I wrote a rebuttal and asked the Bath Chronicle to publish it. I have not even had an acknowledgement so far—so much for a free press.

Perhaps to explain why I support these amendments, and to ensure it is published—albeit in Hansard rather than in the Bath Chronicle—I will read what I wrote, because it sums up exactly where I stand:

“I am a strong supporter of local newspapers and the Bath Chronicle in particular. But I was surprised by your recent editorial suggesting that measures being considered by parliament will mean that ‘Any investigation in the public interest could be silenced by anyone with a vested interest’. This is a complete misreading of the proposals made by Lord Justice Leveson after the Public Inquiry which followed the appalling phone hacking scandal.


Few could deny that in the past the press had a shocking track record of setting up its own toothless regulators which failed to protect the public. Leveson has proposed that the press should now establish a truly independent regulator whose independence is checked and then ‘recognised’ by a body which is itself impartial and independent from government or the press.


This is what the public want as shown by a YouGov poll just last week. When asked ‘Do you think it is important that any newspaper self-regulator undergoes an audit to ensure it is effective and that it is genuinely independent of both politicians and the press?’ nearly three-quarters (72%) said yes and just 6% said no.


The ‘regulator’ under which the Bath Chronicle operates—called IPSO—doesn’t meet this test. It is not only funded but controlled by the newspapers it regulates.


Were the Chronicle to join a ‘recognised’ regulator, or were IPSO to demonstrate through getting recognised that it met proper standards of independence and effectiveness, the funding issues you describe would not happen. Moreover, the public would be protected and you”—


that is, the Chronicle—

“would receive protection from wealthy and powerful local figures if they tried to bully you into withholding stories about them by threatening you with unaffordable court costs”.

My article ended:

“I hope Parliament will agree to support the public and back Leveson’s proposals”.


I certainly hope the Government will accept the amendments before us today.

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, I am obliged to the noble Lord, Lord Stevenson, for expressing this amendment and also to the observations of the noble Lord, Lord Foster of Bath. I would say, with respect to his most recent comments, that the test of a free press is not whether or not they publish a letter. Indeed, the fact that they do not publish your letter is itself an expression of freedom.

Amendment 229ZC would require the Government to report to Parliament about the arrangements that would need to be made should Ofcom assume the responsibilities of an independent regulator of digital publications. I acknowledge the care with which the noble Lord, Lord Stevenson, has drafted this amendment. He was quite candid in saying that his real concern is the regulation of the press, but he was equally candid in indicating that, in order to come within scope for the purposes of this Bill, he was not really concerned with all publications by the press but only digital publications.

I see in his amendment an expression of concern—and, indeed, of frustration—over the lack of progress being made towards a viable avenue for press regulation. I am sure that in a sense that, in part, has prompted this amendment. However, he said himself that it might be slightly premature. With respect, I would concur with that observation. It is perhaps too soon—and people will say in response, “Four years after Leveson, is anything too soon?”—but we have to remember that the press landscape has altered quite dramatically over the last four or five years. That is reflected in the fact that certain matters have gone out for consultation—particularly with regard to Section 40, which is going to be raised in a later amendment—albeit that the consultation process has been somewhat stymied by an application for judicial review.

I move on to the core of the present amendment, which is the idea that we should move towards—and this was a backstop of Lord Leveson’s report—Ofcom as a regulator. The idea that Ofcom should regulate digital publications—albeit with “digital publications” not being a defined term, and I make nothing of that—has behind it the real push that Ofcom should become the regulator for the press. As I understand it, that is essentially what lies behind the amendment.

Let us remember that Ofcom already has huge responsibilities as a regulator, many of which we have debated over the last week. Among other things, it has to ensure that we have fast broadband connections, competition decisions, such as the current consideration of the future of Openreach, which has been referred to, and spectrum management, including forthcoming auctions. We have also discussed today its new role in respect of the BBC and its function in managing listed events, and we have heard from my noble friend Lord Borwick in respect of Ofcom’s regulatory functions and in respect of subtitles and the accessibility of on-demand services. There is plenty more, over and above that, that Ofcom does, and that is without even going into the question of postal regulatory functions.

We have the greatest respect for Ofcom as a regulator, but the question arises about how much more we can put on its plate. This amendment seeks to pile on more. For the first time, it would be setting a regulatory requirement on Ofcom, in statute, in relation to internet content, which is not TV-like, if I may use that rather crude term. As my noble friend Lady Buscombe has already made clear, moving to a situation in which Ofcom is a regulator of a broad range of online content would be an enormous undertaking for Ofcom, or indeed for any other regulatory body.

--- Later in debate ---

[Baroness Jones of Whitchurch]

My Lords, again, given the lateness of the hour, I simply say that our views are well known, that we have supported the implementation of Section 40 in a number of previous debates in this Chamber, and on that basis we support the amendment.

[Lord Keen of Elie]

My Lords, I am obliged to the noble Baroness, Lady Hollins. I will address Amendments 233F and 234A together. The amendments, of course, mirror Section 40 of the Crime and Courts Act 2013 but would apply to digitally published news-related material only, as we know. The House has debated the issue of Section 40 on various recent occasions, including during passage of the Investigatory Powers Act and the Policing and Crime Act. There was also a stand-alone debate just before the Christmas Recess.

There is obviously a great strength of feeling about this matter. I realise that some Members of this House are frustrated by what they see as a lack of progress by government on Section 40. However, the Committee should also recall the strength of feeling on the other side of the debate. Many noble Lords have argued passionately in this House against Section 40 and are concerned about its commencement and its impact upon freedom of the press. That is why the Government ran a consultation to consider the matter further.

The press self-regulatory landscape has changed significantly in the past four years since the Leveson inquiry reported. It is right that the Government take stock, look at the changes which have already taken place and seek the views of all interested parties on the most effective way to ensure that the inexcusable practices which led to the Leveson inquiry being established can never happen again.

A consultation was the most appropriate way to ensure that the Government were listening to all views when considering options for the next step in respect of Section 40. Indeed, the consultation closed on 10 January, and it is estimated that we have received more than 140,000 responses. I know that many Members of this House responded to the consultation, and of course we are grateful that they took the time to do that, but many others have responded as well. It will be necessary to consider the many and diverse views that have been expressed with regard to this matter.

As many Members of the Committee will know, and as the noble Lord, Lord Prescott, mentioned, the consultation is now subject to a legal challenge. While I cannot comment on the ongoing legal proceedings, the Government have committed not to take any final decisions on the matters to which the consultation relates until the judicial review application has been determined. As such, it is not possible for me to set out a timetable for when the Government will respond to the consultation. But of course we hope that that judicial review application will be determined much sooner than later.

That brings me on to the amendments from the noble Baroness, Lady Hollins. The issues that she has raised are of critical importance. I appreciate that she and her family were themselves the subject of press abuse, as were other Members of this House. I also recognise the strength of feeling that parties have on the commencement of Section 40. However, with respect, now is not the right time for this House to consider the present amendment.

News consumption is becoming increasingly global and more and more people are reading their news online from a multitude of sources from around the world. Bringing in a law that effectively mirrors Section 40 but for relevant digital publications only would create an incoherent regime applying different rules depending on the mechanism by which an article has been published.

Noble Lords who have supported these amendments have raised the profile of this issue and given a clear signal of their intent—and of their continuing intent. This has not gone unnoticed in government. But we must ensure that we consider this matter properly. As I said before, a free press is an essential component of a fully functioning democracy and we must ensure that we protect that. I note what the noble Lord, Lord Prescott, said about the position in Ireland. I am not in a position to express a view as to the manner in which that operates but I am perfectly content to indicate that we will look at that going forward as well. I hope that that will satisfy the noble Lord. At this stage, however, I urge the noble Baroness, Lady Hollins, to withdraw her amendment.

[Baroness Hollins]

My Lords, I thank the Minister for his reply. My hope is for a free and responsible press. However, what is most disappointing for the public is that over the last four years of inertia and of the press’s failure to establish a proper regulator, countless more individuals have been affected by press abuse and have no access to redress. They include victims from the Paris Bataclan attack, the Shoreham air disaster, and many more. This issue is still live and is still troubling. All these individuals have been let down by the Government’s decision to renege on their promises and to prevent access to justice for ordinary victims of press abuse. I am disappointed by the Minister’s response and I intend to return to this on Report. I beg leave to withdraw my amendment.

Digital Economy Bill

Lord Keen of Elie Excerpts

Report: 2nd sitting (Hansard - continued): House of Lords
Monday 20th March 2017 Lords Chamber

[The Advocate-General for Scotland (Lord Keen of Elie) (Con)]

My Lords, I am obliged to the noble Baroness, Lady Hamwee. Amendment 25YX and the related Amendments 28CB, 28CG, 28DV and 28FD seek to impose an express requirement that the public service delivery power may be used to share information only to the extent that it is necessary and proportionate to do so. That covers the changes to debt fraud research and similar civil registration provisions in the Bill. With respect, the amendments are unnecessary as the powers will need to be exercised in line with the Data Protection Act and the codes of practice, which already require that only the minimum data necessary to fulfil the particular objective may be shared. It is therefore unnecessary to amend in accordance with this proposal.

The effect of Amendment 25YYD would be that the list of specified persons permitted to use the public service delivery power could be amended only to add or remove bodies. The removal of the word “modify” would affect the way that minor amendments could be made. I do not believe that the noble Baroness, Lady Hamwee, expressly referred to this amendment, but as it is listed in this group as her amendment I just mention the point because clearly it is necessary that there should be a degree of flexibility in how that provision operates.

[Baroness Hamwee]

I apologise; I thought that was in another group, though I received a note later. I would like to understand how extensive a modification might be.

[Lord Keen of Elie]

I am obliged to the noble Baroness. I am happy to explain within this group, where I understand the amendment remains. The removal of the word “modify” would affect the way in which minor amendments could be made. For example, where a body changes its name or the description of the category of a body needs to be adjusted, you would then want to modify rather than delete and start again.

Amendment 26A seeks to remove reference to,

“the contribution made by individuals or households to society”,

from the public service delivery chapter. Again, I venture that the amendment is unnecessary because subsection (10) gives examples of “well-being” but does not provide an exhaustive list. Therefore we have three categories by way of example—but only by way of example. In response to the specific observation made by the noble Baroness, Lady Hamwee, I respectfully suggest that there is nothing paternalistic or judgmental about any of the examples given in the Bill. Indeed, where a party makes a contribution to society, that benefits the contributor as well as society, which is why it is appropriate that it should be given as an example in this context.

Amendment 28AU would provide a new definition of “personal information” for the purposes of the public service delivery power. This point was raised in Committee as well. The amendment expressly incorporates the definition of “personal data” under the Data Protection Act 1998 into the definition of personal information for the purposes of these powers, as well as making clear that the Bill’s extended definition also includes deceased individuals and companies. We consider that the existing provisions set out the same position, albeit in slightly different words. I note that reference was made to the issue in Committee, and to the provision of codes of practice in that context.

The intention of Amendment 28AY seems to be to provide greater transparency by ensuring that individuals would know when information about them has been shared. Existing provisions in the Bill already require those using the powers to comply with Data Protection Act requirements as to the information that people are given about the usage of their personal data. This, supplemented by the requirements imposed by applicable codes of practice, ensures that the use of these powers will be as transparent as it can be.

Amendments 28AR and related amendments seek to narrow the exceptions to the general rule in Clause 36(1) that personal information received under the public service delivery powers may be used only for the purpose for which it was shared, to the effect that such information may not be shared for the purpose of preventing anti-social behaviour, and to restrict the exception permitting disclosure for the purpose of preventing or detecting crime to “serious” crime, as indicated by the noble Baroness. These amendments would also bring in an offence of disclosing personal information for the purposes of anti-social behaviour. The prevention of anti-social behaviour and the prevention or detection of crime are matters of significant public interest. If information sharing indicates potential criminal activity, public authorities should be able to take action. Similarly, if information received under the powers indicates that anti-social behaviour is occurring or is likely, we consider that this information should be disclosable to maintain public order. Anti-social behaviour may itself be seriously harmful to those who become its victims.

Amendment 28BM seeks to remove the power given by Clause 40(4), which allows regulations to make disclosures by newly specified persons subject to the same conditions that apply to disclosures of information provided by HMRC. That power would be used to require the consent of the original provider to any subsequent disclosures of particularly sensitive information, as is the case for information provided by HMRC under Clause 38. The amendment is undesirable, as it would remove flexibility to give enhanced protection to information from certain sources. I do not believe the noble Baroness read the provision in that form, but it is there so that enhanced protection may be given in a particular circumstance.

Amendment 28CF would impose a duty on the Secretary of State to review the civil registration power after three years, akin to the powers already provided in the debt and fraud powers. This duty was included in the debt and fraud powers to assess whether the powers deliver demonstrable benefit via an initial piloting process. The information gathered in the course of the pilot process will provide evidence for the review. It is our view that a similar duty to review the civil registration power would not be appropriate. First, civil registration information is already a matter of public record. Secondly, the powers are simply looking to update outmoded legislation to simplify and provide the flexibility to share civil registration data within the public sector to avoid the need to enact specific powers whenever a new need arises. The power has been developed to support a range of public authorities at national and local government level to transform the services that they can provide to citizens.

Finally, Amendment 39 is intended to ensure that Part 5 could not be brought into force until after the GDPR comes into effect, which would be in May 2018. This would prevent the use of the powers until that date, which would be unhelpful given that a number of bodies are keen to use the powers to achieve particular objectives, such as extending the warm home discount scheme. As we have said before, we consider that the present provisions are compatible with the GDPR—compliant, therefore, in that context—and we are committed to revisiting the codes of practice before May 2018 to ensure that they reflect the latest best practice of compliance with the GDPR.

In those circumstances, I invite the noble Baroness to withdraw her amendment.

[Baroness Hamwee]

My Lords, I thank the Minister, but all that will bear some reading. We felt it important to extend some of the comments that we made in Committee to get a more extended response. Noble Lords will be pleased to know that I shall not respond to all those points. On the Minister’s first point about “necessary or proportionate”, I do not know whether he means that I misread the ICO’s comments, that the Government disagree with the ICO, or whether some of the changes to the Bill since its initial form have dealt with them. Perhaps I should just leave that hanging.

The fact that the “contribution to society” is an example does not answer our concerns. I remain anxious about it, as I do about “anti-social behaviour”, which the Minister described as being a matter of significant public interest. I do not dispute that, but data sharing is a matter of significant public interest—I suggest, possibly greater. We are told that anti-social behaviour may be seriously harmful, but it is not criminal in this context, because we have other provisions to deal with crime.

I was indeed confused about the application of the HMRC powers to other bodies, and I remain confused about whether that extension is appropriate.

Finally, of course civil registration information is a matter of public record, but the updating takes us into a very different regime. The ability to share information in bulk is very different from that to look up individual pieces of information. Can the Minister tell the House today whether the consultation to which he referred extended beyond the sharing organisations to the sort of bodies concerned with privacy? He may not know, and I may be quite out of order in asking this on Report. I do not think he is going to leap to his feet—pause—no, he is not. I do not hold that against him. It is probably not in his brief. If there was not such consultation, that answers my point.

However, clearly, I should beg leave to withdraw the amendment.

--- Later in debate ---

Moved by

[Lord Keen of Elie]

25YY: Clause 31, page 30, line 23, leave out “a specified objective” and insert “an objective which is a specified objective in relation to each of those persons”

[Lord Keen of Elie]

My Lords, the Delegated Powers and Regulatory Reform Committee made a number of recommendations on Part 5 of the Bill. The Government developed the information-sharing powers through consultation and partnership over a process that started over three years ago. These measures are about improving the way the Government operate for the public benefit. Of course, data sharing must be done with transparency, safeguards and oversight. It is in that spirit that we have accepted the bulk of the committee’s recommendations. The way in which Part 5 is structured in seven chapters to deal with different data-sharing powers has meant that it has taken nearly 100 amendments to implement the recommendations, so I will spare the House from referring to every one in turn. I believe that my noble friend Lord Ashton has written previously setting out all that detail.

Our amendments place the lists of specified persons able to disclose and use information under the public service delivery, debt and fraud powers on the face of the Bill rather than in regulations. We then also narrow the powers to amend the lists. For public service delivery, specified persons will be permitted to share information only for the purposes of an objective which has been expressly specified as applicable to that person, rather than any specified objective. We have also narrowed the ability to set and amend data-sharing objectives for public service delivery, so that any specified objective must support the delivery of a specified public authority’s functions.

For water and fuel poverty, we have restricted the powers to amend the list of support measures and to add to the list of permitted recipients of information under the clause, as the DPRRC recommended. Finally, we have adopted the committee’s recommendations to remove Henry VIII powers to make consequential amendments to primary legislation, as well as to narrow the powers to review and amend the fraud and debt powers. We have ensured that any amendments can be only to improve the operation of the fraud and debt powers and there will be no way to use these powers to undo the safeguards that the Bill provides.

In addition to the DPRRC’s recommendations, the Government have tabled amendments on the following matters. Amendments 28FE and 28FF remove repetition in Clause 60(5) relating to the criminal offences which protect personal information originating from HMRC, Revenue Scotland and the Welsh Revenue Authority. By removing this repetition, the amendments avoid any confusion which might otherwise be caused.

Amendments 28FG to 28FN correct an unintended consequence of measures that were agreed during Lords Committee stage to prevent disclosures by journalists in the public interest being caught by the anti-disclosure offences in Chapter 5. The unintended effect is that the criminal offence which protects personal information disclosed under Clause 60(1), and which originates from one of the tax authorities, now applies only to disclosures made by the person who first receives the information but not those within the accreditation system who subsequently receive the information—for example, to undertake peer review or via intermediaries. These amendments therefore restore a key safeguard to the research power, which ensures that information is protected in all parts of the process.

Amendments 28FW, 28FX, 37 and 38 provide new data-sharing powers for Scottish Revenue and the Welsh Revenue Authority. Clause 70 provides the power for HMRC to share de-identified data, allowing HMRC to share aggregate and general information more widely, for purposes in the public interest. Following discussions with the Welsh Government and the Scottish Government, as requested by them, we are providing equivalent powers for devolved tax-raising bodies.

Amendment 28FY, tabled by my noble friend Lord Hunt, is supported by the Government. There is a recognised sound public policy argument for supporting the more effective operation of the Employers’ Liability Tracing Office, referred to as ELTO. The discussions at Lords Committee sparked further conversations between HMRC and ELTO officials, resulting in an agreement to take this amendment forward. This Bill has offered a timely opportunity therefore to legislate. The current clause meets the objective of helping ELTO improve its records of employers’ liability insurance policies, making it easier to identify insurers and so enable claimants to pursue compensation. Both parties recognise that there remains some work to do and it is currently unclear as to how effective HMRC data may be in helping to populate missing data. However, an enabling provision would allow more robust testing of the possibilities, with the opportunity to take these forward.

Amendments 40 and 41 enable commencement of measures by area so that the Government can ensure that measures are not commenced for Northern Ireland in the event that the Northern Ireland Assembly has not given legislative consent. Consent from the Northern Ireland Assembly is required on a number of measures, including the extension of public lending right to e-book loans, Part 5 of the Bill on digital government, the Northern Ireland provision in relation to Ofcom and, should the government amendment be agreed, the offence of breaching limits on ticket sales.

In consequence of the potential need to commence the Bill by area, these amendments also provide the power to make necessary transitional provision. The transitional powers will also be used to define small businesses in the statistics chapter of Part 5 until definitions in the Small Business, Enterprise and Employment Act 2015 come into force. I beg to move.

[Lord Hunt of Wirral (Con)]

I declare my interest as a partner in the global law firm DAC Beachcroft, and other interests set out in the register, including chairing the British Insurance Brokers’ Association and being president of the All-Party Parliamentary Group on Occupational Safety and Health. Taken at face value, Amendment 28FY would appear somewhat technical, but the Employers’ Liability Tracing Office is working well, but it could work better, and this amendment would help to facilitate that.

I am so grateful to the Minister and his colleagues for the support that they have given to this amendment, which could make a substantial difference to the capacity of the office to help to secure compensation, expeditiously and effectively, for those afflicted by industrial illnesses. When someone faces a reduced quality of life and possibly an avoidably and unnecessarily early death because of an industrial illness innocently contracted, the least that we can do is to deliver compensation as quickly as possible in the hope that the individual with the illness can enjoy at least some benefit from it. I believe that in some small way the amendment will serve to make this a more civilised and compassionate country.

[Baroness Hamwee]

My Lords, we have two amendments in this group. The Minister was just a little previous in answering Amendment 25YYD on modification, so we do not need to go back to that. Amendment 33ZYD would remove several organisations from the list of specified persons for the purposes of fraud provisions, and the amendment is here to enable us to ask whether all these require the data-sharing gateway or, conversely, whether there are many other government-related organisations; I am not quite sure what the correct term might be for organisations such as the National Lottery or the British Council, but I shall use the term government-related organisations tonight. Are there not others that might use the power? What were the criteria used to select the ones that are in the schedule?

[Lord Keen of Elie]

I am obliged to my noble friend Lord Hunt and note what he said with regard to the amendment. On the amendment proposed by the noble Baroness, Lady Hamwee, Amendment 33ZYD, which seeks to remove a number of non-departmental public bodies listed in the schedule for the fraud power, I accept that the list in the schedule is long but the fact is that many public authorities are at serious risk of fraud. Each of the bodies was considered individually before being added to the schedule, and the NDPBs have been included because they each administer many millions of pounds in grant expenditure each year, which exposes them to a significant risk of fraud.

[Baroness Hamwee]

Were any organisations considered and discarded for that purpose?

[Lord Keen of Elie]

I am not in a position to say what number of bodies were considered and discarded, but I will undertake to write to the noble Baroness on that point. All the public bodies included in the schedule must, of course, comply with the data-sharing safeguards in the Bill. Clearly, public authorities may not enter into data sharing lightly. They will have to follow the codes of practice, comply with the Information Commissioner’s requirements on data sharing and privacy and have in place all necessary protections to prevent unlawful disclosure.

The list of public bodies in the government amendments is shorter than the lists we have previously published in draft regulations although, as I indicated to the noble Baroness a moment ago, I do not know how many bodies were considered and removed before the process of listing them in the draft regulations took place. Care has been given to ensuring that we share only where there is a clear benefit, as required by the legislation. I hope that, with that explanation, the noble Baroness will withdraw her amendment.

[Lord Collins of Highbury (Lab)]

My Lords, I will take this opportunity to briefly comment on this group of amendments. These Benches did submit a series of amendments in Committee. The Minister responded that the Government were giving due consideration to the Delegated Powers Committee report, so there was no opportunity to go through some of those issues in detail. We welcome the Government’s amendments and the fact that they have responded to the Delegated Powers Committee. I have read the Information Commissioner’s briefing for Report, and I welcome the fact that she strongly supports the Government’s adoption of these amendments, which she believes will strengthen parliamentary scrutiny and government accountability.

The next group of amendments deals with the code of practice, on which we had lengthy debates in Committee, but I believe that the Government are now striking the right proportional balance between improving public and government services and the need to protect data.

[Lord Keen of Elie]

I am obliged to the noble Lord.

Amendment 25YY agreed.

--- Later in debate ---

[Lord Collins of Highbury]

My Lords, in Committee I had my name to an amendment regarding the status of the codes of practice. At that time, the noble and learned Lord referred to the appropriate level of legal obligation. He certainly persuaded me that the wording “having regard to” or “complying with” did not relate to whether a public authority could ignore a code, but whether there were reasons for doing so. I was persuaded about that level of flexibility.

Of course, we were really concerned about what the codes of practice would ultimately look like, what the engagement of the Information Commissioner would be and what the Information Commissioner’s view was. On these Benches we were pleased to see not only the Government’s amendments but the Information Commissioner saying that she was extremely pleased that the Government had accepted her recommendations on there being references in the Bill to codes of practice and the privacy impact assessments.

In the light of the Information Commissioner’s overall comments and the fact that the Government have responded, we certainly welcome these amendments. However, I give notice that—the noble Baroness, Lady Hamwee, referred to this—what is in the codes and how public authorities operate them will be very important, and parliamentary scrutiny of and engagement in them will be critical in the future. I hope that we will see further drafts of the codes before they are ultimately laid before Parliament. It is really important not only that there is the highest level of consultation on them but that Members of Parliament are properly engaged in them.

[Lord Keen of Elie]

I thank noble Lords for their observations on these matters. There are of course government amendments in this group as well and perhaps I may begin with those.

This group of amendments concerns the codes of practice issued under Part 5 and those issued by the Information Commissioner’s Office. It includes the government amendments that implement the recommendations of the Delegated Powers and Regulatory Reform Committee and, as the noble Lord, Lord Collins, observed, the recommendations of the Information Commissioner’s Office. In addition, there are some opposition amendments on similar points.

We have already published draft codes of practice on data sharing. The Delegated Powers and Regulatory Reform Committee recommended that the first codes of practice and the UK Statistics Authority’s statement of principles should be laid before Parliament in draft and should not be brought into force until they had been approved under the affirmative procedure. Revisions were to follow the draft negative procedure. We agree and have tabled amendments to achieve this, and it is intended that Parliament should have a suitable opportunity to consider these drafts and any amendments thereto in due course.

A further series of government amendments will require persons disclosing personal information under relevant chapters of Part 5 to have regard to the Information Commissioner’s codes of practice on privacy impact assessments and privacy notices, transparency and control in so far as they apply to information which is being shared. As the noble Lord, Lord Collins, observed, the Information Commissioner called for explicit reference to these two codes to be made on the face of the Bill. We have worked with her office to develop these amendments, which supplement the existing requirement that the codes of practice prepared under the Bill must be consistent with the commissioner’s own code on data sharing, and I understand that she is satisfied with the steps we have taken in that regard. I hope that this will provide further assurance to noble Lords that we are committed to ensuring that best practice concerning compliance with data protection and transparency will be applied to the exercise of powers under Part 5 of the Bill.

I now turn to the opposition amendments in the names of the noble Baroness, Lady Hamwee, and the noble Lord, Lord Clement-Jones. I hope I can persuade them that their amendments are no longer necessary, as the government amendments fully address the concerns of both the Information Commissioner’s Office and the DPRRC.

As the noble Baroness has explained, the amendments in their names seek to ensure further consistency with the ICO’s codes and to strengthen the role of those codes in the regime set up by Part 5, as well as providing for greater parliamentary oversight of the Government’s codes, and I believe that we are now there. The Bill already requires that codes of practice issued under Part 5 of the Bill must be consistent with the ICO’s data-sharing code of practice. The government amendments further require persons to have regard to the ICO’s codes on privacy impact assessments and privacy notices, transparency and control when exercising relevant powers under Part 5. So we are now referencing all the codes which the ICO felt were critical for the operation of Part 5.

Of course, this is not the first time we have discussed amendments that seek to strengthen enforcement of the codes of practice by requiring authorities that use the powers of determined specified bodies to “comply with” rather than “have regard to” these codes. The Government’s position remains that “have regard to” is the right weight to give to codes of this type. That is itself a legal obligation, as the noble Lord, Lord Collins, noted. Moreover, the public law will expect those who are subject to the codes to follow their stipulations unless there are cogent reasons why they should not. We note that the Information Commissioner’s own codes are themselves advisory. A requirement to “comply with” the codes could lead to their being applied in a tick-box fashion, without due regard to whether the recommendations are actually applicable to and desirable in the context of the specific data share.

On the issue of adding additional persons to the consultation obligations for the codes, since Ministers have committed before Parliament to consult publicly on the Part 5 codes of practice, we suggest that such a requirement is unnecessary. The present provisions reflect what the noble Baroness noted to be the normal position.

Finally, on parliamentary oversight, the Government’s amendments fully implement the DPRRC’s recommendations, including, exceptionally, the use of the affirmative procedure for the first codes and the draft negative procedure thereafter. They go further than the noble Baroness’s amendment, and I hope that that will be welcomed by all noble Lords. I therefore invite the noble Baroness not to press her amendments.

[Baroness Hamwee]

My Lords, I thank the Minister for that response. I had forgotten to say that I was glad to see the government amendments about the affirmative procedure—it was because of looking at those that we got those two stray amendments that were tabled in error.

The noble Lord, Lord Collins, is absolutely right about the codes of practice. I simply say, before begging leave to withdraw, that it will not be possible for amendments to be made once the codes are put formally to Parliament. That is why wide consultation and—I do not like the term—an iterative process is very important on what will be significant documents. I beg leave to withdraw my amendment.

--- Later in debate ---

Moved by

[Lord Keen of Elie]

25YYH: Clause 31, page 31, line 1, after first “objective”” insert “, in relation to a specified person,”

--- Later in debate ---

[Lord Collins of Highbury]

My Lords, I hesitate before intervening in this group of amendments because, the last time I intervened, my noble friend said that I must be slightly confused, as I was talking about electoral rolls, bread rolls and toilet rolls. We are, of course, conflating a number of issues in this group, but I think that there is a really good point. My noble friend has raised an important area where the public good can be served not by sharing confidential information but by ensuring the availability of information that will serve a specific purpose in relation to fuel poverty. We on these Benches are very sympathetic on that point. In Committee we tabled amendments on the common-law duty of confidentiality, and the noble and learned Lord responded to those amendments. The only point I would make now is that it is vital that medical records remain confidential. They contain information that can affect not only people’s health but their access to jobs and to insurance. Access to a whole range of things is at risk if it is felt that this information will not remain confidential. Of course, the consequence of that is another public health issue, because if people do not have confidence that their records will remain confidential, they will not go to their doctor, they will not tell their doctor and they will not seek the treatment that they perhaps should. So there is a very strong case here.

One other point—it is not related to this group of amendments so I ask for forgiveness—is that there is a balance between maintaining confidentiality and security. Many of the problems in the health service, and why people lack confidence in it, are not about policies and procedures but about the health service’s ability to maintain a secure IT system. I hope the noble and learned Lord will be able to address those issues. The assurances that my noble friend has sought about future ability are really important. The ability to communicate—not the details of people’s confidential records but one government department to another and one public agency to another, to serve a very clear public need—is vital.

[Lord Keen of Elie]

I am obliged to noble Lords, and in particular I thank the noble Lord, Lord Whitty, for his continued interest in this area and for taking the time to meet and discuss this matter at some length with me and the Bill team. Clearly, as the noble Lord, Lord Collins, observed, this is an important part of the fuel poverty agenda. That is why it takes on such considerable importance even when faced with issues such as medical confidentiality.

On the point about common-law confidentiality, and medical confidentiality in particular, it is not an absolute; there are already statutory gateways through which information can and must flow on occasions, and therefore one must not take it that medical confidentiality is somehow completely ring-fenced and separate from the world that we actually live in. There are circumstances where there should be, has to be and is disclosure. It may be possible—I put it no higher in terms of this Bill—to address a further gateway. However, one should not confuse any mechanism within the Bill with the consequences of human or IT failure, however regrettable they may be. I agree with the noble Lord, Lord Collins, that one has to have regard not only to the structure within which information is shared but to the need to ensure that the sharing process is itself secure. But they are separate issues.

The noble Lord, Lord Whitty, acknowledges that some parts of his amendment may not be necessary. Amendments 27 and 28 would provide that information can be shared with licensed electricity and gas distributors for the provision of fuel poverty assistance. They can already be added to the data-sharing arrangements in Clause 32 by regulations. The Government will consider whether to exercise this power in the context of considering the future role of electricity and gas distributors in delivering fuel poverty schemes. I reassure the noble Lord that the provision made by Amendment 26 is already covered by Clause 31, which provides powers to share information for,

“the improvement of the well-being of individuals or households”.

Of course, this includes,

“their physical and mental health and emotional well-being”.

While we do not consider the noble Lord’s amendment necessary in this instance, the objectives that he highlights are an example of how in appropriate circumstances information held by healthcare providers could, in future, be valuable to support the more effective delivery of public services to those in need. It underlines why the Government are unable to accept Amendments 28AV, 28AW and 28AX, tabled by the noble Baronesses, Lady Finlay and Lady Hamwee.

The Government do recognise the particular sensitivities with identifiable health information, as highlighted in the National Data Guardian for Health and Social Care’s recent review of data security, consent and opt-outs. Health bodies in England are therefore not included in the list of bodies now in the Bill that will be permitted to use these powers. However, as the noble Lord, Lord Whitty, noted, health issues are a key factor in the complex social problems faced by people, whom we are aiming to support with these powers. Excluding the use of identifiable health information altogether would remove the possibility of including such information in the future without amending legislation. It would be premature to take this step in advance of the implementation of the National Data Guardian’s review and the public consultation that that will engage.

An amendment to maintain the common-law duty of medical confidentiality is not considered necessary. Those powers enable information to be shared only where it is already held by specified persons, acquired in a different context from the patient-doctor relationship. Any information that would have been subject to medical confidentiality would have found its way into a specified person’s hands only through an existing gateway. As I indicated earlier, there are already statutory gateways through which such information can move. Of course, we are dealing with permissive powers.

At this late hour, I will attempt the impossible: to satisfy the interests of all parties in the context of these provisions. Beginning with the inquiry from the noble Lord, Lord Whitty, health bodies are not presently included in the schedules. As drafted, it would be possible for health bodies to be added to the schedules at a future date but—and I emphasise this—no decision will be taken until, first, the Government publish their response to the Caldicott review and any recommendations have been embedded and assessed; secondly, there has been a public consultation on the issue and the views of the National Data Guardian and appropriate representative health bodies such as the GMC and BMA have been sought; and, thirdly, there has been a debate in both Houses pursuant to the affirmative procedure required to add bodies to the schedule. I hope that that reassures the noble Lord, Lord Whitty, that it can be done, although it has yet to be done, and that there are steps that we will take to reassure the noble Baronesses, Lady Finlay and Lady Hamwee, before any such step is implemented.

If health bodies or information were to be expressly excluded in the Bill, it would require primary legislation to enable those bodies to share information under the powers. If and when we decide that it would be helpful to have those powers—in implementing the fuel poverty initiative, for example—it would be most unfortunate if we were delayed by literally years before we could actually achieve the objective, when in fact there is provision here to do it by way of the affirmative procedure so that both Houses have ample opportunity for debate.

If we take those steps, there will be safeguards. When considering whether to add any health bodies to the schedules in the public service delivery, debt and fraud chapters, clear safeguards will apply. First, before a new body may be added to the schedule, it must show that it fulfils the relevant criteria relating to that specific power designed to ensure that only bodies with relevant functions for holding or requiring information relevant to that particular power may be added. The Minister must consider the procedures in place for secure handling of information before any new body can be added to the schedule—a point raised by the noble Lord, Lord Collins. A decision will be taken on whether it is in the public interest and proportionate to share identifying health information in order to achieve a specified objective. There would be no question of simply sharing this information more widely. The powers must be exercised in accordance with the Data Protection Act, which requires that only the minimum information necessary to achieve the objective may be shared. Under the Bill—and under the Data Protection Act—personal information may be used only for the purpose for which it was shared and data must be stored securely to ensure compliance with that Act. Again, this point was raised a moment ago.

Identifying health information will constitute sensitive personal data and so to ensure fair and lawful processing, it must fulfil one of the more onerous Schedule 3 conditions as well as the Schedule 2 condition under the Bill. In addition, new criminal sanctions have been included for wrongful disclosure with a maximum penalty of up two years’ imprisonment, a heavy fine or both. Further steps can of course also be taken to remove a body from the schedule if it does not comply with the requirements of the Act.

I do not suppose that I have satisfied anyone with that explanation at the end of the day. But, if nothing else, I hope that it has assisted in informing your Lordships as to why we consider that these amendments are not appropriate and that it would be appropriate to retain the ability to introduce health bodies by way of appropriate regulation. We feel that there will be appropriate safeguards and extensive consultation before any such step is taken, so I invite the noble Lord to withdraw his amendment.

[Baroness Finlay of Llandaff]

May I ask for clarification over one issue? Would a statutory instrument, when brought forward, envisage adding health bodies to the Bill in a blanket way, or would it be envisaged that there would be statutory instruments for specific purposes, such as health bodies for the purposes of identifying fuel poverty, and that when something else emerged it would require a separate statutory instrument so as to keep that gateway as narrow as possible?

[Lord Keen of Elie]

With respect, we clearly intend to maintain any gateway in as narrow a manner as is reasonable. The point that the noble Baroness raises is really a question for another day. We are not there yet; health bodies are not included in the schedule. If and when it is contemplated that they will be, there will be extensive consultations on the very issues that she raises.

[Lord Whitty]

My Lords, I thank the Minister for his ability to deliver a compromise position between what appeared to be diametrically opposed attacks in this group of amendments. He has done very well and almost satisfied me—I thank him for that and for his previous discussions.

Clearly, my amendments envisage a fairly narrow gateway, and in her latest remarks the noble Baroness, Lady Finlay, was responding to that. I am very grateful to the Minister for his assurance that the procedure could add health authorities and health bodies to the list in specific circumstances. When we come to the statutory instrument phase, I am arguing for only a relatively narrow inclusion, which may well be carried by the form of the statutory instrument which we eventually have to consider. I also recognise that the Minister has to await the outcome of these other considerations.

On the other hand, I would impress on the Minister that fuel poverty is a really big issue and that the lack of communication between the health and social security sides, and the other interventions, has proved a major inhibition in tackling fuel poverty. The information to be shared is in two directions. It would also allow a medical GP, for example, to access DWP information as to whether people in a household qualified for help. It is not simply a matter of disclosing medical information; it is one of ensuring that the medics actually understand the broader context of the household with which they are concerned.

I thank the Minister for his help in this direction. We will no doubt return to this at some subsequent stage but in the meantime, I beg leave to withdraw.

--- Later in debate ---

[Lord Stevenson of Balmacara (Lab)]

Briefly, the ground has been well covered by the noble Lords, Lord Foster and Lord Aberdare, and I have little to add. Three things strike me. I recalled in Committee that this was one of the areas where we had received the most external notifications and correspondence. It is still something that we need to take carefully. As has just been said, it is surprising that almost the entirety of the industry affected by the judgments of Ofcom have joined up to make the case.

Following on from both speeches, what is required is a statement from the noble and learned Lord. I am sure he is straining at the leash to give us all another compromise solution that will do the trick. He is shaking his head; maybe there are other things he has to cover as well. However, the situation seems to hinge on whether Article 4 of the EU directive applies sufficiently well after this Bill goes through, as before. Yet, as has been mentioned, there will be an opportunity, presumably in the great repeal Bill, to cover exactly this point. So what is the hurry?

[Lord Keen of Elie]

My Lords, I am obliged to noble Lords. As the noble Lord, Lord Stevenson, observed, there have been quite a lot of external communications on this. Indeed, I notice that the quotation that the noble Lord, Lord Foster, gave on my observations in Committee was identical to that quoted in a letter from Towerhouse LLP to the Department for Culture, Media and Sport on 17 March. Everybody seems to be singing from the same hymn book.

At present, Section 195 of the Communications Act 2003 requires that appeals against Ofcom’s regulatory decisions are decided by the Competition Appeal Tribunal on the merits. I shall come back to “on the merits” in more detail in a moment.

Appellants argue that appeals “on the merits” should allow for a bottom-up review of the decision, inviting the tribunal to substitute its own view for that of the regulator—in effect, two tiers doing the same thing. Appeals are therefore seen as an opportunity to rerun arguments that were considered and rejected by Ofcom in reaching its decision, or to put forward swathes of new evidence to persuade the tribunal to reach a different decision. Such appeals can lead to extremely lengthy and costly litigation, with extensive cross-examination of experts and witnesses. This depletes the regulator’s resources and means that other regulatory action by Ofcom is inevitably delayed, allowing for the potential for providers to frustrate the regulator with speculative or even spurious appeals, causing considerable uncertainty in the market and delay to other regulatory decisions.

The Government consider that appeals in the communications sector need to be rebalanced to ensure that Ofcom is held properly to account for its decisions, but also enabled to regulate in an effective and timely manner in the interests of citizens and consumers, as it is required to do. Clause 80 does just that; it requires that instead of merits appeals, the tribunal must decide appeals against Ofcom’s decisions by applying the same principles as would be applied by a court on a judicial review. Judicial review is generally a well-understood standard of review against which very significant decisions made by most public bodies are tested. Importantly, this will ensure that appeals are focused on identifying errors in Ofcom’s decisions, rather than simply seeking to persuade the tribunal to reach a different conclusion.

Those affected by Ofcom’s decisions will remain able to challenge them effectively. In Committee, the noble Lord, Lord Clement-Jones, said that judicial review was,

“solely concerned with whether the decision is unlawful in a technical sense—that is, was the correct process followed?”.—[Official Report, 8/2/17; col. 1734.]

I hope I can reassure him that this is simply not the case. First, appellants are able to argue that Ofcom’s decisions are based on material errors of fact or law. Material errors will therefore be identified and corrected in a judicial review process. Secondly, judicial review is a flexible standard of review, which allows the court to decide on the appropriate intensity of review according to the individual circumstances of the case. For example, there may be more intensive review processes in the context of matters pertaining to human rights. In particular, Ofcom has various statutory duties to ensure that its decisions are proportionate—in other words, that they go no further than is appropriate and necessary to attain a legitimate aim. In reviewing whether a decision is proportionate, the courts can carry out a closer and more rigorous review of the decision.

Of course, appeals in the communications sector are required to ensure that,

“the merits of the case are duly taken into account”,

as a matter of EU law under Article 4 of the EU framework directive. That will remain the case under a judicial review standard. I understand that there is uncertainty about the extent to which requirements in EU law may become a part of UK law after the United Kingdom leaves the EU, but that will be a matter for Parliament to determine when the great repeal Bill is introduced, as the noble Lord, Lord Stevenson, observed, and will be looked at in the context of the overall future regulatory framework for electronic communications, including the appeals regime, once the UK has left the EU.

A number of Ofcom’s regulatory decisions are already appealable only by way of judicial review, and the Court of Appeal confirmed as long ago as 2008 that judicial review is capable of taking account of the merits of the case, as required by EU law and, in particular, by Article 4 of the EU directive. Lord Justice Jacob in the Court of Appeal in the T-Mobile case in 2008 said that it,

“is inconceivable that Art. 4 in requiring an appeal which can duly take into account the merits, requires Member States to have in effect a fully equipped duplicate regulatory body waiting in the wings just for appeals. What is called for is an appeal body and no more, a body which can look into whether the regulator had got something material wrong”.

He also held that,

“there can be no doubt that just as JR was adapted because the Human Rights Act so required, so it can and must be adapted to comply with EU law and in particular Article 4 of the Directive”.

Indeed, in a more recent case involving judicial review and Article 4 in 2016, Mr Justice Cranston observed that, as the Competition Appeal Tribunal had said:

“Ofcom enjoys a margin of appreciation on issues which entail the exercise of its judgment”,


and that,

“the Tribunal should apply appropriate restraint”.

It is not a second-tier regulator, and the fact that it might have preferred to give different weight to various factors in the exercise of a regulatory judgment would not in itself provide a sufficient basis to set aside Ofcom’s determination. It should not interfere with Ofcom’s exercise of a judgment unless satisfied that it was wrong.

These are the relevant judicial review standards that will be applied in these circumstances. We do not want a complete retrial—if I can call it that—or a situation in which, at two levels, we begin at the beginning and end at the end with an entirely different opinion and approach to the evidence, and, perhaps, entirely new arguments being advanced evidentially in support of the merits of a case. That is a never-ending process and is not common to any other area of regulation by a public authority.

The judgments I have referred to have been considered in a number of subsequent cases and it is clear that a judicial review standard is consistent with the requirements of Article 4 of the framework directive. In these circumstances, it is not considered that there is any real need for this amendment. It is appropriate that we proceed with Clause 80 and I therefore invite the noble Lord to withdraw the amendment.