Healthcare (International Arrangements) Bill

Lord O'Shaughnessy Excerpts

Committee: 1st sitting (Hansard - continued): House of Lords
Tuesday 19th February 2019 Lords Chamber

[Baroness Thornton]

My Lords, I have an amendment in this group. I support the noble Lord, Lord Patel, and the noble Baroness, Lady Jolly. Clause 4 of the Bill provides the legal basis for processing personal information and data about patients to facilitate patient information and payments for reciprocal healthcare after Brexit—whether as part of an agreement with the EU, an agreement with a country outside the EU or in connection with contingency plans arising from a no-deal scenario. It also seeks to ensure that the key safeguards which should always be at the heart of systems that use and exchange patients’ sensitive personal and medical data are in place. The noble Lord, Lord Patel, is right to press this issue. It was almost the first thing that he and I spoke about when we talked about the Bill, which made me look at and ask why he and other noble Lords, particularly those in the medical profession, were very concerned about this.

At Second Reading the Minister acknowledged that there were deep concerns raised by noble Lords on data processing provisions in Clause 4, and promised to address them—but unfortunately she ran out of time on that day. We look forward to her catching up with that. We know that the noble Baroness has special expertise and experience in this field, so I look forward to hearing her talk about how she envisages the necessary robust standards, security and safeguards applying in post-Brexit healthcare deals with the EU and the rest of the world, and how those will be achieved.

In the Commons, my colleagues pressed this matter with the Minister, Stephen Hammond. He gave an assurance that the powers to access personal data would be limited, and committed at the time to provide a briefing. I wanted to raise that with the Minister—my colleagues in the Commons certainly have not received that, but I thought that she might raise it with her colleague and see what the briefing might have said. I am sure that we too would be interested to receive it.

When I raised this issue at Second Reading, I mentioned that I had been in touch with the National Data Guardian for Health and Social Care, who, as we know, has a vital role in ensuring that confidential healthcare data is used and shared appropriately in protecting the high standard of confidentiality. Pursuing that question is whether the Minister has been in touch and sought her guidance on this matter.

[Lord O’Shaughnessy (Con)]

My Lords, this has been an important discussion on an area that is, of course, of growing concern not just for people in Parliament but for the general public. Noble Lords will also know about my interest in this issue; we have had many discussions over the last few years about it. It is critical that we get this right, to allay any fears—because there are fears that attend to the use and movement of data for various purposes.

The noble Baroness, Lady Jolly, makes the point in her amendment about the Caldicott principles and so on. I was pleased from the Government’s point of view to be able to bring the National Data Guardian on to a statutory footing, as well as other measures that we took to provide that level of reassurance. My understanding is that these are all part of the scaffolding around the Data Protection Act, which is the GDPR as put into our legislation. They are a way of translating the general provisions of that into healthcare purposes. I ask the Minister to confirm that, because the Bill clearly states that the Data Protection Act is the governing piece of legislation here, it therefore follows that things such as the NDG, the principles and other things apply. They, in effect, derive from that and apply to all aspects of healthcare, including reciprocal healthcare.

[Baroness Jolly]

We are talking about exchanging health datasets, but in this world we are talking about our EU partners, the EEA and whoever else in the world we make a healthcare arrangement with. Are there mechanisms—this is a question I do not know the answer to—whereby datasets can be standardised so that any method of recording healthcare information that we might use would be recognisable to somebody in the States, Canada or France?

[Lord O’Shaughnessy]

That is an incredibly important point and it goes to the question that I was about to ask my noble friend. My reading of it is that it will not be possible for us to make reciprocal healthcare arrangements that involve the flow of data with another country unless we deem that country to be adequately complying with the GDPR. That is absolutely right and it is a high bar. It does not just provide a degree of regulatory compliance and standardisation; there are also international healthcare codes that underpin it, as the noble Baroness will know. It would be useful if my noble friend could confirm that, because it is clearly a really important point that will, in a sense, allay some of the fears that have been raised tonight about just how the powers in the Bill, once they extend beyond the European Union, Switzerland, the EEA and so on, might be used.