Data Protection Bill [HL]

Lord Stevenson of Balmacara Excerpts

Committee: 1st sitting (Hansard - continued): House of Lords
Monday 30th October 2017 Lords Chamber

[Baroness Manningham-Buller (CB)]

My Lords, it is late and I have little to add to what my noble friend Lord Patel said. I declare an interest as chair of the Wellcome Trust, and I was also closely involved with Imperial until conflicts of interest preventing my going on. I have a lot of sympathy with those who spoke earlier on the issue of fundraising for universities. I speak tonight briefly about the concern I raised on Second Reading: the Bill as drafted just does not offer the clarity we need for people dealing with medical research in universities and other institutions, such as the Crick Institute.

The noble Lord, Lord Patel, amply illustrated the value of such research in understanding fundamental disease, the efficacy of treatment, and following on and learning from big datasets which give us the power to do things in medical research that were once not possible. We are not looking for medical researchers to be given particularly special treatment—there are quite a lot of exceptions here anyway—but to clarify what they are doing and how, so they can do it safely and with confidence.

I come back to where the noble Lord, Lord Patel, started. Researchers need to be able to do this work to improve global health—the health of everyone. Health does not stop at boundaries. Results are shared and we all learn from each other. We heard examples from the noble Lord. In a more parochial sense, this is a critical part of the industrial strategy we need to implement to deal with the economy post-Brexit. That document said that we have to streamline our legal and ethical approvals for medical research. This is one of the ways to get economic growth, so over and above the health aspects, there are strong economic reasons for being sure we can provide absolute clarity for people doing this sort of work. The consent issues are not straightforward but provided there are other safeguards—proper ethical committees and proper supervision—I think we can get there. However, we need to say a bit more in the Bill so that people are confident that they can do this.

[Lord Stevenson of Balmacara (Lab)]

I am conscious that we have had had a full and interesting introduction to this group of amendments from the noble Lord, Lord Patel, which builds on earlier discussions. It was difficult to get into this debate without having a little more than he was able to give us—and I do not want to push him too hard on this, but it would be helpful to hear a bit more about ethical committees.

As I understand it, the argument is a three-pronged one. An additional point was made about the need to think about the industrial strategy and not to hold back the research that will be influential in driving forward our brilliant life sciences. But the issue here is whether we could have a parallel system, changing the nature of the public interest test as described by the noble Lord, Lord Patel, and relying on an agency basis. We are calling that an ethics committee, which will basically take on the burden of determining what is appropriately done outside the narrow scope of the Bill as drafted. It would provide the measures of assurance that the Bill seeks, because it deals with a particular type of operation that would not fit naturally into the GDPR more generally. That is the main burden of the argument. I need a bit more information on how the noble Lord sees ethics committees more generally taking on that burden; perhaps he could share that with us.

--- Later in debate ---

[Lord Patel]

I shall respond to some of the points raised. First, on the research ethics committee, we established through legislation—and I remember the debates that we had—a national Research Ethics Committee to deal with all applications for biomedical research, but particularly research involving patient data and transfer of data. If I as a clinician want to do a trial, I have to apply to that committee with a full protocol as to what consent procedures and actual research there will be, and what will be the closing time of that consent. If I subsequently found the information that I had could lead to further research, or that the research that I had carried out had suddenly thrown up a next phase of research, I would have to go back to the committee and it would have to say, “Yes, that’s part of the original consent, which is satisfactory to progress with the further research”. It is a robust, nationally driven, independently chaired national ethics committee, apart from the local ethics committee that each trust will run. So the national ethics committee is the guardian.

Furthermore, there is a separate ethics committee for the 500,000 genomes project, run by the Wellcome Trust and other researchers; it is specifically for that project, for the consent issues that it obtains, the information given at the time when the subject gives the consent and how the data can be used in future. The genomes project aims to sequence all the 500,000 genomes, and to link that genome sequence data with the lifestyles that people had and diseases that they developed to identify the genes that we can subsequently use for future diagnosis and treatment—and to develop diagnostic tests that will provide early diagnosis of cancers, for instance. The future is in the diagnostic tests. Eventually we will find them for diseases which have not developed but which have a likelihood of developing. Those diagnostic tests will identify the early expression of a protein from a gene and then find a treatment to suppress that expression well before the diseases develop, rather than waiting until the cancer develops and then treating it.

All this is based on the data originally collected. At this stage, it is impossible to know where that research will lead—that is the history—apart from the clinical trials which are much more specific and you get consent for them. I realise that there is a limit to how much the text of the Bill can deviate from the GDPR, unless it is dealing with specific issues which the GDPR permits member states to provide derogations for. I realise that, post exit, the UK will need an adequacy agreement and some equivalent, neutral recognition of data protection regimes between the UK and the EU. We need that for the transfer of data. For instance, the noble Baroness, Lady Neville-Jones, has talked about extremely rare diseases, which require the exchange of data across many countries because their incidence is low and no one country could possibly have enough information on that group of patients.

The research exemption does not undermine agreement on Clause 7—which is what the noble Lord, Lord Clement-Jones, was leading up to when he asked about the ethics committee. The noble Baroness, Lady Neville-Rolfe, suggested that medical research should be possible through the research exemption, but that has to be wide enough yet not specific enough to encompass wider exemptions. I hope that the Minister will come up with that trick in an amendment which he might bring forward. It will not be restrictive, yet protect the patient’s personal interest.

There is a research exemption for processing specific categories of data, including health data. The legal basis for this is through article 9 of the GDPR, referred to in Part 1 of Schedule 1 to the Bill. However, all processing of personal data also needs an article 6 legal basis: research is not exempt from needing this. I am arguing today that research needs that exemption, defined in wide enough terms. For processing special categories, you need both an article 6 and an article 9 legal basis. We need to have provision for both in the Bill. One of the article 6 legal bases is consent and I have explained why this is not suitable for much research. The other feasible route for universities and other public bodies processing personal data for research is public interest. This is why it is so important to be clear on what processes can use this legal basis.

There was serious concern about the likely impact of the GDPR on research as it was being drafted. However, this was successfully resolved and it provides the necessary flexibility for the UK to create a data protection regime that is supportive of research in the public interest. The Government, and other UK organisations, worked hard to make sure that this was the case. The provision is there: it is now for the Government to act on it. It is also important to seek an adequacy agreement post Brexit: we will have to have one. It will be vital to consider the need to retain, post Brexit, cross-border transfers of data for research. I give the same example of rare diseases as the noble Baroness, Lady Neville-Jones, used. The Government have recognised the value of retaining a data protection regime consistent with the EU, but the research community would welcome knowing whether it will seek a status of adequacy as a third country or an equivalent agreement.

The plea I make is that unless we include a provision, and there are exemptions which can be written in the Bill in the format that is required, we will not be able to carry out much of the research. A question was asked about the life sciences industrial strategy. It is the key pillar of the Government’s industrial strategy Green Paper. It relies on data that the NHS collects and the data that the science community collects and marrying up the two to produce, and lead the world in, treatments and developing technologies. If we are not able to do this, the whole thing will be unworkable.

[Lord Stevenson of Balmacara]

I am very grateful to the noble Lord for a very full response. It was quite a narrow question. I did not need all of that response but I have learned a lot more in the last few minutes—

[Lord Patel]

I thought that it might have been leading up to more.

[Lord Stevenson of Balmacara]

It might have been. The noble Lord has exposed a much greater issue than we thought we were grappling with. The case has now been well made that there are four pillars rather than the three that I adumbrated before. We seem to have a case for special treatment. I am sure that the noble Lord, Lord Patel, with his assiduous workload and high work rate will have made this point several times to officials and Ministers. However, if he is not getting the answers he needs, we have a bit of a problem here, so I hope that the Minister will be able to help us on that.

This goes back to an earlier debate about the public interest. It again worries me—I think the noble Lord, Lord Clement-Jones, touched on this—that “public interest” is becoming an overworked term for rather too many issues. In other words, the argument here is not about the public interest at all; it is about the public good that would come from a differential approach, safeguarded by the ethics approach—I said that was new to me and I am grateful to hear about it—and about reinforcing the contribution that would make to an industrial strategy covering a much broader range of understanding about what we are doing, thus making this country a world centre for all that. So there is a power behind this that I had not appreciated and I am grateful to the noble Lord for explaining it. It is easy to analyse it in this way and come up with the answer that he might want, but is it the right way forward on this?

The noble Lord was wise to point out that there are constraints within the GDPR and limits on what the Government can do, but it must be possible to think more creatively about the problem that has come forward. If, as the noble Lord said, the GDPR opens up the question of not requiring consent in that very formal sense, and we are looking for an evidence-led policy initiative which addresses the public good, it behoves Ministers to think very carefully about how one might take it forward.

This may or may not be the only issue that requires this sort of approach, but the case has been made on its merits that more needs to be done. Listing existing bodies that are not included, to put it in the positive, in a list of issues—for example, the administration of justice is a function of the Houses of Parliament—is not the way into this issue. I appeal to the Minister to think creatively about this because it seems to me that we need a new approach here. I am very convinced by that and look forward to hearing what the Minister says.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, first, I thank the noble Lord, Lord Patel, for his insightful remarks and for providing us with evidence of his knowledge of this subject, and of the Bill’s potential implications for pioneering medical research. I am grateful to him for sharing his expertise on these issues. I am also grateful to the noble Baroness, Lady Manningham-Buller, who speaks on behalf of the Wellcome Trust. Other reputable medical research organisations and universities have also expressed concern about this issue. I understand about the issue of consent and whether it is GDPR-compliant.

On the concerns the noble Lord raised in relation to Clause 7, I mentioned at Second Reading, and on a previous group of amendments, that the list of tasks in Clause 7 is deliberately designed to be indicative and non-exhaustive. When I wrote to noble Lords after that debate, I committed to make this clearer in the Explanatory Notes and the Government will honour that commitment.

The noble Lord, Lord Stevenson, mentioned that we might have to have a new approach to this problem. We are happy to think about these issues. At the moment we find that it is difficult to expand Clause 7 to cover every scenario where personal data has been processed in the public interest. Each addition to the list, however justified on its own merits, would cast greater uncertainty on the public interest tasks that continue to be omitted. However, I can reassure universities and research groups carrying out legitimate medical research, that, in the Government’s view, such tasks are in the public interest for these purposes. I will come later to how we take this forward.

--- Later in debate ---

[Lord Ashton of Hyde]

I believe also that even when consent is obtained, the worry is that it may not be subject to GDPR compliance, even if consent was acceptable before.

[Lord Stevenson of Balmacara]

I think we have already made the point and we do not need to come back to it. What I took from the noble Lord’s earlier contribution was that one way in which medical research is developed and carried out involves a consent process, and we would not want to change anything in that sense. However, for lots of reasons—the noble Lord gave three or four—you cannot always use consent. You may not want to go to the patient, or perhaps you cannot go to or find the patient. Alternatively, the noble Lord made the more general point that you often collect data without any real sense of where it might go in the future. We are not saying that any of that is good, bad or indifferent—one is no better than the other—but they all need to be considered in a broader understanding of the public good being best served by having the least restrictive system concomitant with appropriate procedures being in place. That is the line, with the ethics committee sitting at the top, that gets you to the point where that would be a fruitful conversation to have with Ministers.

[Lord Patel]

I must make the issue absolutely clear. If I did not do so before, I will set it out again slowly and carefully. Medical researchers are not asking to be allowed to do research without consent. They are asking for consent to be interpreted not in a narrow sense but in a sense that will allow research to continue with consent having been obtained. I shall give an example. When I chaired the UK Stem Cell Bank, we made it clear that consent would have to be obtained from those who donated stem cell material, including embryonic stem cells. Consent was given on the basis that the embryonic stem cells would be used for research to improve healthcare, but at that time it was not possible to say which healthcare.

Embryonic stem cells, properly kept, are immortal: they can survive for generations. There is a classic example of this. Most of your Lordships are familiar with the lady whose tissue was taken in 1950. Her name was Henrietta Lacks—hence the cells are called HeLa cells. These aggressive cervical cancer cells were taken from her in the United States without consent, but they still exist in every laboratory in the world. A billion dollars-worth of drugs have been developed and marketed using HeLa cells. If consent had been obtained, what would that consent have been for? Exactly the same applies to consent for stem cells—it is for the development of drugs.

Researchers are not saying that we should not have consent. They are saying that there ought to be an authority like the ethics committee that gives consent and to which you can go back and say, “By the way, I have that material and I have found more. I am still developing drugs but this is not the same”. I hope I have been clear about that. We are looking for exemptions that are wide enough.

Perhaps I may come back to the matters raised by the Minister and refer, first, to the public interest issues. I understand that the Government do not intend the functions listed in Clause 7 to be exhaustive and to allow, for example, research conducted by universities or NHS trusts to use the public interest legal basis. It would provide much needed clarity and assurance for the research community if that could be made explicit in the Bill. That, basically, is all we are saying on the public interest. There is currently a highly risk-averse culture in data protection, driven in part because people are unclear about the rules and about what they can or cannot do with that data and for what purposes. If it is made clear what they can do or where they have to go to make it clear, that will be helpful. This is why the public interest legal basis matters so much for research. The Data Protection Bill is an opportunity to set out very clearly the legitimate basis for processing personal data, setting out a clear public interest function for research that will give researchers the confidence to know when they are operating within the law.

I will now make a comment about what the Minister said about the safeguards. My Amendment 111 is to Clause 18, which prohibits the processing of personal data to support measures or decisions with respect to particular individuals. This is clearly problematic for any research that involves an intervention for an individual, which forms the bedrock of our understanding of a vast range of treatment of diseases. The range of law covering the use of personal data for research is complex, governed both by data protection law and common law, where duties of confidentiality toward the data subject exist. In my view, the implementation of GDPR through the Bill is an opportunity to provide clear information to researchers about the legal basis for processing personal data and the requirements of accountability, transparency and safeguards.

It is therefore essential that authoritative, comprehensive and unambiguous guidance is created to assist with this transition to a new data protection law. The Health Research Authority is working on guidance for health research, but researchers are urgently in need of this advice to ensure they are compliant by May 2018.

Those are my comments in response to the Minister. I am labouring these points today because this is the only opportunity I will have in Committee to debate these issues at length. I do not wish to rehearse this at Third Reading if we can resolve these issues by communication and find a way out.

--- Later in debate ---

[Lord Arbuthnot of Edrom (Con)]

My Lords, I shall speak only to Amendment 188, and I do so because, as so often, I am confused. In Scotland, a person aged 12 is presumed to have capacity to exercise rights under the Data Protection Act 1998, and that position is perpetuated in the Bill. How does that mesh with the general data protection regulations, which provide that consent to process personal data is lawful below the age of 13 only if given by a parent? I think that is the position and that is why I have tabled my probing amendment. Perhaps my noble friend could explain why Scottish children are so much more mature than English children.

I was persuaded by the view expressed by the noble Baroness, Lady Lane-Fox, at Second Reading when she said that we do not want to bring in lots of new and different laws for 13 year-olds and we need to recognise the reality that children will wish to do what their peers are doing. We do not want to incentivise them to tell lies online. So I am perfectly happy with the Government’s position on the age of 13 and just a bit bewildered about Scotland.

[Lord Stevenson of Balmacara]

As a Scot I can hardly complain, and I am always bewildered, too—not only about this but about many other things. Our Amendment 17 in this group is also one of bewilderment. Clause 8 is headed:

“Child’s consent in relation to information society services”,


and refers to “preventive or counselling services” not being included. This goes back to an earlier amendment, when we established that these references are actually recitals and not part of the substantive GDPR, so we are back in what is not normative language and issues that we cannot possibly talk about in relation to the wider context because we are talking about the law that will apply.

There are three points that need to be made and I would be grateful if the noble Lord would either respond today or write to me about them. The first is to be clear that the reference to “information society services”, which is defined, has nothing in it that would suggest that it is a problem in relation to the lack of inclusion of preventive or counselling services. The answer is probably a straightforward yes. Secondly, what are the preventive or counselling services that we are talking about? I think the context is that these are meant to exclude any data processing relating to a data subject if the data subject concerned—with parental consent if the subject is younger than 13 and on their own if they are older than 13—who is taking a form of counselling that may be related to health or sexual issues would not be allowed to be included. Is my understanding of that right? I am sure that it is.

Thirdly, could we have a better definition of preventive or counselling services because those are very wide-ranging terms? Yes, they come from a recital and perhaps in that sense they can be tracked back to earlier discussions around the formation of the GDPR, but they have to be applied in this country to situations in real life. I am not sure what a preventive service is and I should like to have it explained. Counselling services I probably do get, but do they include face-to-face counselling or is this about only online counselling services? Is it the same if the child is being accompanied by a parent or guardian? There are other issues that come into this and there is a need for clarity on the point.

While I am on my feet I should like to respond to the amendment moved by the noble Baroness, Lady Howe, who has campaigned long and hard on these issues. We would be bereft if she did not enter into this Bill with all its implications for children, given the wisdom and experience that she brings to the table. The point she makes is one of simple clarity. There is a need to be very careful about the evidence gathering on this issue and it is probably not appropriate for it to be left to Ministers in regulations. There needs to be a wider discussion and debate on the matter, perhaps involving the Children’s Commissioner and other persons with expertise. She has made her point very well and I should like to support it.

[Lord McNally (LD)]

My Lords, I associate myself with the amendment in the name of the noble Baroness, Lady Howe. We are in Committee and it is a probing amendment. When we discussed it with colleagues the feeling was that 13 might be the right age but, as the noble Baroness indicated, it needs probing and some thinking about.

There is a danger, particularly in a House with our age group, that we assume these technologies are understood by the young—even the very young. We all hear anecdotes of parents or grandparents who have to consult their eight year-olds on how to make various gadgets work, but that misses the point. A frightening amount of information is being freely given. I mentioned at Second Reading that my generation and my parents’ generation had thoughts of personal privacy that my daughter and her contemporaries seem to have no thought of. They are very happy to exchange information about themselves, what they do and where they are with gay abandon.

When we get to the very young it is very important to make sure—we will discuss this in later amendments, if not tonight—that there is sufficient understanding and information to make informed choices, otherwise we get into very dangerous territory indeed. Therefore we are, not for the first time, in the noble Baroness’s debt for raising these questions. Late as it is, it is right that we put on record that these things, along with the amendments that will follow in the next couple of groupings, need to be taken as a whole before we make a final judgment as to the right age.

Battle of Passchendaele

Lord Stevenson of Balmacara Excerpts

Thursday 19th October 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I start by congratulating the noble Lord, Lord Black, on securing the debate and on his very moving and excellent speech, which set the tone for what followed. All speakers have risen to the challenge to come forward with compelling, moving and very interesting contributions, and it has, in totality, been one of the best debates that I have heard in recent years. As many people have said, it has been a privilege simply to be here and to be part of it.

It is also an important debate, and it has benefited hugely from the fact that your Lordships’ House has the capacity to bring into its discussions military expertise, political knowledge, compassion and understanding from all sorts of experiences that we have had. Bringing those experiences together and allowing them to play into the analysis of the issues before us is what we are good at and is something that I hope we will continue to do. Of course, in so doing, it is rather wonderful that so many people are able to work in contemporary issues and reflect on how some of the lessons of the past can be applied in near real-time. I am sure that the Minister will want to respond to this in a vigorous way.

Your Lordships’ House has debated World War I and the troubling questions of how to commemorate it on a number of occasions. I have taken part in a number of these debates, and the early ones were really about how to ensure that the accent that we placed on the national programmes was focused clearly on remembrance and education and on lessons to be learned, particularly avoiding the danger of glorifying the war. It became clear during that process that the emerging conclusion was that our national programmes should be a commemoration, not a glorification: they should concentrate—as many noble Lords have said—not only on the military aspects of the war, but on its impact on Britain’s social history. They should recall, for example, the way that the industrialisation of death and the devastating scale of the military carnage wiped out a generation of our young men, and all the loss of potential that that implied; the contribution of women; the sacrifice of Commonwealth citizens; the contribution of artists and war poets, who have shaped the way that the war is remembered; and, as the noble Lord, Lord Black, mentioned, the animals that lost their lives as part of that process, which is something that we often forget.

There will, no doubt, be opportunities to reflect on how these years of commemoration have gone after the final event on—appropriately—Armistice Day in November 2018. I certainly look forward to that. I agree with the sentiments expressed widely round the House today that the Government have got the balance about right, and that—as my noble friend Lord Hutton hoped—we have not been divided politically or otherwise over how we have, as a country, commemorated this battle and the war more generally.

Having said that, I hope that it will be of interest to your Lordships’ House if I use my time today to reflect on the process in which we are engaged rather than to detail some of the particularities of the commemoration. My first task is to ask, how certain are we about what happened? In January 1936, nearly 20 years after he took part in the Battle of Passchendaele, the poet was asked to choose a poem to represent all of his war poetry—and there is a great deal of it—he chose this one. In it, he asks himself if he can remember the war and describes his feelings when those memories return, often masked by what he calls “mists”, which, he goes on to explain are,

“spiritual

And luminous-obscure,

Evolved of countless circumstance

Of which I am sure;

Of which, at the instance

Of sound, smell, change and stir”.

The closing lines capture well the duality of these memories:

“And some of sparkling, laughing, singing,

Young, heroic, mild;

And some incurable, twisted,

Shrieking, dumb, defiled”.

My point is that while contemporary accounts are, as we have heard, a brilliant way of reliving the events, they can only be, at best, a partial solution to what we seek to understand and remember. We also need to take distance and time to give substance to what would have been the so-called first draft of history. Explanation of memory is not just simply important as a means of understanding a survivor’s experiences; it is also one of the ways that we have of building our own knowledge of our shared past, complementing the dry histories and challenging art works that flow from these lived experiences. As, inevitably, the distance between ourselves and our children and the events themselves widens, so society’s responsibilities to our past become greater. We must impart, in our very act of learning, an obligation to the young to be inquisitive about this narrative and others.

Secondly, what precisely are we commemorating? As we have heard, Passchendaele symbolises all the horrors of trench warfare. Indeed, it has been described as the worst battlefield in history. We have heard about the loss of life, which is almost unimaginable: in three months, 350,000 allied and 260,000 German soldiers were killed. The conditions in which they fought, lived and died are really beyond contemporary understanding. Major Desmond Allhusen recalls in his diary:

“The mud and water reached our waists and it took us about half an hour to do a hundred yards … It was different from what we were used to. It had lost all form and consistency and all resemblance to the honest stuff one finds in peaceful lands. It was just the shapeless mess that remains when everything else is gone”.


Lieutenant General Sir Launcelot Kiggell, General Haig’s chief of staff, when he reached the edge of the battlefield, exclaimed, “Did we really send men to fight in this?”.

As I have been arguing, commemoration, in particular of a battle such as Passchendaele, must be multidimensional. It must be open to exploring the past not only through the lives of the individuals who experienced it but within broader continental and global contexts. Crucially, while we have a responsibility to seek the truth and to be inquisitive, we must be open to our own prejudices. If we can recognise our own preconceived notions, we will be best placed to get the most out of any commemorative act, whether it be a Paul Nash painting or a local council memorial—I would argue that both are as valuable as each other.

What about fake news, to bring it up to date? In the past few months, the threshold on accuracy and truth has being diluted and this could have important consequences for how we commemorate, if we allow the patterns of the present to impact the way in which we see the past. Perhaps the best antidote to such behaviour is to continuously renew our interest in our own past and not shy away from such debates, by being open to different types of commemoration as they come forward. I will return to that point at the end.

Truth, memory and commemoration are all inextricably linked. It is not just the responsibility of academics, teachers or even politicians to be mindful of this. The responsibility of interpretation should weigh heavy on all our minds. Edmund Blunden, the poet I quoted earlier, was acutely aware of how memory changes our understanding of war. It is therefore very important that we have commemorations that properly reflect that.

We need to interrogate what has worked well in the national programme and build that into our thinking and plans for any future commemorations. We have heard of local and national events and of the exemplary work of the Commonwealth War Graves Commission, which I also salute. We heard also from my noble friend—I am sorry, but I have forgotten her name and she is not in her place but on the Woolsack. She cannot do this to me—she is like a ghost, appearing all around the place. I thank her for drawing our attention to the work of the Heritage Lottery Fund, which has been so important in bringing out the bottom end of the spectrum, including a range of responses and detail from the individuals involved.

However, we need more than this. We need writing, films, plays, art and performances if we are to fully understand it. I used to use a film made by Charlie Chaplin to exemplify this point, and it perhaps works in this context. You can understand history by looking at records and films of, for instance, events in Germany during the time of Hitler. But you will understand it much better if you see somebody taking off that, as Chaplin did in “The Great Dictator”. It is that duality that brings us to the nature of the understanding.

I want to leave the House with this. For me, the most impactful commemoration event I have experienced was the astonishing work by Jeremy Deller, “We’re Here Because We’re Here”. Noble Lords may recall this work. The participants were a volunteer army of non-professional performers who were sworn to secrecy while rehearsals took place across the country without anybody really understanding what was going on. The intention, as laid out by Rufus Norris and Jeremy Deller, was to create the complete opposite of,

“a static memorial that the public went to to be sad”.

It was something completely and unnervingly different and it,

“would take itself to the public rather than the public taking itself to the memorial”.

I picked up a very good explanation of the work by the Guardian arts correspondent, Charlotte Higgins. She recorded the appearance of these people in Waterloo station one morning, saying,

“they were dressed in the dull-green uniforms of the first world war. They were just there: not speaking, not even moving very much. Waiting, expressionless, for who knows what. A small crowd gathered, taking photographs. A woman caught the eye of one of the men. She tried to speak to him. Without speaking or dropping his gaze, he pulled a small card out of his pocket and handed it to her. ‘Lance Corporal John Arthur Green,’ it read. ‘1st/9th Battalion, London Regiment (Queen Victoria’s Rifles). Died at the Somme on 1 July 1916. Aged 24 years.’ There were similar scenes across the UK … There were more than 1,500 men in total. They gathered on the steps of the Gallery of Modern Art in Glasgow. They smoked roll-ups outside Bristol Temple Meads and marched … boots ringing, through Manchester Piccadilly. They stood in clumps by the entrance to Queen’s University, Belfast, and sat on the market cross in Lerwick, Shetland”.

It was a silent reflection and it was so moving. In some ways, it said it all.

Brexit: Creative Industries

Lord Stevenson of Balmacara Excerpts

Wednesday 18th October 2017 Lords Chamber

[Lord Ashton of Hyde]

I certainly accept the remarks of my noble friend. For example, since film tax relief was introduced in 2007, 2,070 films have been made accounting for £8.9 billion of UK expenditure. Only recently, we introduced tax relief for children’s television programmes and theatre tax relief, and we hope to continue to do so.

[Lord Stevenson of Balmacara (Lab)]

The Minister mentioned the Bazalgette report, commissioned by the former chairman of the Arts Council, which we welcome. It is a wide-ranging view of what needs to be done in the creative industries to make sure they are a success. As a former Treasury Minister, the Minister might be interested in two or three of the points which play to his strengths, I am sure. Will he advise us of where we are on the review looking at whether the current HMT definition of R&D tax credits captures legitimate R&D activity in the creative industries, which goes back to the film tax point that has just been made? Will he also explain why the creative industries fail to get virtually anything from Innovate UK funding? Currently only 2% goes to the creative industries.

[Lord Ashton of Hyde]

The Creative Industries Council is reviewing the suggestions in the Bazalgette review, which we commissioned. There are many of these, the most important being the proposal for creative clusters. The council expects to come back to the department with its proposals by the end of the year. I am not sure why Innovate UK supplies only 2%. Nevertheless, as the noble Baroness, Lady Quin, said, the creative industries have been a tremendous success story and are growing at one and half times the rate of the rest of the economy.

Data Protection Bill [HL]

Lord Stevenson of Balmacara Excerpts

2nd reading (Hansard): House of Lords
Tuesday 10th October 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I thank the Minister for his comprehensive introduction to the Bill. I look forward to working with him, in what seems to be a never-ending stream of legislation from the previously rather quiescent DCMS. This is our sixth Bill together, and long may it continue.

The Minister mentioned his talented team joining him on the Front Bench—this is a joint venture between the DCMS and the Home Office. On my side, I am joined by my noble friend Lord Kennedy and supported by my noble friends Lord Griffiths and Lord Grantchester.

I congratulate the Bill team on the excellence of the paperwork that we have received—I am sure everybody has read it, word for word, all the way through; it is worth it. They are obviously ahead early in the “Bill team of the year” stakes, a prize which they won easily last time on the Digital Economy Bill, and they are building on that.

We also welcome the chance to debate the excellent House Of Lords EU Committee report, not least because of the substantial weight of evidence that it has brought to this debate, which I will refer to later.

This is a tricky Bill to get hold of, first because of its size and volume. It is a bulky package and it is not even complete because we are told to expect a large number of amendments still being processed and not yet available which may—who knows?—change it substantially. Even without that, it has 300 paragraphs and 18 schedules, one of which helpfully signposts the way that the Government intend to make changes to the Bill so that the GDPR becomes domestic law when we leave the EU, even though the amendments to make that happen will actually be made by secondary legislation. This is “Hamlet” without the prince.

The GDPR itself, which runs to 98 paragraphs—or articles, as it calls them—and which will be the new data-processing law that comes into force in May 2018 whether or not we in Parliament have agreed it, is not actually printed in the Bill. That therefore raises the concern that—post Brexit, courtesy of another, separate Bill, probably by secondary legislation—the regulations will become UK law without ever having been scrutinised by either House of Parliament. I wonder if other noble Lords share my feeling that this is a bad precedent and, if so, what we might do about it. I suspect that this decision might have made sense were we to stay in the EU but we are going to leave, so there is a gap in our procedures here. That is compounded by the fact that this is a Lords starter Bill that comes to us without the benefit of consideration in the other place, and particularly without the usual evidence-taking sessions that ensure that a Bill meets the needs of those affected by it.

I have a suggestion: given the expertise displayed in the EU Committee report HL Paper 7 that we are debating in parallel today, could the authorities arrange for that committee to look carefully at the Bill and at the GDPR in its printed form and arrange for that committee to bring forward either a report or simply a testimony about what the GDPR contains, how it is reflected in the Bill and how it works? It would help the House to do the job that we ought to be doing of scrutinising this legislation. I gather that the committee is due to meet shortly and perhaps the noble Lord, Lord Jay, who speaks in a few minutes, might respond if he can. I am sorry for embarrassing him if he is not prepared for that.

The Government claim that the Bill,

“will bring our data protection laws up to date”,

and,

“ensure that we can remain assured that our data is safe as we move into a future digital world”.

We will probe that rather florid assertion in Committee over the next few weeks, paying particular reference to the needs of business to have certainty about the rules that will be applied in this key sector of our economy in the medium and long term and the need for consumers, particularly vulnerable people and children, to be better supported and protected in this brave new digital world. What we are embarking on here is the precursor to the legislative nightmare that will accompany all our Brexit discussions. As we will hear from the noble Lord, Lord Jay, and others from the EU Committee who considered this, the key issues are what will happen if we leave the Common Market and the customs union, and whether there are any ways in which the Government can secure unhindered and uninterrupted flows of data between the UK and EU post Brexit. The report concludes that,

“any arrangement that resulted in greater friction around data transfers between the UK and the EU post-Brexit could hinder police and security cooperation. It could also present a non-tariff barrier to trade, particularly in services, putting companies operating out of the UK at a competitive disadvantage”. 

In his opening remarks, the Minister said all the right things about the Government’s commitment to unhindered and uninterrupted flows of data post Brexit, but the Bill comprehensively fails to set out how they plan to deliver that outcome. Worse, it may contain measures in Parts 3 and 4 that make it impossible to achieve the “adequacy” agreement, which is the only card that they have left to play post Brexit. You could not make it up.

Some 43% of EU tech companies are based in the UK and 75% of the UK’s data transfers are with EU member states. Even if the Bill successfully aligns UK law with the EU data protection framework as at 25 May 2018, that does not mean that the Bill makes proper provision for the future. On the UK’s exit from the EU, the UK will need to satisfy the European Commission that our legislative framework ensures an “adequate level of protection”, but achieving a positive adequacy decision for the UK is not as uncontentious as the Government think. Under article 45, the GDPR requires the European Commission to consider a wide array of issues such as the rule of law, respect for fundamental rights, and legislation on national security, public security and criminal law when it makes its decision. As has already been pointed out by several commentators, the current surveillance practices of the UK intelligence services may jeopardise a positive adequacy decision, as the UK’s data protection rules do not offer an equivalent standard of protection to that available in the rest of the EU. We will need to pursue this disjuncture in Committee.

The Government seem to have lost sight of the need to ensure continuity during the transition period and afterwards. Surely they must have measures in place to reassure businesses that they will pass the adequacy test and ensure “stability and certainty”, particularly for SMEs, as pointed out by the European Union Committee. If there was any doubt about the importance of this, I draw the attention of your Lordships to a briefing from the ABI which states that the ability to transfer data between firms in different jurisdictions is of particular importance to our insurance and long-term saving providers, who rely on data to provide their customers with the best products at the best price. The association goes on to say that:

“Losing the ability to access, and make use of, European and international data flows risks isolating the UK from the increasingly globalised market. Creating a system where UK insurers have to abide by dual or multiple regulatory systems in order to transfer data internationally will create inefficiencies, legal uncertainty, and risks damaging the global competitiveness of UK insurance”.


My second point was also raised by the European Union Committee. It is about how to establish sustainable longer-term arrangements, about which the Bill is remarkably silent. Even if the UK’s data protection rules are aligned with the EU regime to the maximum extent possible at the point of Brexit, once we leave the EU, policies will be developed within the EU 27 without our input. The EU will inevitably amend or update its rules either by new regulations or by case law derived from ECJ/EU decisions. This is of course a toxic issue for Brexiteers, but it needs to be addressed in the Bill and, no doubt, in many other areas. Perhaps a way forward here would be for the Information Commissioner to have a duty placed on her to make regulations which reflect the changes taking place in the EU, or the Bill could provide for some form of lock-step arrangement under which statutory instruments would be triggered when UK laws need to be amended. We will look at this again in Committee.

I turn now to data protection. Effective, modern data protection laws with robust safeguards are central to securing the public’s trust and confidence in the use of personal information within the digital economy, the delivery of public services and the fight against crime. Ensuring that the public can trust that their data is handled safely, whether in the public or the private sector, is important for everyone. If we cannot get this right in the Bill, people will not benefit to the fullest extent possible from the new data-handling services which are coming on stream now and in the future. We welcome the Government’s decision—a rather surprising one—to gold-plate some of the requirements of the legal enforcement directive, particularly the fact that the Bill will ensure that for the first time the data protection regime applies to the intelligence services. Indeed, as the Information Commissioner has observed, including these provisions in a single piece of primary legislation is welcome, although there is a need for much more detail about how this will work in practice.

My point on this is that there seems to be an imbalance in the Bill, with much more consideration being given to the rights of data subjects. At a time of increasing concern about the use and misuse of personal data, is there not a need for a broader and far more ambitious set of regulatory structures for data capitalism, as it is now called? The big tech companies have for far too long got away with the conceit that they are simply neutral platforms. They are not; they are active media and information companies, and their stock market valuations are based on the data flows they generate and how they can be monetised. With that role surely should come broader societal responsibilities, but the Bill does not go into this area at all. There is nothing about regulating fake news, no attempt has been made to ensure that data companies are covered by competition and other regimes which apply to media companies, and there are no proposals to deal with the allegations being made about undue influence by social media companies and others on politics and elections both here and in the US. We will certainly table amendments in this area.

On more concrete issues about the rights of data subjects, we have a number of issues to pursue, although today I shall concentrate on only three: children and the “age of consent”, the rights of data subjects in relation to third-party use of their data, and the proper representation of data subjects. I shall end with some thoughts on the Leveson report and its implications for this Bill.

The Bill proposes to set the age at which children can consent to the processing of their data through “information society services” which include websites and social media platforms at 13 years. That is a surprising decision and no credible evidence has been adduced to support it. Understandably, there is much concern about this low age limit, particularly as the general data protection regulation gives discretion in a range up to 16 years of age. Last month, the Children’s Commissioner for England said:

“The social media giants have … not done enough to make children aware of what they are signing up to when they install an app or open an account”.


These are often the first contracts a child signs in their life, yet,

“terms and conditions are impenetrable, even to most adults”.

I think we can all say “Hear, hear” to that. The commissioner also said:

“Children have absolutely no idea that they are giving away the right to privacy or the ownership of their data or the material they post online”.


Setting an age limit of 13, or even 16, would almost certainly be illegal under the UN Convention on the Rights of the Child, to which the UK is a signatory. Perhaps the Government could respond on that point.

The Children’s Society argues that if companies continue to rely on their current practices—whereby they allow only over-13s to have an account but have no age verification process to check that children who are consenting are the age they state themselves to be—then there will continue to be widespread breaches of both the companies’ own rules and this new Data Protection Act. In the Bill, it is unclear how breaches will be handled by the Information Commissioner and what penalties will be put in place for those companies failing to verify age properly.

There is also no consideration in the Bill about capacity, rather than simply age, or protection for vulnerable children. Although there are arguments for setting the age limit higher—or indeed lower—there is surely a need both for proper evidence to be gathered and for a minimum requirement for companies to have robust age verification systems and other safeguards in place before any such legislation is passed. We will pursue that. There is also the question of the overlap this derogation has with the right to be forgotten, which the Minister mentioned. That right kicks in only at age 18; we need to probe why that is the case and how that will work in practice.

During Committee, we want to check that the current rules affecting data subjects’ personal data are unchanged by the new laws. Taking the data of workers and prospective workers as an example, there are concerns about where personal data has been collected: it should be gathered, used and shared by employers only following affirmative, meaningful consent. The recent disgraceful cases of blacklisting come to mind in that respect, and we are also concerned about whistleblowers’ rights. The House has been very strong on that point.

Concern about the increasing use of algorithms and automatic data processing needs to be addressed, perhaps requiring recording, testing and some level of disclosure about the use of algorithms and data analysis, particularly when algorithms might affect employment or are used in a public policy context. Related to that is the question of the restriction on data subjects’ rights in relation to processing data contained in documents relating to criminal investigations. Here, we agree with the Information Commissioner that the provision, as drafted, restricts not just access rights but the right to rectification, the right to erasure and the restriction of processing. We welcome greater clarification on the policy intent behind this as we go into Committee.

We welcome the Government’s proposal for an offence of knowingly or recklessly re-identifying de-identified personal data without the data controller’s consent. The rapid evolution of technology and growth in the digital economy has led to a vast increase in the availability and value of data. There is a clear need for robust safeguards against misuse in this area.

On representation, we welcome the provision in article 80(1) of the GDPR which gives greater ability for civil society and other representative bodies to act on behalf of citizens and mirrors consumer rights in goods and services. However, article 80(2) contains a provision that the Government have chosen not to implement, under which consumer groups that operate in the privacy field can act on behalf of data subjects without a particular complainant. We think that this super-complainant system would help to protect anonymity and create a stronger enforcement framework. We know we are supported in that belief by the Information Commissioner.

The wider question here is perhaps whether data subjects in general, particularly vulnerable ones, have sufficient support in relation to the power of media companies that want to access and use their data. Does any of us know what really happens to our data? The Information Commissioner’s Office already has a huge area of work to cover and may struggle to cover all its new responsibilities. Having a better system for dealing with complaints submitted by civil society bodies may be a good first step, but I wonder whether we might think harder about how this will be organised—perhaps modelled on the Caldicott data guardians.

Finally, there has been a lot of debate since the publication of the Leveson report on the cultural practices and ethics of the press, particularly on the role of a future regulatory framework. There has been far less discussion on Lord Leveson’s recommendations to extend data protection regulation. I reassure the Government that we do not see this Bill as an opportunity to rerun many of the excellent debates or table amendments that we have already considered in your Lordships’ House in recent years. Of course, much remains to be done in this field, and the Government’s lack of action is a national disgrace and a flagrant betrayal of the victims who trusted them and gave them a once-in-a-generation chance to sort out the situation, which they have comprehensively failed to take. However, if amendments of this type come forward, we will consider them on their merits, although a better approach would be for an all-party consensus to try to bridge the gap once and for all between the press and Parliament. I hope to have further discussions on this point.

I give notice that we will table amendments which probe why the Government have decided not to bring forward the Leveson recommendations covering: exemptions from the Data Protection Act 1998, available for investigative newsgathering by journalists; extending the scope for statutory intervention over the press by the Information Commissioner; and changes to the power, structure, functions and duties of the ICO relevant to the press. We will also probe whether the Government intend to implement amendments previously made to Section 55 of the Data Protection Act by virtue of Section 77 of the Criminal Justice and Immigration Act 2008, which would allow terms of imprisonment of up to two years to be imposed for offences of unlawfully obtaining disclosure of personal data. As the Information Commissioner has previously noted, this has much wider application than just to the press, because there is an increasing number of cases of blagging and unauthorised use of personal data which must be stopped.

The Government have set themselves a very tight timetable to pass this Bill into law before the end of April 2018. We will support the main principles of the Bill, but, as indicated above, many areas need to be scrutinised in depth before we can agree to them. I hope that we can gather more evidence and find a way of bringing Hamlet back into the play by looking in detail at the GDPR before it becomes the law of the land. If data is the new oil, we owe it to the country and particularly our children to get this right and to get our laws fit for the digital age.

Digital Understanding

Lord Stevenson of Balmacara Excerpts

Thursday 7th September 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, in her excellent speech, the noble Baroness, Lady Lane-Fox, called herself a “dotcom dinosaur”. I beg to differ. I think she was suggesting that her time had passed and that she was a fading force in the scene. That is simply not true: she is a star. We all value the contributions she has made and continues to make in this area and long may she continue. In particular, her willingness to acknowledge the dark side of the digital world, such as poor employment conditions, cybercrime, cyberbullying, fake news and identity theft—I welcome the fact that that was also picked up by the former Minister—was very refreshing and gave a very good start to this important debate. If digital is now something we are, not something we do, she is right to suggest that we parliamentarians have a duty, as the noble Baroness, Lady Worthington, said, to understand this better and to do something about the problems that we perceive.

The theme which has come through most strongly this afternoon is that digitalisation has brought us both good and bad. As the noble Lord, Lord Rees, said, we have got information, convenience and entertainment but we also have sources of crime and loss of privacy. The price we pay for what is often called a “free” service—though it is certainly not that—is that we let companies, the Government and others learn all there is to learn about us. We have no control over who owns the data about us, no idea where they are kept and how they are used but, on the other hand, this flow of personal data leads to products and services that respond more quickly and precisely to our needs and can help give better value and improve productivity. That is why the noble Baroness may be right: as we live more of our lives online there is no doubt that we simply must improve our digital understanding.

The noble Baroness, Lady Kidron, and other noble Lords were right to warn us of the category error of confusing digital skills with digital understanding. However, it would be wrong if the Minister does not pick up in his response the problem of the need for basic skills to be properly funded and introduced across the country. The importance of infrastructure was so wonderfully explained by the noble Earl, Lord Cathcart, and the noble Baroness, Lady Murphy. I was going to deal with some issues to do with technical training and skills, but time has cut into that.

Two points have not had enough attention. The first is the need to make the UK a safe and secure digital economy. Ensuring safety and security is a role for government and it is important that we understand how this happens and what will work. The UK needs to aim to make itself the safest place for people to go online. Young people must be supported to develop digital resilience to navigate the online world safely. As the noble Lord, Lord Baker, said, there is a huge amount of catching up to do in this area under the Department for Education. There is good practice, but it is not nearly sufficiently well bedded.

The noble Lord, Lord Clement-Jones, talked about data ethics and the noble Lord, Lord Mair, touched on this in relation to the data—which underpin all parts of the UK’s ever-digitising economy—that need to be looked at much more carefully in order to get the most out of this revolution. There is another side to this, which has also been raised. A data-driven economy and its licence to innovate will work only if there is public confidence in which data are used and the ethical decision-making employed in using them. As has been noted, that is something which we will return to when we get on to the data protection Bill.

This has been an extremely good debate; one of the best that I have witnessed and been involved in in your Lordships’ House. It will serve as a taster for the Bill as it comes forward. I hope the Minister will be able to explain where we are on that and when we are likely to see a draft, because it would be quite interesting to see what it contains.

It has been said, and the noble Baroness, Lady O’Neill, was right to remind us, that we still have many issues around some of the points that are coming up here. We need to look at the powers which the Bill may contain to give people the right to ask for material on the net to be deleted; the power it may explicitly give to hold or withhold consent to our data being used; the power to protect our online identity by extending definitions of personal data and our right to contest decisions that are made about us by algorithms—a point that came up in some of the later contributions.

This has been a very interesting debate. I take from it that improved digital understanding will help us to benefit more from the good and make us less of a victim of the bad. At the end of her remarks, the noble Baroness, Lady Lane-Fox, suggested—and others have picked up on this—that a digital charter might help with the process of improving digital understanding. As we sit here, around us are the effigies—or perhaps I should say the avatars—of those barons who were involved in the original Magna Carta. They wish us well.