Data Protection Bill [HL]

Lord Tope Excerpts

Committee: 2nd sitting (Hansard - continued): House of Lords
Monday 6th November 2017 Lords Chamber

Moved by

[Lord Tope]

26: Schedule 1, page 112, line 10, leave out “the law relating to” and insert “for the purpose of”

[Lord Tope (LD)]

My Lords, it is a pleasure at last to move Amendment 26. I do not think that I will detain the Committee for very long on this relatively straightforward amendment. I was alerted to concerns about this matter by London Councils, which represents the 32 London borough councils and the City of London. London Councils operates services on behalf of the London boroughs on a non-statutory basis. It is concerned about the present wording of the Bill, particularly Schedule 1 and the part to which my amendment applies, which fails to consider non-statutory services in relation to the conditions that must be satisfied to meet the exemptions set out in Schedule 1.

In particular, London Councils provides the Taxicard service, which is a non-statutory subsidised mobility service for people with severe sight and/or mobility impairments. The service currently provides around 70,000 disabled, and in many cases vulnerable, Londoners with subsidised transport, for which eligibility is determined at borough level.

When applying for the service, applicants provide special categories of data to demonstrate their eligibility. London Councils is therefore data controller and processor of such data. The Taxicard service falls within the definition of social protection and is a social protection scheme as set out in EU regulation 458/2007—however, it is delivered on a non-statutory basis. The current wording of the Bill is ambiguous as to whether services such as Taxicard would comply with the exemptions set out in the Bill. Despite fulfilling the definition of “social protection” set out in EU law it is a non-statutory service in respect of UK law. As the Bill refers to,

“the law relating to social protection”,

there are concerns about the extent to which organisations such as London Councils can rely on the exemption.

Were the exemption not to apply to the scheme, London Councils would have to take measures to comply with the provisions of the GDPR. These would include periodically writing to all 70,000 members to ask their explicit consent to process their special categories of data. Given the particular cohort of members of Taxicard, it is likely that some will not understand or be sufficiently informed of the GDPR to know why they are being written to or, probably, not sufficiently capable or motivated to respond, given their underlying health conditions. In taking such measures there is a real risk that many disabled Londoners who currently benefit from the scheme would no longer be able to do so, because anyone who did not respond would have to be deemed to have withheld their consent. In such cases, London Councils would have to stop providing the Taxicard service.

I am quite certain that it is not the intention of the Government that that should happen; still less that the Bill should be the means by which it happens. I understand that London Councils met officials at the department some three weeks ago, so I hope that the Minister will be able to say, preferably, that he accepts my amendment this evening—victory is always pleasant, if unusual—but if he cannot, that he can at least give some comfort that the Government are cognisant of the problem, that they are working on it and that appropriate amendments will be made to this schedule to ensure that there is no question of any ambiguity. I beg to move.

[Baroness Chisholm of Owlpen (Con)]

My Lords, as the Minister said in responding to the previous group of amendments, in order for special categories of personal data, for example, data concerning health, to be processed, controllers must demonstrate that the processing meets one of the conditions for processing set out in Article 9. Article 9(2)(b) permits processing without the consent of the data subject where necessary for purposes of employment law, social security law and social protection law, provided that a legal basis is set out in UK law. Paragraph 1 of Schedule 1 therefore introduces the necessary processing condition.

The noble Lord queried whether the reference to “social protection law” could be removed in favour of a more general provision on social protection. I am aware that some local councils have raised concerns about whether some of the services they provide would be covered by the current wording. We are somewhat restricted by the wording of Article 9, which specifically refers to “social protection law”, so limited change is allowed. Nevertheless, I can reassure the noble Lord that the term has a broad interpretation. This is because paragraph 1(3) of Schedule 1 provides that “social protection” would include any intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament. I am sure all here read the regs every night, but for those who are not familiar with that regulation, Article 2(b) covers interventions that are needed to support people who may be suffering difficulties in relation to healthcare or sickness; disability; old age; survivorship; family and children; unemployment; housing; and social exclusion. Given the breadth of issues covered, I think it would be fair to say that the current wording of the clause would cover a wide range of social services interventions.

It is worth adding that social protection law is a new ground for processing special categories of data in the Bill. It was not included in the Data Protection Act 1998 as a specific category. From that point of view, it should be more helpful to social service providers than the previous provisions in the Data Protection Act 1998 on which they currently rely.

I recognise the concern that Taxicard is a non-statutory service and therefore may not be able to use the derogation in Part 1 of Schedule 1, which uses the term,

“law relating to social protection”.

As I have already illustrated, the Government’s intention is to apply this derogation broadly. There is no desire to see vital services, which are often a lifeline to their clients, stopped. I am happy to take away the specific issue the noble Lord raised and to work with the Information Commissioner and her office to consider it further. I hope that reassures the noble Lord, Lord Tope, and I respectfully invite him to withdraw his amendment.

[Lord Tope]

My Lords, I am most grateful to the Minister for setting that out so fully and clearly. As I think I said when moving the amendment, I am quite sure it is not the intention of the Government that the Bill should have this effect, but at this stage of any legislation we always have to be particularly concerned about any unintended consequences. I will seek advice from those better able to determine such matters than I am. I am grateful to hear from the Minister that the Government are cognisant of the issue and are considering it. If necessary we can return to it at a later stage of the Bill with appropriate amendments. I beg leave to withdraw the amendment.

Amendment 26 withdrawn.