(4 years, 7 months ago)
Westminster HallWestminster Hall is an alternative Chamber for MPs to hold debates, named after the adjoining Westminster Hall.
Each debate is chaired by an MP from the Panel of Chairs, rather than the Speaker or Deputy Speaker. A Government Minister will give the final speech, and no votes may be called on the debate topic.
This information is provided by Parallel Parliament and does not comprise part of the offical record
I congratulate my hon. Friend the Member for St Helens North (Conor McGinn) on securing this important debate.
Growing up in Sheffield in the 1990s, I took access to live music venues for granted, and we had access to not just some of the best venues in the country, but some of the best music in the country. When I was a teenager the Arctic Monkeys were starting to gig at the Grapes, the Boardwalk, and the Harley, as were bands such as Reverend and the Makers, Milburn and Longpigs. Sadly, not one of those venues still hosts live music today, but all those bands would say that without them it would not have been possible for Sheffield to produce the groundbreaking music that it is now internationally renowned for. I am told that when Radiohead toured with their debut album, “Pablo Honey”, they played 400 music venues of around 500 capacity across the UK. Only three of those music venues are still open today.
Those venues are the incubator of talent and we are feeling their loss across the music industry in the UK today. What is more, arts and culture funding too often gravitates towards prestige and towards London, rather than flowing towards talent. Jon McClure, the “Reverend” of Reverend and the Makers, said to me ahead of today’s debate:
“It is certainly true that the arts have become the preserve of the rich kids, for boys and girls like me are now excluded in the main, through a lack of access to the networks of power, combined with a lack of resources.”
That is why today’s debate is so important, as is the incredible work of UK Music and other bodies, such as the Musicians’ Union. They have fought to save threatened venues, which they recognise as the heart of a revival that must come.
I am incredibly proud to sit on Sheffield city region’s music board, which was set up by UK Music and our Mayor, my hon. Friend the Member for Barnsley Central (Dan Jarvis). It is the first to be set up outside London and is an essential part of the revival. It promotes work such as that of Higher Rhythm, which delivers the breakthrough artist development programme to give intensive support to six Yorkshire artists annually, with a package of opportunities to help them to make tangible progress in their careers. However, we must do more. We have heard about the importance of music education, and I hope that the combined authority will look at UK Music’s proposal to create six music education hubs across the region. We must ensure that the agent of change principle is properly implemented in all our communities, and the Government should look at extending existing relief schemes to cover live music venues.
Finally, no Government can claim to be serious about global Britain while cutting off our greatest cultural export at the knee in the Brexit negotiations, so I hope that the Minister will look carefully at the musicians’ passport. I want the kids in my constituency to have the same opportunities that musicians had in past decades. I want them to be rewarded based on talent, and not on networks or how many followers they can buy on social media. I want them to be able to showcase their talent on stages in Sheffield so that they can then showcase it to the world. Those things are not “nice to haves”. They are fundamental to our economy and culture, and they tell the world everything about what it is to be British.
(5 years, 5 months ago)
Commons ChamberThe Department has just launched the digital inclusion innovation fund, which has been specifically designed to tackle digital exclusion among older and disabled people. A few weeks ago I visited a 5G test bed in the Kensington part of Liverpool, where I saw at first hand how we are harnessing this technology to improve social care and tackle loneliness among older people.
The Offensive Weapons Bill bans the online sale of offensive weapons to residential addresses, but it has revealed a significant gap in the legislation around the sale of offensive weapons on platforms. Will the Secretary of State address that gap in the upcoming White Paper?
I will look carefully at the issue raised by the hon. Lady. Of course it is important that we closely keep track of where these weapons are being sold and the methods being employed. She would expect me to say that the online harms White Paper will focus on the responsibilities of the online platforms to keep people safe from harm. Harm varies, and we are concerned about a variety of different harms, but we will certainly pay close attention to the point that she has raised.
I assure the hon. Gentleman, who has long been properly concerned about this serious offending, that resource will not be a barrier to the prosecution of offences. We have seen an important sea change in attitudes to the complainants and victims of child sexual exploitation. Gone, I hope, are the days when young victims are disregarded or ignored by the authorities. The message has to go out that we will listen and act to protect victims.
Does the Solicitor General agree with the Chancellor that, rather than new money being spent, knife crime and serious and organised crime should simply be prioritised? If he does, which area does he think should be de-prioritised?
I assure the hon. Lady that it is not a question of choice when it comes to the prosecution of offences. I am happy to say that in the last year, more than 27,500 cases involving possession of a knife or bladed article were commenced in our courts. That is an important testimony to the seriousness with which the prosecuting authorities take the possession and use of knives and offensive weapons.
(5 years, 6 months ago)
Commons ChamberThere is a lot to be said for Bicester Village. I have been there many times, and I have an extremely agreeable Zegna tie that I purchased there some years ago. I am not wearing it today, but I will wear it for the benefit of the hon. Member for Banbury (Victoria Prentis) on another occasion.
Tourism is greatly boosted by our music industry. Sheffield’s musicians are renowned the world over, building their reputations on shoestring-budget European tours that are guaranteed because the movement of music equipment around Europe does not require a customs document known as the ATA Carnet. Will the Minister guarantee that musicians in Europe will not require such a document post Brexit, that the movement of music equipment will be frictionless and that the people of Europe will not be deprived of the Arctic Monkeys of tomorrow?
What I can guarantee is that my portfolio involves looking after the interests of musicians and orchestras. The Department does that by lobbying where appropriate and by discussing such matters with the Home Office, which is ultimately responsible for immigration issues. I met the Association of British Orchestras only last week. We are ensuring that musicians are looked after. They are an important part of our economy.
My hon. Friend raises a very important point. Since we introduced the law on coercive control several years ago the number of charges continues to increase. In 2016-17, 309 charges were brought, but last year that trebled to 960.
One of the main barriers to victims of domestic abuse and rape coming forward is the fear of having to hand their entire lives and personal information over to the defence. What steps is the CPS taking to ensure that victims are reassured that disclosure is appropriate and proportionate, and that victims are not asked to sign away their privacy?
The hon. Lady raises a very important point. Several months ago, the Attorney General and I issued a new paper on disclosure, and that will be followed by revised guidelines this year. We are acutely conscious of the need to balance the interests of justice not just in favour of defendants but in favour of victims. A blanket approach to disclosure is not something we encourage; it will depend on the facts of the case. I am glad that the number of cases that are being dropped because of issues with victims continues to fall, and I think that is a sign of progress.
(5 years, 9 months ago)
Commons ChamberUrgent Questions are proposed each morning by backbench MPs, and up to two may be selected each day by the Speaker. Chosen Urgent Questions are announced 30 minutes before Parliament sits each day.
Each Urgent Question requires a Government Minister to give a response on the debate topic.
This information is provided by Parallel Parliament and does not comprise part of the offical record
Following the news, there was widespread public support for the Sheffield Star, the Sheffield Telegraph and the excellent Yorkshire Post, and particularly for the staff who work for those papers. The Secretary of State said earlier that he believed that all those in receipt of a pension would be protected. There is concern that those in receipt of a final salary pension will not be protected when they move over to the new company. Can he provide clarity on that?
My understanding is that all those currently in receipt of their pension will not be affected by this change. As the hon. Lady will see, the Pensions Minister, my hon. Friend the Member for Hexham (Guy Opperman), is sitting next to me, and if that is incorrect, one of us will write to her to explain, but that is my understanding.
(5 years, 10 months ago)
Commons ChamberI could not agree more with my hon. Friend, who has been doing excellent work with the all-party parliamentary group on knife crime and has worked closely with the Youth Violence Commission. I know that this issue has been close to her heart ever since she was elected.
ACEs are traumatic experiences in a young person’s life that can have massive repercussions on an individual’s life chances. People who have grown up with four or more ACEs—only 9% of the population—are 10 times more likely to be involved in violence by the time they are 18, compared with the 52% of young people who have experienced no ACEs. Sustainable relationships can go some way to reducing the negative consequences of ACEs.
I congratulate my hon. Friend not only on securing this debate, but on her incredible work since her election in 2015 on pushing this agenda, including the public health aspect. Many people bandy “public health” around and use it to mean lots of different things, but the only way it can be successful is with a truly whole-system approach, meaning that every agency, from the police to schools to youth services, should take adverse childhood experiences into account. Does she agree that that consequently means delivering a trauma-informed approach?
My hon. Friend is absolutely right. We have had discussions about visiting trauma-informed schools, and we need a much bigger focus on trauma-informed approaches to understand both what they mean and the impact on young people who have experienced trauma.
Turning to some people who do understand that experience, the youth workers I have met completely understand the importance of building and maintaining relationships with the young people they work with. They know the positive impact that that can have on a young person’s life—especially a young person who may not have other adults in their life that they can rely on. They can be that positive role model. However, instead of investment in long-term sustainable relationships, we see piecemeal interventions—little pots of money invested in short programmes.
What can we do? Well, here are a few things that the Youth Violence Commission has recommended. We should develop a national youth policy framework, which would make the provision of youth work a statutory duty. We should ensure that any adult working with young people is professionally trained, especially in recognising signs of trauma. All youth workers should be trained in the same way as social workers. Policies and practices should be evidence informed and developed, and youth workers should be recognised, supported and respected in their field. We need to build young people’s resilience, ensuring that they can cope with and bounce back from adversity. We should provide positive role models and peer mentors to raise low aspirations and self-confidence.
The youth sector is currently an unregulated marketplace. While we want to see innovation, we also want to ensure that we hold youth work to nationally recognised standards. We need a much more consistent approach, with a focus on long-term results, not short-term interventions. Youth centres need to be open access and safe spaces for young people. It should go without saying, but key to youth work is listening to the voices of young people. It should not take a genius to recognise this, but the experiences and views of young people should be at the core of and inform the delivery of youth services. When the Youth Violence Commission conducted the safer lives survey, we asked young people, “If there was one thing you could change that you think would make young people safer, what would it be?” and the most popular response was the provision of more youth centres, sports clubs and other youth activities in their local areas.
I asked the Home Office to respond to this debate as well, because this is not a matter DCMS can tackle by itself, but I do have some questions I would like the Minister here to answer. Youth workers, teachers and police officers told the commission that the most dangerous time for knife attacks involving young people is between 3 pm and 6 pm—after school finishes and before parents finish work—but the Office for National Statistics, the Met police, the Mayor’s Office for Policing and Crime, city hall’s London Datastore, London ambulance dispatch data, the Centre for Crime and Justice Studies and the wonderful House of Commons Library were unable to get us data on the times at which knife attacks take place. When professionals in the field are consistently raising concerns about after-school attacks and grooming, why is this data not published? Will the Minister commit to obtaining the data and publishing it? Does she agree that after-school youth work and activities could help to keep young people safe?
I do not believe that we will ever reduce the level of violence without addressing ACEs. I worry that too many people in Parliament do not understand the impact of ACEs, although I am glad that the expertise of the right hon. Member for North Norfolk (Norman Lamb), who unfortunately is not present, informed our recommendations. Will the Minister commit to reviewing the impact of ACEs and developing a plan to reduce them? Will the Government commit to reviewing the funding model for the sector to ensure it is more collaborative and less competitive, so that we can deliver a regulated youth service that any young person can access, as and when they need it?
Many young people have said to me that they are treated like they are part of the problem when they should be at the heart of the solution. What consultations have the Government conducted with young people to find out what kind of youth provision they want? Finally, I sent the Minister a copy of the Youth Violence Commission’s interim report, and I was glad to hear that she has read our recommendations in detail. Will she commit to or comment on the parts of the report that relate to reforming youth services and the sector?
If the Government are serious about adopting a public health strategy, it is the responsibility of every Department to understand and address the root causes of violence. Youth services play a role in tackling youth violence, as do schools, councils, social workers, hospitals, mental health services, the police and every other service that touches the life of a young person. A genuine public health approach to violence must be cross-departmental and cross-party, so I hope the Minister will raise my concerns with her Department and her counterparts across Government. I look forward to hearing her response to my questions.
I am grateful to the hon. Lady for that. I am now something of an expert on cross-departmental strategies, having been the Minister responsible for the sports strategy, which involves 10 Departments, for the Office for Civil Society strategy, which involves numerous Departments, and for the forthcoming loneliness strategy, which covers nine Departments. I therefore completely appreciate and understand the important point she is making.
Although I might not know all the answers to the hon. Lady’s questions, I do know that this Government have no higher priority for young people than to keep them safe, which is why I am pleased to say that we broadly welcome the commission’s recommendations, some of which anticipated policy announcements we have since made. There is much that we can agree on: the roots to the problem of youth violence are complex and there are no quick fixes; the solution does not lie with any particular Department or single part of the community; and we need a systematic approach, backed by strong and consistent leadership. I am sure that we can all agree that the Home Secretary’s recent announcement on consulting on a new legal duty to underpin a public health approach to serious violence is welcome. That would mean that police officers, education partners, and local authority and healthcare professionals would have a new legal duty to take action and prevent violent crime. That statutory duty would make tackling serious violence a top priority for all key partners, ensuring that all agencies are working together to prevent young people being caught in the criminal cycle.
When I saw the Home Secretary’s announcement, I questioned how the situation would be any different from these people’s current responsibilities under crime and disorder reduction partnerships, which were introduced under the last Labour Government. I appreciate that this is not necessarily the Minister’s responsibility, but I would be grateful if she could elaborate somehow on how the duty would enhance existing responsibilities, which do require these people to work together to prevent crime.
I would not dream of inadvertently misleading the House by trying to respond to a question for another Department to which I would not know the answer. However, there is a Home Office official in the Box this evening, and they will be able to provide a written response to the hon. Lady’s questions. I am sure that Home Office questions are also just around the corner.
An essential part of the approach, as the report notes, will be to address early intervention. The bit of money I am responsible for—the £90 million dormant accounts money that was recently announced—and the £200 million youth endowment fund announced by the Home Secretary will help to address this issue. I am not pretending that they will solve the issues, but both are designed to provide long-term support and learning.
The commission also calls for a reform of youth services. I agree with a number of the points in that section of the report, including the finding that funding and services are fragmented and siloed. The House might have missed it, but in early August I published the civil society strategy, within which I committed to a review of the statutory duty for local authority youth services. If, following that review, the guidance needs to be strengthened, we will do so. However, this is not all about the Government, and that was very much acknowledged in the commission’s report. We need the public, private, social and faith sectors to work much more closely at a community level.
It is really important that the House gets to celebrate the positive role that youth work can play in keeping our young people safe. I recognise, as I am sure we all do, the transformational impact that high-quality interventions can have on all young people, but especially on those who are vulnerable to exploitation or at risk of making poor life choices. We value the role that community youth organisations have in building trust between young people and the wider community. They can play an important role in signposting and facilitating access to services and overcoming barriers to engagement. It would be foolish not to acknowledge that there have been cuts to local authority youth services, but there has also been substantial innovation in new forms of delivery—not least in the hon. Lady’s home borough, where Youth First, the mutual that delivers youth services in Lewisham, has received direct funding from the Department for Digital, Culture, Media and Sport to develop its capacity.
It is also worth acknowledging the support that the Home Office is giving to the “For Jimmy” project in three schools in Deptford as part of the Safe Havens programme. A trusted relationship with a responsible adult or peer, a safe space, and finding a “teachable moment” are key parts of the youth work approach and we support them.
(6 years, 5 months ago)
Public Bill CommitteesThe Information Commissioner has a breadth of corrective powers at her disposal to investigate breaches of data protection legislation. One such power is the ability to issue an information notice on a data controller requesting that they provide the commissioner with specified information. Article 2 of the general data protection regulation states that certain types of processing of personal data, including purely personal or household activities, are exempt from the provisions of the GDPR. That includes the list of all those hon. Members who deserve a Christmas card this year.
Although such processing is exempt, it is important that in certain situations the Information Commissioner is able to verify that the processing actually meets this test and does not fly under the radar of GDPR requirements unduly. Government amendments 51 and 52 will ensure that the Information Commissioner is able to issue an information notice, in order to determine whether the process is genuinely being undertaken in the course of a purely personal or household activity.
Government amendment 54 is a consequential amendment. It ensures that the reference to processing of personal data in the subsection added by Government amendment 52 means any type of processing, pulling on the definitions provided in subsections (2) and (4) of clause 3, rather than those under parts 2, 3 or 4, none of which apply to processing in the course of purely personal or household activities.
Government amendments 58 and 126 make further consequential changes to clause 159 and paragraph 9 of schedule 16. The amendments ensure that certain safeguards for controllers and processors in the context of enforcement action extend to all persons, since their exact status may in fact be the source of dispute.
All in all, this is a common sense set of changes that enjoy the full support of the Information Commissioner’s Office.
Amendment 51 agreed to.
Amendments made: 52, in clause 143, page 77, line 40, at end insert “, or
(b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.”
This amendment and Amendments 51 and 54 enable the Information Commissioner to obtain information in order to work out whether processing is carried out in the course of purely personal or household activities. Such processing is not subject to the GDPR or the applied GDPR (see Article 2(2)(c) of the GDPR and Clause 21(3)).
Amendment 53, in clause 143, page 78, line 23, leave out
“with the day on which”
and insert “when”.
This amendment is consequential on Amendment 71.
Amendment 54, in clause 143, page 78, line 30, at end insert—
“(10) Section 3(14)(b) does not apply to the reference to the processing of personal data in subsection (1)(b).”—(Margot James.)
This amendment secures that the reference to “processing” in the new paragraph (b) inserted by Amendment 52 includes all types of processing of personal data. It disapplies Clause 3(14)(b), which provides that references to processing in Parts 5 to 7 of the bill are usually to processing to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.
Question proposed, That the clause, as amended, stand part of the Bill.
In this of all weeks, it is particularly relevant that we debate this clause, which relates to information notices, and the powers and enforcement sanctions available to the Information Commissioner, given the horrendous breaches of our data regulation that have been exposed by Channel 4 and The Guardian.
The Secretary of State for Digital, Culture, Media and Sport told the House yesterday that the Information Commissioner was seeking further powers to compel compliance with information notices, testimony from other individuals in complex investigations, such as that into Cambridge Analytica, and criminal sanctions for breaches of information notices.
Under the current data protection legislation, breach of information notice is a criminal offence that carries a custodial sentence. The maximum sentence under this Bill is only a fine. That is a significant weakening of the data protection regime and its sanctions. Indeed, in her own evidence, the Information Commissioner said:
“The new approach in the Bill of failure to comply with an”
information notice
“no longer being a criminal offence but punishable by a monetary penalty issued by the ICO is likely to be less of a deterrent, as data controllers with deep pockets might be inclined to pay the fine, rather than disclose the information being requested.”
I would be grateful if the Minister could set out exactly why the Government have decided to weaken the powers given to the Information Commissioner and the sanctions available to her.
Crucially, the Information Commissioner has requested the power to compel compliance with information notices. As things stand, it is an offence not to deliver information, but the Information Commissioner does not have the power to demand compliance with information notices. She has said that that puts us out of step with our closest EU member state neighbour, Ireland, which has a much stronger data protection regime, with much tougher sanctions and, indeed, powers to compel compliance with an information notice.
That gap in the Information Commissioner’s enforcement powers has not caused significant problems up to now, because formal action has largely centred on security breaches or contraventions of the privacy and electronic communications regulations. In such cases, the commissioner rarely needs to use her information notice powers, because the evidence of a contravention is usually clear and in the public domain.
Where the Information Commissioner has used her enforcement powers against a data controller for contraventions of the data protection principles under the Data Protection Act, she has generally found data controllers to be co-operative because, under the current framework, financial penalties are reserved only for the most serious contraventions of the law. However, as investigations become more complex—and as we are seeing this week—the Commissioner will be unable to obtain the information she needs.
The Minister has said that the Government are considering potential amendments to the Bill, as laid out by the Secretary of State yesterday. It is baffling, however, that those amendments have not already been tabled, given that the Information Commissioner suggested them in her written evidence earlier in the process. The provisions represent a serious weakening of the existing regime and a failure of the Government to step up to the plate on the matter of the complex investigations conducted by the Information Commissioner.
I do not accept that this Bill represents a reduction in the powers of the Information Commissioner, and I do not think that that is her view either. Obviously, I accept what she said in response to questioning from Select Committee on Digital, Culture, Media and Sport. As I have already said, my right hon. Friend the Secretary of State is considering her request, and we are working on the areas where she feels there is a shortfall.
I reassure the Committee that the Bill strengthens ICO’s overall powers. The hon. Member for Sheffield, Heeley has mentioned fines. There are fines of up to 4% of global turnover, or £17 million, both for malpractice itself and for blocking investigations and inquiries mounted by the ICO.
Earlier, we debated the requirement for law enforcement agencies to conduct data protection impact assessments ahead of developing or using any new filing system, and we debated several examples of what those filing systems or methods of data collection could be, including automated facial recognition software, automatic number plate recognition and the use of algorithms to determine decisions made in the criminal justice system.
In relation to the clause, the Information Commissioner has requested that she be given the power to impose corrective measures where necessary, when a data protection impact assessment has revealed that the processing of that personal data is of high risk to individuals and where there are no measures to mitigate that risk in relation to law enforcement processing, as she has for other processing. She maintains that a different approach to law enforcement is not justified and might lead to adverse consequences in an important area affecting individuals. That is important because it gives weight to the important aspects raised earlier that require law enforcement agencies to conduct that DPIA. There is little point asking organisations and data controllers to conduct impact assessments and then, even when they are falling short dramatically, to let them carry on conducting assessments and collecting data in that way.
In evidence, the Information Commissioner has said that part 3 of the Bill
“requires these types of assessment to be undertaken”
and provides
“for requirements to consult the Commissioner where such a high risk is present but measures cannot be put in place to mitigate these. They also provide requirements for the Commissioner to use her corrective powers in relation to GDPR but the way the Bill is drafted these corrective powers will not be available in relation to concerns arising from a DIPA involving law enforcement processing. Nor are there any powers available to ensure that the Information Commissioner can take action if a DIPA for law enforcement processing is not carried out when required.”
Not only are there no enforcement powers if the DPIA is conducted and falls short, but the Information Commissioner is not provided with any powers under this legislation to compel a DPIA to take place. Given, as we discussed earlier, the serious threats not just to data rights, but to prevention with respect to an individual’s rights to liberty and freedom, it is very serious indeed if law enforcement agencies will be able to carry out impact assessments without any adherence to the provisions in the Bill.
The Information Commissioner says:
“Having the ability to issue corrective measures based upon the DPIA or indeed requiring a DPIA to be undertaken when it should have been, is an important measure which is missing in relation to law enforcement processing”.
The commissioner has raised her concerns with the Government and suggested drafting solutions. Will the Minister clarify why those were not introduced in Committee?
The clause gives the commissioner the power to issue an enforcement notice, which requires a person to take steps or refrain from taking steps specified in the notice. For example, the commissioner can use an enforcement notice to compel a data controller to give effect to a data subject if they have otherwise failed to do so. Section 40 of the Data Protection Act 1998 made similar provision. In respect of the hon. Lady’s questions concerning the law enforcement aspects of the clause and the need for impact assessments, and the powers that the ICO might need to ensure that those impact assessments are done and are appropriate, I will have to write to her on the details of those latter points.
Question put and agreed to.
Clause 148 accordingly ordered to stand part of the Bill.
Clause 149
Enforcement notices: supplementary
Amendment made: 56, in clause 149, page 83, line 36, leave out “with the day on which” and insert “when”.—(Margot James.)
This amendment is consequential on Amendment 71.
Clause 149, as amended, ordered to stand part of the Bill.
Clause 150
Enforcement notices: rectification and erasure of personal data etc
Question proposed, That the clause stand part of the Bill.
As part of the Information Commissioner’s suite of corrective powers, she can issue penalty notices to data controllers requiring them to pay a fine. Fines can be issued where a controller has failed to comply with a previous notice or where significant breaches of data protection legislation have taken place. Members will be aware from our debate this afternoon that the maximum such penalty will increase from £0.5 million to £17 million, or 4% of global turnover, for the most serious breaches.
When imposing a penalty for breaches of the GDPR, the commissioner must follow the procedures set out in article 83 of the GDPR, which include acting on a case-by-case basis; ensuring that the fine is effective, proportionate and dissuasive; and taking into account various factors. Because law enforcement and intelligence services processing falls outside the scope of the GDPR, the clause makes parallel provision in respect of breaches of those parts of the Bill, including by listing matters that the commissioner must take into account when deciding whether to issue a fine for that type of processing and when determining the magnitude of that fine.
Government amendments 179 and 180 make it clear that, when considering a person’s failure to comply with notices—an information notice, for example—the commissioner is to have regard to the matters listed in article 83(2) of the GDPR and, in relation to law enforcement processing and intelligence processing, to clause 154(3) and (4) of the Bill. Clause 154 prescribes such requirements only for decisions regarding the issuing of a monetary penalty notice in relation to certain failings. The commissioner has powers to prepare guidance on how she uses her enforcement powers, so she could decide, as a matter of policy, to have regard to those matters in relation to other failings. However, the Government’s view is that there should be a requirement for her to do so in the Bill.
Government amendment 57 makes an addition to clause 154(3)(c) to ensure that the Information Commissioner takes into account any actions the controller has taken to mitigate not only damages, but distress suffered by the data subject. The amendment will bring the clause into line with other similar clauses in the Bill, where the Information Commissioner must take into account damage or distress caused. They include clause 149 regarding enforcement notices, where the Information Commissioner must take into account the magnitude of the damage or distress caused by the controller. I am sure right hon. and hon. Members will agree that providing consistency across the Bill is important; the amendment is a step to ensure that that is provided.
Amendment 179 agreed to.
Amendments made: 57, in clause 154, page 86, line 10, at end insert “or distress”.
This amendment is for consistency with Clause 149(2). It requires the Commissioner, when deciding whether to give a penalty notice to a person in respect of a failure to which the GDPR does not apply and when determining the amount of the penalty, to have regard to any action taken by the controller or processor to mitigate the distress suffered by data subjects as a result of the failure.
Amendment 180, in clause 154, page 86, line 28, at end insert—
“(3A) Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 148(5).” —(Margot James.)
See the explanatory statement for amendment 179.
Question proposed, That the clause, as amended, stand part of the Bill.
I am sorry to labour the point; it is pertinent to the clause but also relates to the debate that we just had on information notices. The Minister has failed to set out why the Government have removed the custodial sentence as an enforcement power of the Information Commissioner when data controllers or processors breach information notices. The Minister said earlier that she does not accept that it is the Information Commissioner’s view that that weakens the existing data protection regime, but the commissioner explicitly set that out in her written evidence to the Committee:
“The new approach in the Bill of failure to comply with an IN no longer being a criminal offence but punishable by a monetary penalty issued by the ICO is likely to be less of a deterrent”.
We very much welcome the increased penalty as a sanction by the Information Commissioner, but the Minister has so far failed to set out why she has removed that custodial sentence, which, as the Information Commissioner has laid out, is a serious deterrent. That could weaken her abilities to investigate complex situations and, as I mentioned earlier, it is in direct contrast to the Irish Government’s approach, which carries a fine but also a custodial sentence of up to five years’ imprisonment if the data controller fails to comply with an information notice.
In written evidence, again, the Information Commission suggests that the Government’s approach pales in comparison to that taken by Ireland. Will the Minister take this opportunity to explain why she has so significantly weakened the Information Commissioner’s important powers?
The clause replicates section 55(a) of the 1998 Act, which gives the commissioner a power to serve a monetary penalty, requiring the data controller to pay the commissioner an amount determined by the commissioner. The maximum penalty is specified in clause 156. Before the commissioner can issue a penalty notice, she must be satisfied that a person has failed to comply with certain provisions of the GDPR or the Bill, or has failed to comply with an information notice, assessment notice or enforcement notice.
Clearly, it is up to the commissioner to decide whether a penalty notice is appropriate. She has stated:
“It’s about putting the…citizen first. We can’t lose sight of that…It’s true we’ll have the power to impose fines much bigger than the £500,000 limit the DPA allows us.”
I was coming on to answer the hon. Member for Sheffield, Heeley, but as the hon. Member for Cambridge has raised her question again, I will jump to it. We are not removing all criminal powers under this new legislation. Under paragraph 2 of schedule 15, the commissioner may enforce assessment notices. That power includes the new offence of obstructing a warrant, which is a criminal offence, so criminal offences do remain. As I said, we are looking at the commissioner’s desire for stronger powers in certain areas, but under the current law there is a criminal sanction only for non-compliance with a notice, and that offence is not used. A civil penalty is a better way forward and is provided as the appropriate sanction by the GDPR itself.
The Minister has just confirmed that under the existing arrangements a custodial sentence is the maximum penalty if an individual fails to comply with an information notice. She has not given a coherent reason why she is removing that through the Bill. Is she really arguing that criminal sanctions are less of a deterrent than civil? That is a direct contradiction of the Information Commissioner’s evidence.
I have just been advised that the existing law is non-custodial criminal sanctions. I have referred to the criminal sanctions with respect to assessment notices, and I will get back to the hon. Lady on the question of the sanctions on the information notices that she has asked about. I am told what I am told; the existing law is non-custodial.
Question put and agreed to.
Clause 154, as amended, accordingly ordered to stand part of the Bill.
Schedule 16
PENALTIES
Amendments made: 123, page 203, line 26, leave out “with the day after” and insert “when”.
This amendment is consequential on Amendment 71.
124, page 204, line 10, leave out “with the day on which” and insert “when”.
This amendment is consequential on Amendment 71.
125, page 205, line 5, leave out “with the day after the day on which” and insert “when”.
This amendment is consequential on Amendment 71.
126, page 205, line 37, leave out “controller or processor” and insert “person to whom the penalty notice was given”.—(Margot James.)
This amendment is consequential on Amendment 52.
Schedule 16, as amended, agreed to.
Clause 155 ordered to stand part of the Bill.
Clause 156
Maximum amount of penalty
Question proposed, That the clause stand part of the Bill.
My hon. Friend the Member for Bristol North West has raised important questions about social media providers. Before I entered this place, I worked in the insurance industry. Will the Minister confirm whether insurers would be covered by the clause if they re-identified individuals from datasets to inform the pricing of risk? That is potentially serious when considering the implications of loyalty card, bank or shopping information for health insurance.
I will have to write to the hon. Lady on that. I do not think it would provide cover for insurance companies in those circumstances, but I would like to double-check before I give a definitive answer to her question.
Question put and agreed to.
Clause 171 accordingly ordered to stand part of the Bill.
Clauses 172 to 176 ordered to stand part of the Bill.
Clause 177
Jurisdiction
(6 years, 5 months ago)
Public Bill CommitteesIt is a pleasure to serve under your chairmanship once again, Mr Streeter. I think it was about 18 months ago that we were in this very room, debating the Bill that became the Digital Economy Act 2017. We discussed at length the trade-off between the rights of data subjects, privacy, transparency and the need for Government access to data. In that context we were debating the rights of viewers of online pornography, rather than matters of national security. I note that the Government have had to delay the introduction of the regulations, because they failed to get to grips with the issues that we raised in Committee. I do not envy the new Minister, or, indeed, my right hon. Friend the shadow Minister, their task of attempting to get things right. It was one of the low points of my political career when I had to negotiate with the present Secretary of State for Digital, Culture, Media and Sport on what sexual acts would be blocked. I wish them both luck in taking the matter forward, and am glad I am dealing only with national security issues in the Bill that we are considering today.
As we come to crucial clauses that give Ministers and the security services a great deal more latitude, it is important for the Opposition to lay out key principles on national security certificates. Of course we support the legitimate interests of the intelligence services, as dictated by their statutory functions, including the safeguarding of national security. Of course we recognise that protecting citizens from harm often means striking a difficult balance between operational requirements and the rights of individuals who may fall within the scope of the investigations. We know that the security services take that seriously.
It is the Opposition’s duty, however, to scrutinise the Government’s approach, to ensure that any powers that explicitly allow the setting aside of citizens’ data rights under the Bill are proportionate and necessary, and that they will be overseen through appropriate safeguards. Clauses 26 and 27 provide for a national security certification regime allowing restriction of and exemption from a wide range of rights under the GDPR and the Bill on the basis of national security, and for defence purposes.
The Government state that national security falls outside the scope of EU law and, therefore, the GDPR, and that therefore any processing of personal data relating to national security will be governed by the applied GDPR. Article 4(2) of the treaty on the European Union provides that national security remains the sole responsibility of each member state. Despite that, EU data protection legislation provides for derogations for national security. If national security were entirely outside the scope of the EU treaty, such derogations would be unnecessary, so, as the Joint Committee on Human Rights argued, the provisions imply the retention of some level of EU scrutiny over derogations from EU data protection rights on the grounds of national security. It is thus not at all clear that the Government’s assertions about blanket national security exemptions are correct.
Furthermore, there is no clear definition of which entities will be covered by the extremely broad exemptions under subsection 1, which refers to “national security” and “defence purposes”. I am concerned that a measure allowing broad exemptions to the rights of citizens does not stipulate which entities will be entitled to jettison those rights. As was debated at length in the other place, there are no clear definitions of national security, or of the extended exemption for defence purposes, which goes beyond the Data Protection Act 1998, in the Bill or the explanatory notes. As the right hon. and learned Member for Rushcliffe (Mr Clarke) remarked during the passage of the Investigatory Powers Act 2016,
“National security can easily be conflated with the policy of the Government of the day.”—[Official Report, 15 March 2016; Vol. 607, c. 850.]
As the Joint Committee on Human Rights concluded,
“it is unclear why the authorities require such a breadth of exemptions from their obligations under the data protection regime.”
Before we move on to discuss our amendments to clause 26, I should be grateful if the Minister could assure us about the definitions of “national security” and “defence purposes” and in particular which entities they apply to.
Again, surely it is for the Executive—elected officials—to take responsibility for decisions that are made by data controllers in the Ministry of Defence. Obviously, the Department has considered the Information Commissioner’s representations, but this is not a blanket exemption. The high threshold can be met only in very specific circumstances.
Question put and agreed to.
Clause 26 accordingly ordered to stand part of the Bill.
Clause 27
National security: certificate
I beg to move amendment 161, in clause 27, page 17, line 2, leave out subsection (1) and insert—
“A Minister of the Crown must apply to a Judicial Commissioner for a certificate, if exemptions are sought from specified provisions in relation to any personal data for the purpose of safeguarding national security.”
This amendment would introduce a procedure for a Minister of the Crown to apply to a Judicial Commissioner for a National Security Certificate.
With this it will be convenient to discuss the following:
Amendment 162, in clause 27, page 17, line 5, at end insert—
“(1A) The decision to issue the certificate must be—
(a) approved by a Judicial Commissioner,
(b) laid before Parliament,
(c) published and publicly accessible on the Information Commissioner’s Office website.
(1B) In deciding whether to approve an application under subsection (1), a Judicial Commissioner must review the Minister’s conclusions as to the following matters—
(a) whether the certificate is necessary on relevant grounds,
(b) whether the conduct that would be authorised by the certificate is proportionate to what it sought to be achieved by that conduct, and
(c) whether it is necessary and proportionate to exempt all provisions specified in the certificate.”
This amendment would ensure that oversight and safeguarding in the application for a National Security Certificate are effective, requiring sufficient detail in the application process.
Amendment 163, in clause 27, page 17, leave out lines 6 to 8 and insert—
“(2) An application for a certificate under subsection (1)—
(a) must identify the personal data to which it applies by means of a detailed description, and”.
This amendment would require a National Security Certificate to identify the personal data to which the Certificate applies by means of a detailed description.
Amendment 164, in clause 27, page 17, line 9, leave out subsection (2)(b).
This amendment would ensure that a National Security Certificate cannot be expressed to have prospective effect.
Amendment 165, in clause 27, page 17, line 9, at end insert—
“(c) must specify each provision of this Act which it seeks to exempt, and
(d) must provide a justification for both (a) and (b).”
This amendment would ensure effective oversight of exemptions of this Act from the application for a National Security Certificate.
Amendment 166, in clause 27, page 17, line 10, leave out “directly” and insert
“who believes they are directly or indirectly”
This amendment would broaden the application of subsection (3) so that any person who believes they are directly affected by a National Security Certificate may appeal to the Tribunal against the Certificate.
Amendment 167, in clause 27, page 17, line 12, leave out
“, applying the principles applied by a court on an application for judicial review,”
This amendment removes the application to the appeal against a National Security Certificate of the principles applied by a court on an application for judicial review.
Amendment 168, in clause 27, page 17, line 13, leave out
“the Minister did not have reasonable grounds for issuing”
and insert
“it was not necessary or proportionate to issue”.
These amendments would reflect that the Minister would not be the only authority involved in the process of applying for a National Security Certificate.
Amendment 169, in clause 27, page 17, line 16, at end insert—
“(4A) Where a Judicial Commissioner refuses to approve a Minister’s application for a certificate under this Chapter, the Judicial Commissioner must give the Minister of the Crown reasons in writing for the refusal.
(4B) Where a Judicial Commissioner refuses to approve a Minister’s application for a certificate under this Chapter, the Minister may apply to the Information Commissioner for a review of the decision.
(4C) It is not permissible for exemptions to be specified in relation to—
(a) Chapter II of the applied GDPR (principles)—
(i) Article 5 (lawful, fair and transparent processing),
(ii) Article 6 (lawfulness of processing),
(iii) Article 9 (processing of special categories of personal data),
(b) Chapter IV of the applied GDPR—
(i) GDPR Articles 24 – 32 inclusive,
(ii) GDPR Articles 35 – 43 inclusive,
(c) Chapter VIII of the applied GDPR (remedies, liabilities and penalties)—
(i) GDPR Article 83 (general conditions for imposing administrative fines),
(ii) GDPR Article 84 (penalties),
(d) Part 5 of this Act, or
(e) Part 7 of this Act.”
This amendment would require a Judicial Commissioner to intimate in writing to the Minister reasons for refusing the Minister’s application for a National Security Certificate and allows the Minister to apply for a review by the Information Commissioner of such a refusal.
With our amendments we seek to provide some oversight of and protections against the very broad definitions in this part of the Bill. I am afraid we are not content with the Minister’s assertions in her response on the previous clause.
As they currently stand, national security certificates give Ministers broad powers to remove individuals’ rights with absolutely no oversight. If this is a matter for the Executive, as the Minister has just said, they must be subject to oversight and accountability when making such decisions, and as it stands there is absolutely none at all. The rights at risk from the exemption are the right to be informed when personal data is collected from individuals, which is in article 13 of the GDPR; the right to find out whether personal data against them is being processed, in article 15; and the right to object to automated decision making, in articles 21 and 22. Furthermore, the Information Commissioner’s inspection, authorisation and advisory powers are set aside, which is why she and her office raised concerns, as my hon. Friend the Member for Cambridge set out.
It is not difficult to envisage examples of why those exemptions may be necessary. The Minister has laid some of them out: for instance, during the course of an ongoing national security investigation, the right of an individual to be informed that their data is being processed would not be appropriate. With these exemptions, there will inevitably be a need for appropriate safeguards to protect the rights of citizens. We are not yet convinced that the Bill contains them. That is what these amendments seek to tackle.
(6 years, 5 months ago)
Public Bill CommitteesIt is a pleasure to serve under your chairmanship once again, Mr Streeter. I think it was about 18 months ago that we were in this very room, debating the Bill that became the Digital Economy Act 2017. We discussed at length the trade-off between the rights of data subjects, privacy, transparency and the need for Government access to data. In that context we were debating the rights of viewers of online pornography, rather than matters of national security. I note that the Government have had to delay the introduction of the regulations, because they failed to get to grips with the issues that we raised in Committee. I do not envy the new Minister, or, indeed, my right hon. Friend the shadow Minister, their task of attempting to get things right. It was one of the low points of my political career when I had to negotiate with the present Secretary of State for Digital, Culture, Media and Sport on what sexual acts would be blocked. I wish them both luck in taking the matter forward, and am glad I am dealing only with national security issues in the Bill that we are considering today.
As we come to crucial clauses that give Ministers and the security services a great deal more latitude, it is important for the Opposition to lay out key principles on national security certificates. Of course we support the legitimate interests of the intelligence services, as dictated by their statutory functions, including the safeguarding of national security. Of course we recognise that protecting citizens from harm often means striking a difficult balance between operational requirements and the rights of individuals who may fall within the scope of the investigations. We know that the security services take that seriously.
It is the Opposition’s duty, however, to scrutinise the Government’s approach, to ensure that any powers that explicitly allow the setting aside of citizens’ data rights under the Bill are proportionate and necessary, and that they will be overseen through appropriate safeguards. Clauses 26 and 27 provide for a national security certification regime allowing restriction of and exemption from a wide range of rights under the GDPR and the Bill on the basis of national security, and for defence purposes.
The Government state that national security falls outside the scope of EU law and, therefore, the GDPR, and that therefore any processing of personal data relating to national security will be governed by the applied GDPR. Article 4(2) of the treaty on the European Union provides that national security remains the sole responsibility of each member state. Despite that, EU data protection legislation provides for derogations for national security. If national security were entirely outside the scope of the EU treaty, such derogations would be unnecessary, so, as the Joint Committee on Human Rights argued, the provisions imply the retention of some level of EU scrutiny over derogations from EU data protection rights on the grounds of national security. It is thus not at all clear that the Government’s assertions about blanket national security exemptions are correct.
Furthermore, there is no clear definition of which entities will be covered by the extremely broad exemptions under subsection 1, which refers to “national security” and “defence purposes”. I am concerned that a measure allowing broad exemptions to the rights of citizens does not stipulate which entities will be entitled to jettison those rights. As was debated at length in the other place, there are no clear definitions of national security, or of the extended exemption for defence purposes, which goes beyond the Data Protection Act 1998, in the Bill or the explanatory notes. As the right hon. and learned Member for Rushcliffe (Mr Clarke) remarked during the passage of the Investigatory Powers Act 2016,
“National security can easily be conflated with the policy of the Government of the day.”—[Official Report, 15 March 2016; Vol. 607, c. 850.]
As the Joint Committee on Human Rights concluded,
“it is unclear why the authorities require such a breadth of exemptions from their obligations under the data protection regime.”
Before we move on to discuss our amendments to clause 26, I should be grateful if the Minister could assure us about the definitions of “national security” and “defence purposes” and in particular which entities they apply to.
Again, surely it is for the Executive—elected officials—to take responsibility for decisions that are made by data controllers in the Ministry of Defence. Obviously, the Department has considered the Information Commissioner’s representations, but this is not a blanket exemption. The high threshold can be met only in very specific circumstances.
Question put and agreed to.
Clause 26 accordingly ordered to stand part of the Bill.
Clause 27
National security: certificate
I beg to move amendment 161, in clause 27, page 17, line 2, leave out subsection (1) and insert—
“A Minister of the Crown must apply to a Judicial Commissioner for a certificate, if exemptions are sought from specified provisions in relation to any personal data for the purpose of safeguarding national security.”
This amendment would introduce a procedure for a Minister of the Crown to apply to a Judicial Commissioner for a National Security Certificate.
With this it will be convenient to discuss the following:
Amendment 162, in clause 27, page 17, line 5, at end insert—
“(1A) The decision to issue the certificate must be—
(a) approved by a Judicial Commissioner,
(b) laid before Parliament,
(c) published and publicly accessible on the Information Commissioner’s Office website.
(1B) In deciding whether to approve an application under subsection (1), a Judicial Commissioner must review the Minister’s conclusions as to the following matters—
(a) whether the certificate is necessary on relevant grounds,
(b) whether the conduct that would be authorised by the certificate is proportionate to what it sought to be achieved by that conduct, and
(c) whether it is necessary and proportionate to exempt all provisions specified in the certificate.”
This amendment would ensure that oversight and safeguarding in the application for a National Security Certificate are effective, requiring sufficient detail in the application process.
Amendment 163, in clause 27, page 17, leave out lines 6 to 8 and insert—
“(2) An application for a certificate under subsection (1)—
(a) must identify the personal data to which it applies by means of a detailed description, and”.
This amendment would require a National Security Certificate to identify the personal data to which the Certificate applies by means of a detailed description.
Amendment 164, in clause 27, page 17, line 9, leave out subsection (2)(b).
This amendment would ensure that a National Security Certificate cannot be expressed to have prospective effect.
Amendment 165, in clause 27, page 17, line 9, at end insert—
“(c) must specify each provision of this Act which it seeks to exempt, and
(d) must provide a justification for both (a) and (b).”
This amendment would ensure effective oversight of exemptions of this Act from the application for a National Security Certificate.
Amendment 166, in clause 27, page 17, line 10, leave out “directly” and insert
“who believes they are directly or indirectly”
This amendment would broaden the application of subsection (3) so that any person who believes they are directly affected by a National Security Certificate may appeal to the Tribunal against the Certificate.
Amendment 167, in clause 27, page 17, line 12, leave out
“, applying the principles applied by a court on an application for judicial review,”
This amendment removes the application to the appeal against a National Security Certificate of the principles applied by a court on an application for judicial review.
Amendment 168, in clause 27, page 17, line 13, leave out
“the Minister did not have reasonable grounds for issuing”
and insert
“it was not necessary or proportionate to issue”.
These amendments would reflect that the Minister would not be the only authority involved in the process of applying for a National Security Certificate.
Amendment 169, in clause 27, page 17, line 16, at end insert—
“(4A) Where a Judicial Commissioner refuses to approve a Minister’s application for a certificate under this Chapter, the Judicial Commissioner must give the Minister of the Crown reasons in writing for the refusal.
(4B) Where a Judicial Commissioner refuses to approve a Minister’s application for a certificate under this Chapter, the Minister may apply to the Information Commissioner for a review of the decision.
(4C) It is not permissible for exemptions to be specified in relation to—
(a) Chapter II of the applied GDPR (principles)—
(i) Article 5 (lawful, fair and transparent processing),
(ii) Article 6 (lawfulness of processing),
(iii) Article 9 (processing of special categories of personal data),
(b) Chapter IV of the applied GDPR—
(i) GDPR Articles 24 – 32 inclusive,
(ii) GDPR Articles 35 – 43 inclusive,
(c) Chapter VIII of the applied GDPR (remedies, liabilities and penalties)—
(i) GDPR Article 83 (general conditions for imposing administrative fines),
(ii) GDPR Article 84 (penalties),
(d) Part 5 of this Act, or
(e) Part 7 of this Act.”
This amendment would require a Judicial Commissioner to intimate in writing to the Minister reasons for refusing the Minister’s application for a National Security Certificate and allows the Minister to apply for a review by the Information Commissioner of such a refusal.
With our amendments we seek to provide some oversight of and protections against the very broad definitions in this part of the Bill. I am afraid we are not content with the Minister’s assertions in her response on the previous clause.
As they currently stand, national security certificates give Ministers broad powers to remove individuals’ rights with absolutely no oversight. If this is a matter for the Executive, as the Minister has just said, they must be subject to oversight and accountability when making such decisions, and as it stands there is absolutely none at all. The rights at risk from the exemption are the right to be informed when personal data is collected from individuals, which is in article 13 of the GDPR; the right to find out whether personal data against them is being processed, in article 15; and the right to object to automated decision making, in articles 21 and 22. Furthermore, the Information Commissioner’s inspection, authorisation and advisory powers are set aside, which is why she and her office raised concerns, as my hon. Friend the Member for Cambridge set out.
It is not difficult to envisage examples of why those exemptions may be necessary. The Minister has laid some of them out: for instance, during the course of an ongoing national security investigation, the right of an individual to be informed that their data is being processed would not be appropriate. With these exemptions, there will inevitably be a need for appropriate safeguards to protect the rights of citizens. We are not yet convinced that the Bill contains them. That is what these amendments seek to tackle.
(6 years, 9 months ago)
Commons ChamberThere is no doubt at least one in every colleague’s constituency.
My officials and I have regular conversations with the Home Office on matters relating to football and other sporting events, including counter-terrorism, security and policing matters.
I am very grateful for the Minister’s response. The cost to the Met of policing premier league football last year was almost £7 million, but the clubs contributed only £360,000. Given that they draw in more than £240 million every match day, is it not high time that premier league clubs were paying their full share to overstretched police forces?
Football clubs do make a significant contribution to policing costs for home matches, and the Premier League and the clubs themselves contributed more than £2.4 billion to the public finances. We have to recognise that there are parameters as to policing costs and where these can be recovered from. I know that recent High Court cases have determined that, based on existing legislation, the police are not entitled to charge for these special police services where they are deployed on public land. That court decision has implications for what the police can charge, but we work with both the Premier League and the clubs on a host of policing matters, and I am sure that will continue.