Data Protection Bill [Lords] (Sixth sitting)

Margot James Excerpts

Tuesday 20th March 2018 Public Bill Committees

[The Chair]

It is up to the Minister to decide whether she wishes to respond to that point of order.

[The Minister of State, Department for Digital, Culture, Media and Sport (Margot James)]

I hesitated, Mr Streeter, because I am not quite sure that I can clarify the matter. I cannot answer the right hon. Gentleman’s question. I reiterate that in answer to the important question about strengthening the Information Commissioner’s powers, my right hon. Friend the Secretary of State said yesterday:

“We are considering those new proposals, and I have no doubt that the House will consider that as the Bill passes through the House.”—[Official Report, 19 March 2018; Vol. 638, c. 49.]

In the context of the commissioner’s request for additional powers, he said:

“We are therefore considering the Information Commissioner’s request.”—[Official Report, 19 March 2018; Vol. 638, c. 52.]

The right hon. Gentleman’s point was recently made by the commissioner, so it is a point worth listening to. I can confirm that we are listening and reviewing, but beyond that, I cannot go.

[The Chair]

As the Speaker himself might say, the right hon. Gentleman has been here a long time and will no doubt find other ways to pursue the matter. I am grateful for the point of order.

Clause 132 ordered to stand part of the Bill.

Clauses 133 to 139 ordered to stand part of the Bill.

Clause 140

Publication by the Commissioner

Question proposed, That the clause stand part of the Bill.

[Margot James]

I was not planning to speak to this clause, but as it is relevant I will use the opportunity to give the right hon. Member for Birmingham, Hodge Hill further information. He asked about the code of conduct where the commissioner has a responsibility to publish the document about child-friendly regulation of websites. Clause 140 provides that the document can be published in a way the commissioner considers appropriate. Under clause 126, the Bill contains a duty to publish various codes of practice, including the age-appropriate design code. The Bill requires the commissioner to publish the age-appropriate design code within 18 months of Royal Assent, but as the matter is important and urgent, we will endeavour to do so sooner.

Question put and agreed to.

Clause 140 accordingly ordered to stand part of the Bill.

Clause 141 ordered to stand part of the Bill.

Clause 142

Inquiry into issues arising from data protection breaches committed by or on behalf of news publishers

[Brendan O'Hara (Argyll and Bute) (SNP)]

I beg to move amendment 137, in clause 142, page 77, line 34, at end insert—

“(3) The Secretary of State must consult the Scottish Government and obtain its consent before establishing an inquiry under subsection (1).”

This amendment would ensure that before any inquiry was established, the UK Government must have consent from Scottish Government.

--- Later in debate ---

[Matt Warman]

That is a fascinating philosophical question, but I can only tell the right hon. Gentleman that I would not have voted for it. I appreciate that he will say that it is easy for me to say that now, but the idea that people in this place would be convinced that it is the best possible model is simply not plausible after the statements that my hon. Friend the Member for North Devon and I have made today. Surely we need a set of press regulations that preserves the independence of the media, and their ability to invest in journalism at local and national level, which we all want if we are to hold the powerful to account. We also need regulations that allow hon. Members to say with a clear conscience that we have done nothing that puts those businesses in serious jeopardy.

It does not seem to me that a costly Leveson 2 is the best use of public money, or that the threat of section 40 will ever be the best use of private money, putting legitimate local and national media out of business. Those arguments seem to me like a powerful case for IPSO, and for a sensible look at the sustainability of the press, as the Prime Minister has set about doing. They do not under any circumstances seem to me like a good reason to vote for the amendments.

[Margot James]

I will set out the Government’s position on clauses 142, 168, 169 and 205, before returning to the amendments in the name of the hon. Member for Argyll and Bute.

As we have heard, clause 142 requires the Government to establish an inquiry with terms of reference similar to those contained in part 2 of the Leveson inquiry, but in relation to data protection only. The Government set out our intention not to reopen the Leveson inquiry in our response to the consultation on the future of the inquiry on 1 March. I will not repeat the arguments in full, but I will say that the Government’s firm focus is on the problems faced by the media right now.

The Government recognise that there is a great deal of feeling on both sides of the debate. We have listened to all views, including those of victims, in reaching a decision. No one seeks to excuse the past behaviour of individual media organisations, nor to legitimise it. As the right hon. Member for Birmingham, Hodge Hill said, some of the stories we heard at the beginning of the Leveson inquiry were horrific. The Government have a duty, however, to make decisions that are proportionate and in the public interest. In the light of all the evidence available, it is apparent that part 2 of the inquiry is no longer appropriate or proportionate.

Part 1 of the inquiry lasted over a year, and heard evidence from more than 300 people, including journalists, editors and victims. Since then, the majority of the Leveson recommendations have been implemented. Three major police investigations examining a wide range of offences have been completed. More than 40 people were convicted, some of whom were sent to prison. There have also been extensive reforms to policing practices, and significant changes to press self-regulation.

As a result, the terms of reference for part 2 have largely been met, and the culture that allowed phone hacking to become the norm has changed. Meanwhile, the media are facing critical challenges that threaten their sustainability, including fake news, declining circulations and gaining revenue from online content. Free and vibrant media are vital to democratic discourse, and we need to tackle those challenges urgently. Holding a costly and time-consuming public inquiry looking predominantly backwards is not the right way to go.

The Government are committed to addressing these issues, and we are developing a digital charter to ensure that new technologies work for the benefit of everyone, with rules and protections in place to keep people safe online and to ensure that personal information is used appropriately. As part of that, we are also undertaking work to ensure that there are sustainable business models for high-quality media online. The media landscape is different and the threats are different, too. Issues such as fake news mean there is a need to protect the reliability and objectivity of information.

Likewise, clauses 168 and 169 are similar to the provisions contained in sections 40 and 42 of the Crime and Courts Act 2013, but apply to breaches of data protection law only. The Government do not believe that introducing a provision similar to section 40 of the 2013 Act into the Bill is appropriate, but in relation to data protection only. That is particularly so given our decision earlier this month to repeal section 40 when there is a suitable legislative vehicle. In coming to that decision, we considered all the available evidence, including the views of respondents to the public consultation that we undertook last year. Many respondents cited concerns about the chilling effect that section 40 would have on the freedom of the press, which was so ably summed up by my hon. Friend the Member for Boston and Skegness.

[Liam Byrne]

Will the Minister tell the Committee why she supported it when it came to a vote last time?

[Margot James]

The right hon. Gentleman has made great play of the former Prime Minister’s statement. I remind him that that statement was given six years ago. Much has changed since. My hon. Friend the Member for North Devon tried to make the point that, although we cannot rule out that egregious conduct is still going on in the press, as I imagine there is in virtually every other sector of society, we can agree that much has changed and improved. That is why the Government have changed their direction. I hope that satisfies the right hon. Gentleman.

[Gareth Snell (Stoke-on-Trent Central) (Lab/Co-op)]

It is a pleasure to serve under your chairmanship, Mr Streeter.

On that point, the Minister accepts that egregious activity could be taking place across the industry but does not think that the proposal is the appropriate vehicle for dealing with it. She believes that the digital charter is the appropriate vehicle, but what evidence is she using to ensure that that addresses the egregious activity?

[Margot James]

I want to correct one thing that the hon. Gentleman said: I did not say that that activity was taking place across the industry; I said that it was still taking place. Indeed, we have heard the horrendous allegations made by John Ford, albeit referring to behaviour that predates 2011. He alleges that it is still going on. I am not denying that it probably is still carrying on in pockets, but I would not say that it is widespread.

Press self-regulation has changed significantly in recent years with the establishment of IPSO, which follows many of the principles set out in the Leveson report. As so few publishers have joined a regulator recognised under the royal charter, commencement of section 40 would have a chilling effect on investigative journalism, which is so important to a well-functioning democracy.

[Daniel Zeichner (Cambridge) (Lab)]

It is a pleasure to serve under your chairmanship, Mr Streeter. We keep hearing about the chilling effect—it is well rehearsed—but could the Minister confirm that it could be entirely avoided if newspapers sign up to an appropriate regulator, which does not have to be IMPRESS? It is not a difficult thing to do.

[Margot James]

Currently, IMPRESS is the only regulator recognised under the royal charter. I cannot speak for the press. There was a heated debate when the legislation went through Parliament. The press decided as one not to join what they perceived as a state-backed regulator. IPSO now does the job, albeit the Financial Times and The Guardian alone among the broadsheets have not joined IPSO.

The media landscape has changed. As I noted earlier, high-quality journalism is under threat from the rise of clickbait and fake news, from difficulties in generating revenue online to replace the revenue that used to flow from printed sources, and from the dramatic, continued rise of largely unregulated social media. If implemented, section 40 could impose further financial burdens on publishers, particularly at local level—200 local papers have closed in the last decade.

On top of that, the amendments made in the other place undermine our Scotland and Northern Ireland devolution settlements—that point was ably made by the hon. Member for Argyll and Bute. The proposed new clauses seek to legislate on a UK-wide basis despite press regulation being a reserved matter for the devolved Administrations, which brings me to amendments 137, 138 and 139 in the name of the hon. Gentleman.

The Government are sympathetic to the hon. Gentleman’s arguments for reasons I have set out. We will nevertheless push instead for the removal of those clauses from the Bill in their entirety. Similarly, while we agree with the sentiment of amendment 137, which seeks to require the Government to obtain the Scottish Government’s consent before establishing an inquiry under clause 142, we note that there is already a consultation requirement to that effect in the Inquiries Act 2005. Such an amendment is therefore unnecessary.

To conclude, high-quality news provision is vital to our society and democracy. I know there is shared interest across the House in safeguarding its future, and the Government are passionate about and working to deliver it. We believe that the clauses would work against those aims and cut across the work we are doing to help strengthen the future of high-quality journalism, and will therefore oppose their continued inclusion in the Bill.

[Brendan O'Hara]

I take on board what the Government say and appreciate that they have accepted the principle of the amendment, but I still intend to push it to the vote. It is essential that the devolution settlement is protected in as broad and deep a way as possible. I understand that they would seek to remove the entire clause, but if the clause is passed and de-amended, it has serious consequences for the devolution settlement. For that reason we will be pushing it to the vote.

Question put, That the amendment be made.

--- Later in debate ---

[Margot James]

I beg to move amendment 51, in clause 143, page 77, line 37, after “notice”)” insert “—

(a) ”.

See the explanatory statement for Amendment 52.

[The Chair]

With this it will be convenient to discuss Government amendments 52, 54, 126 and 58.

[Margot James]

The Information Commissioner has a breadth of corrective powers at her disposal to investigate breaches of data protection legislation. One such power is the ability to issue an information notice on a data controller requesting that they provide the commissioner with specified information. Article 2 of the general data protection regulation states that certain types of processing of personal data, including purely personal or household activities, are exempt from the provisions of the GDPR. That includes the list of all those hon. Members who deserve a Christmas card this year.

Although such processing is exempt, it is important that in certain situations the Information Commissioner is able to verify that the processing actually meets this test and does not fly under the radar of GDPR requirements unduly. Government amendments 51 and 52 will ensure that the Information Commissioner is able to issue an information notice, in order to determine whether the process is genuinely being undertaken in the course of a purely personal or household activity.

Government amendment 54 is a consequential amendment. It ensures that the reference to processing of personal data in the subsection added by Government amendment 52 means any type of processing, pulling on the definitions provided in subsections (2) and (4) of clause 3, rather than those under parts 2, 3 or 4, none of which apply to processing in the course of purely personal or household activities.

Government amendments 58 and 126 make further consequential changes to clause 159 and paragraph 9 of schedule 16. The amendments ensure that certain safeguards for controllers and processors in the context of enforcement action extend to all persons, since their exact status may in fact be the source of dispute.

All in all, this is a common sense set of changes that enjoy the full support of the Information Commissioner’s Office.

Amendment 51 agreed to.

Amendments made: 52, in clause 143, page 77, line 40, at end insert “, or

(b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.”

This amendment and Amendments 51 and 54 enable the Information Commissioner to obtain information in order to work out whether processing is carried out in the course of purely personal or household activities. Such processing is not subject to the GDPR or the applied GDPR (see Article 2(2)(c) of the GDPR and Clause 21(3)).

Amendment 53, in clause 143, page 78, line 23, leave out

“with the day on which”

and insert “when”.

This amendment is consequential on Amendment 71.

Amendment 54, in clause 143, page 78, line 30, at end insert—

“(10) Section 3(14)(b) does not apply to the reference to the processing of personal data in subsection (1)(b).”—(Margot James.)

This amendment secures that the reference to “processing” in the new paragraph (b) inserted by Amendment 52 includes all types of processing of personal data. It disapplies Clause 3(14)(b), which provides that references to processing in Parts 5 to 7 of the bill are usually to processing to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.

Question proposed, That the clause, as amended, stand part of the Bill.

[Louise Haigh (Sheffield, Heeley) (Lab)]

In this of all weeks, it is particularly relevant that we debate this clause, which relates to information notices, and the powers and enforcement sanctions available to the Information Commissioner, given the horrendous breaches of our data regulation that have been exposed by Channel 4 and The Guardian.

The Secretary of State for Digital, Culture, Media and Sport told the House yesterday that the Information Commissioner was seeking further powers to compel compliance with information notices, testimony from other individuals in complex investigations, such as that into Cambridge Analytica, and criminal sanctions for breaches of information notices.

Under the current data protection legislation, breach of information notice is a criminal offence that carries a custodial sentence. The maximum sentence under this Bill is only a fine. That is a significant weakening of the data protection regime and its sanctions. Indeed, in her own evidence, the Information Commissioner said:

“The new approach in the Bill of failure to comply with an”

information notice

“no longer being a criminal offence but punishable by a monetary penalty issued by the ICO is likely to be less of a deterrent, as data controllers with deep pockets might be inclined to pay the fine, rather than disclose the information being requested.”

I would be grateful if the Minister could set out exactly why the Government have decided to weaken the powers given to the Information Commissioner and the sanctions available to her.

Crucially, the Information Commissioner has requested the power to compel compliance with information notices. As things stand, it is an offence not to deliver information, but the Information Commissioner does not have the power to demand compliance with information notices. She has said that that puts us out of step with our closest EU member state neighbour, Ireland, which has a much stronger data protection regime, with much tougher sanctions and, indeed, powers to compel compliance with an information notice.

That gap in the Information Commissioner’s enforcement powers has not caused significant problems up to now, because formal action has largely centred on security breaches or contraventions of the privacy and electronic communications regulations. In such cases, the commissioner rarely needs to use her information notice powers, because the evidence of a contravention is usually clear and in the public domain.

Where the Information Commissioner has used her enforcement powers against a data controller for contraventions of the data protection principles under the Data Protection Act, she has generally found data controllers to be co-operative because, under the current framework, financial penalties are reserved only for the most serious contraventions of the law. However, as investigations become more complex—and as we are seeing this week—the Commissioner will be unable to obtain the information she needs.

The Minister has said that the Government are considering potential amendments to the Bill, as laid out by the Secretary of State yesterday. It is baffling, however, that those amendments have not already been tabled, given that the Information Commissioner suggested them in her written evidence earlier in the process. The provisions represent a serious weakening of the existing regime and a failure of the Government to step up to the plate on the matter of the complex investigations conducted by the Information Commissioner.

[Margot James]

I do not accept that this Bill represents a reduction in the powers of the Information Commissioner, and I do not think that that is her view either. Obviously, I accept what she said in response to questioning from Select Committee on Digital, Culture, Media and Sport. As I have already said, my right hon. Friend the Secretary of State is considering her request, and we are working on the areas where she feels there is a shortfall.

I reassure the Committee that the Bill strengthens ICO’s overall powers. The hon. Member for Sheffield, Heeley has mentioned fines. There are fines of up to 4% of global turnover, or £17 million, both for malpractice itself and for blocking investigations and inquiries mounted by the ICO.

[Liam Byrne]

One way in which the Government could row in behind a frustrated Information Commission would be to deny Government contracts to companies that are behaving badly. I understand that Cambridge Analytica has Government contracts with both the Foreign Office and the Ministry of Defence. Are they under review?

[Margot James]

I cannot speak for either of those Departments. We are debating the powers of the ICO rather than contractual matters between private companies and Government Departments. I accept that that is a moot point, but it is not the purpose of this Bill Committee to go into those details.

To return to the points raised by the hon. Member for Sheffield, Heeley, we are strengthening the powers of the Commissioner. We are extending her current power to serve assessment notices on data controllers in public sector bodies to all data controllers across the private sector as well. Those assessment notices will require them to provide evidence of their compliance with the law, and there is now the power to enforce assessment notices by obtaining a warrant to exercise search and seizure powers on behalf of the ICO. The Bill also creates a criminal offence for obstructing a warrant, which is subject to both fines and a criminal record. We are strengthening in those areas and also increasing fines substantially.

[Liam Byrne]

I understand that the Minister cannot answer the detailed question about Government contracts with, for example, Cambridge Analytica, but does she think, philosophically, that a Government would and should reconsider contracts with companies that are not complying with a reasonable request made by the Information Commissioner?

[Margot James]

The right hon. Gentleman makes an entirely reasonable point. As I said earlier, I cannot go into it in a debate on this particular Bill, other than to say that he makes a reasonable point.

Clause 143 provides the commissioner with the power to issue an information notice. This is a type of notice that requires a controller or processor to provide the commissioner with specified information within a certain time period.

Question put and agreed to.

Clause 143, as amended, accordingly ordered to stand part of the Bill.

Clause 144 ordered to stand part of the Bill.

Clause 145

False statements made in response to an information notice

Question proposed, That the clause stand part of the Bill.

[Liam Byrne]

The operation of clause 145 is a matter of great public concern this week, because of the revelations that an app that sat on Facebook collected data for a particular purpose, but they were then re-used by Cambridge Analytica for an entirely different purpose, to bend the outcome of particular elections and, quite possibly, referendums too. Facebook had made a statement that the matter had been resolved a couple of years ago and that the relevant data in question had been deleted. The story has developed over the past 24 hours and former Facebook employees are now alleging that it was not simply 50 million records that were collected for one purpose and re-used for another; there may have been hundreds of millions of records collected for one purpose and used for another.

How will clause 145 bite on a company such as Facebook that may be responding to an information notice issued by the Information Commissioner? The company may have told the Information Commissioner that it was all fine, the data was all deleted and everyone was perfectly satisfied, but a couple of years later it transpires that that is not the case. What would then happen to a company such as Facebook? Is the Minister satisfied that the proposed sanctions and penalties are strong enough? It is not clear to me, given what we now know, that these sanctions are strong enough at all.

[Margot James]

We are debating a suite of powers as part of the overall powers with which the Bill reinforces the Information Commissioner’s Office. It is not just about clause 145. If a company discloses information unlawfully, there is also a separate offence in clause 170. We are not relying on one clause alone.

--- Later in debate ---

[Louise Haigh]

Earlier, we debated the requirement for law enforcement agencies to conduct data protection impact assessments ahead of developing or using any new filing system, and we debated several examples of what those filing systems or methods of data collection could be, including automated facial recognition software, automatic number plate recognition and the use of algorithms to determine decisions made in the criminal justice system.

In relation to the clause, the Information Commissioner has requested that she be given the power to impose corrective measures where necessary, when a data protection impact assessment has revealed that the processing of that personal data is of high risk to individuals and where there are no measures to mitigate that risk in relation to law enforcement processing, as she has for other processing. She maintains that a different approach to law enforcement is not justified and might lead to adverse consequences in an important area affecting individuals. That is important because it gives weight to the important aspects raised earlier that require law enforcement agencies to conduct that DPIA. There is little point asking organisations and data controllers to conduct impact assessments and then, even when they are falling short dramatically, to let them carry on conducting assessments and collecting data in that way.

In evidence, the Information Commissioner has said that part 3 of the Bill

“requires these types of assessment to be undertaken”

and provides

“for requirements to consult the Commissioner where such a high risk is present but measures cannot be put in place to mitigate these. They also provide requirements for the Commissioner to use her corrective powers in relation to GDPR but the way the Bill is drafted these corrective powers will not be available in relation to concerns arising from a DIPA involving law enforcement processing. Nor are there any powers available to ensure that the Information Commissioner can take action if a DIPA for law enforcement processing is not carried out when required.”

Not only are there no enforcement powers if the DPIA is conducted and falls short, but the Information Commissioner is not provided with any powers under this legislation to compel a DPIA to take place. Given, as we discussed earlier, the serious threats not just to data rights, but to prevention with respect to an individual’s rights to liberty and freedom, it is very serious indeed if law enforcement agencies will be able to carry out impact assessments without any adherence to the provisions in the Bill.

The Information Commissioner says:

“Having the ability to issue corrective measures based upon the DPIA or indeed requiring a DPIA to be undertaken when it should have been, is an important measure which is missing in relation to law enforcement processing”.

The commissioner has raised her concerns with the Government and suggested drafting solutions. Will the Minister clarify why those were not introduced in Committee?

[Margot James]

The clause gives the commissioner the power to issue an enforcement notice, which requires a person to take steps or refrain from taking steps specified in the notice. For example, the commissioner can use an enforcement notice to compel a data controller to give effect to a data subject if they have otherwise failed to do so. Section 40 of the Data Protection Act 1998 made similar provision. In respect of the hon. Lady’s questions concerning the law enforcement aspects of the clause and the need for impact assessments, and the powers that the ICO might need to ensure that those impact assessments are done and are appropriate, I will have to write to her on the details of those latter points.

Question put and agreed to.

Clause 148 accordingly ordered to stand part of the Bill.

Clause 149

Enforcement notices: supplementary

Amendment made: 56, in clause 149, page 83, line 36, leave out “with the day on which” and insert “when”.—(Margot James.)

This amendment is consequential on Amendment 71.

Clause 149, as amended, ordered to stand part of the Bill.

Clause 150

Enforcement notices: rectification and erasure of personal data etc

Question proposed, That the clause stand part of the Bill.

[Liam Byrne]

The clause bites on the question of individuals’ rights to the erasure of personal data and rectification. I want to give the Minister an opportunity to update the Committee on her conversations with media, culture and other organisations about how she is going to balance the implementation of clause 150 with the ambitions of those organisations to protect archives—not just archives of very large sets of artefacts, such as the Natural History Museum, but those that are run by News UK or Trinity Mirror or the BBC.

The risk that is obviously posed by those organisations is that they often rely on very good, detailed and often quite old archives of news information. The scenario that was put to us last night by lawyers representing a number of those organisations that wanted to give us their views about clauses 168 and 169 was that successful journalism—whether The Daily Telegraph or the Swindon Advertiser—will often rely on excellent archives.

If rich individuals are seeking to create a different truth and a different history, and to exercise their rights under the clause, a risk will be created for those media organisations. I am more worried about the media organisations’ rights than I am about the Natural History Museum and the BBC, because I think the Minister’s Department will do a good job of working out where to put that grey line round what should be protected and what is up for grabs. The example put to us last night was of rich individuals seeking to create a different kind of history—a different kind of past—to bend deliberately the future of reporting by eradicating a record that might be true. The risk that was put to us is that, very often, newspaper legal directors—the poor things often have to advise on this decision—will sometimes conclude that the game is just not worth it and therefore give in to the rich individual to avoid damaging and expensive legal action and delete the records from their archives.

This is a difficult area, where balances have to be struck, but it is a form of litigation that will doubtless continue into the future. We might have just decided to deny access to ordinary people to correct media malpractice, but rich individuals will continue to bring their cases. Will the Minister tell us how the balance will play out in practice? How do we protect the rights of news organisations to run good archives for the benefit of public interest journalism in the future?

[Margot James]

The clause makes additional provision for enforcement notices where the subject matter of the notice relates to the controller or processor’s failure to comply with the data protection principle of ensuring accuracy. The clause may also apply where a controller or processor has failed to comply with the data subject’s rights on rectification, erasure or restriction of processing under articles 16 to 18 of the general data protection regulation.

We touched on the issue of archives in one of the Committee sittings last week. I explained to the Committee that there is protection for archives under the GDPR, whether they be those of news organisations or of academic sources. We are aware of the concerns expressed by organisations representing archives, and I agree with the right hon. Gentleman that quality journalism often depends on the use of such archives. However, I assure him that my Department will defend the rights of journalists and the press as tenaciously as we would defend the rights of archivists in the great museums of our country against the distortions that he gave as examples of people perhaps wanting to use the right to be forgotten in an excessive manner and in a bid to rewrite history. We are aware of such individuals, and we are comfortable that the GDPR prevents those abuses.

Question put and agreed to.

Clause 150 accordingly ordered to stand part of the Bill.

Clauses 151 and 152 ordered to stand part of the Bill.

Clause 153

Powers of entry and inspection

Question proposed, That the clause stand part of the Bill.

[Liam Byrne]

Again, on this point, we would benefit from some clarification from the Minister. The story that broke this morning was that the Information Commissioner had, in effect, to go to court to get her warrant to investigate what Cambridge Analytica was up to. There was some speculation as to why Facebook was able to exercise some contractual rights and turn up at the offices of Cambridge Analytica to conduct an inspection. The reports are that, as the situation played out, the Information Commissioner had to tell Facebook legal officers to stand down and to stop what they were doing. As it happened, Facebook wisely decided to follow the Information Commissioner’s orders.

A matter of great concern is that the Information Commissioner has to go through what sounds like a laborious process to get the warrant needed to conduct an investigation that is obviously in the public interest. When we secure, for example, emergency injunctions to stop the publication of material that people do not want published, or when magistrates issue search warrants, most of us with experience of this at a local level would observe that such warrants are often issued in a much faster and less high-profile way than the process the Information Commissioner appears to have to go through.

In effect, Cambridge Analytica has had 48 hours’ notice of the Information Commissioner’s concerns—[Interruption.] I am sorry, but I do not know whether the Minister wants to intervene on that—

--- Later in debate ---

[Margot James]

I remind the right hon. Gentleman that, in this case, the Information Commissioner is acting under the existing powers in the Data Protection Act 1998, but she is pursuing warrants where she has to get them to continue her investigation. She has issued 12 information notices—I might have said this earlier—pertaining to Cambridge Analytica, and she plans to issue another six this week. One of those notices has been challenged, but she is now issuing a demand for access and she is getting where she needs to get. She was very surprised to read that Facebook had decided to plough into the offices of Cambridge Analytica when it was itself under investigation. She must have thought that an extraordinary course of action, but as soon as she intervened, Facebook desisted and removed itself from the offices of Cambridge Analytica to enable her to undertake her inquiries.

That is of course all happening under the existing legislation. The Bill will provide new powers, including the ability to serve assessment notices, backed up by warrants if they are not complied with.

Question put and agreed to.

Clause 153 accordingly ordered to stand part of the Bill.

Schedule 15 agreed to.

Clause 154

Penalty notices

[Margot James]

I beg to move amendment 179, in clause 154, page 85, line 39, leave out from the beginning to “when” and insert “Subject to subsection (3A),”.

This amendment and amendment 180 provide that the requirement in clause 154(2) and (3) for the Commissioner to have regard to listed matters when deciding whether to give a penalty notice, and determining the amount of a penalty, applies not only in the case of failures described in clause 148(2), (3) or (4) but also in the case of failures to comply with an information notice, an assessment notice or an enforcement notice.

[The Chair]

With this it will be convenient to discuss Government amendments 57 and 180.

[Margot James]

As part of the Information Commissioner’s suite of corrective powers, she can issue penalty notices to data controllers requiring them to pay a fine. Fines can be issued where a controller has failed to comply with a previous notice or where significant breaches of data protection legislation have taken place. Members will be aware from our debate this afternoon that the maximum such penalty will increase from £0.5 million to £17 million, or 4% of global turnover, for the most serious breaches.

When imposing a penalty for breaches of the GDPR, the commissioner must follow the procedures set out in article 83 of the GDPR, which include acting on a case-by-case basis; ensuring that the fine is effective, proportionate and dissuasive; and taking into account various factors. Because law enforcement and intelligence services processing falls outside the scope of the GDPR, the clause makes parallel provision in respect of breaches of those parts of the Bill, including by listing matters that the commissioner must take into account when deciding whether to issue a fine for that type of processing and when determining the magnitude of that fine.

Government amendments 179 and 180 make it clear that, when considering a person’s failure to comply with notices—an information notice, for example—the commissioner is to have regard to the matters listed in article 83(2) of the GDPR and, in relation to law enforcement processing and intelligence processing, to clause 154(3) and (4) of the Bill. Clause 154 prescribes such requirements only for decisions regarding the issuing of a monetary penalty notice in relation to certain failings. The commissioner has powers to prepare guidance on how she uses her enforcement powers, so she could decide, as a matter of policy, to have regard to those matters in relation to other failings. However, the Government’s view is that there should be a requirement for her to do so in the Bill.

Government amendment 57 makes an addition to clause 154(3)(c) to ensure that the Information Commissioner takes into account any actions the controller has taken to mitigate not only damages, but distress suffered by the data subject. The amendment will bring the clause into line with other similar clauses in the Bill, where the Information Commissioner must take into account damage or distress caused. They include clause 149 regarding enforcement notices, where the Information Commissioner must take into account the magnitude of the damage or distress caused by the controller. I am sure right hon. and hon. Members will agree that providing consistency across the Bill is important; the amendment is a step to ensure that that is provided.

Amendment 179 agreed to.

Amendments made: 57, in clause 154, page 86, line 10, at end insert “or distress”.

This amendment is for consistency with Clause 149(2). It requires the Commissioner, when deciding whether to give a penalty notice to a person in respect of a failure to which the GDPR does not apply and when determining the amount of the penalty, to have regard to any action taken by the controller or processor to mitigate the distress suffered by data subjects as a result of the failure.

Amendment 180, in clause 154, page 86, line 28, at end insert—

“(3A) Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 148(5).” —(Margot James.)

See the explanatory statement for amendment 179.

Question proposed, That the clause, as amended, stand part of the Bill.

[Louise Haigh]

I am sorry to labour the point; it is pertinent to the clause but also relates to the debate that we just had on information notices. The Minister has failed to set out why the Government have removed the custodial sentence as an enforcement power of the Information Commissioner when data controllers or processors breach information notices. The Minister said earlier that she does not accept that it is the Information Commissioner’s view that that weakens the existing data protection regime, but the commissioner explicitly set that out in her written evidence to the Committee:

“The new approach in the Bill of failure to comply with an IN no longer being a criminal offence but punishable by a monetary penalty issued by the ICO is likely to be less of a deterrent”.

We very much welcome the increased penalty as a sanction by the Information Commissioner, but the Minister has so far failed to set out why she has removed that custodial sentence, which, as the Information Commissioner has laid out, is a serious deterrent. That could weaken her abilities to investigate complex situations and, as I mentioned earlier, it is in direct contrast to the Irish Government’s approach, which carries a fine but also a custodial sentence of up to five years’ imprisonment if the data controller fails to comply with an information notice.

In written evidence, again, the Information Commission suggests that the Government’s approach pales in comparison to that taken by Ireland. Will the Minister take this opportunity to explain why she has so significantly weakened the Information Commissioner’s important powers?

[Margot James]

The clause replicates section 55(a) of the 1998 Act, which gives the commissioner a power to serve a monetary penalty, requiring the data controller to pay the commissioner an amount determined by the commissioner. The maximum penalty is specified in clause 156. Before the commissioner can issue a penalty notice, she must be satisfied that a person has failed to comply with certain provisions of the GDPR or the Bill, or has failed to comply with an information notice, assessment notice or enforcement notice.

Clearly, it is up to the commissioner to decide whether a penalty notice is appropriate. She has stated:

“It’s about putting the…citizen first. We can’t lose sight of that…It’s true we’ll have the power to impose fines much bigger than the £500,000 limit the DPA allows us.”

[Daniel Zeichner]

For reasons that are entirely understandable, my constituents in Cambridge take a particularly close interest in some of the things that have been happening with Cambridge Analytica this week. They will be astonished that the Minister does not seem to be answering the question raised by my hon. Friend the Member for Sheffield, Heeley. Financial penalties, yes, but criminal proceedings surely should be uppermost when we have seen these dreadful things that have been going on.

[Margot James]

I was coming on to answer the hon. Member for Sheffield, Heeley, but as the hon. Member for Cambridge has raised her question again, I will jump to it. We are not removing all criminal powers under this new legislation. Under paragraph 2 of schedule 15, the commissioner may enforce assessment notices. That power includes the new offence of obstructing a warrant, which is a criminal offence, so criminal offences do remain. As I said, we are looking at the commissioner’s desire for stronger powers in certain areas, but under the current law there is a criminal sanction only for non-compliance with a notice, and that offence is not used. A civil penalty is a better way forward and is provided as the appropriate sanction by the GDPR itself.

[Louise Haigh]

The Minister has just confirmed that under the existing arrangements a custodial sentence is the maximum penalty if an individual fails to comply with an information notice. She has not given a coherent reason why she is removing that through the Bill. Is she really arguing that criminal sanctions are less of a deterrent than civil? That is a direct contradiction of the Information Commissioner’s evidence.

[Margot James]

I have just been advised that the existing law is non-custodial criminal sanctions. I have referred to the criminal sanctions with respect to assessment notices, and I will get back to the hon. Lady on the question of the sanctions on the information notices that she has asked about. I am told what I am told; the existing law is non-custodial.

Question put and agreed to.

Clause 154, as amended, accordingly ordered to stand part of the Bill.

Schedule 16

PENALTIES

Amendments made: 123, page 203, line 26, leave out “with the day after” and insert “when”.

This amendment is consequential on Amendment 71.

124, page 204, line 10, leave out “with the day on which” and insert “when”.

This amendment is consequential on Amendment 71.

125, page 205, line 5, leave out “with the day after the day on which” and insert “when”.

This amendment is consequential on Amendment 71.

126, page 205, line 37, leave out “controller or processor” and insert “person to whom the penalty notice was given”.—(Margot James.)

This amendment is consequential on Amendment 52.

Schedule 16, as amended, agreed to.

Clause 155 ordered to stand part of the Bill.

Clause 156

Maximum amount of penalty

Question proposed, That the clause stand part of the Bill.

[Liam Byrne]

I think we could all do with a bit of clarity, which did not quite emerge in the last debate. My hon. Friend the Member for Sheffield, Heeley, makes an important point: in light of this week’s news, there is real concern that the maximum possible sentences should be on the books to punish people who try to get in the way of investigations by the Information Commissioner. Can the Minister say whether the Information Commissioner is currently able to prosecute people for getting in her way, and whether they could go to jail? That would be clarification No. 1. Clarification No. 2 would be whether, under the Bill the Minister is asking us to agree, that custodial sentence would still remain.

[Margot James]

I understand that under the current law there are no custodial sentencing provisions, so therefore I cannot argue that they will remain. That does not seem logical at all. The existing DPA offences are for fines only, according to section 60 of the Data Protection Act 1998.

Question put and agreed to.

Clause 156 accordingly ordered to stand part of the Bill.

Clause 157

Fixed penalties for non-compliance with charges regulations

Question proposed, That the clause stand part of the Bill.

[Liam Byrne]

Given the clarity that the Minister has now furnished for the Committee, and given the scale of wrongdoing that is alleged about Cambridge Analytica and potentially Facebook this week, the question on clause 157 is whether she is satisfied that financial penalties are going to do the job in the years to come. Otherwise, is this a clause on which we need to reflect on Report if not now so that if custodial sentences are not currently available, we might consider introducing them for people who appear determined to move heaven and earth to get in the way and obstruct an Information Commissioner inquiry? Could we perhaps come back to that on Report, rather than simply rely on sanctions such as fixed penalty notices?

[Margot James]

I have mentioned before to the right hon. Gentleman that there are criminal offences set out in the Bill, such as an offence of obstructing a warrant, which would enable the ICO to go in and exercise search and seizure powers. Although obstruction carries potential fines and a criminal record, I do not believe that it carries the threat of a custodial sentence, which is no change from the current situation.

As I have said before, and as my right hon. Friend the Secretary of State said yesterday, we are reviewing the enforcement powers of the ICO, and we are working with the commissioner to ensure that we get the whole suite absolutely right. I cannot say any more than I already have on that point.

Question put and agreed to.

Clause 157 accordingly ordered to stand part of the Bill.

Clause 158 ordered to stand part of the Bill.

Clause 159

Guidance about regulatory action

Amendment made: 58, in clause 159, page 89, line 37, leave out from “a” to end of line 38 and insert

“person to make oral representations about the Commissioner’s intention to give the person a penalty notice;”—(Margot James.)

This amendment is consequential on Amendment 52.

Clause 159, as amended, ordered to stand part of the Bill.

Clauses 160 to 163 ordered to stand part of the Bill.

Clause 164

Orders to progress complaints

Amendment made: 59, in clause 164, page 93, line 4, leave out “with the day on which” and insert “when”

This amendment is consequential on Amendment 71.—(Margot James.)

Clause 164, as amended, ordered to stand part of the Bill.

Clauses 165 to 167 ordered to stand part of the Bill.

Clause 168

Publishers of news-related material: damages and costs

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

The right hon. Gentleman is correct: it is essential that we do not create an offence in the clause that will snare whistleblowers. I am sure the Committee shares that goal. Indeed, if we created such an offence, whistleblowers would no longer be whistleblowers—a qualifying disclosure would no longer be a qualifying disclosure if it were an offence under different legislation, including the Bill.

We will listen carefully to what the Minister says, but, to come at it from a slightly different angle, as I understand it, the Employment Rights Act currently requires a “reasonable belief” by the worker making the whistleblowing disclosure that it is in the public interest to disclose that information. That seems a slightly easier test than the one contained in a defence in subsection (2) of the clause, which requires not a “reasonable belief”—those words do not appear—but proof that disclosure was justified in the public interest. There is also a contrast with subsection (3), where a reasonable belief test is applied to a defence but only in circumstances of publication of either journalistic, artistic or literary material.

It is not clear to me why there is a reasonable belief test in subsection (3) but not in subsection (2). I am interested to hear what the Minister has to say about that distinction.

[Margot James]

The amendments concern offences relating to personal data provided for by part 6 of the Bill. Hon. Members will be aware that the offence of unlawful obtaining of personal data has been carried over and updated from the 1998 Act to include the unlawful retention of personal data without the controller’s consent. By contrast, the offence of re-identification of de-identified personal data is new to data protection legislation, underlining our intention to bring data protection laws up to date with the digital age.

Amendment 157 would add an additional defence to clause 170 where the conduct is in the process of a disclosure by an employee raising public interest concerns about wrongdoing or malpractice to the extent that such disclosures would be protected by the Employment Rights Act 1996 and equivalent legislation for Northern Ireland. Amendment 158 adds the same defence to clause 171.

I share the sentiment of the amendments, but believe they are unnecessary. Clauses 170 and 171 provide defences in cases where the processing is necessary for the prevention or detection of crime or can be justified as being in the public interest. We believe that the crime prevention defence would cover a disclosure by an employee who suspected that an offence had been committed, and that the flexible public interest defence would encapsulate the other non-criminal activities envisaged by the amendments. In particular, as set out in section 43B of the Employment Rights Act 1996 and article 67B of the Employment Rights (Northern Ireland) Order 1996, a disclosure is protected in the first place only if the disclosing worker reasonably believes the disclosure to be in the public interest.

[Stuart C. McDonald]

This is a narrow question that I raised in my speech. There is a “reasonable belief” test in the 1996 Act. It is easier for someone to prove that they had a reasonable belief that a disclosure was in the public interest than to prove that it was in the public interest. That slight difference in wording may be significant. There are in fact two different tests in the clause, so I wonder whether the Minister might look at that again.

[Margot James]

I referred to the public interest defence as a flexible defence that would encapsulate non-criminal activities. I do not know whether that satisfies the hon. Gentleman, but a flexible public interest defence is indeed required.

For those reasons, I reassure hon. Members that a further defence providing for whistleblowing is unnecessary. It is telling that there is no such defence in section 55 of the 1998 Act, and we are not aware of any problems with its operation. Hon. Members mentioned section 58 of the Digital Economy Act 2017. That is a difficult comparison. Unlike clauses 170 and 171, section 58 does not contain a straightforward public interest defence, so, unlike the offences in the Bill, there may be no alternative protection for such disclosures. I hope I have given hon. Members sufficient reassurance that they feel confident withdrawing their amendments.

[Liam Byrne]

I am grateful to the Minister for that reply. She says that she wants to try to update the legislation. I understand what she is trying to do and why she does not accept that there is a complete parallel with the Digital Economy Act. None the less, the new definition will need to be tested in court, new guidance will need to be issued and new ambiguity will therefore be created, which brings with it the risk that important whistleblowers will be dissuaded from bringing forward information that is in our interest and letting it see the light of day.

I hope the Minister reflects on that further. She seeks to create an extension in law to ensure that there is a public interest definition in the round—I can see the enlargement that she is trying to make—but I hope she reflects before Report stage on the challenge that new definitions will have to be tested in court, which will create ambiguity and risk. I do not think she wants to create that risk, but the strategy she sets out does not completely delete it and it remains a concern. I will happily withdraw the amendment, but I ask the Minister to reflect on that point before Report.

[Margot James]

I am happy to reflect on what the right hon. Gentleman proposes. The last thing we want is to have any chilling effect on would-be whistleblowers.

[Liam Byrne]

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 170 ordered to stand part of the Bill.

Clause 171

Re-identification of de-identified personal data

Question proposed, That the clause stand part of the Bill.

[The Chair]

I hope the Minister understood all that.

[Margot James]

I am sure you did, Mr Streeter.

Clause 171 creates a new offence of knowingly or recklessly re-identifying information that has been de-identified without the consent of the controller who de-identified the data. It is a response to concerns about the security of de-identified data held in online files. For example, recommendations in the review of data security, consent and opt-outs by the National Data Guardian for Health and Care call for the Government to introduce stronger sanctions to protect de-identified patient data, to which I think the hon. Member for Bristol North West was referring.

Subsection (3) provides the defendant with a defence if he or she can prove that re-identification was necessary for the purposes of preventing crime or complying with a legal obligation, or that it was justified in the public interest. Subsection (4) provides further defences where the defendant can prove they reasonably believed that they had or would have had the consent of the data subjects to whom the information relates or of the data controller responsible for de-identifying the information, or that they acted for the special purposes, with a view to publication, and the re-identification was reasonably believed to be justified in the public interest, or if the effectiveness testing conditions in clause 172 were met.

I have perhaps strayed rather far into the matter of defences in answering the hon. Gentleman, and may not have entirely satisfied him as to his question. If he is agreeable I will write to him, and get from my officials the latest as to the oversight of the important questions he raises.

[Louise Haigh]

My hon. Friend the Member for Bristol North West has raised important questions about social media providers. Before I entered this place, I worked in the insurance industry. Will the Minister confirm whether insurers would be covered by the clause if they re-identified individuals from datasets to inform the pricing of risk? That is potentially serious when considering the implications of loyalty card, bank or shopping information for health insurance.

[Margot James]

I will have to write to the hon. Lady on that. I do not think it would provide cover for insurance companies in those circumstances, but I would like to double-check before I give a definitive answer to her question.

Question put and agreed to.

Clause 171 accordingly ordered to stand part of the Bill.

Clauses 172 to 176 ordered to stand part of the Bill.



Clause 177

Jurisdiction

[Darren Jones (Bristol North West) (Lab)]

I beg to move amendment 151, in clause 177, page 102, line 13, at end insert—

“(4) Notwithstanding any provision in section 6 of the European Union (Withdrawal) Act 2018, a court or tribunal shall have regard to decisions made by the European Court after exit day so far as they relate to any provision under this Act.”.

For fear of sounding like a broken record, my arguments in favour of the amendment are broadly similar to those for amendment 152—in seeking to assist the Government in our shared aim of getting a decision of adequacy with the European Commission, it would be helpful to set out in the Bill our commitment to tracking and implementing European jurisprudence in the area of data protection. Members will remember that amendment 152 dealt with the European data protection board. Amendment 151 makes the same argument, but in respect of the European Court.

I appreciate that there may be some political challenges in stating the aim that the UK will mirror the European Court’s jurisdiction, but the reality is that developing European data protection law, either directly from the courts or through the European data protection board, will in essence come from the application of European law at the European Court of Justice. The amendment does not seek to cause political problems for the Government, but merely says that we ought to have regard to European case law in UK courts, in order to provide the obligation to our learned friends in the judiciary to have regard to European legal decision making and debates in applying European-derived law in the United Kingdom. This short amendment seeks merely to put that into the Bill, to assist the Government in their negotiations on adequacy with the European Commission.

[Liam Byrne]

I would like to say a word in support of this important amendment. We had a rich and unsatisfactory debate on the incorporation of article 8 of the European charter of fundamental rights into British law. We think that that would have helped the Government considerably in ensuring that there is no divergence between the European data protection regime and our own. If the Government are successful, they will operate on different constitutional bases, and there is therefore a real risk of divergence over the years to come. I think that everyone on the Committee is now pretty well versed in the damage that that would do to British exports, many of which are digitally enabled. This is a really helpful amendment. It tries to tighten to lockstep that we have to maintain with European data protection regimes, which will be good for exports, services and the British economy, and the Government should accept it.

[Margot James]

When we leave the European Union, the direct jurisdiction of the Court of Justice of the European Union in the UK will come to an end. Clause 6 of the European Union (Withdrawal) Bill gives effect to that and takes a clear and logical approach to how our domestic courts should approach the case law of the CJEU as a result. In short, where a judgment precedes our exit, it is binding on courts below the Supreme Court. Where a judgment post-dates our exit, our courts may have regard to it if they consider it appropriate, but EU law and the decisions of the ECJ will continue to affect us. The ECJ determines whether agreements that the EU has struck are legal under the EU’s own law. If, as part of our future partnership, Parliament passes an identical law to an EU law, it may make sense for our courts to look at the appropriate ECJ judgments so that we interpret those laws consistently, but our Parliament would ultimately remain sovereign.

--- Later in debate ---

[Ian Murray (Edinburgh South) (Lab)]

The Prime Minister said in her Mansion House speech earlier this month that as a country we may have to stay under the jurisdiction of the ECJ for the purposes of organisations such as Euratom and other EU-wide organisations that the UK may wish to remain part of. Is the Minister saying that that is a possibility with regard to data protection laws in this legislation?

[Margot James]

The future of our membership of the European Data Protection Board will be subject to negotiations. I cannot prejudge how those negotiations will develop and finalise in respect of our membership of that important body.

[Ian Murray]

Am I right in saying that the Minister is not ruling it out as part of the legislation?

[Margot James]

I would not rule it out, but the negotiations are between two parties, so however much we may wish to maintain our membership of the European data protection board, that might not be something that the EU will grant us. As I say, it is a matter for negotiation and I am sure things will become clearer over the next 12 months. To take an approach now that would require our courts to follow future case law of the CJEU, even if only in some areas, would place limitations on the discretion and independence of our courts.

[Liam Byrne]

The Minister is trying to protect a discretion that sounds like the defence of a right to depart from EU case law to such an extent that we might jeopardise an adequacy agreement. Surely the point of this amendment is to keep us in lockstep, to de-risk that adequacy agreement for the years to come. That surely must be an object of her Government’s policy.

[Margot James]

The Government are absolutely committed to getting an adequacy agreement. The Prime Minister has said she wishes to go beyond adequacy in the negotiations. I would like to reassure the right hon. Gentleman that the very opposite is the case. Our courts can have regard to, and that is good enough. There is no reason for this to be different in the area of data protection from what it might be in any other area.

The provision has been discussed at length and agreed to by the House. Hon. Members will be aware that the other place is now scrutinising the EU (Withdrawal) Bill and has focused on this very matter. There is broad agreement that we need to consider how best to ensure that the Bill achieves the policy aim with sufficient clarity. We want to reach agreement on a proposition that commands the greatest possible support. We should, however, be wary of seeking to provide for something that alters the underlying policy in a way that binds or steers our courts towards a particular outcome, for example, by saying that they must have regard in only certain areas of law.

[Liam Byrne]

I do not quite follow the Minister’s argument. On the one hand, she says that it is the object of Government policy to secure an adequacy agreement and presumably keep that adequacy agreement, if not, indeed, go beyond it. She is now seeking to defend a flexibility that would allow some kind of departure from European norms. I cannot understand how she can quite want her cake and eat it.

[Margot James]

Courts will be allowed to follow the jurisprudence of the ECJ in this area of data protection. Nothing I am saying is prompting a departure from that position. We see the amendment as going further than we would like to go. By contrast, the Government’s proposed approach to CJEU oversight respects the referendum result and is clear, consistent and achievable.

[Darren Jones]

The Minister gave a full answer, largely in agreement with the points I made.

[Margot James]

Not much; not with those.

[Darren Jones]

I agree. I would therefore invite the Government to reconsider their position and support the amendment, because it reflects what is in the EU (Withdrawal) Bill, it talks about having regard to ECJ jurisprudence in future and, as the Minister pointed out, Government policy and the Government’s intention are that we are going to end up in that position anyway. By putting that in the Bill, we would put it into law and give a very clear signal to our colleagues in the European Union that that is our intention and we will stand by it.

The Minister’s arguments do not seem to stack up. If I were saying in the amendment that we must apply ECJ case law directly and that the UK courts had no power to disregard EU jurisprudence I would probably agree, but that is not what it seeks to do. I am not convinced it goes beyond the Government’s policy position nor what is said in the EU (Withdrawal) Bill. I merely seek to help the Government by making this simple amendment to the Bill. With your permission, Mr Streeter, I will push it to a vote.

Question put, That the amendment be made.