Data Protection Bill [Lords]

Matt Hancock Excerpts

Money resolution: House of Commons & Programme motion: House of Commons
Monday 5th March 2018 Commons Chamber

[The Secretary of State for Digital, Culture, Media and Sport (Matt Hancock)]

I beg to move, That the Bill be now read a Second time.

This House has a noble track record of working with rather than against technology. Whether it was the Electric Lighting Act 1882, which paved the way for electricity in the 19th century, or the Television Act 1954, which opened up our airwaves to commercial TV broadcasters in the 20th century, we have always helped pioneers to overcome obstacles and to use technology to make life better. The Data Protection Bill will do this, too. It will give people more power and control over their online lives while supporting innovation and entrepreneurship in the digital age, helping to make Britain fit for the future.

The Bill will deliver real benefits across the country, helping our businesses to compete and trade abroad. Strong data protection laws give consumers confidence in the products and services that they buy, and that is good for business, not bad. The Bill provides a full data protection framework as we leave the EU, consistent with the general data protection regulation in EU law. In October, the House debated how our data protection landscape will look after we leave the EU. Members on both sides agreed that the unhindered flow of data between the UK and the EU is vital and in the interests of both. Through today’s Bill, we can make that a reality.

[Chi Onwurah (Newcastle upon Tyne Central) (Lab)]

I am grateful to the Secretary of State for his opening remarks about the importance of the House supporting technology. He will know that data drives our economy and society in ways that people can find difficult to follow. The internet of things will increase exponentially the data trail we all leave, but the digital charter suggests only that private companies follow best practice. Does he not recognise the importance of data rights? Why is he not bringing forward a Bill of data rights?

[Matt Hancock]

I absolutely do, and the Bill does bring forward the right to the protection of personal data, as I will set out. It is incredibly important to ensure that such rights keep pace with the sort of modern technologies that the hon. Lady—she is extremely well informed on these topics—refers to, such as the internet of things. The Bill will directly address the issue she raises by strengthening citizens’ rights in this new digital era, and I will detail the new rights later.

As digital becomes default in our society, people are trusting businesses and public services with more personal and sensitive data than ever before, including through their personal use of the internet and the internet of things, yet without trust that that data will be properly handled, the digital economy simply cannot succeed. Trust underpins a strong economy, and trust in data underpins a strong digital economy. The Bill will strengthen trust in the use of data by enhancing the control, transparency and security of data for people and businesses across the UK. I will speak to each of these three in turn.

First, on control, the Bill delivers on our commitment in the digital charter to empower citizens to take control of their data—after all, data belongs to citizens even when it is held by others—and sets new standards for protecting data while giving new rights to remove or delete it. Everyone will have the right to make sure that the data held about them is fair and accurate, and held in a way that aligns with rigorous principles.

[Joanna Cherry (Edinburgh South West) (SNP)]

Is it really accurate to say that everyone will have that right, given the immigration exemption?

[Matt Hancock]

Yes, of course. Everyone who is a British citizen will have the right to make sure that data about them is held fairly and accurately, and in alignment with rigorous principles. The hon. and learned Lady raises obliquely the point that the Bill contains important exemptions, including those to allow MPs to act on behalf of constituents as part of their casework, and to ensure that we can properly police our borders. I will come to that in more detail later. Nevertheless, at the heart of the Bill is citizens’ ability to control the data that companies and other organisations hold about them.

[Sir Edward Davey (Kingston and Surbiton) (LD)]

Further to the point made by the hon. and learned Member for Edinburgh South West (Joanna Cherry), will the Secretary of State explain the legal basis for the immigration exemption from the general data protection regulation?

[Matt Hancock]

Yes, of course. Exemptions from the GDPR are allowed so that necessary activities can be carried out, including that of making sure that a minority of individuals cannot abuse data protection law with the sole intent of undermining immigration controls. That is provided for in the necessary exemptions. I know that this point was debated extensively in the other place, but we firmly believe not only that it is important to ensure that we can control our borders through immigration controls, but that this is provided for in the GDPR.

[Joanna Cherry]

The Secretary of State says that the immigration exemption is covered by the GDPR, but is he aware of legal opinion saying that the text of parts 1 and 4 of schedule 2 does not in fact reflect the stated permissible exemptions under article 23 of the GDPR? That is independent legal opinion, not mine.

[Matt Hancock]

Of course, there are always legal opinions about everything, and our legal opinion is that that is consistent—that is the basis on which we are proceeding. As I am sure the vast majority of Members would agree, it is important that we control our borders.

The Bill provides new data rights, including a stronger right to be forgotten.

[Rebecca Pow (Taunton Deane) (Con)]

I welcome the element of the Bill about the right to be forgotten. I am sure that the Secretary of State is aware that the Digital, Culture, Media and Sport Committee is carrying out an inquiry into fake news, during which this whole issue of data—who owns it, who holds it and who knows what about whom—has come under the spotlight. Can he say how the Bill might help to control that?

--- Later in debate ---

[Matt Hancock]

Yes, I can.

[Bill Wiggin (North Herefordshire) (Con)]

Before he does, will the Secretary of State give way?

[Matt Hancock]

Of course.

[Bill Wiggin]

Will the provisions apply to Wikipedia as well?

[Matt Hancock]

I will happily respond to both points. Under the Bill, data must be deleted unless there are legitimate grounds for retaining it. The details of what is meant by legitimate grounds will be set out in recitals and then guidance from the Information Commissioner. This is one area in which the right to be forgotten, which has been long dreamt of and thought about, is now being legislated for, and the precise details of where it applies will be set out in guidance, as the Bill states only that there need to be legitimate grounds for retaining data.

[Mr Jacob Rees-Mogg (North East Somerset) (Con)]

Can we be certain that this right to be forgotten will not impede freedom of speech? I am thinking of Max Mosley, of course, and the information that came out on what he said in 1961, which is relevant and pertinent to current debates. We should do nothing that limits the right of a free press.

[Matt Hancock]

I wholeheartedly agree with my hon. Friend about not limiting the rights of the free press. He might be aware of amendments that were made in the other place on exactly that issue and that are supported by a number of Members of this House, including, notably, some who are also supported by Max Mosley. I think that we should remove those two provisions. The ability of our press properly to scrutinise is important and should not be undermined in the ways proposed, but I will come to that in more detail later.

The right to be forgotten is an important element of making sure that data is held appropriately and when there are legitimate grounds. The Bill also allows for data portability—a person’s right to transfer their data from one provider to another.

[Stephen Timms (East Ham) (Lab)]

As the Secretary of State is describing, the Bill puts into UK law the EU’s general data protection regulation, which is the right thing to do. I am confident that he would agree that we need to ensure that our data protection rules stay in line with the EU regulation as things develop. Does it trouble him that we will have less influence over the future content of the EU’s rules once we have left it?

[Matt Hancock]

I agree that this is a strong set of data protection standards. We intend to stay aligned with the EU standards, not least because they are extraterritorial, which means that anyone wanting to do any business or transactions with EU citizens would have to follow them anyway. There is therefore a very strong case for alignment in this area. Indeed, we have set out that we want the Information Commissioner to remain engaged with the future development of technical standards because we expect the GDPR effectively to become a standard that is increasingly followed around the world by companies that want to engage with the EU, and because we believe that high data protection standards go hand in hand with the capability to innovate and provide for customers. The Prime Minister was, of course, clear about the detail on Friday.

[Sir Edward Davey]

I am afraid that the Secretary of State has not answered the question asked by the right hon. Member for East Ham (Stephen Timms). Is it not true that UK companies will be bound by rules that the EU will decide? Those rules will affect a huge amount of business, but we will have no influence over them after we leave the EU?

[Matt Hancock]

I thought I had answered the question—the right hon. Member for East Ham (Stephen Timms) was nodding, so I thought I had at least had a crack at it. As the Prime Minister set out on Friday, and as we set out for the first time last August, we will seek, through the Information Commissioner’s Office, to remain engaged in those technical discussions about the future of the rules. As was proposed in the Conservative party manifesto, the Bill also gives young people the right to have data about them removed once they are 18 years old.

The second element is transparency, which is absolutely vital. All citizens should be able to know what is happening to their data and how it is being used. The Bill requires data controllers to give people information about who controls data, the purpose of processing it, and how long it will be stored. That is especially crucial in a world in which emerging technologies such as artificial intelligence are making increasingly important ethical decisions. The Bill therefore provides powers for the restriction of automated decision making and safeguards for those whose data is used. Our new centre for data ethics and innovation will advise on those safeguards, so that we can promote innovation and respond quickly to changes in technology with clear and transparent guidelines that are based on openness and consent.

The third principle is security. The Bill enhances requirements relating to the security of data and strengthens enforcement for those who do not comply. Data security and innovation go hand in hand, and this move will benefit customers and all responsible businesses. The Data Protection Act 1998 has served us well and placed the UK at the forefront of global data protection standards, but the world has changed since 1998, and the Bill updates the position to make our laws fit for purpose in an increasingly digital economy and society. It modernises many of the offences under the Act and creates new offences to help us to deal with emerging challenges.

[Dr David Drew (Stroud) (Lab/Co-op)]

The Secretary of State is being very generous in taking interventions. He has probably heard from the National Association of Local Councils, which represents parish and town councils. It has asked that an external data protection officer will not have to be appointed at every council level. There would be a cost of some £3.5 million to the smallest but most relevant authorities, so will the Secretary of State be sympathetic to its request for relief from that onerous responsibility?

[Matt Hancock]

I have received representations not only from the National Association of Local Councils, but from the Suffolk Association of Local Councils and many of my own parish councils—including Moulton Parish Council—which do an admirable job in telling me about the pressures facing parish councils throughout the country. I pay tribute to them for their efforts, and for the length of their representations to me.

Of course it is important for parish councils, and other local councils, to follow high-quality data protection standards. The Information Commissioner’s Office has provided extensive guidance to help organisations to prepare for their new responsibilities, and I urge councils to look at it.

The responsibilities of data protection officers—this is relevant to the issue raised by the hon. Gentleman—can be implemented in different ways. For instance, several parish councils can choose to share a single data protection officer, provided that he or she is easily accessible from each establishment. The system does not require the hiring of one person per organisation. Organisations have already been set up to provide this service, and the service itself is important. In the case of a small organisation, such as a very small business or a parish council on a low budget, it is still important for data to be handled and protected carefully, because small organisations too can hold very sensitive personal information. I am extremely sympathetic to the plight of small businesses that must deal with regulation—especially as I come from a small business background myself—but I am also convinced that it is good practice to follow high-quality data protection standards and that it is good for organisations to do so.

[James Cartlidge (South Suffolk) (Con)]

I thank my right hon. Friend for giving way. He is being very generous.

I knew that some small businesses in my constituency were concerned about the impact of the GDPR, so I telephoned the Information Commissioner’s Office to find out what support was available to them. The only answer that the office could give to every question that I asked about how the GDPR would affect small businesses was “Go to the website.” Does my right hon. Friend agree that we should expect better from a telephone line that is funded by the taxpayer?

[Matt Hancock]

I am glad that there is a telephone line. I am sure that the Information Commissioner will be watching the debate and will hear the plea for clear guidance on how small organisations in particular should implement data protection standards, whether they are small councils or small businesses. However, the Information Commissioner’s Office has already provided clearer guidance, as well as the telephone line. It is obviously listening, with the aim of getting the guidance right and ensuring that, in lay terms, meeting the new standards is straightforward. This issue came up in the other place as well. It is important for us to get the implementation right, especially in the case of small organisations.

[Chris Bryant (Rhondda) (Lab)]

The Secretary of State has referred to the right to be forgotten. May I suggest that there might be another right, namely the right to be remembered correctly? All too often, in response to freedom of information requests about, for instance, national security, the Government have imposed a blanket ban on the publication of any information—even many years after the individual concerned has died, when it is pretty difficult to see why there should still be a national security issue. I wonder whether it would not be a good idea for us to have some means of extracting such information in 20, 30, 40 or 50 years’ time.

--- Later in debate ---

[Matt Hancock]

The Bill does not change the freedom of information regime. However, it does establish a data protection regime relating to intelligence services and national security, about which I shall say more shortly, and which will no doubt be scrutinised by the House. The specific issue of the release of records is not in the scope of the Bill, because it is about the protection of live data rather than the release of records. The 30-year rule has, in the main, been changed to a 20-year rule, but of course there are national security opt-outs, some of which are incredibly important.

[Chris Bryant]

Of course there should be national security opt-outs, and when we were changing the rule from 30 to 20 years, I was one of the Ministers who ensured that they were strong. My anxiety is, however, that all too often the security services impose a complete blanket ban, which means that we as a nation are not properly able to understand what happened in the 1930s, 1940s and 1950s. If we were better informed about that, we might be able to make better decisions for our own national security in the future.

[Matt Hancock]

I do not wish to labour the point. I too was the Minister responsible for national security releases. All I can say is that that is not within the scope of the Bill, and I think the system works effectively.

As recommended by Dame Fiona Caldicott, the National Data Guardian for Health and Care, the Bill creates a new offence of the unlawful re-identification of de-identified personal data. It offers new safeguards for children, including a new code on age-appropriate website design. Currently, the law on parental consent for children on social media is complicated, but in most cases it applies to children up to 12 years old. The Bill provides for consent to be required in the case of children aged up to 13, so that parents have more control but the law is still practical.

The Bill also sets out clearer frameworks for data security—for example, by giving everyone a right to know when their data has been breached. We are strengthening the enforcement powers of the Information Commissioner to reflect a world in which data is held and used in much more sophisticated ways than ever before. Under the Bill, the commissioner can issue substantial penalties of up to 4% of global turnover. When she finds criminality, she can also prosecute. With greater control, greater transparency and greater security for our data, the Bill will help to give us a statute book that is fit for the digital age as we leave the EU.

Let me now touch on some specific areas in a little more detail. This is a forensic Bill with 208 clauses. It covers a vast area of British life, including financial services, sport, the protection of equality and much more. It also includes provisions that will support Members of this House in the work that we do, and it will make it easier for us to take up casework on behalf of our constituents.

The Bill provides for three parallel schemes to protect personal data. First, on general data, which accounts for the vast majority of data processing across all sectors of the economy and the public sector, this part of the Bill works in tandem with the EU’s GDPR, which we have discussed. We know that small businesses need advice on this, and it is important to get right the advice from the Information Commissioner’s Office. It says in my notes that the ICO has a small business helpline, but we have already heard about that in the debate.

[Rebecca Pow]

I have been contacted by a number of businesses in Taunton Deane that are concerned about the work already placed on them to comply with data protection legislation. Can the Secretary of State confirm that this Bill will not give them a further workload, that it will indeed help those needing to trade in future across Europe and that it should, overall, be a benefit?

[Matt Hancock]

That is right. The Bill is structured to be consistent with the EU law elements of GDPR, which automatically apply from 25 May this year, to ensure that the non-EU elements of data protection, with respect to general data processing, national security data and law enforcement data, provide for a full spectrum framework for data protection once we leave the EU. The Bill is designed in such a way that it is as simple as possible for businesses to comply with the data protection standards that will be directly enforced from 25 May anyway. That is why from the point of view of small businesses, it is important that we get this Bill through by 25 May, and we have a fully functioning data protection framework. However, I certainly take on board, and am sympathetic to, the concerns my hon. Friend raises about small businesses and the need to ensure our data system is innovative in the future, and that people can comply with the rules. I hope that satisfies her on the concerns of small businesses in her constituency, as well as those of small councils and indeed small charities, which have to comply as well.

The schemes are designed to make sure the police can keep using and sharing personal data to prevent and investigate crime, to bring offenders to justice and to keep communities safe. Likewise, the Bill makes provisions for the personal data processed by our intelligence agencies, so they can continue to protect our country at a time of heightened terrorist threat. The intelligence services will be part of this new framework under the supervision of the Information Commissioner.

We also want to support the hard-hitting investigative journalism that holds the powerful to account and that we have touched on already—and it is good to see my hon. Friend the Member for North East Somerset (Mr Rees-Mogg) engaging with the digital economy on his smartphone; I am delighted that he welcomes at least some elements of the 21st century. On this point, I want briefly to comment on the proposed clauses inserted by the Lords. I set out our response to the consultation on the future of the Leveson inquiry last week, so I will not set out the arguments again in full this afternoon, but I will say this: the amendments are simply not the answer to today’s problems faced by the media. It has been six years since the Leveson inquiry reported; since then, we have seen the completion of three detailed police investigations, extensive reforms to police practices and some of the most significant changes to press self-regulation in recent times. Meanwhile, the media are facing critical challenges that threaten their sustainability, including fake news, declining circulations and in gaining revenue from online content.

On top of that, the amendments undermine our devolution settlement. The new clauses seek to legislate on a UK-wide basis, despite press regulation being a reserved matter for the devolved Administrations. I hope Scottish National party Members, and indeed all Members, will join me in voting these amendments down.

[Andy Slaughter (Hammersmith) (Lab)]

The Secretary of State is not sounding any more convincing than he did in his statement on Thursday. Failure to proceed with part two of Leveson and section 40 of the Crime and Courts Act 2013 is a disgusting and cowardly betrayal of the victims of media harassment. It does not even leave those victims in the same position as before, because since Leveson the Legal Aid, Sentencing and Punishment of Offenders Act 2012 has hobbled the ability of claimants in privacy and defamation actions to access no-win, no-fee representation. Therefore, section 40 is now the only way to ensure access to justice, which is as helpful to small publishers as it is to citizens. Why does the Secretary of State not put their interests before those of big newspaper groups, instead of currying favour for himself and his weak Government?

[Matt Hancock]

We debated this at length on Thursday and discussed the fact that it is vital that we look to what is needed for the media now, to ensure that instead of having a set of proposals that were designed several years ago and that would lead to any claimant being able to claim costs no matter the merits of their case, we have measures that enable our press to be sustainable for the future.

[John Redwood (Wokingham) (Con)]

I support the Secretary of State in proposing that these amendments be removed. Like many in this place, I have been on the wrong end of fake news and misrepresentation many times, so I do not do so out of personal interest. I think there is a wider public interest: a free press is an extremely important part of a democracy. The press will not always get it right, but we need to be very careful about the amendments from the Lords.

[Matt Hancock]

I wholeheartedly agree with my right hon. Friend.

This Bill is an essential piece of legislation that makes the UK’s data laws among the most effective in the world. This House must never shy away from supporting new technology. The Electric Lighting Act 1882 was considered so important that the House sat on a Saturday to get it through. I hope that will not be necessary this time, but I do hope that the House will adopt similar enthusiasm in backing this Bill. Doing so would support our entrepreneurs in harnessing the value of data, while giving citizens confidence when they go online.

I was pleased a few weeks ago that the Opposition Front-Bench teams in the other place agreed that the Bill was a positive and necessary step. I hope the whole House will agree tonight, and I commend this Bill to the House.

--- Later in debate ---

[Matt Hancock]

As the hon. Gentleman may or may not know, it is entirely standard to count in that way. The same was done on the questions of equal marriage and of BBC charter reform, because there is a material difference between clicking a button to sign a preformed digital signature and writing in separately. This is how things have been in other big consultations. It is entirely normal, and the full details were set out last Thursday.

[Tom Watson]

The Secretary of State is obviously living in the analogue age if he thinks that he can accept a coupon from The Sun but ignore 200,000 citizens expressing their concern about the inquiry.

I have only one question for the Secretary of State. Will the Government be able to detail what they will do if evidence of wrongdoing is revealed, in particular if editors misled or were partial in their evidence to the original inquiry? We still need Leveson 2, and Sir Brian agrees.

--- Later in debate ---

[Stephen Timms (East Ham) (Lab)]

Like my hon. Friend the Member for Cambridge (Daniel Zeichner), who gave an excellent speech a few minutes ago, I will focus my remarks on the data protection aspects of the Bill. The Minister will have seen the press report this morning on research carried out by the Federation of Small Businesses showing that fewer than one in 10 small businesses is fully prepared for the obligations that this legislation imposes on them, and just under one in five has not yet heard of the GDPR. These obligations all take effect at the end of May—in less than three months’ time—so whatever the merits of this Bill, there is clearly a huge amount of work to be done in drawing the attention of those affected to what it means.

Ministers have made some changes to the Bill during its passage through the other place since we last discussed it in this Chamber on 12 October. In that debate, I and others made the point that my hon. Friend the Member for West Bromwich East (Tom Watson) made earlier—that leaving article 8 of the European charter of fundamental rights outside UK law poses a serious threat to our achieving a data adequacy determination from the European Commission in future. I therefore welcome the addition of what is now clause 2, which partly addresses that. However, I do not think it goes far enough, so I will be supporting my hon. Friend’s proposal that article 8 should be added to our statute book. Lord Stevenson tabled an amendment in the other place that said:

“The protection of personal data may not be lawfully restricted or limited unless such restrictions and limitations are consistent with the principle of proportionality.”

That is an important additional protection that ought to be in the Bill. I hope that we will be able to debate that amendment in Committee.

There is some confusion in the Government about all this. The Secretary of State set out how important it is that we keep our UK data regulation aligned with the regulation in the European Union because of the importance to the UK economy of personal data transfers between the UK and the EU. He is absolutely right about that. However, in recent months, the Foreign Secretary and the International Trade Secretary have suggested from time to time that it would be a good thing if the UK could deviate from EU rules on data protection. Last July, for example, the International Trade Secretary said in the United States—I am quoting from a report in the Financial Times—that the UK was more in line with US calls for information to be allowed to flow freely across borders while Germany and other EU countries insist on localisation. He was getting a bit confused about two different things, but he is clearly suggesting in that remark, as in others, that it could be a good thing for the UK to deviate from EU data protection rules. In fact—the Secretary of State is absolutely right about this—it would be a disaster for the UK to deviate from EU data protection regulation, because if the EU were to judge our data protection rules to be inadequate, a large chunk of the UK economy would immediately be without any lawful basis. That could affect exactly the kind of innovative company to which my hon. Friend the Member for Cambridge drew attention—a games company with players all over Europe who, as a part of playing the game, need to be able to send personal data between their country and the European Union.

[Matt Hancock]

The right hon. Gentleman has made this point in these debates several times, and I want to reassure him on the Government’s precise position. I stated this in my remarks, not speaking from notes, but let me read to him what the Prime Minister said in her speech on Friday:

“we will be seeking more than just an adequacy arrangement and want to see an appropriate ongoing role for the UK’s Information Commissioner’s Office. This will ensure UK businesses are effectively represented under the EU’s new ‘one stop shop’ mechanism for resolving data protection disputes.”

So there you have it.

[Stephen Timms]

I am grateful to the Secretary of State, and I welcome that commitment on the part of the Prime Minister.

The problem is, however, that the International Trade Secretary and the Foreign Secretary have been saying different. That led to techUK, the industry body, writing to the International Trade Secretary last month to highlight the dangers. This was reported by that reliable publication, The Daily Telegraph, on 19 February, with the headline: “Tech industry warns Ministers not to drop EU security laws”. The report began:

“The British tech industry has issued a stark warning to leading Brexiteer ministers that diverging from EU data protection standards after Brexit will ‘undermine’ the UK’s status as Europe’s leading tech hub.”

The Secretary of State is absolutely right not to have gone down the same road as his right hon. Friends, and I very much welcome what the Prime Minister said about all this on Friday. However, there is clearly a problem in the Cabinet. I gather that after sending that letter, techUK received a reassuring response from the Department, and then a few days later a non-executive director at the Department for International Trade was quoted as saying, “Complying with EU standards on data is not the only solution.” But the truth is that for a large part of the UK economy, it is the only solution. We need to be absolutely clear about this. I am delighted that the Secretary of State is clear about it. Of course, that is why he is bringing this Bill before us and why he has altered it in line with what a number of us said in October.

[Matt Hancock]

I hate to take the wind out of the right hon. Gentleman’s sails, but it was unusual to receive that letter from techUK, because rarely as a Minister have I been lobbied so strongly in support of my own position.

[Stephen Timms]

I am glad that the Secretary of State has been lobbied in support of his own position, but he needs to watch his back against Ministers who lack the clarity that he has expressed—particularly the International Trade Secretary and the Foreign Secretary, who continue to say that there is merit in divergence. There is no merit in divergence at all. Significant numbers of tech start-ups are already going to Berlin rather than basing themselves in the UK because of the uncertainty about this issue. The more uncertainty there is, fanned by some members of the Cabinet, the greater the economic damage to the UK.

This is a very clear example of the situation we are going to find ourselves in more and more when we have left the European Union. It will be asserted that because of our economic interests, in this case, we should comply with rules drawn up by the European Union—in this case, the general data protection regulation—but we will no longer have a vote about what those rules should be. We will become a rule-taker. I welcome the commitment that the Prime Minister has made to a place for the UK’s Information Commissioner on the European data protection board. That will be helpful. It means that we will at least get a voice in these discussions when the rules are being drawn up—but we will not get a vote. We will be less influential in EU data protection laws than we have been as members of the European Union. We need to recognise that our influence, including over laws that we are going to have to implement ourselves, will be less in future than it has been up to now.

I would very much welcome the Minister telling us—my hon. Friend the Member for Cambridge made this point as well—how, in future, we are going to make adequacy determinations about other countries’ data protection laws. Are we going to adopt the EU list and say that those 12 countries are adequate and others are not, or are we going to have our own processes? How is it going to be done?

I echo the concerns expressed by a number of Members about the threats to our future data adequacy determination that come from the immigration exemption and the national security exemption. Those were not well defended by Ministers in the debates in the other place, and the justification for them is not clear. As others have said, they leave us open to criticisms of our data protection regulations that could threaten our future adequacy determinations. I am very keen to hear the Minister’s response to those concerns in particular.

Data Protection Bill [Lords]

Matt Hancock Excerpts

3rd reading: House of Commons & Report stage: House of Commons
Wednesday 9th May 2018 Commons Chamber

[The Secretary of State for Digital, Culture, Media and Sport (Matt Hancock)]

I beg to move, That the clause be read a Second time.

[Madam Deputy Speaker (Dame Rosie Winterton)]

With this it will be convenient to discuss the following:

Government new clause 22—Review of processing of personal data for the purposes of journalism.

Government new clause 23—Data protection and journalism code.

New clause 18—Data protection breaches by national news publishers—

“(1) The Secretary of State must, within the period of three months beginning with the day on which this Act is passed, establish an inquiry under the Inquiries Act 2005 into allegations of data protection breaches committed by or on behalf of national news publishers and other media organisations.

(2) Before setting the terms of reference of and other arrangements for the inquiry the Secretary of State must—

(a) consult the Scottish Ministers with a view to ensuring, in particular, that the inquiry will consider the separate legal context and other circumstances of Scotland;

(b) consult Northern Ireland Ministers and members of the Northern Ireland Assembly with a view to ensuring, in particular, that the inquiry will consider the separate legal context and other circumstances of Northern Ireland;

(c) consult persons appearing to the Secretary of State to represent the interests of victims of data protection breaches committed by, on behalf of or in relation to, national news publishers and other media organisations; and

(d) consult persons appearing to the Secretary of State to represent the interests of news publishers and other media organisations (having regard in particular to organisations representing journalists).

(3) The terms of reference for the inquiry must include requirements—

(e) to inquire into the extent of unlawful or improper conduct by or on behalf of national news publishers and other organisations within the media in respect of personal data;

(f) to inquire into the extent of corporate governance and management failures and the role, if any, of politicians, public servants and others in relation to failures to investigate wrongdoing at media organisations within the scope of the inquiry;

(g) to review the protections and provisions around media coverage of individuals subject to police inquiries, including the policy and practice of naming suspects of crime prior to any relevant charge or conviction;

(h) to investigate the dissemination of information and news, including false news stories, by social media organisations using personal data;

(i) to consider the adequacy of the current regulatory arrangements and the resources, powers and approach of the Information Commissioner and any other relevant authorities in relation to—

(i) the news publishing industry (except in relation to entities regulated by Ofcom) across all platforms and in the light of experience since 2012;

(ii) social media companies;

(j) to make such recommendations as appear to the inquiry to be appropriate for the purpose of ensuring that the privacy rights of individuals are balanced with the right to freedom of expression.

(4) In setting the terms of reference for the inquiry the Secretary of State must—

(k) have regard to the current context of the news, publishing and general media industry;

(l) must set appropriate parameters for determining which allegations are to be considered;

(m) determine the meaning and scope of references to national news publishers and other media organisations for the purposes of the inquiry.

(5) Before complying with subsection (4) the Secretary of State must consult the judge or other person who is likely to be invited to chair the inquiry.

(6) The inquiry may, so far as it considers appropriate—

(n) consider evidence given to previous public inquiries; and

(o) take account of the findings of and evidence given to previous public inquiries (and the inquiry must consider using this power for the purpose of avoiding the waste of public resources).

(7) This section comes into force on Royal Assent.”

This new clause would require the establishment of an inquiry under the Inquiries Act 2005 as recommended by Lord Justice Leveson for Part two of his Inquiry.

New clause 20—Publishers of news-related material: damages and costs (No. 2)—

“(1) This section applies where—

(a) a relevant claim for breach of the data protection legislation is made against a person (‘the defendant’),

(b) the defendant was a relevant publisher at the material time, and

(c) the claim is related to the publication of news-related material.

(2) If the defendant was a member of an approved regulator at the time when the claim was commenced (or was unable to be a member at that time for reasons beyond the defendant’s control or it would have been unreasonable in the circumstances for the defendant to have been a member at that time), the court must award costs against the claimant unless satisfied that—

(d) the issues raised by the claim could not have been resolved by using an arbitration scheme of the approved regulator, or

(e) it is just and equitable in all the circumstances of the case, including, for the avoidance of doubt—

(i) the conduct of the defendant, and

(ii) whether the defendant pleaded a reasonably arguable defence, to make a different award of costs or make no award of costs.

(3) If the defendant was not an exempt relevant publisher and was not a member of an approved regulator at the time when the claim was commenced (but would have been able to be a member at that time and it would have been reasonable in the circumstances for the defendant to have been a member at that time), the court must award costs against the defendant unless satisfied that—

(f) the issues raised by the claim could not have been resolved by using an arbitration scheme of the approved regulator (had the defendant been a member), or

(g) it is just and equitable in all the circumstances of the case, including, for the avoidance of doubt—

(i) the conduct of the claimant, and

(ii) whether the claimant had a reasonably arguable claim, to make a different award of costs or make no award of costs.

(4) This section is not to be read as limiting any power to make rules of court.

(5) This section does not apply until such time as a body is first recognised as an approved regulator.”

This new clause would provide that court costs of non-abusive, non-vexatious, and non-trivial libel and intrusion claims would be awarded against a newspaper choosing not to join a Royal Charter-approved regulator offering low-cost arbitration, but that newspapers who do join such a regulator would be protected from costs awards even if they lose a claim.

New clause 21—Publishers of news-related material: interpretive provisions (No. 2)—

“(1) This section applies for the purposes of section (Publishers of news-related material: damages and costs (No. 2)).

(2) “Approved regulator” means a body recognised as a regulator of relevant publishers.

(3) For the purposes of subsection (2), a body is “recognised” as a regulator of relevant publishers if it is so recognised by any body established by Royal Charter (whether established before or after the coming into force of this section) with the purpose of carrying on activities relating to the recognition of independent regulators of relevant publishers.

(4) “Relevant claim” means a civil claim made in respect of data protection under the data protection legislation, brought in England or Wales by a claimant domiciled anywhere in the United Kingdom.

(5) The “material time”, in relation to a relevant claim, is the time of the events giving rise to the claim.

(6) “News-related material” means—

(a) news or information about current affairs,

(b) opinion about matters relating to the news or current affairs, or

(c) gossip about celebrities, other public figures or other persons in the news.

(7) A relevant claim is related to the publication of news-related material if the claim results from—

(d) the publication of news-related material, or

(e) activities carried on in connection with the publication of such material (whether or not the material is in fact published).

(8) A reference to the “publication” of material is a reference to publication—

(f) on a website,

(g) in hard copy, or

(h) by any other means,

and references to a person who “publishes” material are to be read accordingly.

(9) A reference to “conduct” includes a reference to omissions; and a reference to a person’s conduct includes a reference to a person’s conduct after the events giving rise to the claim concerned.

(10) “Relevant publisher” has the same meaning as in section 41 of the Crime and Courts Act 2013.

(11) A relevant publisher is exempt if it satisfies Condition A or B.

(12) Condition A is that the publisher has a constitution which—

(a) requires any surplus income or gains to be reinvested in the publisher, and

(b) does not allow the distribution of any of its profits or assets (in cash or in kind) to members or third parties.

(13) Condition B is that the publisher—

(a) publishes predominantly in Scotland, or predominantly in Wales, or predominantly in Northern Ireland or predominantly in specific regions or localities; and

(b) has had an average annual turnover not exceeding £100 million over the last five complete financial years.”

This new clause would provide that the penalty incentives in New Clause 20 would not apply to companies which publish only on a regional or local basis and have an annual turnover of less than £100m. It sets out that only data protection claims are eligible, and provides further interpretive provisions.

Amendment (a), line 33 leave out subsection (10) and insert—

“(10) ‘Relevant publisher’ has the same meaning as in section 41 of the Crime and Courts Act 2013, subject to subsection (10A).

(10A) For the purposes of this Act, a publisher shall only be a ‘relevant publisher’ if—

(a) it has a registered address in England or Wales; and

(b) its publications are published in, or in any part of, England or Wales.

(10B) A relevant claim may be made under the data protection legislation only in respect of material which is published by a relevant publisher (as defined by subsections (10) and (10A)) and which is read or accessed in England or Wales.”

Government amendments 146 to 150 and 145.

Amendment 144, page 122, line 10, in clause 205, leave out “Section 190 extends” and insert—

“Sections (Publishers of news-related material: damages and costs (Amendment 2)), (Publishers of news-related material: interpretive provisions (Amendment 2)) and 190 extend”.

Amendment 14, page 156, line 4, in schedule 2, at end insert—

“(d) any code which is adopted by an approved regulator as defined by section 42(2) of the Crime and Courts Act 2013.”

This amendment would give the Standards Code of an approved press regulator the same status as the other journalism codes recognised in the Bill (The BBC and Ofcom Codes, and the Editors’ Code observed by members of IPSO).

[Matt Hancock]

The Data Protection Bill sets out a full new data protection regime for Britain, giving people more control over their data.

First, I wish to address new clauses 20 and 21, before turning to the other new clauses. These new clauses are essentially the provisions contained in sections 40 and 42 of the Crime and Courts Act 2013, although they would apply only to breaches of data protection law and only in England and Wales.

Let me first set out exactly what these new clauses would mean and then our approach to them. They would set new cost provisions for complaints against the press, which means that any publication not regulated by IMPRESS would have to pay the legal costs for any complaint against it, whether it won or lost. Many would object to that and say that it goes against natural justice. It is grounds enough to reject these new clauses on the basis that the courts would punish a publication that has done no wrong, but that is not the only reason. Let us consider the impact of these new clauses on an editor. Faced with any criticism, of any article, by anyone with the means to go to court, a publication would risk having to pay costs, even if every single fact in a story was true and even if there was a strong public interest in publishing. Let us take, for example, Andrew Norfolk, the admirable journalist who uncovered the Rotherham child abuse scandal. He said that section 40 would have made it “near impossible” to do his job. He went on to say that it would have been “inconceivable” to run the front page story naming one of the abusers in a scandal that had ruined the lives of 1,400 innocent young people with disgusting crimes that had gone on for years and years and years. Without Andrew Norfolk’s story, the scandal would have gone on for years and years more.

[Ian C. Lucas (Wrexham) (Lab)]

If the Secretary of State is so opposed to section 40, why did he support it?

[Matt Hancock]

I will come on to what has changed in the many years since 2013, not least of which is the fact that we now have a full-blown independent press regulator, the Independent Press Standards Organisation, which did not exist back then.

[Bill Wiggin (North Herefordshire) (Con)]

I am most grateful to my right hon. Friend for giving way. First, IPSO is not a press regulator, because it does not comply with the requirements to be a regulator; it is merely a complaints handler. Secondly, he may have inadvertently misled the House, because it is not necessary to join IMPRESS as he said earlier on. It is necessary for regulators to comply with the rules, which is slightly different.

--- Later in debate ---

[Matt Hancock]

There is no recognised press regulator other than IMPRESS. As many journalists have pointed out, the truth is that these new clauses would have made it near impossible to uncover some of the stories of abuse, including the abuse of all those children in Rotherham. Another example is that of Mark Stephens, who represented phone hacking victims. He wrote today that the new clauses would

“return Britain to the legal Dark Ages and make it easier for wealthy people to suppress negative stories.”

The impact on local newspapers, too, risks being catastrophic. I say do not just take my word for it. The editor of the Express & Star, well known to the hon. Member for West Bromwich East (Tom Watson), said that the new clauses could spell the end of newspaper printing in this country on a large scale and are a

“ludicrous and patently unfair…piece of legislation.”

[Liam Byrne (Birmingham, Hodge Hill) (Lab)]

Will the Secretary of State confirm to the House that the BBC, Channel 4 and every other broadcaster operates under much more stringent rules, and yet nothing seems to have got in the way of their powers of interrogation and investigation? Does he think that they are operating second-class investigations today?

[Matt Hancock]

We have three separate systems of media regulation in this country: a separate system for broadcasters; an essentially self-regulated system under IPSO for newspapers; and then there is the issue of how we make sure that what happens online is properly regulated as well. I will come on to that last point, because it is a very important part of the debate. The impact of the new clauses on the local press should not be underestimated. Two hundred local newspapers have already closed since 2005, and these new clauses would accelerate that decline. However, there is one national newspaper that is carved out in the small print of the new clauses as it only covers newspapers run for profit. Which newspaper is exempted? It is The Guardian. If those who tabled these new clauses thought that they were making friends with The Guardian, they were wrong. The Guardian has said that

“the Data Protection Bill should not be used as a vehicle for imposing an unfair and partial system on publishers.”

It did not ask for the measures, and it, too, opposes them. Indeed, in a recent consultation, 79% of direct responses favoured full repeal of section 40, compared with just 7% who favoured full commencement.

[Chris Philp (Croydon South) (Con)]

The Secretary of State quoted The Guardian. In fact, its statement released this morning went even further. The Guardian News and Media said that these new clauses would

“further erode press freedom and have a chilling effect on the news media.”

[Matt Hancock]

It did, yes. I am trying to ensure that we have a debate on these measures that takes into account the fact that, yes, we want a free press that can hold the powerful to account, but also that it is fair. I know—as does everyone in this House—that there has been irresponsible behaviour by the press. Although I want to see a press that is free to report without fear or favour, to uncover wrongdoing and to hold the powerful to account, I also want to see a press that is fair and accurate. I am determined that we have a strengthened system so that people have recourse to justice when things go wrong.

[Tom Tugendhat (Tonbridge and Malling) (Con)]

Does my right hon. Friend agree that, in many ways, there are two forms of media already operating in this country? One is printed, published and broadcast from reputable sources, which have assets in this country that we can take action against, or not, and the other form is websites that have either very low assets or no assets in this country with very different accountability. Bizarrely, could we not find ourselves in a position under this system where the only people who can get justice are those who are rich enough, such as Peter Thiel, to destroy the website Gawker, in this case, because it was acting against him, rather than those of us on more modest means who would have absolutely no recourse against these organisations, but yet all the news would have gone online because these regulations would force out our newspapers?

[Matt Hancock]

My hon. Friend is completely right about the gap between online and print in terms of standards of regulation. That is because IPSO was brought into force—I was glad to see it being introduced in 2014. He is also right that tackling the problems online is critical. Our internet safety strategy, which will be published in the next couple of weeks, will address that matter directly. I know that there are many Members who have concerns about the impact of content online, of abuse online, and of the ability to get redress online, and we will not let that rest. We will ensure that we take action to tackle the problems online in the same way that IPSO deals with the press and indeed that these new clauses deal with publications in the press.

I am glad that IPSO now has the power to require front page corrections as it did, for instance, just a couple of weeks ago with The Times. As the House knows, I have pushed IPSO to bring in further measures. It recently introduced a system of compulsory low-cost arbitration. This means that ordinary people who do not have large sums of money can take claims to newspapers for as little as £50. Almost all of the major national newspapers have signed up to it. That means that anyone who has been wronged by a national newspaper can, for the first time, ask for arbitration and the newspaper cannot refuse. The scheme applies not just to words, but to images. This must be the start of a tougher regime, and not the conclusion.

[Mr Peter Bone (Wellingborough) (Con)]

Is not one of the problems that the scheme does not include everyone? It is compulsory, but does not include everyone. When MailOnline is excluded, does that not leave a whacking great hole in it?

[Matt Hancock]

I have a lot of sympathy with the views of my hon. Friend. MailOnline is, of course, an online publication, and we are looking at that as part of our internet safety strategy. I am very happy to talk to him about how that can be done. Only in the past week, however, many publications have joined the IPSO low-cost arbitration scheme, which is binding on them, and I very much hope that more will join in the future.

[Mrs Anne Main (St Albans) (Con)]

Will my right hon. Friend also confirm that the new scheme will allow for a higher maximum level of damages of up to £60,000 and that it can be run for as little as £100?

[Matt Hancock]

That is absolutely right. The minimum access cost will be £50, which means that everybody has access to justice at low cost. There is more to it than that, however. Some people argue that the £60,000 limit on damages is too low, but the arbitration scheme does not stop somebody going to court, so there is access to justice where damages should be higher. The arbitration scheme is an addition to, rather than a replacement for, going to court. It introduces a robust and fair system that is easy for everybody to access, so everyone can have access to justice.

The section 40 amendments would, ironically, have the opposite effect, because anybody with the means to take small newspapers to court could stop them publishing stories for fear of having to pay the costs, even if they get everything right.

[Dr Andrew Murrison (South West Wiltshire) (Con)]

Is it not the case that IPSO proposed its arbitration scheme only when a number of colleagues had tabled amendments that were distinctly unhelpful to the print media? Can we trust that organisation? Will my right hon. Friend be extremely careful about removing the boot from the neck of IPSO, particularly in relation to the review period? I know that he will come on to talk about that shortly, but will he consider tightening the review period, because at the moment it gives IPSO the best part of a decade before there is any prospect of further change if the industry does not behave itself?

[Matt Hancock]

I agree with the sentiment, which is that we have to ensure that the press remains free but also fair and reasonable, and that is the purpose of the amendment proposing a review period of four years. We will not let matters lie.

Some have asked, “What happens if newspapers pull out of the IPSO scheme?” I think that would send a terrible signal of the newspaper industry’s attitude to the standards that it rightly ought to sign up to. The review is there precisely to address my hon. Friend’s concerns.

[Vicky Ford (Chelmsford) (Con)]

I am pleased to hear the Secretary of State refer to a low-cost scheme. People have told me about their concern that £60,000 may be too low because there needs to be a deterrent. Will the four-year review also cover that £60,000 cap?

[Matt Hancock]

Given that this is a Data Protection Bill, the review will consider data protection issues, but I would expect it to be as broad as necessary, to ensure that all those matters are considered.

We have listened to concerns raised during the passage of the Bill, including in this debate.

[Liam Byrne]

I am grateful to the Secretary of State for giving way just before he moves off the subject of IPSO. He has set out arguments in IPSO’s defence. It is not just MailOnline that is outside the arbitration scheme; that is also true of Newsquest and Archant, so a significant chunk of the press is outside it. Brian Leveson said that the regulator needed to have independent board members, independence of operation, fair remedy for complaints, the ability to carry out investigations, the ability to issue fines, and universal arbitration. None of those conditions is put in place by IPSO, so which of those principles does the Secretary of State think should be retired?

[Matt Hancock]

On the contrary, the scheme introduces new, compulsory, low-cost arbitration to ensure that people can have exactly the recourse to justice mentioned by the right hon. Gentleman. In order to address some of the concerns, we have tabled two new clauses. First, new clause 19 requires the Information Commissioner to publish information on how people can get redress. The point is to ensure that there is a plain English guide to help anyone with a complaint to navigate the system. Secondly, new clause 22 requires the Information Commissioner to create a statutory code of practice, setting out standards on data protection. The point is that, when investigating a breach of data protection law, the commissioner has to decide whether a journalist acted reasonably. When making that judgment, a failure to comply with the statutory code will weigh heavily against the journalist.

[Mr Jim Cunningham (Coventry South) (Lab)]

How binding is the arbitration, and how binding is the code of practice?

[Matt Hancock]

The arbitration is binding on the newspapers, meaning that anybody who wants to get redress from a newspaper in the scheme can do so up to a limit of £60,000, and then the recourse is through the courts. The Information Commissioner’s statutory code of practice is binding with respect to data protection standards; after all, this is a Data Protection Bill, so that is what is in scope.

Taken together, the changes from IPSO and the new clauses mean that Britain will have the most robust system we have ever had of redress for press intrusion and it will be accessible to all. It will achieve that and the benefits of high-quality journalism, without the negative effect that section 40 would have.

[Joanna Cherry (Edinburgh South West) (SNP)]

I thank the Secretary of State for giving way; he is being very generous in taking interventions. Before he finishes his peroration on the new clauses, will he confirm that they are purely procedural and will give members of the public, including our constituents, absolutely no new rights whatsoever?

[Matt Hancock]

No, that is not right. The statutory code of practice for journalists must be a consideration in the Information Commissioner’s judgments, and a failure to comply with the statutory code will weigh against the journalist in law. It has precisely the impact that we are trying to bring about.

New clause 18, tabled by the former Leader of the Opposition, the right hon. Member for Doncaster North (Edward Miliband), requires the Government to, in effect, reopen the Leveson inquiry, but only in relation to data protection. I want to say something specific and technical about the new clause. Even on its own terms, it would not deliver Leveson 2 as envisaged. It focuses on data protection breaches, not the broad question of the future of the press. The new clause, therefore, is not appropriate for those who want to vote for Leveson 2.

The first Leveson inquiry lasted more than a year and heard the evidence of more than 300 people, including journalists, editors and victims. The inquiry was a diligent and thorough examination of the culture, practices and ethics of our press, in response to illegal and improper press intrusion. There were far too many cases of terrible behaviour, and having met some of the victims, I understand the impact that had. The inquiry was followed by three major police investigations, leading to more than 40 criminal convictions. More than £48 million was spent on the police investigations and the inquiry.

[Liam Byrne]

This is probably a good point for the Secretary of State to remind the House about Brian Leveson’s view of the future of the inquiry. Will he set that out for us?

[Matt Hancock]

Sir Brian was very clear in his letter to me. He stated that he wanted the inquiry to continue on a different basis. I think, having considered his view and others, that the best approach is to ensure that we do the work necessary to improve the standards of the press, but we do it based on what is needed now to improve things in the future. I will come back to that.

[Robert Neill (Bromley and Chislehurst) (Con)]

I am glad that my right hon. Friend acknowledges the diligence and hard work of Sir Brian Leveson in the inquiry. He highlighted the particular vice of corrupt police officers giving the names of persons—perhaps whose premises are being searched—to corrupt journalists who publish them before charge, and very often those people are never charged. No amount of redress can undo that damage. Will my right hon. Friend meet me and other concerned Members to consider revisions and what additional legal protection can be given to people post-charge to prevent this trade in muck and dirt, sometimes without anybody ever coming before a criminal court, which undermines the presumption in favour of innocence?

[Matt Hancock]

Yes, I will. My hon. Friend makes a very important point. We are discussing the rules around the disclosure of the names of people who are under investigation before arrest. This is a sensitive area, and we have got to get it right. I want to work with colleagues and others to explore the reporting restriction rules further, and I look forward to meeting him and any others who share those concerns.

[Anna Soubry (Broxtowe) (Con)]

I am grateful to the Secretary of State for giving way; it is very generous of him. Some years ago, I put forward a private Member’s Bill calling for anyone who was accused to keep their anonymity until they were charged. It is all there—it is effectively good to go. I too would very much like to meet the Secretary of State, because this is the right thing to do. People should not be named before they are even charged, unless a judge orders otherwise.

[Matt Hancock]

I am aware of my right hon. Friend’s proposals, and I look forward to meeting her. Getting the details of this right is incredibly important, and I am happy to take that forward.

[Mr Kenneth Clarke (Rushcliffe) (Con)]

To go back to the key question of holding an inquiry, the Secretary of State rather implies that the first Leveson inquiry is closed and we now face the possibility of starting a new one. Does he not accept that, from the moment it was set up, the Leveson inquiry was always going to be in two parts? That was the commitment of the Government in which he and I served. It was only suspended so that police operations could take place, and it was quite clearly agreed that part 2 of the inquiry would then resume. The case he has to make is: why is he cancelling a previously promised inquiry endorsed by Leveson? What on earth is the reason for stopping investigations into the kind of things we are all talking about? No one would stop investigations of this kind against any other body in this country.

[Matt Hancock]

I have a huge amount of respect for my right hon. and learned Friend. I was about to come on to precisely the reason for that. The reason is that inquiries are not costless, and not just in terms of taxpayers’ money; that is one consideration, but inquiries also take hours of official time and ministerial time. They divert energy and public attention—[Interruption.] Hold on. The question for the House is this: given all the other challenges facing the press, is this inquiry the right use of resources?

There is something in the calls to reopen the inquiry that implies that the problem is that we do not know what happened, but we do know what happened, and then we had police investigations and the convictions. It is fundamental that we get to the bottom of the challenges that the press face today. I want to divert our attention and resources to tackling and rising to the problems of today and ensuring we have a press that is both free and fair.

[Mr Iain Duncan Smith (Chingford and Woodford Green) (Con)]

In answer to the point made by my right hon. and learned Friend the Member for Rushcliffe (Mr Clarke), surely the question here is not that further issues should not be settled, such as those that have been raised, but how one should go about it. An open-ended continuation of this inquiry will not necessarily resolve those issues but could travel into all sorts of areas, which would take time. Will the Secretary of State commit to dealing with all these issues raised in a more effective way, rather than just opening a further point in the inquiry? That is the point.

[Matt Hancock]

Yes, and my right hon. Friend has pre-empted what I was about to say, which is that the choice is not between doing something and doing nothing, but between doing something and doing something better. New clause 18 calls on us to go into a backward-looking inquiry when what we need to do is ensure that we allow the press to rise to the challenges we face today.

[Paul Farrelly (Newcastle-under-Lyme) (Lab)]

I thank the Secretary of State for giving way, not least in view of what I am going to say. Is the truth not that he has broken promises to the victims, ignored the opinions of Sir Brian Leveson and ridden roughshod over the cross-party, unanimous opinion of the Digital, Culture, Media and Sport Committee? Much has happened since Leveson 1, and one thing that Leveson 2 could establish is who told Sir Brian the truth and nothing but the truth the first time round. Why is the Secretary of State afraid of establishing the truth?

[Matt Hancock]

I want to focus on the challenges we face now. That is my job as Secretary of State, and it is my judgment as to what the proposals I have put forward do, and do in a better way than re-establishing the inquiry.

[Mr Jacob Rees-Mogg (North East Somerset) (Con)]

Has this not been decided in the jewel of our legal system—that is to say, in front of a jury? Some people accused of things that would have been part of Leveson 2 have been acquitted, and a very few have been convicted, but once someone has been tried in front of a jury, it is fundamentally unfair, unjust and a question of double jeopardy if they are then brought before another tribunal and put once more on oath to repeat evidence that they have given before and then been acquitted for. It would be against British justice to proceed in that way.

[Matt Hancock]

The police inquiries and the prosecutions that followed were exhaustive, so much so that in 2015, the Director of Public Prosecutions said that the end had been reached of the need to inquire further into those criminal acts. Of course, the criminal acts were punished, and people were convicted and went to prison.

Crucially, the arrival of the internet has fundamentally changed the landscape. That was not addressed at the core of the first Leveson inquiry, but it must be addressed. Later this month we will publish our internet safety strategy, as I mentioned, in which we will set out the action we need to take to ensure that the online world is better policed. Many colleagues have raised with me huge concerns about online abuse and the inability to get redress. That is a significant challenge for the future, and we must address it.

However, the internet has also fundamentally undermined the business model of our printed press. Today’s core challenge is how to ensure a sustainable future for high-quality journalism that can hold the powerful to account. The rise of clickbait, disinformation and fake news is putting our whole democratic discourse at risk. This is an urgent problem that is shaking the foundations of democracies worldwide. Liberal democracies such as Britain cannot survive without the fourth estate, and the fourth estate is under threat like never before. These amendments would exacerbate that threat and undermine the work we are doing through the Cairncross review and elsewhere to support sustainable journalism.

The terms of reference of part 2 of the inquiry have already largely been met. Where action is needed, I do not back down from taking it. The culture that allowed phone hacking to become the norm has changed fundamentally and must stay that way. We have already seen reforms of police practices, with a new code of conduct for the College of Policing. As I said, we are discussing rules around disclosure. I can confirm that we have asked Her Majesty’s inspectorate of constabulary to undertake a new review of how police forces are adhering to new media relations guidance, as recommended by Sir Brian, and we will not hesitate to strengthen the rules further if that is needed.

[Andy Slaughter (Hammersmith) (Lab)]

The Secretary of State has talked about victims of abuse, but he seems to have forgotten that Leveson was set up because of the victims of press harassment and abuse in the first place. Many of those victims have written to Members on both sides of the House, rejecting the ridiculous IPSO scheme and asking for part 2 of Leveson to proceed. He has heard concerns from Members on both sides of the House today, so why will he not think again? What has changed his mind about those victims over the last three or four years?

[Matt Hancock]

In the period in which people have raised concerns and said that they must be looked into in Leveson 2, every one that has been raised with me was covered in Leveson 1. Leveson 1 was exhaustive, and there were then police investigations, which went further. My judgment is about what is right now, and the challenges the press face now are fundamentally different.

[Christine Jardine (Edinburgh West) (LD)]

Does the Secretary of State accept that many of the challenges that the press face now are the result of the behaviour that led to Leveson 1 and undermined public confidence? The fact that the victims are not perceived as having had justice further undermines the press, and we would be helping the future of the press in this country if we continued along the lines of Leveson 2 and looked at how best to implement the recommendations of Leveson 1.

[Matt Hancock]

I think the representations from the press themselves show that they are not looking for help of that sort. Let us, however, look at the public: there is not a great public cry for this. In response to the consultation, 79% of direct responses favoured the full repeal of section 40. It is my job to address what we face now and the needs of the country now.

[Ian Paisley (North Antrim) (DUP)]

The Secretary of State has made the very interesting point that he will try to address some of the grievances and outcomes by way of a review. Doing so specifically in relation to Northern Ireland was in effect precluded by the first part of Mr Leveson’s inquiry. Will the Secretary of State tell us how he will try to resolve this problem in Northern Ireland?

[Matt Hancock]

Through new clause 23, as I have mentioned, we will require the Information Commissioner to conduct a statutory review of media compliance with the new law over the next four years. Alongside that review, we propose to have a named person review the standards of the press in Northern Ireland, and we will take that forward as part of and alongside new clause 23.

[Ian Paisley]

I thank the Secretary of State for his generosity. Would it be fair for me to characterise that review as a Leveson for Northern Ireland?

[Matt Hancock]

I would characterise it as a review aligned with new clause 23, which we are bringing in for the whole country, specifically to look at the effects in Northern Ireland. The crucial point is that we will make sure, through the review in new clause 23, that the future of the press is both free and reasonable, that its behaviour is reasonable, and yet that it is not subject to statutory regulation. I want to see a press that is both free and fair.

[Edward Miliband (Doncaster North) (Lab)]

This is an extraordinary way to make policy. Will the Secretary of State explain to us why there can be a Leveson for Northern Ireland, but not for the rest of the United Kingdom?

[Matt Hancock]

I have explained that new clause 23, which I hope the right hon. Gentleman supports, will in the future bring in a review of behaviour following the new system that we are putting into place. That is true here, and it is true right across the country.

[Ian C. Lucas]

May I bring the Secretary of State back to the United Kingdom and to Manchester last year? The Kerslake review said:

“The panel was shocked and dismayed by the accounts of the families of their experiences with some of the media.”

That happened last year, so the Secretary of State should not represent the threats posed by press misbehaviour as being from the past; this is a real and pressing problem now. Will he keep his promise to the victims who have suffered from this in the past and are continuing to suffer from it?

[Matt Hancock]

New clause 23 is for the whole of the UK, which includes Northern Ireland. On the hon. Gentleman’s broader point, I have read the Kerslake review, and we asked to see all the evidence that fed into it, but we have not received specific allegations. The crucial point is that the low-cost IPSO arbitration is precisely to make sure that everybody has access to justice and that the press improves the way in which it behaves so that it is both free and fair, and that is what we want to achieve.

[Dr Lisa Cameron (East Kilbride, Strathaven and Lesmahagow) (SNP)]

The Secretary of State may not be aware of this, but my daughter, aged seven, was spoken to and recorded by a journalist in 2016. The incident, which was in our own garden, traumatised her greatly, as has been stated by her school and by her doctor, but it was ignored by IPSO. Will he meet me and my daughter to explain how children like her will be protected by his amendments and what he is trying to do, because she has no faith in the system?

[Matt Hancock]

Yes, I absolutely will. This is the sort of thing that I am trying to put right. It is about making sure that the system is right now: rather than going over the past—there is an enormous amount of evidence of what happened in the past—this is about making sure that we look to the future.

The hon. Member for North Antrim (Ian Paisley) mentioned Northern Ireland and the review I have committed to in Northern Ireland will take place at the same time as the review under new clause 23 for the UK that is before the House.

[Tom Watson (West Bromwich East) (Lab)]

Further to the point made by the hon. Member for North Antrim (Ian Paisley) about the special review for Northern Ireland, may I ask the Secretary of State in reference to the Hurst case—the former Army intelligence officer whose computers were hacked by newspaper journalists working for newspapers in England about his activities protecting our state in Northern Ireland—whether his review will also examine such criminal activity?

[Matt Hancock]

If there are allegations of criminal activity—the hon. Gentleman has just made such an allegation—then that is a matter for the courts.

[Tom Watson]

A newspaper group has admitted liability for criminally hacking the computers of a former Army intelligence officer.

[Matt Hancock]

In a way, the hon. Gentleman has summed up my case. My case is that we want a press that is free and that is fair. Statutes already exist to ensure that, when there are cases of wrongdoing, people can be brought to account through the courts. That already exists, and we now also have a system of compulsory, low-cost arbitration to make sure everybody can get recourse.

I am focused on ensuring that we have high-quality political discourse and a press that can survive and thrive, with high-quality journalists who can hold the powerful to account, and on ensuring that we face the challenges of today rather than those of yesterday. That is what we want to work towards, and new clauses 18, 20 and 21 would make it harder to find solutions to today’s real problems.

[Ian Paisley]

The Secretary of State will correct me if I am wrong, but new clause 23, to which he has referred at the Dispatch Box, looks at cases going forward; it is not retrospective—I hope I am correct. Therefore, it addresses some of the deficiencies in the other new clauses before the House about having just a consultation process on what has happened previously.

[Matt Hancock]

New clause 23 is about ensuring that in the future there is a review of activity from now onwards, and alongside it we will ensure that there is a named person to ensure that the issues in Northern Ireland are looked into properly.

Overall, I want to ensure that the law that applies to the press is applied fairly, and that we have a free press and one that is responsible. I therefore oppose new clauses 18, 20 and 21, which would make that more difficult, not easier, and I urge every Member of the House to do the same.

[Liam Byrne]

I rise to support in particular new clause 18, in the name of my right hon. Friend the Member for Doncaster North (Edward Miliband), and indeed our new clause 20 and the consequential amendments.

The background to this is fairly well rehearsed, but it is worth remembering the level of shock we all felt when the revelations about phone hacking first became public. It is worth remembering the shock we felt when we heard that Milly Dowler’s phone had been hacked. It does not often happen in this House that Members on both sides unite to try to construct a shared way forward through an extremely difficult problem, yet that is exactly what we managed to do with the Leveson inquiry.

That was very difficult, but it was always going to be a game of two halves. There were too many cases coming to court at the time; there was too much evidence still under wraps; and there was too much that had to be left in the dark. As the Father of the House so rightly pointed out, it was never a question of opening a new inquiry; this is about letting the existing inquiry actually finish its work.

When the previous Prime Minister, Mr Cameron, having spoken to victims, made a statement, the point he wanted to impress on Members on both sides of the House was the need for Leveson to finish the job:

“One of the things that the victims have been most concerned about is that part 2 of the investigation should go ahead—because of the concerns about that first police investigation and about improper relationships between journalists and police officers. It is right that it should go ahead, and that is fully our intention.”—[Official Report, 29 November 2012; Vol. 554, c. 458.]

The then Prime Minister was not speaking simply on his own behalf; he was speaking on behalf of Government Members, including members of today’s Government Front Bench such as the Chief Whip, the right hon. Member for Skipton and Ripon (Julian Smith), who wrote not too long ago to one of his constituents:

“The Government has been clear all along that the status quo is not an option and I, personally, am determined to see Lord Justice Leveson’s principles implemented.”

Where has that commitment gone this afternoon?

--- Later in debate ---

[Liam Byrne]

What I want to learn is the truth. I want to learn the truth about police-press collusion and I want to know how we improve our press regulation in the future, so that we have not just a free press but a clean press.

Let me make some progress. The Secretary of State offered us a second line of argument that has now collapsed. I am not quite sure of the exact words he used when he came to the House, but most of us walked away thinking that Lord Leveson was pretty content that the whole thing was going to be shuttered. The House can therefore imagine our surprise when Sir Brian Leveson said that he “fundamentally disagreed” with the Government’s decision to end part two of the inquiry. When Lord Leveson said that he wanted the terms to be revised, he meant that he wanted them to be expanded, not cancelled all together. The Secretary of State says that malpractice is in the past and that there is nothing more to see, officials are busy, inquiries are expensive and so we must move on. He intimated that Lord Leveson agreed with him when that was not in fact the case.

A third line of attack from the Secretary of State was that the review looked to the past and ignored the challenges for the press in the future. That was a legitimate challenge and if he studies carefully the words of the amendment tabled by my hon. Friend the Member for West Bromwich East (Tom Watson), he will see that there is a new ambition to get into some of the challenges around fake news that were looked at by Brian Leveson. That was not enough to satisfy the Secretary of State, however. In a letter to Conservative Members—I did not receive a copy—he offered some more objections, each one of which we can knock down.

The Secretary of State, in his letter to his colleagues, says that the first half of Leveson was “full and broad” when in fact it was partial and incomplete. He says that newspaper margins are under pressure, as if economic hardship is now some sort of defence against the full glare of justice. He says that the effect of the proposals will be “chilling”, when he knows that our fine broadcasters in this country operate under far more rigorous regulation than newspapers and that does not stop them pursuing the most extraordinarily brilliant investigations. He says that Sir Joe Pilling has “cleared” the IPSO scheme, but Joe Pilling was appointed by IPSO and IPSO itself says it does not comply with Leveson. He says that IPSO now has a low-cost arbitration scheme, but as the hon. Member for Wellingborough (Mr Bone) pointed out, MailOnline, Newsquest and Archant are all outside it, so it is not a universal scheme in the way the Secretary of State has tried to present it to the House this afternoon.

The final line of argument is that officials are very busy and inquiries are very expensive, and we should therefore just walk on by. I just do not think that that is good enough.

[Matt Hancock]

rose—

[Liam Byrne]

I am happy to hear from the Secretary of State why he thinks I am wrong.

[Matt Hancock]

The right hon. Gentleman is not making much progress. He is implying that broadcasters are under regulation but there is no chilling effect. The description of a chilling effect, raised by my hon. Friend the Member for Croydon South (Chris Philp), is the expected impact of section 40, under which anybody would be able to take a newspaper to court and get costs awarded against the newspaper even if they did not have anything in their case. The broadcasters do not have to deal with anything like that. On the point about things being brought to light, will he confirm that the case of Mr Ford, which he raised and was raised in an argument for Leveson 2, was in fact raised in the original Leveson inquiry and was therefore covered?

[Liam Byrne]

Mr Ford’s activity was, but not Mr Ford’s allegations that the activity is already under way.

Let me come on to the point the Secretary of State made about the future of press regulation. The scheme he voted for—it was elegantly designed, I think, by the right hon. Member for West Dorset (Sir Oliver Letwin)—was a good scheme. There have been a couple of important objections to it made by many of our constituents, but more importantly by many journalists in our local media. The first objection is that a royal charter is somehow tantamount to a state authorised, state-operated regulator, which will somehow impede free speech. Royal charters have for centuries been the basis by which we have given stature to universities and learning societies like the Royal Society. None of them confront restrictions on free speech in any way whatever. That argument, frankly, is fanciful.

--- Later in debate ---

[Matt Hancock]

I beg to move, That the Bill be now read the Third time.

What a great pleasure this is. The Bill gives people more power and control over their lives online while supporting innovation and entrepreneurship in the digital age. It will deliver real benefits across the country and help our businesses to compete and trade abroad. Strong data protection laws give customers confidence in the products and services that they buy, and that is good for business. The Bill provides a full data protection framework as we leave the EU, consistent with the general data protection regulation.

We have heard many things during our debates in the Chamber and in Committee, including concerns about small businesses. I reassure colleagues that the Information Commissioner’s Office has produced specific advice for them, as well as detailed advice for charities and local government.

The Bill provides a bespoke tech framework that is tailored to the needs of our criminal justice agencies and the intelligence services. That will protect the rights of victims, witnesses and suspects while making sure that we can tackle the changing nature of the global threats that the UK faces.

The Bill has received coverage from around the world, including Australia, the Philippines and, indeed, Suffolk. Let me be clear: the Bill is about preparing Britain for the future. As we leave the EU, the Bill sets out full spectrum data protection legislation, and I hope that the House will give it its Third Reading.

I am very grateful for the way in which the House has engaged with the Bill. I want to put on record my thanks to many people: my hon. Friend the Minister for Digital and the Creative Industries, in particular, for her sterling work day in, day out; my predecessor, who is now Northern Ireland Secretary, who worked hard with me on the Bill before her promotion; the Under-Secretary of State for the Home Department, my hon. Friend the Member for Louth and Horncastle (Victoria Atkins), for grappling with the Bill in a brand new brief; the Digital, Culture, Media and Sport Committee, whose members made many contributions; the Public Bill Committee; the Information Commissioner herself, with whom we have worked very closely on the Bill and who is a great star; and the Whips, Clerks, Committee Chairs, Mr Speaker and the Deputy Speakers. They have all been of great assistance. I also thank the Front-Bench teams of Her Majesty’s loyal Opposition, the Scottish National party and other parties for, on the whole, their highly constructive attitude to this important legislation.

The Bill that we send back to the other place has been improved in three key respects. First, we have made good on the promises made by Lord Ashton in the other place. For instance, we have delivered certainty for patient support groups—a cause passionately championed by my noble Friend Baroness Neville-Jones. We have provided reassurance for those on the frontline, safeguarding the emotional, physical and mental health of some of our most vulnerable citizens. We have legislated for a statutory review of the private enforcement provisions of the Bill, which will ensure that we leave no stone unturned in our search for strong and effective oversight of data controllers, particularly where children are concerned.

Secondly, the House has ensured that we have learned the lessons from the Cambridge Analytica scandal, which exploded during the passage of the Bill. The ongoing investigation into that is unprecedented in its scale and importance. We have increased the powers of the Information Commissioner to ensure she has enough resources. Some say that that scandal put data protection at the top of the news. Some even say it made data protection sexy. With the Bill, we can be assured that the Information Commissioner will have the powers that she needs to ensure that those who flout the law are held to account for their actions. I want particularly to thank the Digital, Culture, Media and Sport Committee for its proposals, which we took on board to strengthen the Bill in response to that scandal. Finally, we have ensured that when it comes to the freedom of the press, we are prepared for the future, not stuck in the past.

The Bill will give people more control over their data, support businesses in their use of data and prepare Britain for Brexit. Over a generation, the Data Protection Act 1998, which this Bill replaces, has commanded broad public consensus and cross-party support. That has been one of its strengths. I hope that this Bill will gain cross-party support on Third Reading so that no matter the debate on some of the points of detail, we will have a broad consensus behind our data protection approach here in the UK for the years to come, because that is one of the strengths of our digital economy—a digital economy that is powering ahead. I hope that the Bill can add to the fundamental underpinnings of the strength of our economy and our society for the future. I commend it to the House.

--- Later in debate ---

[Peter Heaton-Jones]

It is a pleasure to be able to speak briefly at the conclusion of our proceedings on the Bill. I have followed it with interest throughout all its stages, and I had the pleasure of sitting on the Public Bill Committee. I echo what has been said about the fine contributions made by Members on both sides of the House at all stages, and I thought that the Committee was extraordinarily well conducted. I particular enjoyed my light-hearted sparring with the right hon. Member for Birmingham, Hodge Hill (Liam Byrne), and the people at BBC Radio Essex will have been delighted that they got a disproportionate amount of airtime as a result.

This is a good Bill. Data protection is incredibly important—and increasingly so. The Bill has successfully navigated the choppy waters that are coming towards us, created by the need for the GDPR to be implemented in only about 14 days’ time. If I may say so, the Secretary of State and his entire team have navigated those waters with skill and elegance to ensure that we in the UK now have legislation that does what it needs to do as far as the GDPR is concerned, on which I congratulate them. The Government, the House and the other place have looked into this matter very carefully and rigorously, and they have arrived at what I think is a good package of measures that will do what it needs to do as far as data protection is concerned.

My interest has been in the amendments concerning press regulation, as Members on both sides of the House will remember. I believe that the House has reached the right decision on what started off as an amendment in the other place and what was set out in new clause 18 today. Not to go ahead with Leveson 2 is the right decision. However, I agree with the sentiment that we must keep the victims of what will undoubtedly still be a difficult press environment at the centre of our thinking. It is important that we have not lost the opportunity to do that, and I know the Secretary of State and his team will continue to do so, but I think we have got the balance right today.

I congratulate the whole ministerial team and all those who have taken part in these deliberations. I have followed with interest the arguments made by Members on both sides.

[Matt Hancock]

My hon. Friend mentioned some people he wanted to thank, and there is one other person I want to thank: my hon. Friend the Member for Chelmsford (Vicky Ford). She was involved with the development of the GDPR in the European Parliament right from the start, and I want to put on the record our thanks, and my personal thanks, for her guidance. She has lived with the Bill for far longer than anybody else in the Chamber.

[Peter Heaton-Jones]

Yet another mention for Essex, where people will be absolutely delighted.

This is the Government getting on with business. We promised that we would do this in our manifesto, on which we were elected, and we have got on with and delivered it. I will be delighted to see the Bill reaching the statute book. This is the Government delivering what they need to deliver, and doing it in a very rigorous, elegant and clever way. This is a digital Bill for the digital age, and I am pleased to support it.

Question put and agreed to.

Bill accordingly read the Third time and passed, with amendments.

Deferred Divisions

Motion made, and Question put forthwith (Standing Order No. 41A(3)),

That, at this day’s sitting, Standing Order No. 41A (Deferred divisions) shall not apply to the Motion in the name of Jeremy Corbyn relating to Education (Student Support).—(Jo Churchill.)

Question agreed to.