Draft Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023

Debate between Stephen Timms and Chris Bryant

Monday 4th December 2023 General Committees

[Sir Chris Bryant (Rhondda) (Lab)]

It is a great delight to sit under your chairmanship, Mrs Latham. You and I have many things in common, not least our determination to see that fewer people suffer from melanoma and that more get the proper treatment that they deserve. I know that has been a long-standing campaign of yours.

First, I will just correct the Minister. He mentioned these regulations being subject to the agreement of the Committee today. There is no such thing as the agreement of the Committee today, because even if every single member of the Committee voted that we disagreed with the motion, it would go through none the less as all it does is ask whether the Committee has “considered” the regulations. On a minor point, this is one of my arguments regarding the problems with Henry VIII powers and the extensive use of secondary legislation, all of which is unamendable.

To get back to the bit where I agree with the Minister, these regulations do indeed amend the existing UK data protection regime so that references in relation to data controllers and Ministers, and to “fundamental rights and freedoms”, pertain to the European convention on human rights—enshrined by the Human Rights Act 1988—as opposed to the charter of fundamental rights of the European Union. This may of course feel like a great deal of dancing upon the head of a pin, in that we are changing one European Court for another—I am sure that has been a very useful waste of British legislative time over these years. As the Minister says, the Government are making this change under section 14 of the Retained EU Law (Revocation and Reform) Act 2023, which allows the Government to revoke secondary retained EU law and replace it with such provisions as they consider appropriate.

I do have a few questions. Paragraph 2.2 of the explanatory memorandum refers to

“an alternative source of fundamental rights and freedoms, namely those under the European Convention on Human Rights (ECHR), which have been enshrined in the UK’s domestic law under the Human Rights Act 1998.”

The regulations themselves, however, refer directly only to the Human Rights Act, thereby making me worry as to the true intentions of the Government in relation to the European convention on human rights and the European Court of Human Rights. Why is there a difference between what is in the memorandum and what is in the regulations?

Secondly, can we presume from this that the Government—as the Minister’s helpful, mischievous friend at the back, the hon. Member for Amber Valley, pointed out earlier—have no plans to leave the European convention on human rights? I know the Minister has been a very outspoken critic of Russia and of Belarus. I am sure he would personally hate for the UK to be joining a small group of Belarus and Russia as the countries that have left the European convention. Or should we presume that the Government do intend to resile from the convention? That seems to be the implication of the difference between the memorandum and the regulations.

What further amendment to the data protection regime would be necessary if we were to leave the European convention on human rights? The Minister said that we would have to convene again. Is that right, or would we simply be able to rely on the Human Rights Act 1998 as it stands?

The next set of questions relate to the fact that we are changing essentially from one Court to another. The ECHR has often taken a much more permissive approach than the European Court of Justice to mass surveillance by Governments and other organisations. Is this an attempt from the Government to move to a situation where they are intending to extend mass surveillance of, for instance, bank accounts, including the bank accounts of people with state pensions in the UK, as was agreed to by hon. Members last week in the debate on the Data Protection and Digital Information Bill? Have the Government made an assessment of the difference between the approaches of the European Court of Human Rights and the European Court of Justice towards such mass surveillance issues?

Under the Human Rights Act, UK courts will obviously be adhering to their understanding of what the European Court of Human Rights has held on these views, particularly in relation to the two key human rights of privacy and freedom of expression—articles 8 and 10. The truth, however, is that the UK courts will only effectively keep pace with the European Court of Human Rights. They will not recognise rights in contexts where the case law has not yet been developed. What analysis have the Government done of the case law, which might therefore be applied by UK courts in interpreting the Human Rights Act?

[Sir Stephen Timms (East Ham) (Lab)]

My hon. Friend referred a moment ago to the enormous new power that the Government put into their legislation last week that will allow them to look into the bank accounts of anyone claiming a state pension. In last week’s debate, he said that the House of Commons Library had confirmed that that is indeed the implication of the amendment that was agreed, and the Library has also confirmed that to me today. However, journalists speaking to the Department for Work and Pensions were told that that is not what that amendment does. Does my hon. Friend have an update on whether the Government are in fact taking that power for themselves?

[Sir Chris Bryant]

I am afraid I am unable to update my right hon. Friend—he is updating me—but perhaps the Minister will be able to update us. I know that he is not a Department for Work and Pensions Minister but none the less it is his Bill that is going off to the House of Lords now. As my right hon. Friend the Member for East Ham knows, we have significant concerns about the extent of the power the Government are taking and the set of circumstances in which they would want to use it. I have a sneaking worry that these regulations are aimed at helping them to take more substantive power and a bigger step, but perhaps the Minister will relieve my anguished breast on these matters.

My final question concerns the UK’s data adequacy, because it is obviously in the interests of UK businesses to have stability and certainty about where data protection law is going and that we have full data adequacy not only with the United States of America, which has been arranged through the new bridge agreement that we supported, but with the EU. I think the Minister agrees, notwithstanding the points he made about Brexit freedoms and all that stuff.

The EU made the decision to grant UK data adequacy in June 2021 for a period of four years, after which it will be renewed only if the European Commission considers that the UK continues to ensure an adequate level of data protection. What assessment have the Government made of how the regulations will impact on a future decision by the European Commission on data adequacy? For instance, if the Human Rights Act embraced the kinds of decisions previously made by the European Court of Human Rights and allowed a much more permissive approach than the European Court of Justice towards mass surveillance, that could thrust us into a situation where UK courts effectively allowed far more generous mass surveillance by Government and other organisations than the EU would allow. Would that not threaten the UK’s data adequacy arrangements? Nevertheless, despite those points, we are broadly happy to support the measure and I am sure that the Minister will want to reassure me.