Data Protection Bill [Lords]

Stuart C McDonald Excerpts

3rd reading: House of Commons & Report stage: House of Commons
Wednesday 9th May 2018 Commons Chamber

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

Can the Minister give us a couple of examples to illustrate why these additional powers are necessary, and where the other powers in the Bill—in relation to criminal offences and investigations, for example—would not already suffice to do everything that the Home Office wishes?

[Margot James]

We are permitted under GDPR to make these exemptions and are doing so in a very selective way and on a case-by-case basis, so it will not result in a widespread denial of people’s data rights.

The exemption should be as limited as possible, which is why we have brought forward amendments 141 and 142. These amendments will ensure that migrants enjoy the rights afforded under all of the data protection principles, except where a restriction on those principles is a consequence of restricting one of the other rights coming within the scope of the exemption.

I now turn to Opposition amendments 18 and 19 on primary care providers, and Government amendments 22 to 24 on parish councils. Parish and community councils are not exempt from the new law. None the less, by describing parish and community councils as “public authorities” the Bill gives these councils additional obligations above and beyond those placed on other small organisations, including that they must appoint a data protection officer. We have been working to minimise the impact of this requirement, and have concluded that as parish and community councils process very little personal data, the burden they would face would be disproportionate. Amendments 22, 23 and 24 therefore take these councils out of the definition of “public authorities” for data protection purposes.

--- Later in debate ---

[Caroline Lucas]

Like others, I would like to associate myself with the very powerful arguments that have been made in favour of amendment 15, but I want to speak briefly to amendment 16 to extend the debate about the conditions under which someone’s rights can be breached. It would prevent the crime exemption in the Bill being invoked in relation to low-level offences under immigration law.

Few of us would dispute the overall principle that data might be shared in some circumstances—for example, to prevent a serious crime or to apprehend an offender—but when the crimes in question are not serious and arise simply because of someone’s immigration status, we have to question whether the grounds for suspending data protection rights really do stack up. It is clear that the majority of offences under immigration law are not serious crimes. Most result only in a custodial sentence of two years or less, or a fine. Rather, they are the mundane activities of people doing what they must to survive. The effect is already forcing undocumented migrants to avoid sending their children to school, visiting the GP, presenting to homelessness services and seeking social support, for fear they might risk detention and removal by doing so.

Last year, a woman who was five months pregnant went to report being repeatedly raped to the police but was subsequently arrested at a rape crisis centre on immigration grounds. My amendment 16 seeks to better protect her and all others like her whose data protection rights are routinely being breached just because they are undocumented migrants and who are therefore being automatically criminalised just for leading their lives. There must be a firewall between Home Office immigration control and other Departments if we are serious about ending the current hostile immigration environment.

[Stuart C. McDonald]

I echo the criticisms of the outrageous immigration exemption in the Bill and am pleased to add my name to amendment 15.

Little has been said today about international transfers of personal data by intelligence services, despite the serious concerns raised in Committee. I will therefore speak briefly to new clause 24, which it is all the more important we debate, given the moves by the Trump Administration in the USA to roll back on safeguards on the targeting of drone strikes and the significant increase in their use of lethal force outside armed conflict zones. These developments mean an increased risk of strikes being in breach of international human rights law, and we know that UK intelligence personnel are involved in the transfer of data that could be used in such drone strikes, so it is all the more important that there be safeguards and accountability on when and how information can be transferred and that legal certainty be provided for our personnel.

As the Joint Committee on Human Rights said in its 2016 report,

“we owe it to all those involved in the chain of command for such uses of lethal force…to provide them with absolute clarity about the circumstances in which they will have a defence against any possible future criminal prosecution, including those which might originate from outside the UK.”

The Bill fails to provide those safeguards and clarity. Clause 109 places no realistic restriction on such transfers, referring simply to necessity and proportionality in pursuit of statutory goals. The new clause would provide a clear bar on transfers for use in unlawful operations and introduce accountability and transparency by requiring that written reasons be provided for any transfer thought to be lawful, that there be ministerial sign-off, that certain information be provided to the Information Commissioner and the Investigatory Powers Commissioner and that guidance on transfers be laid before Parliament. The new clause would not hinder but help our personnel working in this area and ensure that the UK is seen as complying with the rule of law and its international obligations. This is an important debate to which we will have to return in the future.

Question put and agreed to.

New clause 13 accordingly read a Second time, and added to the Bill.

New Clause 14

Destroying or falsifying information and documents etc

“(1) This section applies where a person—

(a) has been given an information notice requiring the person to provide the Commissioner with information, or

(b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.

(2) It is an offence for the person—

(a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or

“(b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,

with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.

(3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.”—(Margot James.)

This new clause would be inserted after Clause 145. It provides that, where the Information Commissioner has given an information notice (see Clause 141) or an assessment notice (see Clause 144) requiring access to information, a document, equipment or material, it is an offence to destroy or otherwise dispose of, conceal, block or (where relevant) falsify it.

Brought up, read the First and Second time, and added to the Bill.

New Clause 15

Applications in respect of urgent notices

“(1) This section applies where an information notice, an assessment notice or an enforcement notice given to a person contains an urgency statement.

(2) The person may apply to the court for either or both of the following—

(a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;

(b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.

(3) On an application under subsection (2), the court may do any of the following—

(a) direct that the notice is to have effect as if it did not contain the urgency statement;

(b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;

(c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;

(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).

(4) The decision of the court on an application under this section is final.

(5) In this section, “urgency statement” means—

(a) in relation to an information notice, a statement under section141(7)(a),

(b) in relation to an assessment notice, a statement under section144(8)(a) or (8A)(d), and

(c) in relation to an enforcement notice, a statement under section147(8)(a).”—(Margot James.)

This new clause would be inserted after Clause 160. It enables a person who is given an information notice, assessment notice or enforcement which requires the person to comply with it urgently to apply to the court for variation of the timetable for compliance. It replaces the provision in Clauses 159(2) and 160(5) for appeals to the Tribunal. See also Amendments 54, 56 and 60.

Brought up, read the First and Second time, and added to the Bill.

New Clause 16

Post-review powers to make provision about representation of data subjects

“(1) After the report under section 182(1) is laid before Parliament, the Secretary of State may by regulations—

(a) exercise the powers under Article 80(2) of the GDPR in relation to England and Wales and Northern Ireland,

(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise a data subject’s rights under Article 82 of the GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and

(c) make provision described in section182(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

(2) The powers under subsection (1) include power—

(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject’s rights;

(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject’s rights;

(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;

(d) to confer functions on a person, including functions involving the exercise of a discretion;

(e) to amend sections162 to164,173,180,194,196 and197;

(f) to insert new sections and Schedules into Part 6 or 7;

(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(c) the assessment of the amount of compensation;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the affirmative resolution procedure.”—(Margot James.)

This new clause would be inserted after Clause 182. It contains the provisions currently in subsections (4) to (7) of Clause 182, modified to take account of the changes made to that Clause by Amendments 61 and 62 (see subsections (1)(c) and (3) of this new Clause).

Brought up, read the First and Second time, and added to the Bill.

New Clause 17

Reserve forces: data-sharing by HMRC

“(1) The Reserve Forces Act 1996 is amended as follows.

(2) After section 125 insert—

“125A Supply of contact details by HMRC

(1) This subsection applies to contact details for—

(a) a member of an ex-regular reserve force, or

(b) a person to whom section 66 (officers and former servicemen liable to recall) applies,

which are held by HMRC in connection with a function of HMRC.

(2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State—

(a) to contact a member of an ex-regular reserve force in connection with the person’s liability, or potential liability, to be called out for service under Part 6;

(b) to contact a person to whom section 66 applies in connection with the person’s liability, or potential liability, to be recalled for service under Part 7.

(3) Where a person’s contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person’s service (whether past, present or future) in the reserve forces or regular services.

(4) In this section, “HMRC” means Her Majesty’s Revenue and Customs.

125B Prohibition on disclosure of contact details supplied under section 125A

‘(1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty’s Revenue and Customs (which may be general or specific).

(2) A person who contravenes subsection (1) is guilty of an offence.

(3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed—

(a) that the disclosure was lawful, or

(b) that the information had already lawfully been made available to the public.

(4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section.

(5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section.

125C Data protection

‘(1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation.

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”—(Margot James.)

This new clause would be inserted after Clause 186. It provides for HMRC to supply the Secretary of State with the contact details of members of the ex-regular reserve force and former members of the armed forces so that they may be contacted regarding their liability to be called out or recalled for service under the Reserved Forces Act 1996. The details supplied may also be used for defence purposes connected with their service in the forces (whether past, present or future). It is an offence for the details supplied to be disclosed without the consent of the Commissioners for Revenue and Customs.

Brought up, read the First and Second time, and added to the Bill.