Oral Answers to Questions
Stuart C McDonald Excerpts(5 years, 1 month ago)
Commons ChamberRead Full debate Read Hansard Text Read Debate Ministerial Extracts
The Attorney General
I completely agree with what my hon. Friend has said, and it applies, if I may say so, not only to law enforcement agencies, but to other agencies as well. We cannot forget that, particularly in county lines offending, there is a wide range of other dimensions at play and safeguarding agencies are also very important.
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
David Linden (Glasgow East) (SNP)
The Attorney General (Mr Geoffrey Cox)
The priorities of my office are set out in the published business plan for this year. In relation to the UK’s withdrawal from the European Union, my priority continues to be to support the successful delivery of the Government’s objectives by giving legal and constitutional advice within the Government. I am of course also engaged in the support of preparations for future international co-operation between the Law Officers’ departments, and with prosecution and other criminal justice operations.
Stuart C. McDonald
I am pleased to hear that the Attorney General is committed to continuing to provide sound legal advice in the face of fantasy politics, which he has a good track record in. Will he confirm that it is the Government’s position that after a no-deal Brexit, article 24 of the general agreement on tariffs and trade cannot be unilaterally invoked to ensure a standstill in current trading arrangements, and that the EU cannot and will not be compelled to trade on that basis?
Oral Answers to Questions
Stuart C McDonald Excerpts(5 years, 5 months ago)
Commons ChamberRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Deidre Brock (Edinburgh North and Leith) (SNP)
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
The Attorney General (Mr Geoffrey Cox)
The priorities of my Office are published in the business plan. In relation to the UK’s withdrawal from the Union, my priority continues to be supporting the successfully delivery of the Government’s objectives by giving legal and constitutional advice within the Government, and, in particular, by contributing to international negotiations. I take a keen interest in the programme of Brexit-related domestic legislation and I am of course involved in supporting preparations for future international co-operation with the Law Officers’ Departments and the prosecution agencies.
The Attorney General
The hon. Lady knows that she is asking me questions that belong to the Department for Transport, not to me. These matters do not come to the Law Officers unless they have a Law Officers’ point, so the reality is that I am afraid I must direct her to my right hon. Friend the Secretary of State for Transport.
Stuart C. McDonald
Will the Attorney General therefore confirm whether or not he provided any legal advice to the Department for Transport in relation to that contract and settlement with Eurotunnel; and if he did, given the huge public concern about this, will he publish it?
The Attorney General
It grieves me to have to say to the hon. Gentleman that he knows I will be bound, and am bound, by the Law Officers’ convention not to disclose either the fact or content of my advice, if any were given on that subject. I am sorry.
Data Protection Bill [Lords]
Stuart C McDonald ExcerptsWednesday 9th May 2018
(6 years, 3 months ago)
Commons ChamberRead Full debate Data Protection Act 2018 View all Data Protection Act 2018 Debates Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: Consideration of Bill Amendments as at 8 May 2018 - (9 May 2018)
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
Can the Minister give us a couple of examples to illustrate why these additional powers are necessary, and where the other powers in the Bill—in relation to criminal offences and investigations, for example—would not already suffice to do everything that the Home Office wishes?
Margot James
We are permitted under GDPR to make these exemptions and are doing so in a very selective way and on a case-by-case basis, so it will not result in a widespread denial of people’s data rights.
The exemption should be as limited as possible, which is why we have brought forward amendments 141 and 142. These amendments will ensure that migrants enjoy the rights afforded under all of the data protection principles, except where a restriction on those principles is a consequence of restricting one of the other rights coming within the scope of the exemption.
I now turn to Opposition amendments 18 and 19 on primary care providers, and Government amendments 22 to 24 on parish councils. Parish and community councils are not exempt from the new law. None the less, by describing parish and community councils as “public authorities” the Bill gives these councils additional obligations above and beyond those placed on other small organisations, including that they must appoint a data protection officer. We have been working to minimise the impact of this requirement, and have concluded that as parish and community councils process very little personal data, the burden they would face would be disproportionate. Amendments 22, 23 and 24 therefore take these councils out of the definition of “public authorities” for data protection purposes.
Caroline Lucas
Like others, I would like to associate myself with the very powerful arguments that have been made in favour of amendment 15, but I want to speak briefly to amendment 16 to extend the debate about the conditions under which someone’s rights can be breached. It would prevent the crime exemption in the Bill being invoked in relation to low-level offences under immigration law.
Few of us would dispute the overall principle that data might be shared in some circumstances—for example, to prevent a serious crime or to apprehend an offender—but when the crimes in question are not serious and arise simply because of someone’s immigration status, we have to question whether the grounds for suspending data protection rights really do stack up. It is clear that the majority of offences under immigration law are not serious crimes. Most result only in a custodial sentence of two years or less, or a fine. Rather, they are the mundane activities of people doing what they must to survive. The effect is already forcing undocumented migrants to avoid sending their children to school, visiting the GP, presenting to homelessness services and seeking social support, for fear they might risk detention and removal by doing so.
Last year, a woman who was five months pregnant went to report being repeatedly raped to the police but was subsequently arrested at a rape crisis centre on immigration grounds. My amendment 16 seeks to better protect her and all others like her whose data protection rights are routinely being breached just because they are undocumented migrants and who are therefore being automatically criminalised just for leading their lives. There must be a firewall between Home Office immigration control and other Departments if we are serious about ending the current hostile immigration environment.
Stuart C. McDonald
I echo the criticisms of the outrageous immigration exemption in the Bill and am pleased to add my name to amendment 15.
Little has been said today about international transfers of personal data by intelligence services, despite the serious concerns raised in Committee. I will therefore speak briefly to new clause 24, which it is all the more important we debate, given the moves by the Trump Administration in the USA to roll back on safeguards on the targeting of drone strikes and the significant increase in their use of lethal force outside armed conflict zones. These developments mean an increased risk of strikes being in breach of international human rights law, and we know that UK intelligence personnel are involved in the transfer of data that could be used in such drone strikes, so it is all the more important that there be safeguards and accountability on when and how information can be transferred and that legal certainty be provided for our personnel.
As the Joint Committee on Human Rights said in its 2016 report,
“we owe it to all those involved in the chain of command for such uses of lethal force…to provide them with absolute clarity about the circumstances in which they will have a defence against any possible future criminal prosecution, including those which might originate from outside the UK.”
The Bill fails to provide those safeguards and clarity. Clause 109 places no realistic restriction on such transfers, referring simply to necessity and proportionality in pursuit of statutory goals. The new clause would provide a clear bar on transfers for use in unlawful operations and introduce accountability and transparency by requiring that written reasons be provided for any transfer thought to be lawful, that there be ministerial sign-off, that certain information be provided to the Information Commissioner and the Investigatory Powers Commissioner and that guidance on transfers be laid before Parliament. The new clause would not hinder but help our personnel working in this area and ensure that the UK is seen as complying with the rule of law and its international obligations. This is an important debate to which we will have to return in the future.
Question put and agreed to.
New clause 13 accordingly read a Second time, and added to the Bill.
New Clause 14
Destroying or falsifying information and documents etc
“(1) This section applies where a person—
(a) has been given an information notice requiring the person to provide the Commissioner with information, or
(b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.
(2) It is an offence for the person—
(a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or
“(b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,
with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.
(3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.”—(Margot James.)
This new clause would be inserted after Clause 145. It provides that, where the Information Commissioner has given an information notice (see Clause 141) or an assessment notice (see Clause 144) requiring access to information, a document, equipment or material, it is an offence to destroy or otherwise dispose of, conceal, block or (where relevant) falsify it.
Brought up, read the First and Second time, and added to the Bill.
New Clause 15
Applications in respect of urgent notices
“(1) This section applies where an information notice, an assessment notice or an enforcement notice given to a person contains an urgency statement.
(2) The person may apply to the court for either or both of the following—
(a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;
(b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.
(3) On an application under subsection (2), the court may do any of the following—
(a) direct that the notice is to have effect as if it did not contain the urgency statement;
(b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;
(c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;
(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).
(4) The decision of the court on an application under this section is final.
(5) In this section, “urgency statement” means—
(a) in relation to an information notice, a statement under section141(7)(a),
(b) in relation to an assessment notice, a statement under section144(8)(a) or (8A)(d), and
(c) in relation to an enforcement notice, a statement under section147(8)(a).”—(Margot James.)
This new clause would be inserted after Clause 160. It enables a person who is given an information notice, assessment notice or enforcement which requires the person to comply with it urgently to apply to the court for variation of the timetable for compliance. It replaces the provision in Clauses 159(2) and 160(5) for appeals to the Tribunal. See also Amendments 54, 56 and 60.
Brought up, read the First and Second time, and added to the Bill.
New Clause 16
Post-review powers to make provision about representation of data subjects
“(1) After the report under section 182(1) is laid before Parliament, the Secretary of State may by regulations—
(a) exercise the powers under Article 80(2) of the GDPR in relation to England and Wales and Northern Ireland,
(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise a data subject’s rights under Article 82 of the GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and
(c) make provision described in section182(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.
(2) The powers under subsection (1) include power—
(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject’s rights;
(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject’s rights;
(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;
(d) to confer functions on a person, including functions involving the exercise of a discretion;
(e) to amend sections162 to164,173,180,194,196 and197;
(f) to insert new sections and Schedules into Part 6 or 7;
(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.
(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.
(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—
(a) the effect of judgments and orders;
(b) agreements to settle claims;
(c) the assessment of the amount of compensation;
(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
(e) costs.
(5) Regulations under this section are subject to the affirmative resolution procedure.”—(Margot James.)
This new clause would be inserted after Clause 182. It contains the provisions currently in subsections (4) to (7) of Clause 182, modified to take account of the changes made to that Clause by Amendments 61 and 62 (see subsections (1)(c) and (3) of this new Clause).
Brought up, read the First and Second time, and added to the Bill.
New Clause 17
Reserve forces: data-sharing by HMRC
“(1) The Reserve Forces Act 1996 is amended as follows.
(2) After section 125 insert—
“125A Supply of contact details by HMRC
(1) This subsection applies to contact details for—
(a) a member of an ex-regular reserve force, or
(b) a person to whom section 66 (officers and former servicemen liable to recall) applies,
which are held by HMRC in connection with a function of HMRC.
(2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State—
(a) to contact a member of an ex-regular reserve force in connection with the person’s liability, or potential liability, to be called out for service under Part 6;
(b) to contact a person to whom section 66 applies in connection with the person’s liability, or potential liability, to be recalled for service under Part 7.
(3) Where a person’s contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person’s service (whether past, present or future) in the reserve forces or regular services.
(4) In this section, “HMRC” means Her Majesty’s Revenue and Customs.
125B Prohibition on disclosure of contact details supplied under section 125A
‘(1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty’s Revenue and Customs (which may be general or specific).
(2) A person who contravenes subsection (1) is guilty of an offence.
(3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed—
(a) that the disclosure was lawful, or
(b) that the information had already lawfully been made available to the public.
(4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section.
(5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section.
125C Data protection
‘(1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation.
(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”—(Margot James.)
This new clause would be inserted after Clause 186. It provides for HMRC to supply the Secretary of State with the contact details of members of the ex-regular reserve force and former members of the armed forces so that they may be contacted regarding their liability to be called out or recalled for service under the Reserved Forces Act 1996. The details supplied may also be used for defence purposes connected with their service in the forces (whether past, present or future). It is an offence for the details supplied to be disclosed without the consent of the Commissioners for Revenue and Customs.
Brought up, read the First and Second time, and added to the Bill.
Data Protection Bill [ Lords ] (Seventh sitting)
Stuart C McDonald Excerpts(6 years, 5 months ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Liam Byrne
Absolutely. That is why the European Commission has been working on it for so long. Today’s legislation incorporates a bit of European legislation into British law.
The crime that may have been committed is the international transfer of data. It is highly likely that data collected here in the UK was transferred to the United States and deployed—weaponised, in a way—in a political campaign in the United States. It is not clear that that is legal.
The scandal has knocked about $40 billion off the value of Facebook. I noted with interest that Mr Zuckerberg dumped a whole load of Facebook stock the weekend before the revelations on Monday and Tuesday, and no doubt his shareholders will want to hold him to account for that decision. I read his statement when it finally materialised on Facebook last night, and it concerned me that there was not one word of apology to Facebook users in it. There was an acknowledgement that there had been a massive data breach and a breach of trust, but there was not a single word of apology for what had happened or for Facebook basically facilitating and enabling it. That tells me that we simply will not be able to rely on Facebook self-policing adherence to data protection policies.
The hon. Member for Hornchurch and Upminster is absolutely right—that is why the Bill is absolutely necessary—but the question about the clause is whether the sanctions for misbehaviour are tough enough. Of the two or three things that concerned me most this week, one was how on earth it took the Information Commissioner so long to get the warrant she wanted to search the Cambridge Analytica offices. The Minister may want to say a word about whether that warrant has now been issued. That time lag begs the question whether there is a better way of giving the Information Commissioner the power to conduct such investigations. As we rehearsed in an earlier sitting, the proposed sanctions are financial, but the reality is that many of Cambridge Analytica’s clients are not short of cash—they are not short of loose change—so even the proposed new fines are not necessarily significant enough.
I say that because we know that the companies that contract with organisations such as Cambridge Analytica are often shell companies, so a fine that is cast as a percentage of turnover is not necessarily a sufficient disincentive for people to break the law. That is why I ask the Minister again to consider reviewing the clause and to ask herself, her officials and her Government colleagues whether we should consider a sanction of a custodial sentence where people get in the way of an investigation by the Information Commissioner’s Office.
I am afraid that such activities will continue. I very much hope that the Secretary of State for Digital, Culture, Media and Sport reflects on our exchange on the Floor of the House this morning and uses the information he has about public contracts to do a little more work to expose who is in the network of individuals associated with Cambridge Analytica and where other companies may be implicated in this scandal. We know, because it has said so, that Cambridge Analytica is in effect a shell company—it is in effect a wholly owned subsidiary of SCL Elections Ltd—but we also know that it has an intellectual property sharing agreement with other companies, such as AggregateIQ. Mr Alexander Nix, because he signed the non-disclosure agreement, was aware of that. There are relationships between companies around Cambridge Analytica that extend far and wide. I mentioned this morning that I am concerned that the Foreign and Commonwealth Office may be bringing some of them together for its computational propaganda conference somewhere in the countryside this weekend.
The point I really want the Minister to address is whether she is absolutely content that the sanctions proposed under the clause are sufficient to deter and prosecute the kind of misbehaviour, albeit still only alleged, that has been in the news this week, which raises real concerns.
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
I will be very brief, because I will largely echo what the right hon. Member for Birmingham, Hodge Hill said. It is absolutely fair to say that our understanding of the potential value of personal information, including that gained by people who break data protection laws, has increased exponentially in recent times, as has our understanding of the damage that can be done to victims of such breaches. I agree that it is not easy to see why the proposed offences stop where they do.
I have a specific question about why there is a two-tier system of penalties. There is a set of offences that are triable only in a summary court and for which there is a maximum fine. I think the maximum in Scotland and Northern Ireland is £5,000. There is a second set of offences that could conceivably be triable on indictment, and there is provision there for an unlimited fine, but not any custodial sentence.
For some companies, if they were in trouble, a £5,000 fine for essentially obstructing justice would be small beer, especially if it allowed them to avoid an unlimited fine. It would be interesting to hear an explanation for that. Many folk would see some of the offences that are triable on indictment as morally equivalent to embezzlement, serious theft or serious fraud, so it is legitimate to ask why there is no option for a custodial sentence in any circumstance.
Margot James
I certainly share the concerns that hon. Members have expressed in the light of the dreadful Cambridge Analytica scandal. I will set out the penalties for summary only offences, which lie in clause 119, “Inspection of personal data in accordance with international obligations”; clause 173, “Alteration etc of personal data to prevent disclosure”; and paragraph 15(1) of schedule 15, which contains the offence of obstructing the execution of a warrant. The maximum penalty on summary conviction for those offences is an unlimited fine in England and Wales or a level 5 fine in Scotland and Northern Ireland.
Clause 189(2) sets out the maximum penalties for offences that can be tried summarily on indictment, which include offences in clause 132 “Confidentiality of information”; clause 145 “False statements made in response to an information notice”; clause 170 “Unlawful obtaining etc of personal data”; clause 171 “Re-identification of de-identified personal data”; and clause 181 “Prohibition of requirement to produce relevant records”. Again, the maximum penalty when tried summarily in England or Wales, or on indictment, is an unlimited fine. In Scotland and Northern Ireland, the maximum penalty on summary conviction is a fine
“not exceeding the statutory maximum”
of an unlimited fine when tried on indictment.
Data Protection Bill [Lords] (Sixth sitting)
Stuart C McDonald Excerpts(6 years, 5 months ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Liam Byrne
I am grateful to my hon. Friend the Member for Edinburgh South for keeping me warm and enthused.
The amendment is important. None of us wants to damage the right and power of whistleblowers to bring important information into the public domain, sometimes to the attention of regulators, sometimes to the attention of organisations, such as the Health and Safety Executive, and sometimes to the attention of Members. Over the years, we have put in place a good regime in order to ensure that whistleblowers are afforded protections that allow them to come forward with information that is in the public interest.
The reason we have to consider that now is that data protection legislation is being strengthened by the incorporation of GDPR into British law. However, the risk is that the ambiguities that frame the protection of whistleblowers in the Bill are such that many are concerned that whistleblowers will not be given the right protection against data protection legislation.
The Government recognise that it is important to protect whistleblowers. There is a protection in clause 170 for whistleblowers bringing forward information that is
“justified as being in the public interest.”
The argument put to us by Public Concern at Work and others is that that approach is unlikely to be effective. We are told that there will be a new test in law, which will therefore require guidance from the courts. Until that time, the precise meaning will obviously be a bit moot, and the scope of the situations that the Government seek to protect will remain a little uncertain. That uncertainty and ambiguity will jeopardise an individual who might have something important to bring to the attention of the outside world.
Exceptions to violations in personal data confidentiality were recently considered by the Government in section 58 of the Digital Economy Act 2017, which provided a far more comprehensive list of exceptions. Where there is overlap between the Bill and the Digital Economy Act, it appears that the Act deals much more satisfactorily with whistleblowers.
I remind the Committee that section 58 of the Act says that the offence does not apply to a disclosure
“which is a protected disclosure for any of the purposes of the Employment Rights Act 1996 or the Employment Rights (Northern Ireland) Order 1996”.
We therefore have a pretty well established and grounded definition of exceptions. Indeed, it was so well defined and grounded that the Government decided to use that definition in the 2017 Act. It is not clear why the Bill seeks to create alternative definitions and therefore the need for alternative tests and guidance in the courts when we have a definition we can rely on.
The Opposition amendment would return us to what we think was sensible drafting in the Digital Economy Act. That Act is not ancient history—it was only 12 months ago. Otherwise, the risk is that the Government, employers, courts and trade unions will get into an awful muddle as they try to understand which legislation protects whistleblowers in new circumstances. None of us wants to create a situation of uncertainty and ambiguity that stops whistleblowers from coming forward with important information.
I therefore hope we can have a useful debate about why the Government have chosen to introduce new definitions when it is not clear that they are improvements on well-established employment law that dates back to the Employment Rights Act 1996. Let us hear what the Minister has to say, but I hope the Government reflect on the arguments we rehearse this afternoon and introduce further enhancements and perfections on Report.
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
The right hon. Gentleman is correct: it is essential that we do not create an offence in the clause that will snare whistleblowers. I am sure the Committee shares that goal. Indeed, if we created such an offence, whistleblowers would no longer be whistleblowers—a qualifying disclosure would no longer be a qualifying disclosure if it were an offence under different legislation, including the Bill.
We will listen carefully to what the Minister says, but, to come at it from a slightly different angle, as I understand it, the Employment Rights Act currently requires a “reasonable belief” by the worker making the whistleblowing disclosure that it is in the public interest to disclose that information. That seems a slightly easier test than the one contained in a defence in subsection (2) of the clause, which requires not a “reasonable belief”—those words do not appear—but proof that disclosure was justified in the public interest. There is also a contrast with subsection (3), where a reasonable belief test is applied to a defence but only in circumstances of publication of either journalistic, artistic or literary material.
It is not clear to me why there is a reasonable belief test in subsection (3) but not in subsection (2). I am interested to hear what the Minister has to say about that distinction.
Margot James
The amendments concern offences relating to personal data provided for by part 6 of the Bill. Hon. Members will be aware that the offence of unlawful obtaining of personal data has been carried over and updated from the 1998 Act to include the unlawful retention of personal data without the controller’s consent. By contrast, the offence of re-identification of de-identified personal data is new to data protection legislation, underlining our intention to bring data protection laws up to date with the digital age.
Amendment 157 would add an additional defence to clause 170 where the conduct is in the process of a disclosure by an employee raising public interest concerns about wrongdoing or malpractice to the extent that such disclosures would be protected by the Employment Rights Act 1996 and equivalent legislation for Northern Ireland. Amendment 158 adds the same defence to clause 171.
I share the sentiment of the amendments, but believe they are unnecessary. Clauses 170 and 171 provide defences in cases where the processing is necessary for the prevention or detection of crime or can be justified as being in the public interest. We believe that the crime prevention defence would cover a disclosure by an employee who suspected that an offence had been committed, and that the flexible public interest defence would encapsulate the other non-criminal activities envisaged by the amendments. In particular, as set out in section 43B of the Employment Rights Act 1996 and article 67B of the Employment Rights (Northern Ireland) Order 1996, a disclosure is protected in the first place only if the disclosing worker reasonably believes the disclosure to be in the public interest.
Stuart C. McDonald
This is a narrow question that I raised in my speech. There is a “reasonable belief” test in the 1996 Act. It is easier for someone to prove that they had a reasonable belief that a disclosure was in the public interest than to prove that it was in the public interest. That slight difference in wording may be significant. There are in fact two different tests in the clause, so I wonder whether the Minister might look at that again.
Margot James
I referred to the public interest defence as a flexible defence that would encapsulate non-criminal activities. I do not know whether that satisfies the hon. Gentleman, but a flexible public interest defence is indeed required.
For those reasons, I reassure hon. Members that a further defence providing for whistleblowing is unnecessary. It is telling that there is no such defence in section 55 of the 1998 Act, and we are not aware of any problems with its operation. Hon. Members mentioned section 58 of the Digital Economy Act 2017. That is a difficult comparison. Unlike clauses 170 and 171, section 58 does not contain a straightforward public interest defence, so, unlike the offences in the Bill, there may be no alternative protection for such disclosures. I hope I have given hon. Members sufficient reassurance that they feel confident withdrawing their amendments.
Data Protection Bill [ Lords ] (Third sitting)
Stuart C McDonald Excerpts(6 years, 5 months ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
It is a pleasure to serve under your chairmanship, Mr Streeter. We have had three excellent speeches already in support of amendments 154 and 155, so I will not try to replicate them. As the right hon. Member for Birmingham, Hodge Hill said, this is one of the pivotal debates on the Bill. I would like to be positive, but all I can bring myself to say about the Government’s new clause and amendments is that they are marginally better than nothing. However, they do not go far enough and they will leave the UK significantly behind other EU countries in terms of collective redress and the pursuit of the gold standard of data protection. They will leave the Bill falling short of what the Government themselves promised on effective redress.
Only amendments 154 and 155 will provide a comprehensive opt-out regime and enable adults and children who are victims of data breaches properly to vindicate their rights to proper protection of their personal data. The amendments will provide a mechanism whereby serious breaches of data protection, which can affect the most vulnerable in society, are seriously addressed and result in real change that will benefit thousands if not millions of consumers across the UK.
The Bill provides a hugely significant opportunity to legislate for a cost-effective and efficient mechanism for redress in cases of mass data breaches, which we all know are increasingly common and which the Information Commissioner’s Office has limited resources to deal with. The measure is essential to make the Bill fit for purpose and I wholeheartedly support both amendments.
The Chair
Before I call the Minister to respond, it might help the Committee to know that, although we are properly debating Opposition amendments 154 and 155 at the moment, if they are to be put to a Division, that cannot happen until we reach clause 183. However, that does not prevent the Minister from indicating she might accept them at this stage. That is entirely up to her.
Data Protection Bill [ Lords ] (Morning sitting)
Stuart C McDonald Excerpts(6 years, 5 months ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
It is a pleasure to serve under your chairmanship, Mr Streeter. We have had three excellent speeches already in support of amendments 154 and 155, so I will not try to replicate them. As the right hon. Member for Birmingham, Hodge Hill said, this is one of the pivotal debates on the Bill. I would like to be positive, but all I can bring myself to say about the Government’s new clause and amendments is that they are marginally better than nothing. However, they do not go far enough and they will leave the UK significantly behind other EU countries in terms of collective redress and the pursuit of the gold standard of data protection. They will leave the Bill falling short of what the Government themselves promised on effective redress.
Only amendments 154 and 155 will provide a comprehensive opt-out regime and enable adults and children who are victims of data breaches properly to vindicate their rights to proper protection of their personal data. The amendments will provide a mechanism whereby serious breaches of data protection, which can affect the most vulnerable in society, are seriously addressed and result in real change that will benefit thousands if not millions of consumers across the UK.
The Bill provides a hugely significant opportunity to legislate for a cost-effective and efficient mechanism for redress in cases of mass data breaches, which we all know are increasingly common and which the Information Commissioner’s Office has limited resources to deal with. The measure is essential to make the Bill fit for purpose and I wholeheartedly support both amendments.
The Chair
Before I call the Minister to respond, it might help the Committee to know that, although we are properly debating Opposition amendments 154 and 155 at the moment, if they are to be put to a Division, that cannot happen until we reach clause 183. However, that does not prevent the Minister from indicating she might accept them at this stage. That is entirely up to her.
Data Protection Bill [ Lords ] (First sitting)
Stuart C McDonald Excerpts(6 years, 5 months ago)
Public Bill CommitteesRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)
We, too, are grateful to the Minister for tabling the amendment and for her letter to you on 12 March, Mr Hanson, which has been shared with the Committee.
From our point of view, the description of democratic engagement as a new lawful basis for processing in the public interest, under article 6(1)(e) of the GDPR, is useful. In fact, there might even be an argument for including the non-exhaustive list, which I think is due to appear in the explanatory notes, in the Bill. Will the Minister think about that? I appreciate that it has been kept in very general terms.
In her letter, the Minister asked for views on whether the basis for processing data from electoral registers is currently appropriate as defined. Those registers are supplied to parties with the main condition that they are used for electoral purposes. The Law Commission, which recently reported on the review of electoral law, expressed the view that the legislation should be more precise about what that means. Again, the list in the letter that the Minister sent to you, Mr Hanson, looks like a good starting point for that.
Margot James
The hon. Gentleman is right that the GDPR stipulates 16 as the minimum age for consenting to data processing without parental consent, but that it provides for member states to derogate from that. At least seven, including Spain, Ireland and Denmark, have done just that. Like us, they have proposed a much younger age of 13, so we are not an outlier on the issue.
Currently, the minimum age in this country for allowing personal data to be used without parental consent is 12, so in a sense we are derogating from that policy by setting the minimum age at 13 in the Bill. The hon. Gentleman is right to point out that it is very difficult for technology companies to implement meaningful verification mechanisms for those younger than 18, who may not have anything like a credit card or driving licence. I have no doubt that the Government will keep an open mind on the matter, in line with other developments that will take place long after the Bill is passed.
Question put and agreed to.
Clause 9 accordingly ordered to stand part of the Bill.
Clause 10
Special categories of personal data and criminal convictions etc data
Stuart C. McDonald
I beg to move amendment 129, in clause 10, page 6, line 19, leave out subsections (6) and (7).
This amendment would remove delegated powers that would allow the Secretary of State to vary the conditions and safeguards governing the general processing of sensitive personal data.
The Chair
With this it will be convenient to discuss the following:
Amendment 132, in clause 35, page 21, line 29, leave out subsections (6) and (7).
This amendment would remove delegated powers that would allow the Secretary of State to vary the conditions and safeguards governing the general processing of sensitive personal data.
Amendment 134, in clause 86, page 50, line 33, leave out subsections (3) and (4).
This amendment would remove delegated powers that would allow the Secretary of State to vary the conditions and safeguards governing the general processing of sensitive personal data.
Stuart C. McDonald
The amendments stand not only in my name and that of my hon. Friend the Member for Argyll and Bute, but in the names of Labour Members, for whose support we are very grateful.
There cannot be anyone in this Committee Room who does not know what a Henry VIII power is. If my email inbox is anything to go by, half the country knows what a Henry VIII clause is now, even if they did not know before the European Union (Withdrawal) Bill commenced its progress through the House. Amendments 129, 132 and 134 would remove Henry VIII powers from clauses 10, 35 and 86 respectively. To explain why those powers are not appropriate and need to be removed, I need to explain briefly what those clauses concern and why the powers are therefore too significant and wide.
Clause 10 needs to be read alongside article 9 of the GDPR, which states unambiguously:
“Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.”
Such data includes some of the most sensitive information that we can imagine. Article 9 then sets out situations in which the prohibition does not apply. Some of the exceptions that it lists, such as those in which
“processing relates to personal data which are manifestly made public by the data subject”,
apply directly, so the Bill need not address them. Others need to be interpreted in accordance with EU or member state law before they can be relied on; for instance, paragraph 2(g) of article 9 states that the prohibition shall not apply if
“processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law”.
Clause 10, which applies schedule 1, establishes the basis in member state law for lifting the prohibition on processing such sensitive information. For example, part 2 of schedule 1 includes 18 conditions—ranging from parliamentary and ministerial functions to preventing money laundering and detecting unlawful acts—that provide the basis in UK law for the substantial public interest exception to apply to the processing of special categories of personal data.
Clause 35 is in part 3, which is headed “Law enforcement processing”. It states that the first of the data protection principles by which law enforcement bodies must abide
“is that the processing of personal data for any of the law enforcement purposes must be lawful and fair”.
The specific conditions that must be met with respect to sensitive data are set out in schedule 8, which is similar to schedule 1. They include cases in which the processing is necessary
“for the administration of justice”
or
“to protect the vital interests of the data subject or of another individual.”
Clause 86 is in part 4, “Intelligence services processing”. It essentially does for that activity what clause 35 does for law enforcement, and it applies schedule 10. In short, we have a carefully framed set of exceptions to the prohibition on processing of this extremely sensitive information, and those exceptions provide a lawful basis for the processing of information that we normally would not dream of processing because of its highly intrusive and sensitive nature.
Margot James
Following recommendations by the Delegated Powers and Regulatory Reform Committee, we have considered carefully the use of the Bill’s order-making powers and amended the Bill in the House of Lords to provide additional safeguards for the exercise of those powers, but Members of the Lords on all sides of the House agreed that it was essential to retain the order-making powers in the Bill as amended.
I will explain how the powers will be used in practice. Article 9 of the GDPR prohibits the processing of special categories of personal data unless one of the exemptions in paragraph 2 of article 9 applies. The exemptions include, for example, the situation where processing is necessary for reasons of substantial public interest. Schedule 1 to the Bill provides a series of processing conditions for special categories of data under article 9 and criminal convictions data under article 10. Most of those processing conditions have been imported from the Data Protection Act 1998 and statutory instruments made under that Act, but some of them are new—for example, the conditions on anti-doping in sport or processing for insurance purposes. They have been added to reflect the way in which the use of data has changed over the past 20 years.
Amendment 129 would remove the ability to amend schedule 1 via secondary legislation. That would be particularly damaging because it would mean that primary legislation might be needed every time the need for a new processing activity involving special categories of data arose. The 1998 Act was itself amended several times through secondary legislation, and it is important that we retain the flexibility to respond to emerging technologies and the different ways in which data might be used in the future.
It is interesting to note that the hon. Member for Sheffield, Heeley has tabled an amendment to schedule 1 that would add a completely new processing condition in relation to maintaining the missing persons register. My hon. Friend the Under-Secretary of State for the Home Department will touch on the merits of that proposal later, but the fact that others in the Committee are considering further changes to schedule 1 illustrates the point that schedule 1 cannot simply freeze the regimes in parts 3 and 4 of the Bill. I urge colleagues to resist the amendment.
Stuart C. McDonald
It is vital that we get the balance right: we are talking about very sensitive information and processing of that information. It is absolutely right for hon. Members to table amendments to the Bill and for them to be considered, including proposals on the missing persons register. The fact that hon. Members are suggesting changes at this stage does not mean that we are saying that we want to fix things for all time now and never suggest changes again. We are saying that we are not happy with the process whereby changes are brought about. The Minister has not explained why she believes that changes could not be brought about satisfactorily by changes to legislation from time to time. She has not explained why there would be urgent situations in which the only possibility would be a “Take it or leave it” statutory instrument. In the light of the seriousness of the data that we are speaking about and the inadequacy of the Minister’s explanation, we would like to press the amendment to a vote.
Question put, That the amendment be made.